Index: includes/common.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/common.inc,v
retrieving revision 1.1250
diff -u -p -r1.1250 common.inc
--- includes/common.inc	7 Nov 2010 18:33:52 -0000	1.1250
+++ includes/common.inc	10 Nov 2010 22:35:36 -0000
@@ -5969,14 +5969,22 @@ function element_set_attributes(array &$
  *   An array of parent keys, starting with the outermost key.
  * @param $value
  *   The value to set.
+ * @param $force
+ *   (Optional) If TRUE, the value is forced into the structure even if it
+ *   requires the deletion of an already existing non-array parent value. If
+ *   FALSE, PHP throws an error if trying to add into a value that is not an
+ *   array. Defaults to FALSE.
  *
  * @see drupal_array_get_nested_value()
  */
-function drupal_array_set_nested_value(array &$array, array $parents, $value) {
+function drupal_array_set_nested_value(array &$array, array $parents, $value, $force = FALSE) {
   $ref = &$array;
   foreach ($parents as $parent) {
-    // Note that PHP is fine with referencing a not existing array key - in this
-    // case it just creates an entry with NULL as value.
+    // PHP auto-creates container arrays and NULL entries without error if $ref
+    // is NULL, but throws an error if $ref is set, but not an array.
+    if ($force && isset($ref) && !is_array($ref)) {
+      $ref = array();
+    }
     $ref = &$ref[$parent];
   }
   $ref = $value;
@@ -6040,10 +6048,7 @@ function drupal_array_set_nested_value(a
 function drupal_array_get_nested_value(array &$array, array $parents, &$key_exists = NULL) {
   $ref = &$array;
   foreach ($parents as $parent) {
-    // array_key_exists() is slower than isset() and triggers notices if the
-    // second argument is not an array, so only call it when absolutely
-    // necessary.
-    if (isset($ref[$parent]) || (is_array($ref) && array_key_exists($parent, $ref))) {
+    if (is_array($ref) && array_key_exists($parent, $ref)) {
       $ref = &$ref[$parent];
     }
     else {
Index: includes/form.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/form.inc,v
retrieving revision 1.508
diff -u -p -r1.508 form.inc
--- includes/form.inc	7 Nov 2010 21:46:09 -0000	1.508
+++ includes/form.inc	10 Nov 2010 22:35:39 -0000
@@ -1031,10 +1031,29 @@ function drupal_validate_form($form_id, 
         drupal_array_set_nested_value($values, $section, $value);
       }
     }
-    // For convenience we always make the value of the pressed button available.
+    // A button's #value does not require validation, so for convenience we
+    // allow the value of the clicked button to be retained in its normal
+    // $form_state['values'] locations, even if these locations are not included
+    // in #limit_validation_errors.
     if (isset($form_state['triggering_element']['#button_type'])) {
-      $values[$form_state['triggering_element']['#name']] = $form_state['triggering_element']['#value'];
-      drupal_array_set_nested_value($values, $form_state['triggering_element']['#parents'], $form_state['triggering_element']['#value']);
+      $button_value = $form_state['triggering_element']['#value'];
+
+      // Like all input controls, the button value may be in the location
+      // dictated by #parents. If it is, copy it to $values, but do not override
+      // what may already be in $values.
+      $parents = $form_state['triggering_element']['#parents'];
+      if (!drupal_array_nested_key_exists($values, $parents) && drupal_array_get_nested_value($form_state['values'], $parents) === $button_value) {
+        drupal_array_set_nested_value($values, $parents, $button_value);
+      }
+
+      // Additionally, form_builder() places the button value in
+      // $form_state['values'][BUTTON_NAME]. If it's still there, after
+      // validation handlers have run, copy it to $values, but do not override
+      // what may already be in $values.
+      $name = $form_state['triggering_element']['#name'];
+      if (!isset($values[$name]) && isset($form_state['values'][$name]) && $form_state['values'][$name] === $button_value) {
+        $values[$name] = $button_value;
+      }
     }
     $form_state['values'] = $values;
   }
@@ -2301,7 +2320,7 @@ function form_type_token_value($element,
  *   Form state array where the value change should be recorded.
  */
 function form_set_value($element, $value, &$form_state) {
-  drupal_array_set_nested_value($form_state['values'], $element['#parents'], $value);
+  drupal_array_set_nested_value($form_state['values'], $element['#parents'], $value, TRUE);
 }
 
 /**
Index: modules/file/file.field.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/file/file.field.inc,v
retrieving revision 1.38
diff -u -p -r1.38 file.field.inc
--- modules/file/file.field.inc	31 Oct 2010 12:12:00 -0000	1.38
+++ modules/file/file.field.inc	10 Nov 2010 22:35:40 -0000
@@ -648,8 +648,9 @@ function file_field_widget_process($elem
   // Adjust the AJAX settings so that on upload and remove of any individual
   // file, the entire group of file fields is updated together.
   if ($field['cardinality'] != 1) {
-    $new_path = preg_replace('/\/\d+\//', '/', $element['remove_button']['#ajax']['path'], 1);
-    $field_element = drupal_array_get_nested_value($form, array_slice($element['#array_parents'], 0, -1));
+    $parents = array_slice($element['#array_parents'], 0, -1);
+    $new_path = 'file/ajax/' . implode('/', $parents) . '/' . $form['form_build_id']['#value'];
+    $field_element = drupal_array_get_nested_value($form, $parents);
     $new_wrapper = $field_element['#id'] . '-ajax-wrapper';
     foreach (element_children($element) as $key) {
       if (isset($element[$key]['#ajax'])) {
Index: modules/file/file.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/file/file.module,v
retrieving revision 1.45
diff -u -p -r1.45 file.module
--- modules/file/file.module	20 Oct 2010 15:22:53 -0000	1.45
+++ modules/file/file.module	10 Nov 2010 22:35:40 -0000
@@ -360,7 +360,7 @@ function file_managed_file_process($elem
   $element['#tree'] = TRUE;
 
   $ajax_settings = array(
-    'path' => 'file/ajax/' . implode('/', $element['#parents']) . '/' . $form['form_build_id']['#value'],
+    'path' => 'file/ajax/' . implode('/', $element['#array_parents']) . '/' . $form['form_build_id']['#value'],
     'wrapper' => $element['#id'] . '-ajax-wrapper',
     'effect' => 'fade',
     'progress' => array(
Index: modules/file/tests/file.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/file/tests/file.test,v
retrieving revision 1.27
diff -u -p -r1.27 file.test
--- modules/file/tests/file.test	20 Oct 2010 15:22:53 -0000	1.27
+++ modules/file/tests/file.test	10 Nov 2010 22:35:41 -0000
@@ -13,7 +13,7 @@ class FileFieldTestCase extends DrupalWe
   protected $admin_user;
 
   function setUp() {
-    parent::setUp('file');
+    parent::setUp(array('file', 'file_module_test'));
     $this->admin_user = $this->drupalCreateUser(array('access content', 'access administration pages', 'administer site configuration', 'administer users', 'administer permissions', 'administer content types', 'administer nodes', 'bypass node access'));
     $this->drupalLogin($this->admin_user);
   }
@@ -201,6 +201,27 @@ class FileFieldTestCase extends DrupalWe
   }
 }
 
+/**
+ * Test that nested file element works.
+ */
+class NestedFileWidgetTestCase extends FileFieldTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'Nest file widget upload test',
+      'description' => 'Tests the file field widget when nested in a form.',
+      'group' => 'File',
+    );
+  }
+
+  public function testNestedFileWidget() {
+    $test_file = $this->getTestFile('image');
+    $result = $this->drupalPostAJAX('file/test', array('files[file]' => drupal_realpath($test_file->uri)), 'file_upload_button');
+    $this->drupalPost('file/test', array('file[fid]' => 1), t('Save'));
+    $file = file_load(1);
+    $this->assertFileExists($file, t('New file, uploaded via ajax widget, saved to disk.'));
+    $this->assertEqual($file->status, FILE_STATUS_PERMANENT, t('New file is set to permanent.'));
+  }
+}
 
 /**
  * Test class to test file field widget, single and multi-valued, with and without AJAX, with public and private files.
Index: modules/file/tests/file_module_test.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/file/tests/file_module_test.module,v
retrieving revision 1.3
diff -u -p -r1.3 file_module_test.module
--- modules/file/tests/file_module_test.module	4 Dec 2009 16:49:46 -0000	1.3
+++ modules/file/tests/file_module_test.module	10 Nov 2010 22:35:41 -0000
@@ -11,36 +11,43 @@
  */
 function file_module_test_menu() {
   $items = array();
-
   $items['file/test'] = array(
     'title' => 'Managed file test',
     'page callback' => 'drupal_get_form',
     'page arguments' => array('file_module_test_form'),
     'access arguments' => array('access content'),
   );
-
   return $items;
 }
 
+/**
+ * Provides a simple form to test file widgets not at the top level of a form.
+ */
 function file_module_test_form($form, $form_state) {
-  $form['#tree'] = TRUE;
-
-  $form['file'] = array(
+  $form['nested'] = array(
+    '#type' => 'fieldset',
+    '#title' => 'Managed file within',
+  );
+  $form['nested']['file'] = array(
     '#type' => 'managed_file',
-    '#title' => t('Managed file'),
+    '#title' => 'Managed file',
     '#upload_location' => 'public://test',
-    '#progress_message' => t('Please wait...'),
-  );
-
-  $form['textfield'] = array(
-    '#type' => 'textfield',
-    '#title' => t('Type a value and ensure it stays'),
+    '#progress_message' => 'Please wait...',
   );
-
   $form['submit'] = array(
     '#type' => 'submit',
     '#value' => t('Save'),
   );
-
   return $form;
 }
+
+/**
+ * Test submit handler.
+ */
+function file_module_test_form_submit($form, $form_state) {
+  // TODO: this is surely not the right way to do this.
+  $file = file_load($form_state['values']['file']);
+  $file->status = FILE_STATUS_PERMANENT;
+  file_save($file);
+}
+
Index: modules/simpletest/drupal_web_test_case.php
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/drupal_web_test_case.php,v
retrieving revision 1.246
diff -u -p -r1.246 drupal_web_test_case.php
--- modules/simpletest/drupal_web_test_case.php	31 Oct 2010 13:08:29 -0000	1.246
+++ modules/simpletest/drupal_web_test_case.php	10 Nov 2010 22:35:43 -0000
@@ -1801,6 +1801,39 @@ class DrupalWebTestCase extends DrupalTe
    * array of commands, to update $this->content using equivalent DOM
    * manipulation as is used by ajax.js. It also returns the array of commands.
    *
+   * @param $path
+   *   Location of the form containing the AJAX enabled element to test. Can be
+   *   either a Drupal path or an absolute path or NULL to use the current page.
+   * @param $edit
+   *   Field data in an associative array. Changes the current input fields
+   *   (where possible) to the values indicated.
+   * @param $triggering_element
+   *   The name of the form element that is responsible for triggering the AJAX
+   *   functionality to test. May be a string or, if the triggering element is
+   *   a button, an associative array where the key is the name of the button
+   *   and the value is the button label. i.e.) array('op' => t('Refresh')).
+   * @param $ajax_path
+   *   (optional) Override the path set by the AJAX settings of the triggering
+   *   element. In the absence of both the triggering element's AJAX path and
+   *   $ajax_path 'system/ajax' will be used.
+   * @param $options
+   *   (optional) Options to be forwarded to url().
+   * @param $headers
+   *   (optional) An array containing additional HTTP request headers, each
+   *   formatted as "name: value". Forwarded to drupalPost().
+   * @param $form_html_id
+   *   (optional) HTML ID of the form to be submitted, use when there is more
+   *   than one identical form on the same page and the value of the triggering
+   *   element is not enough to identify the form. Note this is not the Drupal
+   *   ID of the form but rather the HTML ID of the form.
+   * @param $ajax_settings
+   *   (optional) An array of AJAX settings which if specified will be used in
+   *   place of the AJAX settings of the triggering element.
+   *
+   * @return
+   *   An array of AJAX commands.
+   *
+   * @see drupalPost()
    * @see ajax.js
    */
   protected function drupalPostAJAX($path, $edit, $triggering_element, $ajax_path = NULL, array $options = array(), array $headers = array(), $form_html_id = NULL, $ajax_settings = NULL) {