Index: includes/common.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/common.inc,v
retrieving revision 1.1250
diff -u -p -r1.1250 common.inc
--- includes/common.inc	7 Nov 2010 18:33:52 -0000	1.1250
+++ includes/common.inc	9 Nov 2010 10:16:33 -0000
@@ -5969,14 +5969,22 @@ function element_set_attributes(array &$
  *   An array of parent keys, starting with the outermost key.
  * @param $value
  *   The value to set.
+ * @param $force
+ *   (Optional) If TRUE, the value is forced into the structure even if it
+ *   requires the deletion of an already existing non-array parent value. If
+ *   FALSE, PHP throws an error if trying to add into a value that is not an
+ *   array. Defaults to FALSE.
  *
  * @see drupal_array_get_nested_value()
  */
-function drupal_array_set_nested_value(array &$array, array $parents, $value) {
+function drupal_array_set_nested_value(array &$array, array $parents, $value, $force = FALSE) {
   $ref = &$array;
   foreach ($parents as $parent) {
-    // Note that PHP is fine with referencing a not existing array key - in this
-    // case it just creates an entry with NULL as value.
+    // PHP auto-creates container arrays and NULL entries without error if $ref
+    // is NULL, but throws an error if $ref is set, but not an array.
+    if ($force && isset($ref) && !is_array($ref)) {
+      $ref = array();
+    }
     $ref = &$ref[$parent];
   }
   $ref = $value;
@@ -6040,10 +6048,7 @@ function drupal_array_set_nested_value(a
 function drupal_array_get_nested_value(array &$array, array $parents, &$key_exists = NULL) {
   $ref = &$array;
   foreach ($parents as $parent) {
-    // array_key_exists() is slower than isset() and triggers notices if the
-    // second argument is not an array, so only call it when absolutely
-    // necessary.
-    if (isset($ref[$parent]) || (is_array($ref) && array_key_exists($parent, $ref))) {
+    if (is_array($ref) && array_key_exists($parent, $ref)) {
       $ref = &$ref[$parent];
     }
     else {
Index: includes/form.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/form.inc,v
retrieving revision 1.508
diff -u -p -r1.508 form.inc
--- includes/form.inc	7 Nov 2010 21:46:09 -0000	1.508
+++ includes/form.inc	9 Nov 2010 10:16:35 -0000
@@ -1031,10 +1031,29 @@ function drupal_validate_form($form_id, 
         drupal_array_set_nested_value($values, $section, $value);
       }
     }
-    // For convenience we always make the value of the pressed button available.
+    // A button's #value does not require validation, so for convenience we
+    // allow the value of the clicked button to be retained in its normal
+    // $form_state['values'] locations, even if these locations are not included
+    // in #limit_validation_errors.
     if (isset($form_state['triggering_element']['#button_type'])) {
-      $values[$form_state['triggering_element']['#name']] = $form_state['triggering_element']['#value'];
-      drupal_array_set_nested_value($values, $form_state['triggering_element']['#parents'], $form_state['triggering_element']['#value']);
+      $button_value = $form_state['triggering_element']['#value'];
+
+      // Like all input controls, the button value may be in the location
+      // dictated by #parents. If it is, copy it to $values, but do not override
+      // what may already be in $values.
+      $parents = $form_state['triggering_element']['#parents'];
+      if (!drupal_array_nested_key_exists($values, $parents) && drupal_array_get_nested_value($form_state['values'], $parents) === $button_value) {
+        drupal_array_set_nested_value($values, $parents, $button_value);
+      }
+
+      // Additionally, form_builder() places the button value in
+      // $form_state['values'][BUTTON_NAME]. If it's still there, after
+      // validation handlers have run, copy it to $values, but do not override
+      // what may already be in $values.
+      $name = $form_state['triggering_element']['#name'];
+      if (!isset($values[$name]) && isset($form_state['values'][$name]) && $form_state['values'][$name] === $button_value) {
+        $values[$name] = $button_value;
+      }
     }
     $form_state['values'] = $values;
   }
@@ -2301,7 +2320,7 @@ function form_type_token_value($element,
  *   Form state array where the value change should be recorded.
  */
 function form_set_value($element, $value, &$form_state) {
-  drupal_array_set_nested_value($form_state['values'], $element['#parents'], $value);
+  drupal_array_set_nested_value($form_state['values'], $element['#parents'], $value, TRUE);
 }
 
 /**
Index: modules/file/file.field.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/file/file.field.inc,v
retrieving revision 1.38
diff -u -p -r1.38 file.field.inc
--- modules/file/file.field.inc	31 Oct 2010 12:12:00 -0000	1.38
+++ modules/file/file.field.inc	9 Nov 2010 10:16:36 -0000
@@ -648,8 +648,9 @@ function file_field_widget_process($elem
   // Adjust the AJAX settings so that on upload and remove of any individual
   // file, the entire group of file fields is updated together.
   if ($field['cardinality'] != 1) {
-    $new_path = preg_replace('/\/\d+\//', '/', $element['remove_button']['#ajax']['path'], 1);
-    $field_element = drupal_array_get_nested_value($form, array_slice($element['#array_parents'], 0, -1));
+    $parents = array_slice($element['#array_parents'], 0, -1);
+    $new_path = 'file/ajax/' . implode('/', $parents) . '/' . $form['form_build_id']['#value'];
+    $field_element = drupal_array_get_nested_value($form, $parents);
     $new_wrapper = $field_element['#id'] . '-ajax-wrapper';
     foreach (element_children($element) as $key) {
       if (isset($element[$key]['#ajax'])) {
Index: modules/file/file.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/file/file.module,v
retrieving revision 1.45
diff -u -p -r1.45 file.module
--- modules/file/file.module	20 Oct 2010 15:22:53 -0000	1.45
+++ modules/file/file.module	9 Nov 2010 10:16:36 -0000
@@ -360,7 +360,7 @@ function file_managed_file_process($elem
   $element['#tree'] = TRUE;
 
   $ajax_settings = array(
-    'path' => 'file/ajax/' . implode('/', $element['#parents']) . '/' . $form['form_build_id']['#value'],
+    'path' => 'file/ajax/' . implode('/', $element['#array_parents']) . '/' . $form['form_build_id']['#value'],
     'wrapper' => $element['#id'] . '-ajax-wrapper',
     'effect' => 'fade',
     'progress' => array(
Index: modules/file/tests/file.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/file/tests/file.test,v
retrieving revision 1.27
diff -u -p -r1.27 file.test
--- modules/file/tests/file.test	20 Oct 2010 15:22:53 -0000	1.27
+++ modules/file/tests/file.test	9 Nov 2010 10:16:37 -0000
@@ -201,6 +201,52 @@ class FileFieldTestCase extends DrupalWe
   }
 }
 
+class FileFieldAjaxUploadTestCase extends FileFieldTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'File field ajax upload test',
+      'description' => 'Tests the file field widget, single and multi-valued, with and without AJAX, with public and private files.',
+      'group' => 'File',
+    );
+  }
+
+  /**
+   * Tests upload and remove buttons, with and without AJAX, for a single-valued File field.
+   */
+  function testAjaxUploadSingleValuedWidget() {
+    // Use 'page' instead of 'article', so that the 'article' image field does
+    // not conflict with this test. If in the future the 'page' type gets its
+    // own default file or image field, this test can be made more robust by
+    // using a custom node type.
+    $type_name = 'page';
+    $field_name = strtolower($this->randomName());
+    $this->createFileField($field_name, $type_name);
+    $field = field_info_field($field_name);
+    $instance = field_info_instance('node', $field_name, $type_name);
+
+    $test_file = $this->getTestFile('text');
+
+    // Load the page we're going run the ajax on so we can get the form build id.
+    $this->drupalGet('node/add/' . $type_name);
+    $form_build_id = (string) array_pop($this->xpath("//input[@name='form_build_id']/@value"));
+
+    $edit['files[' . $field_name . '_' . LANGUAGE_NONE . '_0]'] = drupal_realpath($test_file->uri);
+    $ajax_path = 'file/ajax/' . $field_name . '/' . LANGUAGE_NONE . '/0/' . $form_build_id;
+    $triggering_element = $field_name . '_' . LANGUAGE_NONE . '_0_upload_button';
+    $result = $this->drupalPostAJAX(NULL, $edit, $triggering_element, $ajax_path);
+
+    $edit = array(
+      'title' => $this->randomName(),
+      'revision' => '0',
+      $field_name . '[' . LANGUAGE_NONE . '][0][fid]' => 1,
+      $field_name . '[' . LANGUAGE_NONE . '][0][display]' => 1,
+    );
+    $this->drupalPost('node/add/' . $type_name, $edit, t('Save'));
+    $node = node_load(preg_replace('/.*(\d+)$/', '$1', $this->getUrl()), NULL, TRUE);
+    $node_file = (object) $node->{$field_name}[LANGUAGE_NONE][0];
+    $this->assertFileExists($node_file, t('New file, uploaded via ajax widget, saved to disk on node creation.'));
+  }
+}
 
 /**
  * Test class to test file field widget, single and multi-valued, with and without AJAX, with public and private files.
Index: modules/simpletest/drupal_web_test_case.php
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/drupal_web_test_case.php,v
retrieving revision 1.246
diff -u -p -r1.246 drupal_web_test_case.php
--- modules/simpletest/drupal_web_test_case.php	31 Oct 2010 13:08:29 -0000	1.246
+++ modules/simpletest/drupal_web_test_case.php	9 Nov 2010 10:16:38 -0000
@@ -1801,6 +1801,39 @@ class DrupalWebTestCase extends DrupalTe
    * array of commands, to update $this->content using equivalent DOM
    * manipulation as is used by ajax.js. It also returns the array of commands.
    *
+   * @param $path
+   *   Location of the form containing the AJAX enabled element to test. Can be
+   *   either a Drupal path or an absolute path or NULL to use the current page.
+   * @param $edit
+   *   Field data in an associative array. Changes the current input fields
+   *   (where possible) to the values indicated.
+   * @param $triggering_element
+   *   The name of the form element that is responsible for triggering the AJAX
+   *   functionality to test. May be a string or, if the triggering element is
+   *   a button, an associative array where the key is the name of the button
+   *   and the value is the button label. i.e.) array('op' => t('Refresh')).
+   * @param $ajax_path
+   *   (optional) Override the path set by the AJAX settings of the triggering
+   *   element. In the absence of both the triggering element's AJAX path and
+   *   $ajax_path 'system/ajax' will be used.
+   * @param $options
+   *   (optional) Options to be forwarded to url().
+   * @param $headers
+   *   (optional) An array containing additional HTTP request headers, each
+   *   formatted as "name: value". Forwarded to drupalPost().
+   * @param $form_html_id
+   *   (optional) HTML ID of the form to be submitted, use when there is more
+   *   than one identical form on the same page and the value of the triggering
+   *   element is not enough to identify the form. Note this is not the Drupal
+   *   ID of the form but rather the HTML ID of the form.
+   * @param $ajax_settings
+   *   (optional) An array of AJAX settings which if specified will be used in
+   *   place of the AJAX settings of the triggering element.
+   *
+   * @return
+   *   An array of AJAX commands.
+   *
+   * @see drupalPost()
    * @see ajax.js
    */
   protected function drupalPostAJAX($path, $edit, $triggering_element, $ajax_path = NULL, array $options = array(), array $headers = array(), $form_html_id = NULL, $ajax_settings = NULL) {