diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index cf8cc69715..6d054a814d 100644
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,34 @@
+2011-03-10  Tom Tromey  <tromey@redhat.com>
+
+	* tracepoint.c (trace_actions_command): Update.
+	* thread.c (thread_apply_command): Update.
+	* reverse.c (delete_bookmark_command): Update.
+	(bookmarks_info): Update.
+	* printcmd.c (undisplay_command): Update.
+	* memattr.c (mem_enable_command): Update.
+	(mem_disable_command): Update.
+	(mem_delete_command): Update.
+	* inferior.c (detach_inferior_command): Update.
+	(kill_inferior_command): Update.
+	(remove_inferior_command): Update.
+	* cli/cli-utils.h (struct get_number_or_range_state): New.
+	(init_number_or_range): Declare.
+	(get_number_or_range): Update.
+	* cli/cli-utils.c (init_number_or_range): New function.
+	(get_number_or_range): Change 'pp' parameter to 'state'.  Remove
+	static variables.
+	(number_is_in_list): Update.
+	* breakpoint.h (get_tracepoint_by_number): Update.
+	* breakpoint.c (map_breakpoint_numbers): Update for change to
+	get_number_or_range.
+	(find_location_by_number): Use get_number, not
+	get_number_or_range.
+	(trace_pass_set_count): New function.
+	(trace_pass_command): Update for change to get_number_or_range.
+	Rework loop logic.
+	(get_tracepoint_by_number): Remove 'multi_p' parameter; add
+	'state' parameter.
+
 2011-03-10  Phil Muldoon  <pmuldoon@redhat.com>
 
 	* python/py-param.c (add_setshow_generic): Add set/show callback
diff --git a/gdb/breakpoint.c b/gdb/breakpoint.c
index 5bcab8710a..8d9926c11d 100644
--- a/gdb/breakpoint.c
+++ b/gdb/breakpoint.c
@@ -10804,21 +10804,23 @@ map_breakpoint_numbers (char *args, void (*function) (struct breakpoint *,
 						      void *),
 			void *data)
 {
-  char *p = args;
-  char *p1;
   int num;
   struct breakpoint *b, *tmp;
   int match;
+  struct get_number_or_range_state state;
 
-  if (p == 0)
+  if (args == 0)
     error_no_arg (_("one or more breakpoint numbers"));
 
-  while (*p)
-    {
-      match = 0;
-      p1 = p;
+  init_number_or_range (&state, args);
 
-      num = get_number_or_range (&p1);
+  while (!state.finished)
+    {
+      char *p = state.string;
+
+      match = 0;
+
+      num = get_number_or_range (&state);
       if (num == 0)
 	{
 	  warning (_("bad breakpoint number at or near '%s'"), p);
@@ -10838,7 +10840,6 @@ map_breakpoint_numbers (char *args, void (*function) (struct breakpoint *,
 	  if (match == 0)
 	    printf_unfiltered (_("No breakpoint number %d.\n"), num);
 	}
-      p = p1;
     }
 }
 
@@ -10855,7 +10856,7 @@ find_location_by_number (char *number)
   *dot = '\0';
 
   p1 = number;
-  bp_num = get_number_or_range (&p1);
+  bp_num = get_number (&p1);
   if (bp_num == 0)
     error (_("Bad breakpoint number '%s'"), number);
 
@@ -10869,7 +10870,7 @@ find_location_by_number (char *number)
     error (_("Bad breakpoint number '%s'"), number);
   
   p1 = dot+1;
-  loc_num = get_number_or_range (&p1);
+  loc_num = get_number (&p1);
   if (loc_num == 0)
     error (_("Bad breakpoint location number '%s'"), number);
 
@@ -11613,6 +11614,18 @@ delete_trace_command (char *arg, int from_tty)
     map_breakpoint_numbers (arg, do_delete_breakpoint, NULL);
 }
 
+/* Helper function for trace_pass_command.  */
+
+static void
+trace_pass_set_count (struct breakpoint *bp, int count, int from_tty)
+{
+  bp->pass_count = count;
+  observer_notify_tracepoint_modified (bp->number);
+  if (from_tty)
+    printf_filtered (_("Setting tracepoint %d's passcount to %d\n"),
+		     bp->number, count);
+}
+
 /* Set passcount for tracepoint.
 
    First command argument is passcount, second is tracepoint number.
@@ -11622,9 +11635,8 @@ delete_trace_command (char *arg, int from_tty)
 static void
 trace_pass_command (char *args, int from_tty)
 {
-  struct breakpoint *t1 = (struct breakpoint *) -1, *t2;
+  struct breakpoint *t1;
   unsigned int count;
-  int all = 0;
 
   if (args == 0 || *args == 0)
     error (_("passcount command requires an "
@@ -11638,32 +11650,32 @@ trace_pass_command (char *args, int from_tty)
   if (*args && strncasecmp (args, "all", 3) == 0)
     {
       args += 3;			/* Skip special argument "all".  */
-      all = 1;
       if (*args)
 	error (_("Junk at end of arguments."));
+
+      ALL_TRACEPOINTS (t1)
+      {
+	trace_pass_set_count (t1, count, from_tty);
+      }
+    }
+  else if (*args == '\0')
+    {
+      t1 = get_tracepoint_by_number (&args, NULL, 1);
+      if (t1)
+	trace_pass_set_count (t1, count, from_tty);
     }
   else
-    t1 = get_tracepoint_by_number (&args, 1, 1);
-
-  do
     {
-      if (t1)
+      struct get_number_or_range_state state;
+
+      init_number_or_range (&state, args);
+      while (!state.finished)
 	{
-	  ALL_TRACEPOINTS (t2)
-	    if (t1 == (struct breakpoint *) -1 || t1 == t2)
-	      {
-		t2->pass_count = count;
-		observer_notify_tracepoint_modified (t2->number);
-		if (from_tty)
-		  printf_filtered (_("Setting tracepoint %d's "
-				     "passcount to %d\n"),
-				   t2->number, count);
-	      }
-	  if (! all && *args)
-	    t1 = get_tracepoint_by_number (&args, 1, 0);
+	  t1 = get_tracepoint_by_number (&args, &state, 1);
+	  if (t1)
+	    trace_pass_set_count (t1, count, from_tty);
 	}
     }
-  while (*args);
 }
 
 struct breakpoint *
@@ -11695,18 +11707,25 @@ get_tracepoint_by_number_on_target (int num)
 }
 
 /* Utility: parse a tracepoint number and look it up in the list.
-   If MULTI_P is true, there might be a range of tracepoints in ARG.
-   if OPTIONAL_P is true, then if the argument is missing, the most
+   If STATE is not NULL, use, get_number_or_range_state and ignore ARG.
+   If OPTIONAL_P is true, then if the argument is missing, the most
    recent tracepoint (tracepoint_count) is returned.  */
 struct breakpoint *
-get_tracepoint_by_number (char **arg, int multi_p, int optional_p)
+get_tracepoint_by_number (char **arg,
+			  struct get_number_or_range_state *state,
+			  int optional_p)
 {
   extern int tracepoint_count;
   struct breakpoint *t;
   int tpnum;
   char *instring = arg == NULL ? NULL : *arg;
 
-  if (arg == NULL || *arg == NULL || ! **arg)
+  if (state)
+    {
+      gdb_assert (!state->finished);
+      tpnum = get_number_or_range (state);
+    }
+  else if (arg == NULL || *arg == NULL || ! **arg)
     {
       if (optional_p)
 	tpnum = tracepoint_count;
@@ -11714,7 +11733,7 @@ get_tracepoint_by_number (char **arg, int multi_p, int optional_p)
 	error_no_arg (_("tracepoint number"));
     }
   else
-    tpnum = multi_p ? get_number_or_range (arg) : get_number (arg);
+    tpnum = get_number (arg);
 
   if (tpnum <= 0)
     {
@@ -11733,9 +11752,6 @@ get_tracepoint_by_number (char **arg, int multi_p, int optional_p)
       return t;
     }
 
-  /* FIXME: if we are in the middle of a range we don't want to give
-     a message.  The current interface to get_number_or_range doesn't
-     allow us to discover this.  */
   printf_unfiltered ("No tracepoint number %d.\n", tpnum);
   return NULL;
 }
diff --git a/gdb/breakpoint.h b/gdb/breakpoint.h
index a0fea211e6..bd097137e6 100644
--- a/gdb/breakpoint.h
+++ b/gdb/breakpoint.h
@@ -28,6 +28,7 @@
 struct value;
 struct block;
 struct breakpoint_object;
+struct get_number_or_range_state;
 
 /* This is the maximum number of bytes a breakpoint instruction can
    take.  Feel free to increase it.  It's just used in a few places to
@@ -1150,9 +1151,10 @@ extern struct breakpoint *get_tracepoint (int num);
 extern struct breakpoint *get_tracepoint_by_number_on_target (int num);
 
 /* Find a tracepoint by parsing a number in the supplied string.  */
-extern struct breakpoint *get_tracepoint_by_number (char **arg, 
-						    int multi_p,
-						    int optional_p);
+extern struct breakpoint *
+     get_tracepoint_by_number (char **arg, 
+			       struct get_number_or_range_state *state,
+			       int optional_p);
 
 /* Return a vector of all tracepoints currently defined.  The vector
    is newly allocated; the caller should free when done with it.  */
@@ -1187,6 +1189,4 @@ extern struct breakpoint *iterate_over_breakpoints (int (*) (struct breakpoint *
 
 extern int user_breakpoint_p (struct breakpoint *);
 
-extern int get_number_or_range (char **pp);
-
 #endif /* !defined (BREAKPOINT_H) */
diff --git a/gdb/cli/cli-utils.c b/gdb/cli/cli-utils.c
index 133ac53831..2cce06897a 100644
--- a/gdb/cli/cli-utils.c
+++ b/gdb/cli/cli-utils.c
@@ -117,19 +117,25 @@ get_number (char **pp)
 
 /* See documentation in cli-utils.h.  */
 
-int
-get_number_or_range (char **pp)
+void
+init_number_or_range (struct get_number_or_range_state *state,
+		      char *string)
 {
-  static int last_retval, end_value;
-  static char *end_ptr;
-  static int in_range = 0;
+  memset (state, 0, sizeof (*state));
+  state->string = string;
+}
 
-  if (**pp != '-')
+/* See documentation in cli-utils.h.  */
+
+int
+get_number_or_range (struct get_number_or_range_state *state)
+{
+  if (*state->string != '-')
     {
-      /* Default case: pp is pointing either to a solo number, 
-	 or to the first number of a range.  */
-      last_retval = get_number_trailer (pp, '-');
-      if (**pp == '-')
+      /* Default case: state->string is pointing either to a solo
+	 number, or to the first number of a range.  */
+      state->last_retval = get_number_trailer (&state->string, '-');
+      if (*state->string == '-')
 	{
 	  char **temp;
 
@@ -137,44 +143,43 @@ get_number_or_range (char **pp)
 	     Skip the '-', parse and remember the second number,
 	     and also remember the end of the final token.  */
 
-	  temp = &end_ptr; 
-	  end_ptr = *pp + 1; 
-	  while (isspace ((int) *end_ptr))
-	    end_ptr++;	/* skip white space */
-	  end_value = get_number (temp);
-	  if (end_value < last_retval) 
+	  temp = &state->end_ptr; 
+	  state->end_ptr = skip_spaces (state->string + 1);
+	  state->end_value = get_number (temp);
+	  if (state->end_value < state->last_retval) 
 	    {
 	      error (_("inverted range"));
 	    }
-	  else if (end_value == last_retval)
+	  else if (state->end_value == state->last_retval)
 	    {
 	      /* Degenerate range (number1 == number2).  Advance the
 		 token pointer so that the range will be treated as a
 		 single number.  */ 
-	      *pp = end_ptr;
+	      state->string = state->end_ptr;
 	    }
 	  else
-	    in_range = 1;
+	    state->in_range = 1;
 	}
     }
-  else if (! in_range)
+  else if (! state->in_range)
     error (_("negative value"));
   else
     {
-      /* pp points to the '-' that betokens a range.  All
+      /* state->string points to the '-' that betokens a range.  All
 	 number-parsing has already been done.  Return the next
 	 integer value (one greater than the saved previous value).
-	 Do not advance the token pointer 'pp' until the end of range
+	 Do not advance the token pointer until the end of range
 	 is reached.  */
 
-      if (++last_retval == end_value)
+      if (++state->last_retval == state->end_value)
 	{
 	  /* End of range reached; advance token pointer.  */
-	  *pp = end_ptr;
-	  in_range = 0;
+	  state->string = state->end_ptr;
+	  state->in_range = 0;
 	}
     }
-  return last_retval;
+  state->finished = *state->string == '\0';
+  return state->last_retval;
 }
 
 /* Accept a number and a string-form list of numbers such as is 
@@ -188,12 +193,15 @@ get_number_or_range (char **pp)
 int
 number_is_in_list (char *list, int number)
 {
+  struct get_number_or_range_state state;
+
   if (list == NULL || *list == '\0')
     return 1;
 
-  while (*list != '\0')
+  init_number_or_range (&state, list);
+  while (!state.finished)
     {
-      int gotnum = get_number_or_range (&list);
+      int gotnum = get_number_or_range (&state);
 
       if (gotnum == 0)
 	error (_("Args must be numbers or '$' variables."));
diff --git a/gdb/cli/cli-utils.h b/gdb/cli/cli-utils.h
index 09240d0764..2954c46a21 100644
--- a/gdb/cli/cli-utils.h
+++ b/gdb/cli/cli-utils.h
@@ -28,6 +28,40 @@
 
 extern int get_number (char **);
 
+/* An object of this type is passed to get_number_or_range.  It must
+   be initialized by calling init_number_or_range.  This type is
+   defined here so that it can be stack-allocated, but all members
+   other than `finished' and `string' should be treated as opaque.  */
+
+struct get_number_or_range_state
+{
+  /* Non-zero if parsing has completed.  */
+  int finished;
+
+  /* The string being parsed.  When parsing has finished, this points
+     past the last parsed token.  */
+  char *string;
+
+  /* Last value returned.  */
+  int last_retval;
+
+  /* When parsing a range, the final value in the range.  */
+  int end_value;
+
+  /* When parsing a range, a pointer past the final token in the
+     range.  */
+  char *end_ptr;
+
+  /* Non-zero when parsing a range.  */
+  int in_range;
+};
+
+/* Initialize a get_number_or_range_state for use with
+   get_number_or_range_state.  STRING is the string to be parsed.  */
+
+extern void init_number_or_range (struct get_number_or_range_state *state,
+				  char *string);
+
 /* Parse a number or a range.
    A number will be of the form handled by get_number.
    A range will be of the form <number1> - <number2>, and 
@@ -37,13 +71,13 @@ extern int get_number (char **);
    While processing a range, this fuction is called iteratively;
    At each call it will return the next value in the range.
 
-   At the beginning of parsing a range, the char pointer PP will
+   At the beginning of parsing a range, the char pointer STATE->string will
    be advanced past <number1> and left pointing at the '-' token.
    Subsequent calls will not advance the pointer until the range
    is completed.  The call that completes the range will advance
-   pointer PP past <number2>.  */
+   the pointer past <number2>.  */
 
-extern int get_number_or_range (char **);
+extern int get_number_or_range (struct get_number_or_range_state *state);
 
 /* Accept a number and a string-form list of numbers such as is 
    accepted by get_number_or_range.  Return TRUE if the number is
diff --git a/gdb/inferior.c b/gdb/inferior.c
index eb33b9a376..db4dd41e6b 100644
--- a/gdb/inferior.c
+++ b/gdb/inferior.c
@@ -612,13 +612,15 @@ detach_inferior_command (char *args, int from_tty)
 {
   int num, pid;
   struct thread_info *tp;
+  struct get_number_or_range_state state;
 
   if (!args || !*args)
     error (_("Requires argument (inferior id(s) to detach)"));
 
-  while (*args != '\0')
+  init_number_or_range (&state, args);
+  while (!state.finished)
     {
-      num = get_number_or_range (&args);
+      num = get_number_or_range (&state);
 
       if (!valid_gdb_inferior_id (num))
 	{
@@ -646,13 +648,15 @@ kill_inferior_command (char *args, int from_tty)
 {
   int num, pid;
   struct thread_info *tp;
+  struct get_number_or_range_state state;
 
   if (!args || !*args)
     error (_("Requires argument (inferior id(s) to kill)"));
 
-  while (*args != '\0')
+  init_number_or_range (&state, args);
+  while (!state.finished)
     {
-      num = get_number_or_range (&args);
+      num = get_number_or_range (&state);
 
       if (!valid_gdb_inferior_id (num))
 	{
@@ -747,13 +751,15 @@ remove_inferior_command (char *args, int from_tty)
 {
   int num;
   struct inferior *inf;
+  struct get_number_or_range_state state;
 
   if (args == NULL || *args == '\0')
     error (_("Requires an argument (inferior id(s) to remove)"));
 
-  while (*args != '\0')
+  init_number_or_range (&state, args);
+  while (!state.finished)
     {
-      num = get_number_or_range (&args);
+      num = get_number_or_range (&state);
       inf = find_inferior_id (num);
 
       if (inf == NULL)
diff --git a/gdb/memattr.c b/gdb/memattr.c
index 1a2be8f102..d576155c80 100644
--- a/gdb/memattr.c
+++ b/gdb/memattr.c
@@ -28,6 +28,7 @@
 #include "vec.h"
 #include "gdb_string.h"
 #include "breakpoint.h"
+#include "cli/cli-utils.h"
 
 const struct mem_attrib default_mem_attrib =
 {
@@ -577,11 +578,16 @@ mem_enable_command (char *args, int from_tty)
 	m->enabled_p = 1;
     }
   else
-    while (args != NULL && *args != '\0')
-      {
-	num = get_number_or_range (&args);
-	mem_enable (num);
-      }
+    {
+      struct get_number_or_range_state state;
+
+      init_number_or_range (&state, args);
+      while (!state.finished)
+	{
+	  num = get_number_or_range (&state);
+	  mem_enable (num);
+	}
+    }
 }
 
 
@@ -619,11 +625,16 @@ mem_disable_command (char *args, int from_tty)
 	m->enabled_p = 0;
     }
   else
-    while (args != NULL && *args != '\0')
-      {
-	num = get_number_or_range (&args);
-	mem_disable (num);
-      }
+    {
+      struct get_number_or_range_state state;
+
+      init_number_or_range (&state, args);
+      while (!state.finished)
+	{
+	  num = get_number_or_range (&state);
+	  mem_disable (num);
+	}
+    }
 }
 
 /* Delete the memory region number NUM.  */
@@ -657,6 +668,7 @@ static void
 mem_delete_command (char *args, int from_tty)
 {
   int num;
+  struct get_number_or_range_state state;
 
   require_user_regions (from_tty);
 
@@ -670,9 +682,10 @@ mem_delete_command (char *args, int from_tty)
       return;
     }
 
-  while (args != NULL && *args != '\0')
+  init_number_or_range (&state, args);
+  while (!state.finished)
     {
-      num = get_number_or_range (&args);
+      num = get_number_or_range (&state);
       mem_delete (num);
     }
 
diff --git a/gdb/printcmd.c b/gdb/printcmd.c
index 12249a004b..efc89cfb0d 100644
--- a/gdb/printcmd.c
+++ b/gdb/printcmd.c
@@ -1589,9 +1589,8 @@ delete_display (struct display *display)
 static void
 undisplay_command (char *args, int from_tty)
 {
-  char *p = args;
-  char *p1;
   int num;
+  struct get_number_or_range_state state;
 
   if (args == 0)
     {
@@ -1601,11 +1600,12 @@ undisplay_command (char *args, int from_tty)
       return;
     }
 
-  while (*p)
+  init_number_or_range (&state, args);
+  while (!state.finished)
     {
-      p1 = p;
+      char *p = state.string;
 
-      num = get_number_or_range (&p1);
+      num = get_number_or_range (&state);
       if (num == 0)
 	warning (_("bad display number at or near '%s'"), p);
       else
@@ -1620,8 +1620,6 @@ undisplay_command (char *args, int from_tty)
 	  else
 	    delete_display (d);
 	}
-
-      p = p1;
     }
   dont_repeat ();
 }
diff --git a/gdb/reverse.c b/gdb/reverse.c
index 7169cc3e63..61f2e7c50b 100644
--- a/gdb/reverse.c
+++ b/gdb/reverse.c
@@ -222,6 +222,7 @@ delete_bookmark_command (char *args, int from_tty)
 {
   struct bookmark *b;
   int num;
+  struct get_number_or_range_state state;
 
   if (bookmark_chain == NULL)
     {
@@ -237,9 +238,10 @@ delete_bookmark_command (char *args, int from_tty)
       return;
     }
 
-  while (args != NULL && *args != '\0')
+  init_number_or_range (&state, args);
+  while (!state.finished)
     {
-      num = get_number_or_range (&args);
+      num = get_number_or_range (&state);
       if (!delete_one_bookmark (num))
 	/* Not found.  */
 	warning (_("No bookmark #%d."), num);
@@ -328,11 +330,16 @@ bookmarks_info (char *args, int from_tty)
   else if (args == NULL || *args == '\0')
     bookmark_1 (-1);
   else
-    while (args != NULL && *args != '\0')
-      {
-	bnum = get_number_or_range (&args);
-	bookmark_1 (bnum);
-      }
+    {
+      struct get_number_or_range_state state;
+
+      init_number_or_range (&state, args);
+      while (!state.finished)
+	{
+	  bnum = get_number_or_range (&state);
+	  bookmark_1 (bnum);
+	}
+    }
 }
 
 
diff --git a/gdb/thread.c b/gdb/thread.c
index b48909f1e4..6ad1807db8 100644
--- a/gdb/thread.c
+++ b/gdb/thread.c
@@ -1214,6 +1214,7 @@ thread_apply_command (char *tidlist, int from_tty)
   char *cmd;
   struct cleanup *old_chain;
   char *saved_cmd;
+  struct get_number_or_range_state state;
 
   if (tidlist == NULL || *tidlist == '\000')
     error (_("Please specify a thread ID list"));
@@ -1227,13 +1228,15 @@ thread_apply_command (char *tidlist, int from_tty)
      execute_command.  */
   saved_cmd = xstrdup (cmd);
   old_chain = make_cleanup (xfree, saved_cmd);
-  while (tidlist < cmd)
+
+  init_number_or_range (&state, tidlist);
+  while (!state.finished && state.string < cmd)
     {
       struct thread_info *tp;
       int start;
       char *p = tidlist;
 
-      start = get_number_or_range (&tidlist);
+      start = get_number_or_range (&state);
 
       make_cleanup_restore_current_thread ();
 
diff --git a/gdb/tracepoint.c b/gdb/tracepoint.c
index e6dea4816f..7aef35f539 100644
--- a/gdb/tracepoint.c
+++ b/gdb/tracepoint.c
@@ -581,7 +581,7 @@ trace_actions_command (char *args, int from_tty)
   struct breakpoint *t;
   struct command_line *l;
 
-  t = get_tracepoint_by_number (&args, 0, 1);
+  t = get_tracepoint_by_number (&args, NULL, 1);
   if (t)
     {
       char *tmpbuf =