diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index 4af881e..ef8e493 100644
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,22 @@
+2015-08-18  Doug Evans  <dje@google.com>
+	    Adrian Sendroiu <adrian.sendroiu@freescale.com>
+
+	PR mi/18833
+	* cli/cli-logging.c (pop_output_files): Don't restore redirection
+	if MI-like.
+	* mi/mi-out.c: #include "vec.h".
+	(ui_filep): New type.
+	(DEV_VEC_P (ui_filep)): New type.
+	(struct ui_out_data) <buffer, original_buffer>: Delete.
+	(struct ui_out_data) <streams>: New member.
+	(mi_ui_out_impl): Add data_destroy field.
+	(mi_field_string, mi_field_fmt): Update.
+	(mi_flush, mi_redirect, field_separator): Update.
+	(mi_open, mi_close): Update.
+	(mi_out_buffered, mi_out_rewind, mi_out_put): Update.
+	(mi_out_data_ctor, mi_out_data_dtor): New functions.
+	(mi_out_new): Call mi_out_data_ctor.
+
  2015-08-18  Sandra Loosemore  <sandra@codesourcery.com>

  	* remote.c (strprefix): New.
diff --git a/gdb/cli/cli-logging.c b/gdb/cli/cli-logging.c
index 7d340c1..c282260 100644
--- a/gdb/cli/cli-logging.c
+++ b/gdb/cli/cli-logging.c
@@ -177,7 +177,9 @@ pop_output_files (void)
    saved_output.targ = NULL;
    saved_output.targerr = NULL;

-  ui_out_redirect (current_uiout, NULL);
+  /* Stay consistent with handle_redirections.  */
+  if (!ui_out_is_mi_like_p (current_uiout))
+    ui_out_redirect (current_uiout, NULL);
  }

  /* This is a helper for the `set logging' command.  */
diff --git a/gdb/mi/mi-out.c b/gdb/mi/mi-out.c
index fa8282f..ef0a2df 100644
--- a/gdb/mi/mi-out.c
+++ b/gdb/mi/mi-out.c
@@ -22,19 +22,23 @@
  #include "defs.h"
  #include "ui-out.h"
  #include "mi-out.h"
+#include "vec.h"
+
+typedef struct ui_file *ui_filep;
+DEF_VEC_P (ui_filep);

  struct ui_out_data
    {
      int suppress_field_separator;
      int suppress_output;
      int mi_version;
-    struct ui_file *buffer;
-    struct ui_file *original_buffer;
+    VEC (ui_filep) *streams;
    };
  typedef struct ui_out_data mi_out_data;

  /* These are the MI output functions */

+static void mi_out_data_dtor (struct ui_out *ui_out);
  static void mi_table_begin (struct ui_out *uiout, int nbrofcols,
  			    int nr_rows, const char *tblid);
  static void mi_table_body (struct ui_out *uiout);
@@ -85,7 +89,7 @@ static const struct ui_out_impl mi_ui_out_impl =
    mi_wrap_hint,
    mi_flush,
    mi_redirect,
-  0,
+  mi_out_data_dtor,
    1, /* Needs MI hacks.  */
  };

@@ -215,17 +219,19 @@ mi_field_string (struct ui_out *uiout, int fldno, int  
width,
  		 enum ui_align align, const char *fldname, const char *string)
  {
    mi_out_data *data = ui_out_data (uiout);
+  struct ui_file *stream;

    if (data->suppress_output)
      return;

+  stream = VEC_last (ui_filep, data->streams);
    field_separator (uiout);
    if (fldname)
-    fprintf_unfiltered (data->buffer, "%s=", fldname);
-  fprintf_unfiltered (data->buffer, "\"");
+    fprintf_unfiltered (stream, "%s=", fldname);
+  fprintf_unfiltered (stream, "\"");
    if (string)
-    fputstr_unfiltered (string, '"', data->buffer);
-  fprintf_unfiltered (data->buffer, "\"");
+    fputstr_unfiltered (string, '"', stream);
+  fprintf_unfiltered (stream, "\"");
  }

  /* This is the only field function that does not align.  */
@@ -236,17 +242,19 @@ mi_field_fmt (struct ui_out *uiout, int fldno, int  
width,
  	      const char *format, va_list args)
  {
    mi_out_data *data = ui_out_data (uiout);
+  struct ui_file *stream;

    if (data->suppress_output)
      return;

+  stream = VEC_last (ui_filep, data->streams);
    field_separator (uiout);
    if (fldname)
-    fprintf_unfiltered (data->buffer, "%s=\"", fldname);
+    fprintf_unfiltered (stream, "%s=\"", fldname);
    else
-    fputs_unfiltered ("\"", data->buffer);
-  vfprintf_unfiltered (data->buffer, format, args);
-  fputs_unfiltered ("\"", data->buffer);
+    fputs_unfiltered ("\"", stream);
+  vfprintf_unfiltered (stream, format, args);
+  fputs_unfiltered ("\"", stream);
  }

  void
@@ -275,8 +283,9 @@ void
  mi_flush (struct ui_out *uiout)
  {
    mi_out_data *data = ui_out_data (uiout);
+  struct ui_file *stream = VEC_last (ui_filep, data->streams);

-  gdb_flush (data->buffer);
+  gdb_flush (stream);
  }

  int
@@ -285,15 +294,9 @@ mi_redirect (struct ui_out *uiout, struct ui_file  
*outstream)
    mi_out_data *data = ui_out_data (uiout);

    if (outstream != NULL)
-    {
-      data->original_buffer = data->buffer;
-      data->buffer = outstream;
-    }
-  else if (data->original_buffer != NULL)
-    {
-      data->buffer = data->original_buffer;
-      data->original_buffer = NULL;
-    }
+    VEC_safe_push (ui_filep, data->streams, outstream);
+  else
+    VEC_pop (ui_filep, data->streams);

    return 0;
  }
@@ -306,29 +309,31 @@ static void
  field_separator (struct ui_out *uiout)
  {
    mi_out_data *data = ui_out_data (uiout);
+  struct ui_file *stream = VEC_last (ui_filep, data->streams);

    if (data->suppress_field_separator)
      data->suppress_field_separator = 0;
    else
-    fputc_unfiltered (',', data->buffer);
+    fputc_unfiltered (',', stream);
  }

  static void
  mi_open (struct ui_out *uiout, const char *name, enum ui_out_type type)
  {
    mi_out_data *data = ui_out_data (uiout);
+  struct ui_file *stream = VEC_last (ui_filep, data->streams);

    field_separator (uiout);
    data->suppress_field_separator = 1;
    if (name)
-    fprintf_unfiltered (data->buffer, "%s=", name);
+    fprintf_unfiltered (stream, "%s=", name);
    switch (type)
      {
      case ui_out_type_tuple:
-      fputc_unfiltered ('{', data->buffer);
+      fputc_unfiltered ('{', stream);
        break;
      case ui_out_type_list:
-      fputc_unfiltered ('[', data->buffer);
+      fputc_unfiltered ('[', stream);
        break;
      default:
        internal_error (__FILE__, __LINE__, _("bad switch"));
@@ -339,14 +344,15 @@ static void
  mi_close (struct ui_out *uiout, enum ui_out_type type)
  {
    mi_out_data *data = ui_out_data (uiout);
+  struct ui_file *stream = VEC_last (ui_filep, data->streams);

    switch (type)
      {
      case ui_out_type_tuple:
-      fputc_unfiltered ('}', data->buffer);
+      fputc_unfiltered ('}', stream);
        break;
      case ui_out_type_list:
-      fputc_unfiltered (']', data->buffer);
+      fputc_unfiltered (']', stream);
        break;
      default:
        internal_error (__FILE__, __LINE__, _("bad switch"));
@@ -360,8 +366,9 @@ void
  mi_out_buffered (struct ui_out *uiout, char *string)
  {
    mi_out_data *data = ui_out_data (uiout);
+  struct ui_file *stream = VEC_last (ui_filep, data->streams);

-  fprintf_unfiltered (data->buffer, "%s", string);
+  fprintf_unfiltered (stream, "%s", string);
  }

  /* Clear the buffer.  */
@@ -370,8 +377,9 @@ void
  mi_out_rewind (struct ui_out *uiout)
  {
    mi_out_data *data = ui_out_data (uiout);
+  struct ui_file *stream = VEC_last (ui_filep, data->streams);

-  ui_file_rewind (data->buffer);
+  ui_file_rewind (stream);
  }

  /* Dump the buffer onto the specified stream.  */
@@ -380,9 +388,10 @@ void
  mi_out_put (struct ui_out *uiout, struct ui_file *stream)
  {
    mi_out_data *data = ui_out_data (uiout);
+  struct ui_file *outstream = VEC_last (ui_filep, data->streams);

-  ui_file_put (data->buffer, ui_file_write_for_put, stream);
-  ui_file_rewind (data->buffer);
+  ui_file_put (outstream, ui_file_write_for_put, stream);
+  ui_file_rewind (outstream);
  }

  /* Return the current MI version.  */
@@ -395,19 +404,41 @@ mi_version (struct ui_out *uiout)
    return data->mi_version;
  }

+/* Constructor for an `mi_out_data' object.  */
+
+static void
+mi_out_data_ctor (mi_out_data *self, int mi_version, struct ui_file  
*stream)
+{
+  gdb_assert (stream != NULL);
+
+  self->streams = NULL;
+  VEC_safe_push (ui_filep, self->streams, stream);
+
+  self->suppress_field_separator = 0;
+  self->suppress_output = 0;
+  self->mi_version = mi_version;
+}
+
+/* The destructor.  */
+
+static void
+mi_out_data_dtor (struct ui_out *ui_out)
+{
+  mi_out_data *data = ui_out_data (ui_out);
+
+  VEC_free (ui_filep, data->streams);
+  xfree (data);
+}
+
  /* Initialize private members at startup.  */

  struct ui_out *
  mi_out_new (int mi_version)
  {
    int flags = 0;
-
    mi_out_data *data = XNEW (mi_out_data);
-  data->suppress_field_separator = 0;
-  data->suppress_output = 0;
-  data->mi_version = mi_version;
-  /* FIXME: This code should be using a ``string_file'' and not the
-     TUI buffer hack. */
-  data->buffer = mem_fileopen ();
+  struct ui_file *stream = mem_fileopen ();
+
+  mi_out_data_ctor (data, mi_version, stream);
    return ui_out_new (&mi_ui_out_impl, data, flags);
  }
diff --git a/gdb/testsuite/ChangeLog b/gdb/testsuite/ChangeLog
index 9a7cf88..eac803a 100644
--- a/gdb/testsuite/ChangeLog
+++ b/gdb/testsuite/ChangeLog
@@ -1,3 +1,14 @@
+2015-08-18  Doug Evans  <dje@google.com>
+	    Adrian Sendroiu <adrian.sendroiu@freescale.com>
+
+	* lib/gdb.exp (skip_python_tests_prompt): Renamed from
+	skip_python_tests.  New arg prompt_regexp.
+	(skip_python_tests): New function.
+	* lib/mi-support.exp (mi_skip_python_tests): New function.
+	* gdb.python/py-mi-objfile-gdb.py: New file.
+	* gdb.python/py-mi-objfile.c: New file.
+	* gdb.python/py-mi-objfile.exp: New file.
+
  2015-08-17  Keith Seitz  <keiths@redhat.com>

  	* gdb.linespec/explicit.exp: Move strace test from here ...
diff --git a/gdb/testsuite/gdb.python/py-mi-objfile-gdb.py  
b/gdb/testsuite/gdb.python/py-mi-objfile-gdb.py
new file mode 100644
index 0000000..6e41773
--- /dev/null
+++ b/gdb/testsuite/gdb.python/py-mi-objfile-gdb.py
@@ -0,0 +1,27 @@
+# Copyright (C) 2015 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# This file is part of the GDB testsuite.
+
+import gdb
+
+# PR 18833
+# We want to have two levels of redirection while MI is current_uiout.
+# This will create one for to_string=True and then another for the
+# parameter change notification.
+gdb.execute("set width 101", to_string=True)
+# And finally a command that will use the original MI stream, which in a
+# buggy gdb will use just-freed data.
+gdb.execute("list")
diff --git a/gdb/testsuite/gdb.python/py-mi-objfile.c  
b/gdb/testsuite/gdb.python/py-mi-objfile.c
new file mode 100644
index 0000000..b92fefb
--- /dev/null
+++ b/gdb/testsuite/gdb.python/py-mi-objfile.c
@@ -0,0 +1,22 @@
+/* This testcase is part of GDB, the GNU debugger.
+
+   Copyright 2015 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see  <http://www.gnu.org/licenses/>.   
*/
+
+int
+main (void)
+{
+  return 0;
+}
diff --git a/gdb/testsuite/gdb.python/py-mi-objfile.exp  
b/gdb/testsuite/gdb.python/py-mi-objfile.exp
new file mode 100644
index 0000000..5424cc1
--- /dev/null
+++ b/gdb/testsuite/gdb.python/py-mi-objfile.exp
@@ -0,0 +1,57 @@
+# Copyright (C) 2008-2015 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# This file is part of the GDB testsuite.  It tests exercises PR 18833.
+
+load_lib mi-support.exp
+set MIFLAGS "-i=mi2"
+
+gdb_exit
+if [mi_gdb_start] {
+    continue
+}
+
+standard_testfile
+set pyfile ${testfile}-gdb.py
+
+if  { [gdb_compile "${srcdir}/${subdir}/${srcfile}" "${binfile}"  
executable {debug}] != "" } {
+    untested ${testfile}.exp
+    return -1
+}
+
+if { [mi_skip_python_tests] } { continue }
+
+# Make the -gdb.py script available to gdb, it is automagically loaded by  
gdb.
+# Care is taken to put it in the same directory as the binary so that
+# gdb will find it.
+set remote_python_file [gdb_remote_download host  
${srcdir}/${subdir}/${pyfile}]
+
+mi_delete_breakpoints
+mi_gdb_reinitialize_dir $srcdir/$subdir
+mi_gdb_test "set auto-load safe-path ${remote_python_file}" \
+    {.*\^done} \
+    "set safe-path"
+
+if [is_remote host] {
+    set filename ${testfile}
+    remote_download host ${binfile} ${filename}
+} else {
+    set filename ${binfile}
+}
+
+# PR 18833.  This will cause an unpatched gdb to crash.
+mi_gdb_test "-file-exec-and-symbols ${filename}" \
+    ".*\\^done,line=.*${srcfile}\"" \
+    "file-exec-and-symbols operation"
diff --git a/gdb/testsuite/lib/gdb.exp b/gdb/testsuite/lib/gdb.exp
index c5b7a06..56cde7a 100644
--- a/gdb/testsuite/lib/gdb.exp
+++ b/gdb/testsuite/lib/gdb.exp
@@ -1734,35 +1734,35 @@ proc skip_d_tests {} {
  }

  # Return a 1 for configurations that do not support Python scripting.
+# PROMPT_REGEXP is the expected prompt.

-proc skip_python_tests {} {
-    global gdb_prompt
+proc skip_python_tests_prompt { prompt_regexp } {
      global gdb_py_is_py3k
      global gdb_py_is_py24

      gdb_test_multiple "python print ('test')" "verify python support" {
-	-re "not supported.*$gdb_prompt $"	{
+	-re "not supported.*$prompt_regexp" {
  	    unsupported "Python support is disabled."
  	    return 1
  	}
-	-re "$gdb_prompt $"	{}
+	-re "$prompt_regexp" {}
      }

      set gdb_py_is_py24 0
      gdb_test_multiple "python print (sys.version_info\[0\])" "check if  
python 3" {
-	-re "3.*$gdb_prompt $"	{
+	-re "3.*$prompt_regexp" {
              set gdb_py_is_py3k 1
          }
-	-re ".*$gdb_prompt $"	{
+	-re ".*$prompt_regexp" {
              set gdb_py_is_py3k 0
          }
      }
      if { $gdb_py_is_py3k == 0 } {
          gdb_test_multiple "python print (sys.version_info\[1\])" "check if  
python 2.4" {
-	    -re "\[45\].*$gdb_prompt $" {
+	    -re "\[45\].*$prompt_regexp" {
                  set gdb_py_is_py24 1
              }
-	    -re ".*$gdb_prompt $" {
+	    -re ".*$prompt_regexp" {
                  set gdb_py_is_py24 0
              }
          }
@@ -1771,6 +1771,15 @@ proc skip_python_tests {} {
      return 0
  }

+# Return a 1 for configurations that do not support Python scripting.
+# Note: This also sets various globals that specify which version of Python
+# is in use.  See skip_python_tests_prompt.
+
+proc skip_python_tests {} {
+    global gdb_prompt
+    return [skip_python_tests_prompt "$gdb_prompt $"]
+}
+
  # Return a 1 if we should skip shared library tests.

  proc skip_shlib_tests {} {
diff --git a/gdb/testsuite/lib/mi-support.exp  
b/gdb/testsuite/lib/mi-support.exp
index 0d17ecb..dd6c41a 100644
--- a/gdb/testsuite/lib/mi-support.exp
+++ b/gdb/testsuite/lib/mi-support.exp
@@ -2501,3 +2501,12 @@ proc mi_make_breakpoint_table {bp_list} {
      # Assemble the final regexp.
       
return "BreakpointTable={nr_rows=\"$nr\",nr_cols=\"$nc\",$header,$body}"
  }
+
+# Return a 1 for configurations that do not support Python scripting.
+# Note: This also sets various globals that specify which version of Python
+# is in use.  See skip_python_tests_prompt.
+
+proc mi_skip_python_tests {} {
+    global mi_gdb_prompt
+    return [skip_python_tests_prompt "$mi_gdb_prompt$"]
