path: root/roff.c

/* $Id$ */
/*
 * Copyright (c) 2010-2015, 2017-2022 Ingo Schwarze <schwarze@openbsd.org>
 * Copyright (c) 2008-2012, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 *
 * Implementation of the roff(7) parser for mandoc(1).
 */
#include "config.h"

#include <sys/types.h>

#include <assert.h>
#include <ctype.h>
#include <limits.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "mandoc_aux.h"
#include "mandoc_ohash.h"
#include "mandoc.h"
#include "roff.h"
#include "mandoc_parse.h"
#include "libmandoc.h"
#include "roff_int.h"
#include "tbl_parse.h"
#include "eqn_parse.h"

/* Maximum number of string expansions per line, to break infinite loops. */
#define	EXPAND_LIMIT	1000

/* Types of definitions of macros and strings. */
#define	ROFFDEF_USER	(1 << 1)  /* User-defined. */
#define	ROFFDEF_PRE	(1 << 2)  /* Predefined. */
#define	ROFFDEF_REN	(1 << 3)  /* Renamed standard macro. */
#define	ROFFDEF_STD	(1 << 4)  /* mdoc(7) or man(7) macro. */
#define	ROFFDEF_ANY	(ROFFDEF_USER | ROFFDEF_PRE | \
			 ROFFDEF_REN | ROFFDEF_STD)
#define	ROFFDEF_UNDEF	(1 << 5)  /* Completely undefined. */

/* --- data types --------------------------------------------------------- */

/*
 * An incredibly-simple string buffer.
 */
struct	roffstr {
	char		*p; /* nil-terminated buffer */
	size_t		 sz; /* saved strlen(p) */
};

/*
 * A key-value roffstr pair as part of a singly-linked list.
 */
struct	roffkv {
	struct roffstr	 key;
	struct roffstr	 val;
	struct roffkv	*next; /* next in list */
};

/*
 * A single number register as part of a singly-linked list.
 */
struct	roffreg {
	struct roffstr	 key;
	int		 val;
	int		 step;
	struct roffreg	*next;
};

/*
 * Association of request and macro names with token IDs.
 */
struct	roffreq {
	enum roff_tok	 tok;
	char		 name[];
};

/*
 * A macro processing context.
 * More than one is needed when macro calls are nested.
 */
struct	mctx {
	char		**argv;
	int		 argc;
	int		 argsz;
};

struct	roff {
	struct roff_man	*man; /* mdoc or man parser */
	struct roffnode	*last; /* leaf of stack */
	struct mctx	*mstack; /* stack of macro contexts */
	int		*rstack; /* stack of inverted `ie' values */
	struct ohash	*reqtab; /* request lookup table */
	struct roffreg	*regtab; /* number registers */
	struct roffkv	*strtab; /* user-defined strings & macros */
	struct roffkv	*rentab; /* renamed strings & macros */
	struct roffkv	*xmbtab; /* multi-byte trans table (`tr') */
	struct roffstr	*xtab; /* single-byte trans table (`tr') */
	const char	*current_string; /* value of last called user macro */
	struct tbl_node	*first_tbl; /* first table parsed */
	struct tbl_node	*last_tbl; /* last table parsed */
	struct tbl_node	*tbl; /* current table being parsed */
	struct eqn_node	*last_eqn; /* equation parser */
	struct eqn_node	*eqn; /* active equation parser */
	int		 eqn_inline; /* current equation is inline */
	int		 options; /* parse options */
	int		 mstacksz; /* current size of mstack */
	int		 mstackpos; /* position in mstack */
	int		 rstacksz; /* current size limit of rstack */
	int		 rstackpos; /* position in rstack */
	int		 format; /* current file in mdoc or man format */
	char		 control; /* control character */
	char		 escape; /* escape character */
};

/*
 * A macro definition, condition, or ignored block.
 */
struct	roffnode {
	enum roff_tok	 tok; /* type of node */
	struct roffnode	*parent; /* up one in stack */
	int		 line; /* parse line */
	int		 col; /* parse col */
	char		*name; /* node name, e.g. macro name */
	char		*end; /* custom end macro of the block */
	int		 endspan; /* scope to: 1=eol 2=next line -1=\} */
	int		 rule; /* content is: 1=evaluated 0=skipped */
};

#define	ROFF_ARGS	 struct roff *r, /* parse ctx */ \
			 enum roff_tok tok, /* tok of macro */ \
			 struct buf *buf, /* input buffer */ \
			 int ln, /* parse line */ \
			 int ppos, /* original pos in buffer */ \
			 int pos, /* current pos in buffer */ \
			 int *offs /* reset offset of buffer data */

typedef	int (*roffproc)(ROFF_ARGS);

struct	roffmac {
	roffproc	 proc; /* process new macro */
	roffproc	 text; /* process as child text of macro */
	roffproc	 sub; /* process as child of macro */
	int		 flags;
#define	ROFFMAC_STRUCT	(1 << 0) /* always interpret */
};

struct	predef {
	const char	*name; /* predefined input name */
	const char	*str; /* replacement symbol */
};

#define	PREDEF(__name, __str) \
	{ (__name), (__str) },

/* --- function prototypes ------------------------------------------------ */

static	int		 roffnode_cleanscope(struct roff *);
static	int		 roffnode_pop(struct roff *);
static	void		 roffnode_push(struct roff *, enum roff_tok,
				const char *, int, int);
static	void		 roff_addtbl(struct roff_man *, int, struct tbl_node *);
static	int		 roff_als(ROFF_ARGS);
static	int		 roff_block(ROFF_ARGS);
static	int		 roff_block_text(ROFF_ARGS);
static	int		 roff_block_sub(ROFF_ARGS);
static	int		 roff_break(ROFF_ARGS);
static	int		 roff_cblock(ROFF_ARGS);
static	int		 roff_cc(ROFF_ARGS);
static	int		 roff_ccond(struct roff *, int, int);
static	int		 roff_char(ROFF_ARGS);
static	int		 roff_cond(ROFF_ARGS);
static	int		 roff_cond_checkend(ROFF_ARGS);
static	int		 roff_cond_text(ROFF_ARGS);
static	int		 roff_cond_sub(ROFF_ARGS);
static	int		 roff_ds(ROFF_ARGS);
static	int		 roff_ec(ROFF_ARGS);
static	int		 roff_eo(ROFF_ARGS);
static	int		 roff_eqndelim(struct roff *, struct buf *, int);
static	int		 roff_evalcond(struct roff *, int, char *, int *);
static	int		 roff_evalnum(struct roff *, int,
				const char *, int *, int *, int);
static	int		 roff_evalpar(struct roff *, int,
				const char *, int *, int *, int);
static	int		 roff_evalstrcond(const char *, int *);
static	int		 roff_expand(struct roff *, struct buf *,
				int, int, char);
static	void		 roff_expand_patch(struct buf *, int,
				const char *, int);
static	void		 roff_free1(struct roff *);
static	void		 roff_freereg(struct roffreg *);
static	void		 roff_freestr(struct roffkv *);
static	size_t		 roff_getname(struct roff *, char **, int, int);
static	int		 roff_getnum(const char *, int *, int *, int);
static	int		 roff_getop(const char *, int *, char *);
static	int		 roff_getregn(struct roff *,
				const char *, size_t, char);
static	int		 roff_getregro(const struct roff *,
				const char *name);
static	const char	*roff_getstrn(struct roff *,
				const char *, size_t, int *);
static	int		 roff_hasregn(const struct roff *,
				const char *, size_t);
static	int		 roff_insec(ROFF_ARGS);
static	int		 roff_it(ROFF_ARGS);
static	int		 roff_line_ignore(ROFF_ARGS);
static	void		 roff_man_alloc1(struct roff_man *);
static	void		 roff_man_free1(struct roff_man *);
static	int		 roff_manyarg(ROFF_ARGS);
static	int		 roff_mc(ROFF_ARGS);
static	int		 roff_noarg(ROFF_ARGS);
static	int		 roff_nop(ROFF_ARGS);
static	int		 roff_nr(ROFF_ARGS);
static	int		 roff_onearg(ROFF_ARGS);
static	enum roff_tok	 roff_parse(struct roff *, char *, int *,
				int, int);
static	int		 roff_parse_comment(struct roff *, struct buf *,
				int, int, char);
static	int		 roff_parsetext(struct roff *, struct buf *,
				int, int *);
static	int		 roff_renamed(ROFF_ARGS);
static	int		 roff_req_or_macro(ROFF_ARGS);
static	int		 roff_return(ROFF_ARGS);
static	int		 roff_rm(ROFF_ARGS);
static	int		 roff_rn(ROFF_ARGS);
static	int		 roff_rr(ROFF_ARGS);
static	void		 roff_setregn(struct roff *, const char *,
				size_t, int, char, int);
static	void		 roff_setstr(struct roff *,
				const char *, const char *, int);
static	void		 roff_setstrn(struct roffkv **, const char *,
				size_t, const char *, size_t, int);
static	int		 roff_shift(ROFF_ARGS);
static	int		 roff_so(ROFF_ARGS);
static	int		 roff_tr(ROFF_ARGS);
static	int		 roff_Dd(ROFF_ARGS);
static	int		 roff_TE(ROFF_ARGS);
static	int		 roff_TS(ROFF_ARGS);
static	int		 roff_EQ(ROFF_ARGS);
static	int		 roff_EN(ROFF_ARGS);
static	int		 roff_T_(ROFF_ARGS);
static	int		 roff_unsupp(ROFF_ARGS);
static	int		 roff_userdef(ROFF_ARGS);

/* --- constant data ------------------------------------------------------ */

#define	ROFFNUM_SCALE	(1 << 0)  /* Honour scaling in roff_getnum(). */
#define	ROFFNUM_WHITE	(1 << 1)  /* Skip whitespace in roff_evalnum(). */

const char *__roff_name[MAN_MAX + 1] = {
	"br",		"ce",		"fi",		"ft",
	"ll",		"mc",		"nf",
	"po",		"rj",		"sp",
	"ta",		"ti",		NULL,
	"ab",		"ad",		"af",		"aln",
	"als",		"am",		"am1",		"ami",
	"ami1",		"as",		"as1",		"asciify",
	"backtrace",	"bd",		"bleedat",	"blm",
        "box",		"boxa",		"bp",		"BP",
	"break",	"breakchar",	"brnl",		"brp",
	"brpnl",	"c2",		"cc",
	"cf",		"cflags",	"ch",		"char",
	"chop",		"class",	"close",	"CL",
	"color",	"composite",	"continue",	"cp",
	"cropat",	"cs",		"cu",		"da",
	"dch",		"Dd",		"de",		"de1",
	"defcolor",	"dei",		"dei1",		"device",
	"devicem",	"di",		"do",		"ds",
	"ds1",		"dwh",		"dt",		"ec",
	"ecr",		"ecs",		"el",		"em",
	"EN",		"eo",		"EP",		"EQ",
	"errprint",	"ev",		"evc",		"ex",
	"fallback",	"fam",		"fc",		"fchar",
	"fcolor",	"fdeferlig",	"feature",	"fkern",
	"fl",		"flig",		"fp",		"fps",
	"fschar",	"fspacewidth",	"fspecial",	"ftr",
	"fzoom",	"gcolor",	"hc",		"hcode",
	"hidechar",	"hla",		"hlm",		"hpf",
	"hpfa",		"hpfcode",	"hw",		"hy",
	"hylang",	"hylen",	"hym",		"hypp",
	"hys",		"ie",		"if",		"ig",
	"index",	"it",		"itc",		"IX",
	"kern",		"kernafter",	"kernbefore",	"kernpair",
	"lc",		"lc_ctype",	"lds",		"length",
	"letadj",	"lf",		"lg",		"lhang",
	"linetabs",	"lnr",		"lnrf",		"lpfx",
	"ls",		"lsm",		"lt",
	"mediasize",	"minss",	"mk",		"mso",
	"na",		"ne",		"nh",		"nhychar",
	"nm",		"nn",		"nop",		"nr",
	"nrf",		"nroff",	"ns",		"nx",
	"open",		"opena",	"os",		"output",
	"padj",		"papersize",	"pc",		"pev",
	"pi",		"PI",		"pl",		"pm",
	"pn",		"pnr",		"ps",
	"psbb",		"pshape",	"pso",		"ptr",
	"pvs",		"rchar",	"rd",		"recursionlimit",
	"return",	"rfschar",	"rhang",
	"rm",		"rn",		"rnn",		"rr",
	"rs",		"rt",		"schar",	"sentchar",
	"shc",		"shift",	"sizes",	"so",
	"spacewidth",	"special",	"spreadwarn",	"ss",
	"sty",		"substring",	"sv",		"sy",
	"T&",		"tc",		"TE",
	"TH",		"tkf",		"tl",
	"tm",		"tm1",		"tmc",		"tr",
	"track",	"transchar",	"trf",		"trimat",
	"trin",		"trnt",		"troff",	"TS",
	"uf",		"ul",		"unformat",	"unwatch",
	"unwatchn",	"vpt",		"vs",		"warn",
	"warnscale",	"watch",	"watchlength",	"watchn",
	"wh",		"while",	"write",	"writec",
	"writem",	"xflag",	".",		NULL,
	NULL,		"text",
	"Dd",		"Dt",		"Os",		"Sh",
	"Ss",		"Pp",		"D1",		"Dl",
	"Bd",		"Ed",		"Bl",		"El",
	"It",		"Ad",		"An",		"Ap",
	"Ar",		"Cd",		"Cm",		"Dv",
	"Er",		"Ev",		"Ex",		"Fa",
	"Fd",		"Fl",		"Fn",		"Ft",
	"Ic",		"In",		"Li",		"Nd",
	"Nm",		"Op",		"Ot",		"Pa",
	"Rv",		"St",		"Va",		"Vt",
	"Xr",		"%A",		"%B",		"%D",
	"%I",		"%J",		"%N",		"%O",
	"%P",		"%R",		"%T",		"%V",
	"Ac",		"Ao",		"Aq",		"At",
	"Bc",		"Bf",		"Bo",		"Bq",
	"Bsx",		"Bx",		"Db",		"Dc",
	"Do",		"Dq",		"Ec",		"Ef",
	"Em",		"Eo",		"Fx",		"Ms",
	"No",		"Ns",		"Nx",		"Ox",
	"Pc",		"Pf",		"Po",		"Pq",
	"Qc",		"Ql",		"Qo",		"Qq",
	"Re",		"Rs",		"Sc",		"So",
	"Sq",		"Sm",		"Sx",		"Sy",
	"Tn",		"Ux",		"Xc",		"Xo",
	"Fo",		"Fc",		"Oo",		"Oc",
	"Bk",		"Ek",		"Bt",		"Hf",
	"Fr",		"Ud",		"Lb",		"Lp",
	"Lk",		"Mt",		"Brq",		"Bro",
	"Brc",		"%C",		"Es",		"En",
	"Dx",		"%Q",		"%U",		"Ta",
	"Tg",		NULL,
	"TH",		"SH",		"SS",		"TP",
	"TQ",
	"LP",		"PP",		"P",		"IP",
	"HP",		"SM",		"SB",		"BI",
	"IB",		"BR",		"RB",		"R",
	"B",		"I",		"IR",		"RI",
	"RE",		"RS",		"DT",		"UC",
	"PD",		"AT",		"in",
	"SY",		"YS",		"OP",
	"EX",		"EE",		"UR",
	"UE",		"MT",		"ME",		NULL
};
const	char *const *roff_name = __roff_name;

static	struct roffmac	 roffs[TOKEN_NONE] = {
	{ roff_noarg, NULL, NULL, 0 },  /* br */
	{ roff_onearg, NULL, NULL, 0 },  /* ce */
	{ roff_noarg, NULL, NULL, 0 },  /* fi */
	{ roff_onearg, NULL, NULL, 0 },  /* ft */
	{ roff_onearg, NULL, NULL, 0 },  /* ll */
	{ roff_mc, NULL, NULL, 0 },  /* mc */
	{ roff_noarg, NULL, NULL, 0 },  /* nf */
	{ roff_onearg, NULL, NULL, 0 },  /* po */
	{ roff_onearg, NULL, NULL, 0 },  /* rj */
	{ roff_onearg, NULL, NULL, 0 },  /* sp */
	{ roff_manyarg, NULL, NULL, 0 },  /* ta */
	{ roff_onearg, NULL, NULL, 0 },  /* ti */
	{ NULL, NULL, NULL, 0 },  /* ROFF_MAX */
	{ roff_unsupp, NULL, NULL, 0 },  /* ab */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ad */
	{ roff_line_ignore, NULL, NULL, 0 },  /* af */
	{ roff_unsupp, NULL, NULL, 0 },  /* aln */
	{ roff_als, NULL, NULL, 0 },  /* als */
	{ roff_block, roff_block_text, roff_block_sub, 0 },  /* am */
	{ roff_block, roff_block_text, roff_block_sub, 0 },  /* am1 */
	{ roff_block, roff_block_text, roff_block_sub, 0 },  /* ami */
	{ roff_block, roff_block_text, roff_block_sub, 0 },  /* ami1 */
	{ roff_ds, NULL, NULL, 0 },  /* as */
	{ roff_ds, NULL, NULL, 0 },  /* as1 */
	{ roff_unsupp, NULL, NULL, 0 },  /* asciify */
	{ roff_line_ignore, NULL, NULL, 0 },  /* backtrace */
	{ roff_line_ignore, NULL, NULL, 0 },  /* bd */
	{ roff_line_ignore, NULL, NULL, 0 },  /* bleedat */
	{ roff_unsupp, NULL, NULL, 0 },  /* blm */
	{ roff_unsupp, NULL, NULL, 0 },  /* box */
	{ roff_unsupp, NULL, NULL, 0 },  /* boxa */
	{ roff_line_ignore, NULL, NULL, 0 },  /* bp */
	{ roff_unsupp, NULL, NULL, 0 },  /* BP */
	{ roff_break, NULL, NULL, 0 },  /* break */
	{ roff_line_ignore, NULL, NULL, 0 },  /* breakchar */
	{ roff_line_ignore, NULL, NULL, 0 },  /* brnl */
	{ roff_noarg, NULL, NULL, 0 },  /* brp */
	{ roff_line_ignore, NULL, NULL, 0 },  /* brpnl */
	{ roff_unsupp, NULL, NULL, 0 },  /* c2 */
	{ roff_cc, NULL, NULL, 0 },  /* cc */
	{ roff_insec, NULL, NULL, 0 },  /* cf */
	{ roff_line_ignore, NULL, NULL, 0 },  /* cflags */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ch */
	{ roff_char, NULL, NULL, 0 },  /* char */
	{ roff_unsupp, NULL, NULL, 0 },  /* chop */
	{ roff_line_ignore, NULL, NULL, 0 },  /* class */
	{ roff_insec, NULL, NULL, 0 },  /* close */
	{ roff_unsupp, NULL, NULL, 0 },  /* CL */
	{ roff_line_ignore, NULL, NULL, 0 },  /* color */
	{ roff_unsupp, NULL, NULL, 0 },  /* composite */
	{ roff_unsupp, NULL, NULL, 0 },  /* continue */
	{ roff_line_ignore, NULL, NULL, 0 },  /* cp */
	{ roff_line_ignore, NULL, NULL, 0 },  /* cropat */
	{ roff_line_ignore, NULL, NULL, 0 },  /* cs */
	{ roff_line_ignore, NULL, NULL, 0 },  /* cu */
	{ roff_unsupp, NULL, NULL, 0 },  /* da */
	{ roff_unsupp, NULL, NULL, 0 },  /* dch */
	{ roff_Dd, NULL, NULL, 0 },  /* Dd */
	{ roff_block, roff_block_text, roff_block_sub, 0 },  /* de */
	{ roff_block, roff_block_text, roff_block_sub, 0 },  /* de1 */
	{ roff_line_ignore, NULL, NULL, 0 },  /* defcolor */
	{ roff_block, roff_block_text, roff_block_sub, 0 },  /* dei */
	{ roff_block, roff_block_text, roff_block_sub, 0 },  /* dei1 */
	{ roff_unsupp, NULL, NULL, 0 },  /* device */
	{ roff_unsupp, NULL, NULL, 0 },  /* devicem */
	{ roff_unsupp, NULL, NULL, 0 },  /* di */
	{ roff_unsupp, NULL, NULL, 0 },  /* do */
	{ roff_ds, NULL, NULL, 0 },  /* ds */
	{ roff_ds, NULL, NULL, 0 },  /* ds1 */
	{ roff_unsupp, NULL, NULL, 0 },  /* dwh */
	{ roff_unsupp, NULL, NULL, 0 },  /* dt */
	{ roff_ec, NULL, NULL, 0 },  /* ec */
	{ roff_unsupp, NULL, NULL, 0 },  /* ecr */
	{ roff_unsupp, NULL, NULL, 0 },  /* ecs */
	{ roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT },  /* el */
	{ roff_unsupp, NULL, NULL, 0 },  /* em */
	{ roff_EN, NULL, NULL, 0 },  /* EN */
	{ roff_eo, NULL, NULL, 0 },  /* eo */
	{ roff_unsupp, NULL, NULL, 0 },  /* EP */
	{ roff_EQ, NULL, NULL, 0 },  /* EQ */
	{ roff_line_ignore, NULL, NULL, 0 },  /* errprint */
	{ roff_unsupp, NULL, NULL, 0 },  /* ev */
	{ roff_unsupp, NULL, NULL, 0 },  /* evc */
	{ roff_unsupp, NULL, NULL, 0 },  /* ex */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fallback */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fam */
	{ roff_unsupp, NULL, NULL, 0 },  /* fc */
	{ roff_unsupp, NULL, NULL, 0 },  /* fchar */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fcolor */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fdeferlig */
	{ roff_line_ignore, NULL, NULL, 0 },  /* feature */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fkern */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fl */
	{ roff_line_ignore, NULL, NULL, 0 },  /* flig */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fp */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fps */
	{ roff_unsupp, NULL, NULL, 0 },  /* fschar */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fspacewidth */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fspecial */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ftr */
	{ roff_line_ignore, NULL, NULL, 0 },  /* fzoom */
	{ roff_line_ignore, NULL, NULL, 0 },  /* gcolor */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hc */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hcode */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hidechar */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hla */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hlm */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hpf */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hpfa */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hpfcode */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hw */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hy */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hylang */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hylen */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hym */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hypp */
	{ roff_line_ignore, NULL, NULL, 0 },  /* hys */
	{ roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT },  /* ie */
	{ roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT },  /* if */
	{ roff_block, roff_block_text, roff_block_sub, 0 },  /* ig */
	{ roff_unsupp, NULL, NULL, 0 },  /* index */
	{ roff_it, NULL, NULL, 0 },  /* it */
	{ roff_unsupp, NULL, NULL, 0 },  /* itc */
	{ roff_line_ignore, NULL, NULL, 0 },  /* IX */
	{ roff_line_ignore, NULL, NULL, 0 },  /* kern */
	{ roff_line_ignore, NULL, NULL, 0 },  /* kernafter */
	{ roff_line_ignore, NULL, NULL, 0 },  /* kernbefore */
	{ roff_line_ignore, NULL, NULL, 0 },  /* kernpair */
	{ roff_unsupp, NULL, NULL, 0 },  /* lc */
	{ roff_unsupp, NULL, NULL, 0 },  /* lc_ctype */
	{ roff_unsupp, NULL, NULL, 0 },  /* lds */
	{ roff_unsupp, NULL, NULL, 0 },  /* length */
	{ roff_line_ignore, NULL, NULL, 0 },  /* letadj */
	{ roff_insec, NULL, NULL, 0 },  /* lf */
	{ roff_line_ignore, NULL, NULL, 0 },  /* lg */
	{ roff_line_ignore, NULL, NULL, 0 },  /* lhang */
	{ roff_unsupp, NULL, NULL, 0 },  /* linetabs */
	{ roff_unsupp, NULL, NULL, 0 },  /* lnr */
	{ roff_unsupp, NULL, NULL, 0 },  /* lnrf */
	{ roff_unsupp, NULL, NULL, 0 },  /* lpfx */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ls */
	{ roff_unsupp, NULL, NULL, 0 },  /* lsm */
	{ roff_line_ignore, NULL, NULL, 0 },  /* lt */
	{ roff_line_ignore, NULL, NULL, 0 },  /* mediasize */
	{ roff_line_ignore, NULL, NULL, 0 },  /* minss */
	{ roff_line_ignore, NULL, NULL, 0 },  /* mk */
	{ roff_insec, NULL, NULL, 0 },  /* mso */
	{ roff_line_ignore, NULL, NULL, 0 },  /* na */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ne */
	{ roff_line_ignore, NULL, NULL, 0 },  /* nh */
	{ roff_line_ignore, NULL, NULL, 0 },  /* nhychar */
	{ roff_unsupp, NULL, NULL, 0 },  /* nm */
	{ roff_unsupp, NULL, NULL, 0 },  /* nn */
	{ roff_nop, NULL, NULL, 0 },  /* nop */
	{ roff_nr, NULL, NULL, 0 },  /* nr */
	{ roff_unsupp, NULL, NULL, 0 },  /* nrf */
	{ roff_line_ignore, NULL, NULL, 0 },  /* nroff */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ns */
	{ roff_insec, NULL, NULL, 0 },  /* nx */
	{ roff_insec, NULL, NULL, 0 },  /* open */
	{ roff_insec, NULL, NULL, 0 },  /* opena */
	{ roff_line_ignore, NULL, NULL, 0 },  /* os */
	{ roff_unsupp, NULL, NULL, 0 },  /* output */
	{ roff_line_ignore, NULL, NULL, 0 },  /* padj */
	{ roff_line_ignore, NULL, NULL, 0 },  /* papersize */
	{ roff_line_ignore, NULL, NULL, 0 },  /* pc */
	{ roff_line_ignore, NULL, NULL, 0 },  /* pev */
	{ roff_insec, NULL, NULL, 0 },  /* pi */
	{ roff_unsupp, NULL, NULL, 0 },  /* PI */
	{ roff_line_ignore, NULL, NULL, 0 },  /* pl */
	{ roff_line_ignore, NULL, NULL, 0 },  /* pm */
	{ roff_line_ignore, NULL, NULL, 0 },  /* pn */
	{ roff_line_ignore, NULL, NULL, 0 },  /* pnr */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ps */
	{ roff_unsupp, NULL, NULL, 0 },  /* psbb */
	{ roff_unsupp, NULL, NULL, 0 },  /* pshape */
	{ roff_insec, NULL, NULL, 0 },  /* pso */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ptr */
	{ roff_line_ignore, NULL, NULL, 0 },  /* pvs */
	{ roff_unsupp, NULL, NULL, 0 },  /* rchar */
	{ roff_line_ignore, NULL, NULL, 0 },  /* rd */
	{ roff_line_ignore, NULL, NULL, 0 },  /* recursionlimit */
	{ roff_return, NULL, NULL, 0 },  /* return */
	{ roff_unsupp, NULL, NULL, 0 },  /* rfschar */
	{ roff_line_ignore, NULL, NULL, 0 },  /* rhang */
	{ roff_rm, NULL, NULL, 0 },  /* rm */
	{ roff_rn, NULL, NULL, 0 },  /* rn */
	{ roff_unsupp, NULL, NULL, 0 },  /* rnn */
	{ roff_rr, NULL, NULL, 0 },  /* rr */
	{ roff_line_ignore, NULL, NULL, 0 },  /* rs */
	{ roff_line_ignore, NULL, NULL, 0 },  /* rt */
	{ roff_unsupp, NULL, NULL, 0 },  /* schar */
	{ roff_line_ignore, NULL, NULL, 0 },  /* sentchar */
	{ roff_line_ignore, NULL, NULL, 0 },  /* shc */
	{ roff_shift, NULL, NULL, 0 },  /* shift */
	{ roff_line_ignore, NULL, NULL, 0 },  /* sizes */
	{ roff_so, NULL, NULL, 0 },  /* so */
	{ roff_line_ignore, NULL, NULL, 0 },  /* spacewidth */
	{ roff_line_ignore, NULL, NULL, 0 },  /* special */
	{ roff_line_ignore, NULL, NULL, 0 },  /* spreadwarn */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ss */
	{ roff_line_ignore, NULL, NULL, 0 },  /* sty */
	{ roff_unsupp, NULL, NULL, 0 },  /* substring */
	{ roff_line_ignore, NULL, NULL, 0 },  /* sv */
	{ roff_insec, NULL, NULL, 0 },  /* sy */
	{ roff_T_, NULL, NULL, 0 },  /* T& */
	{ roff_unsupp, NULL, NULL, 0 },  /* tc */
	{ roff_TE, NULL, NULL, 0 },  /* TE */
	{ roff_Dd, NULL, NULL, 0 },  /* TH */
	{ roff_line_ignore, NULL, NULL, 0 },  /* tkf */
	{ roff_unsupp, NULL, NULL, 0 },  /* tl */
	{ roff_line_ignore, NULL, NULL, 0 },  /* tm */
	{ roff_line_ignore, NULL, NULL, 0 },  /* tm1 */
	{ roff_line_ignore, NULL, NULL, 0 },  /* tmc */
	{ roff_tr, NULL, NULL, 0 },  /* tr */
	{ roff_line_ignore, NULL, NULL, 0 },  /* track */
	{ roff_line_ignore, NULL, NULL, 0 },  /* transchar */
	{ roff_insec, NULL, NULL, 0 },  /* trf */
	{ roff_line_ignore, NULL, NULL, 0 },  /* trimat */
	{ roff_unsupp, NULL, NULL, 0 },  /* trin */
	{ roff_unsupp, NULL, NULL, 0 },  /* trnt */
	{ roff_line_ignore, NULL, NULL, 0 },  /* troff */
	{ roff_TS, NULL, NULL, 0 },  /* TS */
	{ roff_line_ignore, NULL, NULL, 0 },  /* uf */
	{ roff_line_ignore, NULL, NULL, 0 },  /* ul */
	{ roff_unsupp, NULL, NULL, 0 },  /* unformat */
	{ roff_line_ignore, NULL, NULL, 0 },  /* unwatch */
	{ roff_line_ignore, NULL, NULL, 0 },  /* unwatchn */
	{ roff_line_ignore, NULL, NULL, 0 },  /* vpt */
	{ roff_line_ignore, NULL, NULL, 0 },  /* vs */
	{ roff_line_ignore, NULL, NULL, 0 },  /* warn */
	{ roff_line_ignore, NULL, NULL, 0 },  /* warnscale */
	{ roff_line_ignore, NULL, NULL, 0 },  /* watch */
	{ roff_line_ignore, NULL, NULL, 0 },  /* watchlength */
	{ roff_line_ignore, NULL, NULL, 0 },  /* watchn */
	{ roff_unsupp, NULL, NULL, 0 },  /* wh */
	{ roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT }, /*while*/
	{ roff_insec, NULL, NULL, 0 },  /* write */
	{ roff_insec, NULL, NULL, 0 },  /* writec */
	{ roff_insec, NULL, NULL, 0 },  /* writem */
	{ roff_line_ignore, NULL, NULL, 0 },  /* xflag */
	{ roff_cblock, NULL, NULL, 0 },  /* . */
	{ roff_renamed, NULL, NULL, 0 },
	{ roff_userdef, NULL, NULL, 0 }
};

/* Array of injected predefined strings. */
#define	PREDEFS_MAX	 38
static	const struct predef predefs[PREDEFS_MAX] = {
#include "predefs.in"
};

static	int	 roffce_lines;	/* number of input lines to center */
static	struct roff_node *roffce_node;  /* active request */
static	int	 roffit_lines;  /* number of lines to delay */
static	char	*roffit_macro;  /* nil-terminated macro line */


/* --- request table ------------------------------------------------------ */

struct ohash *
roffhash_alloc(enum roff_tok mintok, enum roff_tok maxtok)
{
	struct ohash	*htab;
	struct roffreq	*req;
	enum roff_tok	 tok;
	size_t		 sz;
	unsigned int	 slot;

	htab = mandoc_malloc(sizeof(*htab));
	mandoc_ohash_init(htab, 8, offsetof(struct roffreq, name));

	for (tok = mintok; tok < maxtok; tok++) {
		if (roff_name[tok] == NULL)
			continue;
		sz = strlen(roff_name[tok]);
		req = mandoc_malloc(sizeof(*req) + sz + 1);
		req->tok = tok;
		memcpy(req->name, roff_name[tok], sz + 1);
		slot = ohash_qlookup(htab, req->name);
		ohash_insert(htab, slot, req);
	}
	return htab;
}

void
roffhash_free(struct ohash *htab)
{
	struct roffreq	*req;
	unsigned int	 slot;

	if (htab == NULL)
		return;
	for (req = ohash_first(htab, &slot); req != NULL;
	     req = ohash_next(htab, &slot))
		free(req);
	ohash_delete(htab);
	free(htab);
}

enum roff_tok
roffhash_find(struct ohash *htab, const char *name, size_t sz)
{
	struct roffreq	*req;
	const char	*end;

	if (sz) {
		end = name + sz;
		req = ohash_find(htab, ohash_qlookupi(htab, name, &end));
	} else
		req = ohash_find(htab, ohash_qlookup(htab, name));
	return req == NULL ? TOKEN_NONE : req->tok;
}

/* --- stack of request blocks -------------------------------------------- */

/*
 * Pop the current node off of the stack of roff instructions currently
 * pending.  Return 1 if it is a loop or 0 otherwise.
 */
static int
roffnode_pop(struct roff *r)
{
	struct roffnode	*p;
	int		 inloop;

	p = r->last;
	inloop = p->tok == ROFF_while;
	r->last = p->parent;
	free(p->name);
	free(p->end);
	free(p);
	return inloop;
}

/*
 * Push a roff node onto the instruction stack.  This must later be
 * removed with roffnode_pop().
 */
static void
roffnode_push(struct roff *r, enum roff_tok tok, const char *name,
		int line, int col)
{
	struct roffnode	*p;

	p = mandoc_calloc(1, sizeof(struct roffnode));
	p->tok = tok;
	if (name)
		p->name = mandoc_strdup(name);
	p->parent = r->last;
	p->line = line;
	p->col = col;
	p->rule = p->parent ? p->parent->rule : 0;

	r->last = p;
}

/* --- roff parser state data management ---------------------------------- */

static void
roff_free1(struct roff *r)
{
	int		 i;

	tbl_free(r->first_tbl);
	r->first_tbl = r->last_tbl = r->tbl = NULL;

	eqn_free(r->last_eqn);
	r->last_eqn = r->eqn = NULL;

	while (r->mstackpos >= 0)
		roff_userret(r);

	while (r->last)
		roffnode_pop(r);

	free (r->rstack);
	r->rstack = NULL;
	r->rstacksz = 0;
	r->rstackpos = -1;

	roff_freereg(r->regtab);
	r->regtab = NULL;

	roff_freestr(r->strtab);
	roff_freestr(r->rentab);
	roff_freestr(r->xmbtab);
	r->strtab = r->rentab = r->xmbtab = NULL;

	if (r->xtab)
		for (i = 0; i < 128; i++)
			free(r->xtab[i].p);
	free(r->xtab);
	r->xtab = NULL;
}

void
roff_reset(struct roff *r)
{
	roff_free1(r);
	r->options |= MPARSE_COMMENT;
	r->format = r->options & (MPARSE_MDOC | MPARSE_MAN);
	r->control = '\0';
	r->escape = '\\';
	roffce_lines = 0;
	roffce_node = NULL;
	roffit_lines = 0;
	roffit_macro = NULL;
}

void
roff_free(struct roff *r)
{
	int		 i;

	roff_free1(r);
	for (i = 0; i < r->mstacksz; i++)
		free(r->mstack[i].argv);
	free(r->mstack);
	roffhash_free(r->reqtab);
	free(r);
}

struct roff *
roff_alloc(int options)
{
	struct roff	*r;

	r = mandoc_calloc(1, sizeof(struct roff));
	r->reqtab = roffhash_alloc(0, ROFF_RENAMED);
	r->options = options | MPARSE_COMMENT;
	r->format = options & (MPARSE_MDOC | MPARSE_MAN);
	r->mstackpos = -1;
	r->rstackpos = -1;
	r->escape = '\\';
	return r;
}

/* --- syntax tree state data management ---------------------------------- */

static void
roff_man_free1(struct roff_man *man)
{
	if (man->meta.first != NULL)
		roff_node_delete(man, man->meta.first);
	free(man->meta.msec);
	free(man->meta.vol);
	free(man->meta.os);
	free(man->meta.arch);
	free(man->meta.title);
	free(man->meta.name);
	free(man->meta.date);
	free(man->meta.sodest);
}

void
roff_state_reset(struct roff_man *man)
{
	man->last = man->meta.first;
	man->last_es = NULL;
	man->flags = 0;
	man->lastsec = man->lastnamed = SEC_NONE;
	man->next = ROFF_NEXT_CHILD;
	roff_setreg(man->roff, "nS", 0, '=');
}

static void
roff_man_alloc1(struct roff_man *man)
{
	memset(&man->meta, 0, sizeof(man->meta));
	man->meta.first = mandoc_calloc(1, sizeof(*man->meta.first));
	man->meta.first->type = ROFFT_ROOT;
	man->meta.macroset = MACROSET_NONE;
	roff_state_reset(man);
}

void
roff_man_reset(struct roff_man *man)
{
	roff_man_free1(man);
	roff_man_alloc1(man);
}

void
roff_man_free(struct roff_man *man)
{
	roff_man_free1(man);
	free(man->os_r);
	free(man);
}

struct roff_man *
roff_man_alloc(struct roff *roff, const char *os_s, int quick)
{
	struct roff_man *man;

	man = mandoc_calloc(1, sizeof(*man));
	man->roff = roff;
	man->os_s = os_s;
	man->quick = quick;
	roff_man_alloc1(man);
	roff->man = man;
	return man;
}

/* --- syntax tree handling ----------------------------------------------- */

struct roff_node *
roff_node_alloc(struct roff_man *man, int line, int pos,
	enum roff_type type, int tok)
{
	struct roff_node	*n;

	n = mandoc_calloc(1, sizeof(*n));
	n->line = line;
	n->pos = pos;
	n->tok = tok;
	n->type = type;
	n->sec = man->lastsec;

	if (man->flags & MDOC_SYNOPSIS)
		n->flags |= NODE_SYNPRETTY;
	else
		n->flags &= ~NODE_SYNPRETTY;
	if ((man->flags & (ROFF_NOFILL | ROFF_NONOFILL)) == ROFF_NOFILL)
		n->flags |= NODE_NOFILL;
	else
		n->flags &= ~NODE_NOFILL;
	if (man->flags & MDOC_NEWLINE)
		n->flags |= NODE_LINE;
	man->flags &= ~MDOC_NEWLINE;

	return n;
}

void
roff_node_append(struct roff_man *man, struct roff_node *n)
{

	switch (man->next) {
	case ROFF_NEXT_SIBLING:
		if (man->last->next != NULL) {
			n->next = man->last->next;
			man->last->next->prev = n;
		} else
			man->last->parent->last = n;
		man->last->next = n;
		n->prev = man->last;
		n->parent = man->last->parent;
		break;
	case ROFF_NEXT_CHILD:
		if (man->last->child != NULL) {
			n->next = man->last->child;
			man->last->child->prev = n;
		} else
			man->last->last = n;
		man->last->child = n;
		n->parent = man->last;
		break;
	default:
		abort();
	}
	man->last = n;

	switch (n->type) {
	case ROFFT_HEAD:
		n->parent->head = n;
		break;
	case ROFFT_BODY:
		if (n->end != ENDBODY_NOT)
			return;
		n->parent->body = n;
		break;
	case ROFFT_TAIL:
		n->parent->tail = n;
		break;
	default:
		return;
	}

	/*
	 * Copy over the normalised-data pointer of our parent.  Not
	 * everybody has one, but copying a null pointer is fine.
	 */

	n->norm = n->parent->norm;
	assert(n->parent->type == ROFFT_BLOCK);
}

void
roff_word_alloc(struct roff_man *man, int line, int pos, const char *word)
{
	struct roff_node	*n;

	n = roff_node_alloc(man, line, pos, ROFFT_TEXT, TOKEN_NONE);
	n->string = roff_strdup(man->roff, word);
	roff_node_append(man, n);
	n->flags |= NODE_VALID | NODE_ENDED;
	man->next = ROFF_NEXT_SIBLING;
}

void
roff_word_append(struct roff_man *man, const char *word)
{
	struct roff_node	*n;
	char			*addstr, *newstr;

	n = man->last;
	addstr = roff_strdup(man->roff, word);
	mandoc_asprintf(&newstr, "%s %s", n->string, addstr);
	free(addstr);
	free(n->string);
	n->string = newstr;
	man->next = ROFF_NEXT_SIBLING;
}

void
roff_elem_alloc(struct roff_man *man, int line, int pos, int tok)
{
	struct roff_node	*n;

	n = roff_node_alloc(man, line, pos, ROFFT_ELEM, tok);
	roff_node_append(man, n);
	man->next = ROFF_NEXT_CHILD;
}

struct roff_node *
roff_block_alloc(struct roff_man *man, int line, int pos, int tok)
{
	struct roff_node	*n;

	n = roff_node_alloc(man, line, pos, ROFFT_BLOCK, tok);
	roff_node_append(man, n);
	man->next = ROFF_NEXT_CHILD;
	return n;
}

struct roff_node *
roff_head_alloc(struct roff_man *man, int line, int pos, int tok)
{
	struct roff_node	*n;

	n = roff_node_alloc(man, line, pos, ROFFT_HEAD, tok);
	roff_node_append(man, n);
	man->next = ROFF_NEXT_CHILD;
	return n;
}

struct roff_node *
roff_body_alloc(struct roff_man *man, int line, int pos, int tok)
{
	struct roff_node	*n;

	n = roff_node_alloc(man, line, pos, ROFFT_BODY, tok);
	roff_node_append(man, n);
	man->next = ROFF_NEXT_CHILD;
	return n;
}

static void
roff_addtbl(struct roff_man *man, int line, struct tbl_node *tbl)
{
	struct roff_node	*n;
	struct tbl_span		*span;

	if (man->meta.macroset == MACROSET_MAN)
		man_breakscope(man, ROFF_TS);
	while ((span = tbl_span(tbl)) != NULL) {
		n = roff_node_alloc(man, line, 0, ROFFT_TBL, TOKEN_NONE);
		n->span = span;
		roff_node_append(man, n);
		n->flags |= NODE_VALID | NODE_ENDED;
		man->next = ROFF_NEXT_SIBLING;
	}
}

void
roff_node_unlink(struct roff_man *man, struct roff_node *n)
{

	/* Adjust siblings. */

	if (n->prev)
		n->prev->next = n->next;
	if (n->next)
		n->next->prev = n->prev;

	/* Adjust parent. */

	if (n->parent != NULL) {
		if (n->parent->child == n)
			n->parent->child = n->next;
		if (n->parent->last == n)
			n->parent->last = n->prev;
	}

	/* Adjust parse point. */

	if (man == NULL)
		return;
	if (man->last == n) {
		if (n->prev == NULL) {
			man->last = n->parent;
			man->next = ROFF_NEXT_CHILD;
		} else {
			man->last = n->prev;
			man->next = ROFF_NEXT_SIBLING;
		}
	}
	if (man->meta.first == n)
		man->meta.first = NULL;
}

void
roff_node_relink(struct roff_man *man, struct roff_node *n)
{
	roff_node_unlink(man, n);
	n->prev = n->next = NULL;
	roff_node_append(man, n);
}

void
roff_node_free(struct roff_node *n)
{

	if (n->args != NULL)
		mdoc_argv_free(n->args);
	if (n->type == ROFFT_BLOCK || n->type == ROFFT_ELEM)
		free(n->norm);
	eqn_box_free(n->eqn);
	free(n->string);
	free(n->tag);
	free(n);
}

void
roff_node_delete(struct roff_man *man, struct roff_node *n)
{

	while (n->child != NULL)
		roff_node_delete(man, n->child);
	roff_node_unlink(man, n);
	roff_node_free(n);
}

int
roff_node_transparent(struct roff_node *n)
{
	if (n == NULL)
		return 0;
	if (n->type == ROFFT_COMMENT || n->flags & NODE_NOPRT)
		return 1;
	return roff_tok_transparent(n->tok);
}

int
roff_tok_transparent(enum roff_tok tok)
{
	switch (tok) {
	case ROFF_ft:
	case ROFF_ll:
	case ROFF_mc:
	case ROFF_po:
	case ROFF_ta:
	case MDOC_Db:
	case MDOC_Es:
	case MDOC_Sm:
	case MDOC_Tg:
	case MAN_DT:
	case MAN_UC:
	case MAN_PD:
	case MAN_AT:
		return 1;
	default:
		return 0;
	}
}

struct roff_node *
roff_node_child(struct roff_node *n)
{
	for (n = n->child; roff_node_transparent(n); n = n->next)
		continue;
	return n;
}

struct roff_node *
roff_node_prev(struct roff_node *n)
{
	do {
		n = n->prev;
	} while (roff_node_transparent(n));
	return n;
}

struct roff_node *
roff_node_next(struct roff_node *n)
{
	do {
		n = n->next;
	} while (roff_node_transparent(n));
	return n;
}

void
deroff(char **dest, const struct roff_node *n)
{
	char	*cp;
	size_t	 sz;

	if (n->string == NULL) {
		for (n = n->child; n != NULL; n = n->next)
			deroff(dest, n);
		return;
	}

	/* Skip leading whitespace. */

	for (cp = n->string; *cp != '\0'; cp++) {
		if (cp[0] == '\\' && cp[1] != '\0' &&
		    strchr(" %&0^|~", cp[1]) != NULL)
			cp++;
		else if ( ! isspace((unsigned char)*cp))
			break;
	}

	/* Skip trailing backslash. */

	sz = strlen(cp);
	if (sz > 0 && cp[sz - 1] == '\\')
		sz--;

	/* Skip trailing whitespace. */

	for (; sz; sz--)
		if ( ! isspace((unsigned char)cp[sz-1]))
			break;

	/* Skip empty strings. */

	if (sz == 0)
		return;

	if (*dest == NULL) {
		*dest = mandoc_strndup(cp, sz);
		return;
	}

	mandoc_asprintf(&cp, "%s %*s", *dest, (int)sz, cp);
	free(*dest);
	*dest = cp;
}

/* --- main functions of the roff parser ---------------------------------- */

/*
 * Save comments preceding the title macro, for example in order to
 * preserve Copyright and license headers in HTML output,
 * provide diagnostics about RCS ids and trailing whitespace in comments,
 * then discard comments including preceding whitespace.
 * This function also handles input line continuation.
 */
static int
roff_parse_comment(struct roff *r, struct buf *buf, int ln, int pos, char ec)
{
	struct roff_node *n;	/* used for header comments */
	const char	*start;	/* start of the string to process */
	const char	*cp;	/* for RCS id parsing */
	char		*stesc;	/* start of an escape sequence ('\\') */
	char		*ep;	/* end of comment string */
	int		 rcsid;	/* kind of RCS id seen */

	for (start = stesc = buf->buf + pos;; stesc++) {
		/*
		 * XXX Ugly hack: Remove the newline character that
		 * mparse_buf_r() appended to mark the end of input
		 * if it is not preceded by an escape character.
		 */
		if (stesc[0] == '\n') {
			assert(stesc[1] == '\0');
			stesc[0] = '\0';
		}

		/* The line ends without continuation or comment. */
		if (stesc[0] == '\0')
			return ROFF_CONT;

		/* Unescaped byte: skip it. */
		if (stesc[0] != ec)
			continue;

		/*
		 * XXX Ugly hack: Do not attempt to append another line
		 * if the function mparse_buf_r() appended a newline
		 * character to indicate the end of input.
		 */
		if (stesc[1] == '\n') {
			assert(stesc[2] == '\0');
			stesc[0] = '\0';
			return ROFF_CONT;
		}

		/*
		 * An escape character at the end of an input line
		 * requests line continuation.
		 */
		if (stesc[1] == '\0') {
			stesc[0] = '\0';
			return ROFF_IGN | ROFF_APPEND;
		}

		/* Found a comment: process it. */
		if (stesc[1] == '"' || stesc[1] == '#')
			break;

		/* Escaped escape character: skip them both. */
		if (stesc[1] == ec)
			stesc++;
	}

	/* Look for an RCS id in the comment. */

	rcsid = 0;
	if ((cp = strstr(stesc + 2, "$" "OpenBSD")) != NULL) {
		rcsid = 1 << MANDOC_OS_OPENBSD;
		cp += 8;
	} else if ((cp = strstr(stesc + 2, "$" "NetBSD")) != NULL) {
		rcsid = 1 << MANDOC_OS_NETBSD;
		cp += 7;
	}
	if (cp != NULL && isalnum((unsigned char)*cp) == 0 &&
	    strchr(cp, '$') != NULL) {
		if (r->man->meta.rcsids & rcsid)
			mandoc_msg(MANDOCERR_RCS_REP, ln,
			    (int)(stesc - buf->buf) + 2, "%s", stesc + 1);
		r->man->meta.rcsids |= rcsid;
	}

	/* Warn about trailing whitespace at the end of the comment. */

	ep = strchr(stesc + 2, '\0') - 1;
	if (*ep == '\n')
		*ep-- = '\0';
	if (*ep == ' ' || *ep == '\t')
		mandoc_msg(MANDOCERR_SPACE_EOL,
		    ln, (int)(ep - buf->buf), NULL);

	/* Save comments preceding the title macro in the syntax tree. */

	if (r->options & MPARSE_COMMENT) {
		while (*ep == ' ' || *ep == '\t')
			ep--;
		ep[1] = '\0';
		n = roff_node_alloc(r->man, ln, stesc + 1 - buf->buf,
		    ROFFT_COMMENT, TOKEN_NONE);
		n->string = mandoc_strdup(stesc + 2);
		roff_node_append(r->man, n);
		n->flags |= NODE_VALID | NODE_ENDED;
		r->man->next = ROFF_NEXT_SIBLING;
	}

	/* The comment requests line continuation. */

	if (stesc[1] == '#') {
		*stesc = '\0';
		return ROFF_IGN | ROFF_APPEND;
	}

	/* Discard the comment including preceding whitespace. */

	while (stesc > start && stesc[-1] == ' ' &&
	    (stesc == start + 1 || stesc[-2] != '\\'))
		stesc--;
	*stesc = '\0';
	return ROFF_CONT;
}

/*
 * In the current line, expand escape sequences that produce parsable
 * input text.  Also check the syntax of the remaining escape sequences,
 * which typically produce output glyphs or change formatter state.
 */
static int
roff_expand(struct roff *r, struct buf *buf, int ln, int pos, char ec)
{
	char		 ubuf[24];	/* buffer to print a number */
	struct mctx	*ctx;		/* current macro call context */
	const char	*res;		/* the string to be pasted */
	const char	*src;		/* source for copying */
	char		*dst;		/* destination for copying */
	int		 iesc;		/* index of leading escape char */
	int		 inam;		/* index of the escape name */
	int		 iarg;		/* index beginning the argument */
	int		 iendarg;	/* index right after the argument */
	int		 iend;		/* index right after the sequence */
	int		 isrc, idst;	/* to reduce \\ and \. in names */
	int		 deftype;	/* type of definition to paste */
	int		 argi;		/* macro argument index */
	int		 quote_args;	/* true for \\$@, false for \\$* */
	int		 asz;		/* length of the replacement */
	int		 rsz;		/* length of the rest of the string */
	int		 npos;		/* position in numeric expression */
	int		 expand_count;	/* to avoid infinite loops */

	expand_count = 0;
	while (buf->buf[pos] != '\0') {

		/*
		 * Skip plain ASCII characters.
		 * If we have a non-standard escape character,
		 * escape literal backslashes because all processing in
		 * subsequent functions uses the standard escaping rules.
		 */

		if (buf->buf[pos] != ec) {
			if (buf->buf[pos] == '\\') {
				roff_expand_patch(buf, pos, "\\e", pos + 1);
				pos++;
			}
			pos++;
			continue;
		}

		/*
		 * Parse escape sequences,
		 * issue diagnostic messages when appropriate,
		 * and skip sequences that do not need expansion.
		 * If we have a non-standard escape character, translate
		 * it to backslashes and translate backslashes to \e.
		 */

		if (roff_escape(buf->buf, ln, pos, &iesc, &inam,
		    &iarg, &iendarg, &iend) != ESCAPE_EXPAND) {
			while (pos < iend) {
				if (buf->buf[pos] == ec) {
					buf->buf[pos] = '\\';
					if (pos + 1 < iend)
						pos++;
				} else if (buf->buf[pos] == '\\') {
					roff_expand_patch(buf,
					    pos, "\\e", pos + 1);
					pos++;
					iend++;
				}
				pos++;
			}
			continue;
		}

		/* Reduce \\ and \. in names. */

		if (buf->buf[inam] == '*' || buf->buf[inam] == 'n') {
			isrc = idst = iarg;
			while (isrc < iendarg) {
				if (isrc + 1 < iendarg &&
				    buf->buf[isrc] == '\\' &&
				    (buf->buf[isrc + 1] == '\\' ||
				     buf->buf[isrc + 1] == '.'))
					isrc++;
				buf->buf[idst++] = buf->buf[isrc++];
			}
			iendarg -= isrc - idst;
		}

		/* Handle expansion. */

		res = NULL;
		switch (buf->buf[inam]) {
		case '*':
			if (iendarg == iarg)
				break;
			deftype = ROFFDEF_USER | ROFFDEF_PRE;
			if ((res = roff_getstrn(r, buf->buf + iarg,
			    iendarg - iarg, &deftype)) != NULL)
				break;

			/*
			 * If not overridden,
			 * let \*(.T through to the formatters.
			 */

			if (iendarg - iarg == 2 &&
			    buf->buf[iarg] == '.' &&
			    buf->buf[iarg + 1] == 'T') {
				roff_setstrn(&r->strtab, ".T", 2, NULL, 0, 0);
				pos = iend;
				continue;
			}

			mandoc_msg(MANDOCERR_STR_UNDEF, ln, iesc,
			    "%.*s", iendarg - iarg, buf->buf + iarg);
			break;

		case '$':
			if (r->mstackpos < 0) {
				mandoc_msg(MANDOCERR_ARG_UNDEF, ln, iesc,
				    "%.*s", iend - iesc, buf->buf + iesc);
				break;
			}
			ctx = r->mstack + r->mstackpos;
			argi = buf->buf[iarg] - '1';
			if (argi >= 0 && argi <= 8) {
				if (argi < ctx->argc)
					res = ctx->argv[argi];
				break;
			}
			if (buf->buf[iarg] == '*')
				quote_args = 0;
			else if (buf->buf[iarg] == '@')
				quote_args = 1;
			else {
				mandoc_msg(MANDOCERR_ARG_NONUM, ln, iesc,
				    "%.*s", iend - iesc, buf->buf + iesc);
				break;
			}
			asz = 0;
			for (argi = 0; argi < ctx->argc; argi++) {
				if (argi)
					asz++;  /* blank */
				if (quote_args)
					asz += 2;  /* quotes */
				asz += strlen(ctx->argv[argi]);
			}
			if (asz != iend - iesc) {
				rsz = buf->sz - iend;
				if (asz < iend - iesc)
					memmove(buf->buf + iesc + asz,
					    buf->buf + iend, rsz);
				buf->sz = iesc + asz + rsz;
				buf->buf = mandoc_realloc(buf->buf, buf->sz);
				if (asz > iend - iesc)
					memmove(buf->buf + iesc + asz,
					    buf->buf + iend, rsz);
			}
			dst = buf->buf + iesc;
			for (argi = 0; argi < ctx->argc; argi++) {
				if (argi)
					*dst++ = ' ';
				if (quote_args)
					*dst++ = '"';
				src = ctx->argv[argi];
				while (*src != '\0')
					*dst++ = *src++;
				if (quote_args)
					*dst++ = '"';
			}
			continue;
		case 'A':
			ubuf[0] = iendarg > iarg ? '1' : '0';
			ubuf[1] = '\0';
			res = ubuf;
			break;
		case 'B':
			npos = 0;
			ubuf[0] = iendarg > iarg && iend > iendarg &&
			    roff_evalnum(r, ln, buf->buf + iarg, &npos,
					 NULL, ROFFNUM_SCALE) &&
			    npos == iendarg - iarg ? '1' : '0';
			ubuf[1] = '\0';
			res = ubuf;
			break;
		case 'V':
			mandoc_msg(MANDOCERR_UNSUPP, ln, iesc,
			    "%.*s", iend - iesc, buf->buf + iesc);
			roff_expand_patch(buf, iendarg, "}", iend);
			roff_expand_patch(buf, iesc, "${", iarg);
			continue;
		case 'g':
			break;
		case 'n':
			if (iendarg > iarg)
				(void)snprintf(ubuf, sizeof(ubuf), "%d",
				    roff_getregn(r, buf->buf + iarg,
				    iendarg - iarg, buf->buf[inam + 1]));
			else
				ubuf[0] = '\0';
			res = ubuf;
			break;
		case 'w':
			(void)snprintf(ubuf, sizeof(ubuf),
			    "%d", (iendarg - iarg) * 24);
			res = ubuf;
			break;
		default:
			break;
		}
		if (res == NULL)
			res = "";
		if (++expand_count > EXPAND_LIMIT ||
		    buf->sz + strlen(res) > SHRT_MAX) {
			mandoc_msg(MANDOCERR_ROFFLOOP, ln, iesc, NULL);
			return ROFF_IGN;
		}
		roff_expand_patch(buf, iesc, res, iend);
	}
	return ROFF_CONT;
}

/*
 * Replace the substring from the start position (inclusive)
 * to end position (exclusive) with the repl(acement) string.
 */
static void
roff_expand_patch(struct buf *buf, int start, const char *repl, int end)
{
	char	*nbuf;

	buf->sz = mandoc_asprintf(&nbuf, "%.*s%s%s", start, buf->buf,
	    repl, buf->buf + end) + 1;
	free(buf->buf);
	buf->buf = nbuf;
}

/*
 * Parse a quoted or unquoted roff-style request or macro argument.
 * Return a pointer to the parsed argument, which is either the original
 * pointer or advanced by one byte in case the argument is quoted.
 * NUL-terminate the argument in place.
 * Collapse pairs of quotes inside quoted arguments.
 * Advance the argument pointer to the next argument,
 * or to the NUL byte terminating the argument line.
 */
char *
roff_getarg(struct roff *r, char **cpp, int ln, int *pos)
{
	struct buf	 buf;
	char		*cp, *start;
	int		 newesc, pairs, quoted, white;

	/* Quoting can only start with a new word. */
	start = *cpp;
	quoted = 0;
	if ('"' == *start) {
		quoted = 1;
		start++;
	}

	newesc = pairs = white = 0;
	for (cp = start; '\0' != *cp; cp++) {

		/*
		 * Move the following text left
		 * after quoted quotes and after "\\" and "\t".
		 */
		if (pairs)
			cp[-pairs] = cp[0];

		if ('\\' == cp[0]) {
			/*
			 * In copy mode, translate double to single
			 * backslashes and backslash-t to literal tabs.
			 */
			switch (cp[1]) {
			case 'a':
			case 't':
				cp[-pairs] = '\t';
				pairs++;
				cp++;
				break;
			case '\\':
				cp[-pairs] = '\\';
				newesc = 1;
				pairs++;
				cp++;
				break;
			case ' ':
				/* Skip escaped blanks. */
				if (0 == quoted)
					cp++;
				break;
			default:
				break;
			}
		} else if (0 == quoted) {
			if (' ' == cp[0]) {
				/* Unescaped blanks end unquoted args. */
				white = 1;
				break;
			}
		} else if ('"' == cp[0]) {
			if ('"' == cp[1]) {
				/* Quoted quotes collapse. */
				pairs++;
				cp++;
			} else {
				/* Unquoted quotes end quoted args. */
				quoted = 2;
				break;
			}
		}
	}

	/* Quoted argument without a closing quote. */
	if (1 == quoted)
		mandoc_msg(MANDOCERR_ARG_QUOTE, ln, *pos, NULL);

	/* NUL-terminate this argument and move to the next one. */
	if (pairs)
		cp[-pairs] = '\0';
	if ('\0' != *cp) {
		*cp++ = '\0';
		while (' ' == *cp)
			cp++;
	}
	*pos += (int)(cp - start) + (quoted ? 1 : 0);
	*cpp = cp;

	if ('\0' == *cp && (white || ' ' == cp[-1]))
		mandoc_msg(MANDOCERR_SPACE_EOL, ln, *pos, NULL);

	start = mandoc_strdup(start);
	if (newesc == 0)
		return start;

	buf.buf = start;
	buf.sz = strlen(start) + 1;
	buf.next = NULL;
	if (roff_expand(r, &buf, ln, 0, '\\') & ROFF_IGN) {
		free(buf.buf);
		buf.buf = mandoc_strdup("");
	}
	return buf.buf;
}


/*
 * Process text streams.
 */
static int
roff_parsetext(struct roff *r, struct buf *buf, int pos, int *offs)
{
	size_t		 sz;
	const char	*start;
	char		*p;
	int		 isz;
	enum mandoc_esc	 esc;

	/* Spring the input line trap. */

	if (roffit_lines == 1) {
		isz = mandoc_asprintf(&p, "%s\n.%s", buf->buf, roffit_macro);
		free(buf->buf);
		buf->buf = p;
		buf->sz = isz + 1;
		*offs = 0;
		free(roffit_macro);
		roffit_lines = 0;
		return ROFF_REPARSE;
	} else if (roffit_lines > 1)
		--roffit_lines;

	if (roffce_node != NULL && buf->buf[pos] != '\0') {
		if (roffce_lines < 1) {
			r->man->last = roffce_node;
			r->man->next = ROFF_NEXT_SIBLING;
			roffce_lines = 0;
			roffce_node = NULL;
		} else
			roffce_lines--;
	}

	/* Convert all breakable hyphens into ASCII_HYPH. */

	start = p = buf->buf + pos;

	while (*p != '\0') {
		sz = strcspn(p, "-\\");
		p += sz;

		if (*p == '\0')
			break;

		if (*p == '\\') {
			/* Skip over escapes. */
			p++;
			esc = mandoc_escape((const char **)&p, NULL, NULL);
			if (esc == ESCAPE_ERROR)
				break;
			while (*p == '-')
				p++;
			continue;
		} else if (p == start) {
			p++;
			continue;
		}

		if (isalpha((unsigned char)p[-1]) &&
		    isalpha((unsigned char)p[1]))
			*p = ASCII_HYPH;
		p++;
	}
	return ROFF_CONT;
}

int
roff_parseln(struct roff *r, int ln, struct buf *buf, int *offs, size_t len)
{
	enum roff_tok	 t;
	int		 e;
	int		 pos;	/* parse point */
	int		 spos;	/* saved parse point for messages */
	int		 ppos;	/* original offset in buf->buf */
	int		 ctl;	/* macro line (boolean) */

	ppos = pos = *offs;

	if (len > 80 && r->tbl == NULL && r->eqn == NULL &&
	    (r->man->flags & ROFF_NOFILL) == 0 &&
	    strchr(" .\\", buf->buf[pos]) == NULL &&
	    buf->buf[pos] != r->control &&
	    strcspn(buf->buf, " ") < 80)
		mandoc_msg(MANDOCERR_TEXT_LONG, ln, (int)len - 1,
		    "%.20s...", buf->buf + pos);

	/* Handle in-line equation delimiters. */

	if (r->tbl == NULL &&
	    r->last_eqn != NULL && r->last_eqn->delim &&
	    (r->eqn == NULL || r->eqn_inline)) {
		e = roff_eqndelim(r, buf, pos);
		if (e == ROFF_REPARSE)
			return e;
		assert(e == ROFF_CONT);
	}

	/* Handle comments and escape sequences. */

	e = roff_parse_comment(r, buf, ln, pos, r->escape);
	if ((e & ROFF_MASK) == ROFF_IGN)
		return e;
	assert(e == ROFF_CONT);

	e = roff_expand(r, buf, ln, pos, r->escape);
	if ((e & ROFF_MASK) == ROFF_IGN)
		return e;
	assert(e == ROFF_CONT);

	ctl = roff_getcontrol(r, buf->buf, &pos);

	/*
	 * First, if a scope is open and we're not a macro, pass the
	 * text through the macro's filter.
	 * Equations process all content themselves.
	 * Tables process almost all content themselves, but we want
	 * to warn about macros before passing it there.
	 */

	if (r->last != NULL && ! ctl) {
		t = r->last->tok;
		e = (*roffs[t].text)(r, t, buf, ln, pos, pos, offs);
		if ((e & ROFF_MASK) == ROFF_IGN)
			return e;
		e &= ~ROFF_MASK;
	} else
		e = ROFF_IGN;
	if (r->eqn != NULL && strncmp(buf->buf + ppos, ".EN", 3)) {
		eqn_read(r->eqn, buf->buf + ppos);
		return e;
	}
	if (r->tbl != NULL && (ctl == 0 || buf->buf[pos] == '\0')) {
		tbl_read(r->tbl, ln, buf->buf, ppos);
		roff_addtbl(r->man, ln, r->tbl);
		return e;
	}
	if ( ! ctl) {
		r->options &= ~MPARSE_COMMENT;
		return roff_parsetext(r, buf, pos, offs) | e;
	}

	/* Skip empty request lines. */

	if (buf->buf[pos] == '"') {
		mandoc_msg(MANDOCERR_COMMENT_BAD, ln, pos, NULL);
		return ROFF_IGN;
	} else if (buf->buf[pos] == '\0')
		return ROFF_IGN;

	/*
	 * If a scope is open, go to the child handler for that macro,
	 * as it may want to preprocess before doing anything with it.
	 */

	if (r->last) {
		t = r->last->tok;
		return (*roffs[t].sub)(r, t, buf, ln, ppos, pos, offs);
	}

	r->options &= ~MPARSE_COMMENT;
	spos = pos;
	t = roff_parse(r, buf->buf, &pos, ln, ppos);
	return roff_req_or_macro(r, t, buf, ln, spos, pos, offs);
}

/*
 * Handle a new request or macro.
 * May be called outside any scope or from inside a conditional scope.
 */
static int
roff_req_or_macro(ROFF_ARGS) {

	/* For now, tables ignore most macros and some request. */

	if (r->tbl != NULL && (tok == TOKEN_NONE || tok == ROFF_TS ||
	    tok == ROFF_br || tok == ROFF_ce || tok == ROFF_rj ||
	    tok == ROFF_sp)) {
		mandoc_msg(MANDOCERR_TBLMACRO,
		    ln, ppos, "%s", buf->buf + ppos);
		if (tok != TOKEN_NONE)
			return ROFF_IGN;
		while (buf->buf[pos] != '\0' && buf->buf[pos] != ' ')
			pos++;
		while (buf->buf[pos] == ' ')
			pos++;
		tbl_read(r->tbl, ln, buf->buf, pos);
		roff_addtbl(r->man, ln, r->tbl);
		return ROFF_IGN;
	}

	/* For now, let high level macros abort .ce mode. */

	if (roffce_node != NULL &&
	    (tok == TOKEN_NONE || tok == ROFF_Dd || tok == ROFF_EQ ||
	     tok == ROFF_TH || tok == ROFF_TS)) {
		r->man->last = roffce_node;
		r->man->next = ROFF_NEXT_SIBLING;
		roffce_lines = 0;
		roffce_node = NULL;
	}

	/*
	 * This is neither a roff request nor a user-defined macro.
	 * Let the standard macro set parsers handle it.
	 */

	if (tok == TOKEN_NONE)
		return ROFF_CONT;

	/* Execute a roff request or a user-defined macro. */

	return (*roffs[tok].proc)(r, tok, buf, ln, ppos, pos, offs);
}

/*
 * Internal interface function to tell the roff parser that execution
 * of the current macro ended.  This is required because macro
 * definitions usually do not end with a .return request.
 */
void
roff_userret(struct roff *r)
{
	struct mctx	*ctx;
	int		 i;

	assert(r->mstackpos >= 0);
	ctx = r->mstack + r->mstackpos;
	for (i = 0; i < ctx->argc; i++)
		free(ctx->argv[i]);
	ctx->argc = 0;
	r->mstackpos--;
}

void
roff_endparse(struct roff *r)
{
	if (r->last != NULL)
		mandoc_msg(MANDOCERR_BLK_NOEND, r->last->line,
		    r->last->col, "%s", roff_name[r->last->tok]);

	if (r->eqn != NULL) {
		mandoc_msg(MANDOCERR_BLK_NOEND,
		    r->eqn->node->line, r->eqn->node->pos, "EQ");
		eqn_parse(r->eqn);
		r->eqn = NULL;
	}

	if (r->tbl != NULL) {
		tbl_end(r->tbl, 1);
		r->tbl = NULL;
	}
}

/*
 * Parse the request or macro name at buf[*pos].
 * Return ROFF_RENAMED, ROFF_USERDEF, or a ROFF_* token value.
 * For empty, undefined, mdoc(7), and man(7) macros, return TOKEN_NONE.
 * As a side effect, set r->current_string to the definition or to NULL.
 */
static enum roff_tok
roff_parse(struct roff *r, char *buf, int *pos, int ln, int ppos)
{
	char		*cp;
	const char	*mac;
	size_t		 maclen;
	int		 deftype;
	enum roff_tok	 t;

	cp = buf + *pos;

	if ('\0' == *cp || '"' == *cp || '\t' == *cp || ' ' == *cp)
		return TOKEN_NONE;

	mac = cp;
	maclen = roff_getname(r, &cp, ln, ppos);

	deftype = ROFFDEF_USER | ROFFDEF_REN;
	r->current_string = roff_getstrn(r, mac, maclen, &deftype);
	switch (deftype) {
	case ROFFDEF_USER:
		t = ROFF_USERDEF;
		break;
	case ROFFDEF_REN:
		t = ROFF_RENAMED;
		break;
	default:
		t = roffhash_find(r->reqtab, mac, maclen);
		break;
	}
	if (t != TOKEN_NONE)
		*pos = cp - buf;
	else if (deftype == ROFFDEF_UNDEF) {
		/* Using an undefined macro defines it to be empty. */
		roff_setstrn(&r->strtab, mac, maclen, "", 0, 0);
		roff_setstrn(&r->rentab, mac, maclen, NULL, 0, 0);
	}
	return t;
}

/* --- handling of request blocks ----------------------------------------- */

/*
 * Close a macro definition block or an "ignore" block.
 */
static int
roff_cblock(ROFF_ARGS)
{
	int	 rr;

	if (r->last == NULL) {
		mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "..");
		return ROFF_IGN;
	}

	switch (r->last->tok) {
	case ROFF_am:
	case ROFF_ami:
	case ROFF_de:
	case ROFF_dei:
	case ROFF_ig:
		break;
	case ROFF_am1:
	case ROFF_de1:
		/* Remapped in roff_block(). */
		abort();
	default:
		mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "..");
		return ROFF_IGN;
	}

	roffnode_pop(r);
	roffnode_cleanscope(r);

	/*
	 * If a conditional block with braces is still open,
	 * check for "\}" block end markers.
	 */

	if (r->last != NULL && r->last->endspan < 0) {
		rr = 1;  /* If arguments follow "\}", warn about them. */
		roff_cond_checkend(r, tok, buf, ln, ppos, pos, &rr);
	}

	if (buf->buf[pos] != '\0')
		mandoc_msg(MANDOCERR_ARG_SKIP, ln, pos,
		    ".. %s", buf->buf + pos);

	return ROFF_IGN;
}

/*
 * Pop all nodes ending at the end of the current input line.
 * Return the number of loops ended.
 */
static int
roffnode_cleanscope(struct roff *r)
{
	int inloop;

	inloop = 0;
	while (r->last != NULL && r->last->endspan > 0) {
		if (--r->last->endspan != 0)
			break;
		inloop += roffnode_pop(r);
	}
	return inloop;
}

/*
 * Handle the closing "\}" of a conditional block.
 * Apart from generating warnings, this only pops nodes.
 * Return the number of loops ended.
 */
static int
roff_ccond(struct roff *r, int ln, int ppos)
{
	if (NULL == r->last) {
		mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "\\}");
		return 0;
	}

	switch (r->last->tok) {
	case ROFF_el:
	case ROFF_ie:
	case ROFF_if:
	case ROFF_while:
		break;
	default:
		mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "\\}");
		return 0;
	}

	if (r->last->endspan > -1) {
		mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "\\}");
		return 0;
	}

	return roffnode_pop(r) + roffnode_cleanscope(r);
}

static int
roff_block(ROFF_ARGS)
{
	const char	*name, *value;
	char		*call, *cp, *iname, *rname;
	size_t		 csz, namesz, rsz;
	int		 deftype;

	/* Ignore groff compatibility mode for now. */

	if (tok == ROFF_de1)
		tok = ROFF_de;
	else if (tok == ROFF_dei1)
		tok = ROFF_dei;
	else if (tok == ROFF_am1)
		tok = ROFF_am;
	else if (tok == ROFF_ami1)
		tok = ROFF_ami;

	/* Parse the macro name argument. */

	cp = buf->buf + pos;
	if (tok == ROFF_ig) {
		iname = NULL;
		namesz = 0;
	} else {
		iname = cp;
		namesz = roff_getname(r, &cp, ln, ppos);
		iname[namesz] = '\0';
	}

	/* Resolve the macro name argument if it is indirect. */

	if (namesz && (tok == ROFF_dei || tok == ROFF_ami)) {
		deftype = ROFFDEF_USER;
		name = roff_getstrn(r, iname, namesz, &deftype);
		if (name == NULL) {
			mandoc_msg(MANDOCERR_STR_UNDEF,
			    ln, (int)(iname - buf->buf),
			    "%.*s", (int)namesz, iname);
			namesz = 0;
		} else
			namesz = strlen(name);
	} else
		name = iname;

	if (namesz == 0 && tok != ROFF_ig) {
		mandoc_msg(MANDOCERR_REQ_EMPTY,
		    ln, ppos, "%s", roff_name[tok]);
		return ROFF_IGN;
	}

	roffnode_push(r, tok, name, ln, ppos);

	/*
	 * At the beginning of a `de' macro, clear the existing string
	 * with the same name, if there is one.  New content will be
	 * appended from roff_block_text() in multiline mode.
	 */

	if (tok == ROFF_de || tok == ROFF_dei) {
		roff_setstrn(&r->strtab, name, namesz, "", 0, 0);
		roff_setstrn(&r->rentab, name, namesz, NULL, 0, 0);
	} else if (tok == ROFF_am || tok == ROFF_ami) {
		deftype = ROFFDEF_ANY;
		value = roff_getstrn(r, iname, namesz, &deftype);
		switch (deftype) {  /* Before appending, ... */
		case ROFFDEF_PRE: /* copy predefined to user-defined. */
			roff_setstrn(&r->strtab, name, namesz,
			    value, strlen(value), 0);
			break;
		case ROFFDEF_REN: /* call original standard macro. */
			csz = mandoc_asprintf(&call, ".%.*s \\$* \\\"\n",
			    (int)strlen(value), value);
			roff_setstrn(&r->strtab, name, namesz, call, csz, 0);
			roff_setstrn(&r->rentab, name, namesz, NULL, 0, 0);
			free(call);
			break;
		case ROFFDEF_STD:  /* rename and call standard macro. */
			rsz = mandoc_asprintf(&rname, "__%s_renamed", name);
			roff_setstrn(&r->rentab, rname, rsz, name, namesz, 0);
			csz = mandoc_asprintf(&call, ".%.*s \\$* \\\"\n",
			    (int)rsz, rname);
			roff_setstrn(&r->strtab, name, namesz, call, csz, 0);
			free(call);
			free(rname);
			break;
		default:
			break;
		}
	}

	if (*cp == '\0')
		return ROFF_IGN;

	/* Get the custom end marker. */

	iname = cp;
	namesz = roff_getname(r, &cp, ln, ppos);

	/* Resolve the end marker if it is indirect. */

	if (namesz && (tok == ROFF_dei || tok == ROFF_ami)) {
		deftype = ROFFDEF_USER;
		name = roff_getstrn(r, iname, namesz, &deftype);
		if (name == NULL) {
			mandoc_msg(MANDOCERR_STR_UNDEF,
			    ln, (int)(iname - buf->buf),
			    "%.*s", (int)namesz, iname);
			namesz = 0;
		} else
			namesz = strlen(name);
	} else
		name = iname;

	if (namesz)
		r->last->end = mandoc_strndup(name, namesz);

	if (*cp != '\0')
		mandoc_msg(MANDOCERR_ARG_EXCESS,
		    ln, pos, ".%s ... %s", roff_name[tok], cp);

	return ROFF_IGN;
}

static int
roff_block_sub(ROFF_ARGS)
{
	enum roff_tok	t;
	int		i, j;

	/*
	 * If a custom end marker is a user-defined or predefined macro
	 * or a request, interpret it.
	 */

	if (r->last->end) {
		for (i = pos, j = 0; r->last->end[j]; j++, i++)
			if (buf->buf[i] != r->last->end[j])
				break;

		if (r->last->end[j] == '\0' &&
		    (buf->buf[i] == '\0' ||
		     buf->buf[i] == ' ' ||
		     buf->buf[i] == '\t')) {
			roffnode_pop(r);
			roffnode_cleanscope(r);

			while (buf->buf[i] == ' ' || buf->buf[i] == '\t')
				i++;

			pos = i;
			if (roff_parse(r, buf->buf, &pos, ln, ppos) !=
			    TOKEN_NONE)
				return ROFF_RERUN;
			return ROFF_IGN;
		}
	}

	/* Handle the standard end marker. */

	t = roff_parse(r, buf->buf, &pos, ln, ppos);
	if (t == ROFF_cblock)
		return roff_cblock(r, t, buf, ln, ppos, pos, offs);

	/* Not an end marker, so append the line to the block. */

	if (tok != ROFF_ig)
		roff_setstr(r, r->last->name, buf->buf + ppos, 2);
	return ROFF_IGN;
}

static int
roff_block_text(ROFF_ARGS)
{

	if (tok != ROFF_ig)
		roff_setstr(r, r->last->name, buf->buf + pos, 2);

	return ROFF_IGN;
}

/*
 * Check for a closing "\}" and handle it.
 * In this function, the final "int *offs" argument is used for
 * different purposes than elsewhere:
 * Input: *offs == 0: caller wants to discard arguments following \}
 *        *offs == 1: caller wants to preserve text following \}
 * Output: *offs = 0: tell caller to discard input line
 *         *offs = 1: tell caller to use input line
 */
static int
roff_cond_checkend(ROFF_ARGS)
{
	char		*ep;
	int		 endloop, irc, rr;

	irc = ROFF_IGN;
	rr = r->last->rule;
	endloop = tok != ROFF_while ? ROFF_IGN :
	    rr ? ROFF_LOOPCONT : ROFF_LOOPEXIT;
	if (roffnode_cleanscope(r))
		irc |= endloop;

	/*
	 * If "\}" occurs on a macro line without a preceding macro or
	 * a text line contains nothing else, drop the line completely.
	 */

	ep = buf->buf + pos;
	if (ep[0] == '\\' && ep[1] == '}' && (ep[2] == '\0' || *offs == 0))
		rr = 0;

	/*
	 * The closing delimiter "\}" rewinds the conditional scope
	 * but is otherwise ignored when interpreting the line.
	 */

	while ((ep = strchr(ep, '\\')) != NULL) {
		switch (ep[1]) {
		case '}':
			if (ep[2] == '\0')
				ep[0] = '\0';
			else if (rr)
				ep[1] = '&';
			else
				memmove(ep, ep + 2, strlen(ep + 2) + 1);
			if (roff_ccond(r, ln, ep - buf->buf))
				irc |= endloop;
			break;
		case '\0':
			++ep;
			break;
		default:
			ep += 2;
			break;
		}
	}
	*offs = rr;
	return irc;
}

/*
 * Parse and process a request or macro line in conditional scope.
 */
static int
roff_cond_sub(ROFF_ARGS)
{
	struct roffnode	*bl;
	int		 irc, rr, spos;
	enum roff_tok	 t;

	rr = 0;  /* If arguments follow "\}", skip them. */
	irc = roff_cond_checkend(r, tok, buf, ln, ppos, pos, &rr);
	spos = pos;
	t = roff_parse(r, buf->buf, &pos, ln, ppos);

	/*
	 * Handle requests and macros if the conditional evaluated
	 * to true or if they are structurally required.
	 * The .break request is always handled specially.
	 */

	if (t == ROFF_break) {
		if (irc & ROFF_LOOPMASK)
			irc = ROFF_IGN | ROFF_LOOPEXIT;
		else if (rr) {
			for (bl = r->last; bl != NULL; bl = bl->parent) {
				bl->rule = 0;
				if (bl->tok == ROFF_while)
					break;
			}
		}
	} else if (rr || (t < TOKEN_NONE && roffs[t].flags & ROFFMAC_STRUCT)) {
		irc |= roff_req_or_macro(r, t, buf, ln, spos, pos, offs);
		if (irc & ROFF_WHILE)
			irc &= ~(ROFF_LOOPCONT | ROFF_LOOPEXIT);
	}
	return irc;
}

/*
 * Parse and process a text line in conditional scope.
 */
static int
roff_cond_text(ROFF_ARGS)
{
	int	 irc, rr;

	rr = 1;  /* If arguments follow "\}", preserve them. */
	irc = roff_cond_checkend(r, tok, buf, ln, ppos, pos, &rr);
	if (rr)
		irc |= ROFF_CONT;
	return irc;
}

/* --- handling of numeric and conditional expressions -------------------- */

/*
 * Parse a single signed integer number.  Stop at the first non-digit.
 * If there is at least one digit, return success and advance the
 * parse point, else return failure and let the parse point unchanged.
 * Ignore overflows, treat them just like the C language.
 */
static int
roff_getnum(const char *v, int *pos, int *res, int flags)
{
	int	 myres, scaled, n, p;

	if (NULL == res)
		res = &myres;

	p = *pos;
	n = v[p] == '-';
	if (n || v[p] == '+')
		p++;

	if (flags & ROFFNUM_WHITE)
		while (isspace((unsigned char)v[p]))
			p++;

	for (*res = 0; isdigit((unsigned char)v[p]); p++)
		*res = 10 * *res + v[p] - '0';
	if (p == *pos + n)
		return 0;

	if (n)
		*res = -*res;

	/* Each number may be followed by one optional scaling unit. */

	switch (v[p]) {
	case 'f':
		scaled = *res * 65536;
		break;
	case 'i':
		scaled = *res * 240;
		break;
	case 'c':
		scaled = *res * 240 / 2.54;
		break;
	case 'v':
	case 'P':
		scaled = *res * 40;
		break;
	case 'm':
	case 'n':
		scaled = *res * 24;
		break;
	case 'p':
		scaled = *res * 10 / 3;
		break;
	case 'u':
		scaled = *res;
		break;
	case 'M':
		scaled = *res * 6 / 25;
		break;
	default:
		scaled = *res;
		p--;
		break;
	}
	if (flags & ROFFNUM_SCALE)
		*res = scaled;

	*pos = p + 1;
	return 1;
}

/*
 * Evaluate a string comparison condition.
 * The first character is the delimiter.
 * Succeed if the string up to its second occurrence
 * matches the string up to its third occurrence.
 * Advance the cursor after the third occurrence
 * or lacking that, to the end of the line.
 */
static int
roff_evalstrcond(const char *v, int *pos)
{
	const char	*s1, *s2, *s3;
	int		 match;

	match = 0;
	s1 = v + *pos;		/* initial delimiter */
	s2 = s1 + 1;		/* for scanning the first string */
	s3 = strchr(s2, *s1);	/* for scanning the second string */

	if (NULL == s3)		/* found no middle delimiter */
		goto out;

	while ('\0' != *++s3) {
		if (*s2 != *s3) {  /* mismatch */
			s3 = strchr(s3, *s1);
			break;
		}
		if (*s3 == *s1) {  /* found the final delimiter */
			match = 1;
			break;
		}
		s2++;
	}

out:
	if (NULL == s3)
		s3 = strchr(s2, '\0');
	else if (*s3 != '\0')
		s3++;
	*pos = s3 - v;
	return match;
}

/*
 * Evaluate an optionally negated single character, numerical,
 * or string condition.
 */
static int
roff_evalcond(struct roff *r, int ln, char *v, int *pos)
{
	const char	*start, *end;
	char		*cp, *name;
	size_t		 sz;
	int		 deftype, len, number, savepos, istrue, wanttrue;

	if ('!' == v[*pos]) {
		wanttrue = 0;
		(*pos)++;
	} else
		wanttrue = 1;

	switch (v[*pos]) {
	case '\0':
		return 0;
	case 'n':
	case 'o':
		(*pos)++;
		return wanttrue;
	case 'e':
	case 't':
	case 'v':
		(*pos)++;
		return !wanttrue;
	case 'c':
		do {
			(*pos)++;
		} while (v[*pos] == ' ');

		/*
		 * Quirk for groff compatibility:
		 * The horizontal tab is neither available nor unavailable.
		 */

		if (v[*pos] == '\t') {
			(*pos)++;
			return 0;
		}

		/* Printable ASCII characters are available. */

		if (v[*pos] != '\\') {
			(*pos)++;
			return wanttrue;
		}

		end = v + ++*pos;
		switch (mandoc_escape(&end, &start, &len)) {
		case ESCAPE_SPECIAL:
			istrue = mchars_spec2cp(start, len) != -1;
			break;
		case ESCAPE_UNICODE:
			istrue = 1;
			break;
		case ESCAPE_NUMBERED:
			istrue = mchars_num2char(start, len) != -1;
			break;
		default:
			istrue = !wanttrue;
			break;
		}
		*pos = end - v;
		return istrue == wanttrue;
	case 'd':
	case 'r':
		cp = v + *pos + 1;
		while (*cp == ' ')
			cp++;
		name = cp;
		sz = roff_getname(r, &cp, ln, cp - v);
		if (sz == 0)
			istrue = 0;
		else if (v[*pos] == 'r')
			istrue = roff_hasregn(r, name, sz);
		else {
			deftype = ROFFDEF_ANY;
		        roff_getstrn(r, name, sz, &deftype);
			istrue = !!deftype;
		}
		*pos = (name + sz) - v;
		return istrue == wanttrue;
	default:
		break;
	}

	savepos = *pos;
	if (roff_evalnum(r, ln, v, pos, &number, ROFFNUM_SCALE))
		return (number > 0) == wanttrue;
	else if (*pos == savepos)
		return roff_evalstrcond(v, pos) == wanttrue;
	else
		return 0;
}

static int
roff_line_ignore(ROFF_ARGS)
{

	return ROFF_IGN;
}

static int
roff_insec(ROFF_ARGS)
{

	mandoc_msg(MANDOCERR_REQ_INSEC, ln, ppos, "%s", roff_name[tok]);
	return ROFF_IGN;
}

static int
roff_unsupp(ROFF_ARGS)
{

	mandoc_msg(MANDOCERR_REQ_UNSUPP, ln, ppos, "%s", roff_name[tok]);
	return ROFF_IGN;
}

static int
roff_cond(ROFF_ARGS)
{
	int	 irc;

	roffnode_push(r, tok, NULL, ln, ppos);

	/*
	 * An `.el' has no conditional body: it will consume the value
	 * of the current rstack entry set in prior `ie' calls or
	 * defaults to DENY.
	 *
	 * If we're not an `el', however, then evaluate the conditional.
	 */

	r->last->rule = tok == ROFF_el ?
	    (r->rstackpos < 0 ? 0 : r->rstack[r->rstackpos--]) :
	    roff_evalcond(r, ln, buf->buf, &pos);

	/*
	 * An if-else will put the NEGATION of the current evaluated
	 * conditional into the stack of rules.
	 */

	if (tok == ROFF_ie) {
		if (r->rstackpos + 1 == r->rstacksz) {
			r->rstacksz += 16;
			r->rstack = mandoc_reallocarray(r->rstack,
			    r->rstacksz, sizeof(int));
		}
		r->rstack[++r->rstackpos] = !r->last->rule;
	}

	/* If the parent has false as its rule, then so do we. */

	if (r->last->parent && !r->last->parent->rule)
		r->last->rule = 0;

	/*
	 * Determine scope.
	 * If there is nothing on the line after the conditional,
	 * not even whitespace, use next-line scope.
	 * Except that .while does not support next-line scope.
	 */

	if (buf->buf[pos] == '\0' && tok != ROFF_while) {
		r->last->endspan = 2;
		goto out;
	}

	while (buf->buf[pos] == ' ')
		pos++;

	/* An opening brace requests multiline scope. */

	if (buf->buf[pos] == '\\' && buf->buf[pos + 1] == '{') {
		r->last->endspan = -1;
		pos += 2;
		while (buf->buf[pos] == ' ')
			pos++;
		goto out;
	}

	/*
	 * Anything else following the conditional causes
	 * single-line scope.  Warn if the scope contains
	 * nothing but trailing whitespace.
	 */

	if (buf->buf[pos] == '\0')
		mandoc_msg(MANDOCERR_COND_EMPTY,
		    ln, ppos, "%s", roff_name[tok]);

	r->last->endspan = 1;

out:
	*offs = pos;
	irc = ROFF_RERUN;
	if (tok == ROFF_while)
		irc |= ROFF_WHILE;
	return irc;
}

static int
roff_ds(ROFF_ARGS)
{
	char		*string;
	const char	*name;
	size_t		 namesz;

	/* Ignore groff compatibility mode for now. */

	if (tok == ROFF_ds1)
		tok = ROFF_ds;
	else if (tok == ROFF_as1)
		tok = ROFF_as;

	/*
	 * The first word is the name of the string.
	 * If it is empty or terminated by an escape sequence,
	 * abort the `ds' request without defining anything.
	 */

	name = string = buf->buf + pos;
	if (*name == '\0')
		return ROFF_IGN;

	namesz = roff_getname(r, &string, ln, pos);
	switch (name[namesz]) {
	case '\\':
		return ROFF_IGN;
	case '\t':
		string = buf->buf + pos + namesz;
		break;
	default:
		break;
	}

	/* Read past the initial double-quote, if any. */
	if (*string == '"')
		string++;

	/* The rest is the value. */
	roff_setstrn(&r->strtab, name, namesz, string, strlen(string),
	    ROFF_as == tok);
	roff_setstrn(&r->rentab, name, namesz, NULL, 0, 0);
	return ROFF_IGN;
}

/*
 * Parse a single operator, one or two characters long.
 * If the operator is recognized, return success and advance the
 * parse point, else return failure and let the parse point unchanged.
 */
static int
roff_getop(const char *v, int *pos, char *res)
{

	*res = v[*pos];

	switch (*res) {
	case '+':
	case '-':
	case '*':
	case '/':
	case '%':
	case '&':
	case ':':
		break;
	case '<':
		switch (v[*pos + 1]) {
		case '=':
			*res = 'l';
			(*pos)++;
			break;
		case '>':
			*res = '!';
			(*pos)++;
			break;
		case '?':
			*res = 'i';
			(*pos)++;
			break;
		default:
			break;
		}
		break;
	case '>':
		switch (v[*pos + 1]) {
		case '=':
			*res = 'g';
			(*pos)++;
			break;
		case '?':
			*res = 'a';
			(*pos)++;
			break;
		default:
			break;
		}
		break;
	case '=':
		if ('=' == v[*pos + 1])
			(*pos)++;
		break;
	default:
		return 0;
	}
	(*pos)++;

	return *res;
}

/*
 * Evaluate either a parenthesized numeric expression
 * or a single signed integer number.
 */
static int
roff_evalpar(struct roff *r, int ln,
	const char *v, int *pos, int *res, int flags)
{

	if ('(' != v[*pos])
		return roff_getnum(v, pos, res, flags);

	(*pos)++;
	if ( ! roff_evalnum(r, ln, v, pos, res, flags | ROFFNUM_WHITE))
		return 0;

	/*
	 * Omission of the closing parenthesis
	 * is an error in validation mode,
	 * but ignored in evaluation mode.
	 */

	if (')' == v[*pos])
		(*pos)++;
	else if (NULL == res)
		return 0;

	return 1;
}

/*
 * Evaluate a complete numeric expression.
 * Proceed left to right, there is no concept of precedence.
 */
static int
roff_evalnum(struct roff *r, int ln, const char *v,
	int *pos, int *res, int flags)
{
	int		 mypos, operand2;
	char		 operator;

	if (NULL == pos) {
		mypos = 0;
		pos = &mypos;
	}

	if (flags & ROFFNUM_WHITE)
		while (isspace((unsigned char)v[*pos]))
			(*pos)++;

	if ( ! roff_evalpar(r, ln, v, pos, res, flags))
		return 0;

	while (1) {
		if (flags & ROFFNUM_WHITE)
			while (isspace((unsigned char)v[*pos]))
				(*pos)++;

		if ( ! roff_getop(v, pos, &operator))
			break;

		if (flags & ROFFNUM_WHITE)
			while (isspace((unsigned char)v[*pos]))
				(*pos)++;

		if ( ! roff_evalpar(r, ln, v, pos, &operand2, flags))
			return 0;

		if (flags & ROFFNUM_WHITE)
			while (isspace((unsigned char)v[*pos]))
				(*pos)++;

		if (NULL == res)
			continue;

		switch (operator) {
		case '+':
			*res += operand2;
			break;
		case '-':
			*res -= operand2;
			break;
		case '*':
			*res *= operand2;
			break;
		case '/':
			if (operand2 == 0) {
				mandoc_msg(MANDOCERR_DIVZERO,
					ln, *pos, "%s", v);
				*res = 0;
				break;
			}
			*res /= operand2;
			break;
		case '%':
			if (operand2 == 0) {
				mandoc_msg(MANDOCERR_DIVZERO,
					ln, *pos, "%s", v);
				*res = 0;
				break;
			}
			*res %= operand2;
			break;
		case '<':
			*res = *res < operand2;
			break;
		case '>':
			*res = *res > operand2;
			break;
		case 'l':
			*res = *res <= operand2;
			break;
		case 'g':
			*res = *res >= operand2;
			break;
		case '=':
			*res = *res == operand2;
			break;
		case '!':
			*res = *res != operand2;
			break;
		case '&':
			*res = *res && operand2;
			break;
		case ':':
			*res = *res || operand2;
			break;
		case 'i':
			if (operand2 < *res)
				*res = operand2;
			break;
		case 'a':
			if (operand2 > *res)
				*res = operand2;
			break;
		default:
			abort();
		}
	}
	return 1;
}

/* --- register management ------------------------------------------------ */

void
roff_setreg(struct roff *r, const char *name, int val, char sign)
{
	roff_setregn(r, name, strlen(name), val, sign, INT_MIN);
}

static void
roff_setregn(struct roff *r, const char *name, size_t len,
    int val, char sign, int step)
{
	struct roffreg	*reg;

	/* Search for an existing register with the same name. */
	reg = r->regtab;

	while (reg != NULL && (reg->key.sz != len ||
	    strncmp(reg->key.p, name, len) != 0))
		reg = reg->next;

	if (NULL == reg) {
		/* Create a new register. */
		reg = mandoc_malloc(sizeof(struct roffreg));
		reg->key.p = mandoc_strndup(name, len);
		reg->key.sz = len;
		reg->val = 0;
		reg->step = 0;
		reg->next = r->regtab;
		r->regtab = reg;
	}

	if ('+' == sign)
		reg->val += val;
	else if ('-' == sign)
		reg->val -= val;
	else
		reg->val = val;
	if (step != INT_MIN)
		reg->step = step;
}

/*
 * Handle some predefined read-only number registers.
 * For now, return -1 if the requested register is not predefined;
 * in case a predefined read-only register having the value -1
 * were to turn up, another special value would have to be chosen.
 */
static int
roff_getregro(const struct roff *r, const char *name)
{

	switch (*name) {
	case '$':  /* Number of arguments of the last macro evaluated. */
		return r->mstackpos < 0 ? 0 : r->mstack[r->mstackpos].argc;
	case 'A':  /* ASCII approximation mode is always off. */
		return 0;
	case 'g':  /* Groff compatibility mode is always on. */
		return 1;
	case 'H':  /* Fixed horizontal resolution. */
		return 24;
	case 'j':  /* Always adjust left margin only. */
		return 0;
	case 'T':  /* Some output device is always defined. */
		return 1;
	case 'V':  /* Fixed vertical resolution. */
		return 40;
	default:
		return -1;
	}
}

int
roff_getreg(struct roff *r, const char *name)
{
	return roff_getregn(r, name, strlen(name), '\0');
}

static int
roff_getregn(struct roff *r, const char *name, size_t len, char sign)
{
	struct roffreg	*reg;
	int		 val;

	if ('.' == name[0] && 2 == len) {
		val = roff_getregro(r, name + 1);
		if (-1 != val)
			return val;
	}

	for (reg = r->regtab; reg; reg = reg->next) {
		if (len == reg->key.sz &&
		    0 == strncmp(name, reg->key.p, len)) {
			switch (sign) {
			case '+':
				reg->val += reg->step;
				break;
			case '-':
				reg->val -= reg->step;
				break;
			default:
				break;
			}
			return reg->val;
		}
	}

	roff_setregn(r, name, len, 0, '\0', INT_MIN);
	return 0;
}

static int
roff_hasregn(const struct roff *r, const char *name, size_t len)
{
	struct roffreg	*reg;
	int		 val;

	if ('.' == name[0] && 2 == len) {
		val = roff_getregro(r, name + 1);
		if (-1 != val)
			return 1;
	}

	for (reg = r->regtab; reg; reg = reg->next)
		if (len == reg->key.sz &&
		    0 == strncmp(name, reg->key.p, len))
			return 1;

	return 0;
}

static void
roff_freereg(struct roffreg *reg)
{
	struct roffreg	*old_reg;

	while (NULL != reg) {
		free(reg->key.p);
		old_reg = reg;
		reg = reg->next;
		free(old_reg);
	}
}

static int
roff_nr(ROFF_ARGS)
{
	char		*key, *val, *step;
	size_t		 keysz;
	int		 iv, is, len;
	char		 sign;

	key = val = buf->buf + pos;
	if (*key == '\0')
		return ROFF_IGN;

	keysz = roff_getname(r, &val, ln, pos);
	if (key[keysz] == '\\' || key[keysz] == '\t')
		return ROFF_IGN;

	sign = *val;
	if (sign == '+' || sign == '-')
		val++;

	len = 0;
	if (roff_evalnum(r, ln, val, &len, &iv, ROFFNUM_SCALE) == 0)
		return ROFF_IGN;

	step = val + len;
	while (isspace((unsigned char)*step))
		step++;
	if (roff_evalnum(r, ln, step, NULL, &is, 0) == 0)
		is = INT_MIN;

	roff_setregn(r, key, keysz, iv, sign, is);
	return ROFF_IGN;
}

static int
roff_rr(ROFF_ARGS)
{
	struct roffreg	*reg, **prev;
	char		*name, *cp;
	size_t		 namesz;

	name = cp = buf->buf + pos;
	if (*name == '\0')
		return ROFF_IGN;
	namesz = roff_getname(r, &cp, ln, pos);
	name[namesz] = '\0';

	prev = &r->regtab;
	while (1) {
		reg = *prev;
		if (reg == NULL || !strcmp(name, reg->key.p))
			break;
		prev = &reg->next;
	}
	if (reg != NULL) {
		*prev = reg->next;
		free(reg->key.p);
		free(reg);
	}
	return ROFF_IGN;
}

/* --- handler functions for roff requests -------------------------------- */

static int
roff_rm(ROFF_ARGS)
{
	const char	 *name;
	char		 *cp;
	size_t		  namesz;

	cp = buf->buf + pos;
	while (*cp != '\0') {
		name = cp;
		namesz = roff_getname(r, &cp, ln, (int)(cp - buf->buf));
		roff_setstrn(&r->strtab, name, namesz, NULL, 0, 0);
		roff_setstrn(&r->rentab, name, namesz, NULL, 0, 0);
		if (name[namesz] == '\\' || name[namesz] == '\t')
			break;
	}
	return ROFF_IGN;
}

static int
roff_it(ROFF_ARGS)
{
	int		 iv;

	/* Parse the number of lines. */

	if ( ! roff_evalnum(r, ln, buf->buf, &pos, &iv, 0)) {
		mandoc_msg(MANDOCERR_IT_NONUM,
		    ln, ppos, "%s", buf->buf + 1);
		return ROFF_IGN;
	}

	while (isspace((unsigned char)buf->buf[pos]))
		pos++;

	/*
	 * Arm the input line trap.
	 * Special-casing "an-trap" is an ugly workaround to cope
	 * with DocBook stupidly fiddling with man(7) internals.
	 */

	roffit_lines = iv;
	roffit_macro = mandoc_strdup(iv != 1 ||
	    strcmp(buf->buf + pos, "an-trap") ?
	    buf->buf + pos : "br");
	return ROFF_IGN;
}

static int
roff_Dd(ROFF_ARGS)
{
	int		 mask;
	enum roff_tok	 t, te;

	switch (tok) {
	case ROFF_Dd:
		tok = MDOC_Dd;
		te = MDOC_MAX;
		if (r->format == 0)
			r->format = MPARSE_MDOC;
		mask = MPARSE_MDOC | MPARSE_QUICK;
		break;
	case ROFF_TH:
		tok = MAN_TH;
		te = MAN_MAX;
		if (r->format == 0)
			r->format = MPARSE_MAN;
		mask = MPARSE_QUICK;
		break;
	default:
		abort();
	}
	if ((r->options & mask) == 0)
		for (t = tok; t < te; t++)
			roff_setstr(r, roff_name[t], NULL, 0);
	return ROFF_CONT;
}

static int
roff_TE(ROFF_ARGS)
{
	r->man->flags &= ~ROFF_NONOFILL;
	if (r->tbl == NULL) {
		mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "TE");
		return ROFF_IGN;
	}
	if (tbl_end(r->tbl, 0) == 0) {
		r->tbl = NULL;
		free(buf->buf);
		buf->buf = mandoc_strdup(".sp");
		buf->sz = 4;
		*offs = 0;
		return ROFF_REPARSE;
	}
	r->tbl = NULL;
	return ROFF_IGN;
}

static int
roff_T_(ROFF_ARGS)
{

	if (NULL == r->tbl)
		mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "T&");
	else
		tbl_restart(ln, ppos, r->tbl);

	return ROFF_IGN;
}

/*
 * Handle in-line equation delimiters.
 */
static int
roff_eqndelim(struct roff *r, struct buf *buf, int pos)
{
	char		*cp1, *cp2;
	const char	*bef_pr, *bef_nl, *mac, *aft_nl, *aft_pr;

	/*
	 * Outside equations, look for an opening delimiter.
	 * If we are inside an equation, we already know it is
	 * in-line, or this function wouldn't have been called;
	 * so look for a closing delimiter.
	 */

	cp1 = buf->buf + pos;
	cp2 = strchr(cp1, r->eqn == NULL ?
	    r->last_eqn->odelim : r->last_eqn->cdelim);
	if (cp2 == NULL)
		return ROFF_CONT;

	*cp2++ = '\0';
	bef_pr = bef_nl = aft_nl = aft_pr = "";

	/* Handle preceding text, protecting whitespace. */

	if (*buf->buf != '\0') {
		if (r->eqn == NULL)
			bef_pr = "\\&";
		bef_nl = "\n";
	}

	/*
	 * Prepare replacing the delimiter with an equation macro
	 * and drop leading white space from the equation.
	 */

	if (r->eqn == NULL) {
		while (*cp2 == ' ')
			cp2++;
		mac = ".EQ";
	} else
		mac = ".EN";

	/* Handle following text, protecting whitespace. */

	if (*cp2 != '\0') {
		aft_nl = "\n";
		if (r->eqn != NULL)
			aft_pr = "\\&";
	}

	/* Do the actual replacement. */

	buf->sz = mandoc_asprintf(&cp1, "%s%s%s%s%s%s%s", buf->buf,
	    bef_pr, bef_nl, mac, aft_nl, aft_pr, cp2) + 1;
	free(buf->buf);
	buf->buf = cp1;

	/* Toggle the in-line state of the eqn subsystem. */

	r->eqn_inline = r->eqn == NULL;
	return ROFF_REPARSE;
}

static int
roff_EQ(ROFF_ARGS)
{
	struct roff_node	*n;

	if (r->man->meta.macroset == MACROSET_MAN)
		man_breakscope(r->man, ROFF_EQ);
	n = roff_node_alloc(r->man, ln, ppos, ROFFT_EQN, TOKEN_NONE);
	if (ln > r->man->last->line)
		n->flags |= NODE_LINE;
	n->eqn = eqn_box_new();
	roff_node_append(r->man, n);
	r->man->next = ROFF_NEXT_SIBLING;

	assert(r->eqn == NULL);
	if (r->last_eqn == NULL)
		r->last_eqn = eqn_alloc();
	else
		eqn_reset(r->last_eqn);
	r->eqn = r->last_eqn;
	r->eqn->node = n;

	if (buf->buf[pos] != '\0')
		mandoc_msg(MANDOCERR_ARG_SKIP, ln, pos,
		    ".EQ %s", buf->buf + pos);

	return ROFF_IGN;
}

static int
roff_EN(ROFF_ARGS)
{
	if (r->eqn != NULL) {
		eqn_parse(r->eqn);
		r->eqn = NULL;
	} else
		mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, ppos, "EN");
	if (buf->buf[pos] != '\0')
		mandoc_msg(MANDOCERR_ARG_SKIP, ln, pos,
		    "EN %s", buf->buf + pos);
	return ROFF_IGN;
}

static int
roff_TS(ROFF_ARGS)
{
	if (r->tbl != NULL) {
		mandoc_msg(MANDOCERR_BLK_BROKEN, ln, ppos, "TS breaks TS");
		tbl_end(r->tbl, 0);
	}
	r->man->flags |= ROFF_NONOFILL;
	r->tbl = tbl_alloc(ppos, ln, r->last_tbl);
	if (r->last_tbl == NULL)
		r->first_tbl = r->tbl;
	r->last_tbl = r->tbl;
	return ROFF_IGN;
}

static int
roff_noarg(ROFF_ARGS)
{
	if (r->man->flags & (MAN_BLINE | MAN_ELINE))
		man_breakscope(r->man, tok);
	if (tok == ROFF_brp)
		tok = ROFF_br;
	roff_elem_alloc(r->man, ln, ppos, tok);
	if (buf->buf[pos] != '\0')
		mandoc_msg(MANDOCERR_ARG_SKIP, ln, pos,
		   "%s %s", roff_name[tok], buf->buf + pos);
	if (tok == ROFF_nf)
		r->man->flags |= ROFF_NOFILL;
	else if (tok == ROFF_fi)
		r->man->flags &= ~ROFF_NOFILL;
	r->man->last->flags |= NODE_LINE | NODE_VALID | NODE_ENDED;
	r->man->next = ROFF_NEXT_SIBLING;
	return ROFF_IGN;
}

static int
roff_onearg(ROFF_ARGS)
{
	struct roff_node	*n;
	char			*cp;
	int			 npos;

	if (r->man->flags & (MAN_BLINE | MAN_ELINE) &&
	    (tok == ROFF_ce || tok == ROFF_rj || tok == ROFF_sp ||
	     tok == ROFF_ti))
		man_breakscope(r->man, tok);

	if (roffce_node != NULL && (tok == ROFF_ce || tok == ROFF_rj)) {
		r->man->last = roffce_node;
		r->man->next = ROFF_NEXT_SIBLING;
	}

	roff_elem_alloc(r->man, ln, ppos, tok);
	n = r->man->last;

	cp = buf->buf + pos;
	if (*cp != '\0') {
		while (*cp != '\0' && *cp != ' ')
			cp++;
		while (*cp == ' ')
			*cp++ = '\0';
		if (*cp != '\0')
			mandoc_msg(MANDOCERR_ARG_EXCESS,
			    ln, (int)(cp - buf->buf),
			    "%s ... %s", roff_name[tok], cp);
		roff_word_alloc(r->man, ln, pos, buf->buf + pos);
	}

	if (tok == ROFF_ce || tok == ROFF_rj) {
		if (r->man->last->type == ROFFT_ELEM) {
			roff_word_alloc(r->man, ln, pos, "1");
			r->man->last->flags |= NODE_NOSRC;
		}
		npos = 0;
		if (roff_evalnum(r, ln, r->man->last->string, &npos,
		    &roffce_lines, 0) == 0) {
			mandoc_msg(MANDOCERR_CE_NONUM,
			    ln, pos, "ce %s", buf->buf + pos);
			roffce_lines = 1;
		}
		if (roffce_lines < 1) {
			r->man->last = r->man->last->parent;
			roffce_node = NULL;
			roffce_lines = 0;
		} else
			roffce_node = r->man->last->parent;
	} else {
		n->flags |= NODE_VALID | NODE_ENDED;
		r->man->last = n;
	}
	n->flags |= NODE_LINE;
	r->man->next = ROFF_NEXT_SIBLING;
	return ROFF_IGN;
}

static int
roff_manyarg(ROFF_ARGS)
{
	struct roff_node	*n;
	char			*sp, *ep;

	roff_elem_alloc(r->man, ln, ppos, tok);
	n = r->man->last;

	for (sp = ep = buf->buf + pos; *sp != '\0'; sp = ep) {
		while (*ep != '\0' && *ep != ' ')
			ep++;
		while (*ep == ' ')
			*ep++ = '\0';
		roff_word_alloc(r->man, ln, sp - buf->buf, sp);
	}

	n->flags |= NODE_LINE | NODE_VALID | NODE_ENDED;
	r->man->last = n;
	r->man->next = ROFF_NEXT_SIBLING;
	return ROFF_IGN;
}

static int
roff_als(ROFF_ARGS)
{
	char		*oldn, *newn, *end, *value;
	size_t		 oldsz, newsz, valsz;

	newn = oldn = buf->buf + pos;
	if (*newn == '\0')
		return ROFF_IGN;

	newsz = roff_getname(r, &oldn, ln, pos);
	if (newn[newsz] == '\\' || newn[newsz] == '\t' || *oldn == '\0')
		return ROFF_IGN;

	end = oldn;
	oldsz = roff_getname(r, &end, ln, oldn - buf->buf);
	if (oldsz == 0)
		return ROFF_IGN;

	valsz = mandoc_asprintf(&value, ".%.*s \\$@\\\"\n",
	    (int)oldsz, oldn);
	roff_setstrn(&r->strtab, newn, newsz, value, valsz, 0);
	roff_setstrn(&r->rentab, newn, newsz, NULL, 0, 0);
	free(value);
	return ROFF_IGN;
}

/*
 * The .break request only makes sense inside conditionals,
 * and that case is already handled in roff_cond_sub().
 */
static int
roff_break(ROFF_ARGS)
{
	mandoc_msg(MANDOCERR_BLK_NOTOPEN, ln, pos, "break");
	return ROFF_IGN;
}

static int
roff_cc(ROFF_ARGS)
{
	const char	*p;

	p = buf->buf + pos;

	if (*p == '\0' || (r->control = *p++) == '.')
		r->control = '\0';

	if (*p != '\0')
		mandoc_msg(MANDOCERR_ARG_EXCESS,
		    ln, p - buf->buf, "cc ... %s", p);

	return ROFF_IGN;
}

static int
roff_char(ROFF_ARGS)
{
	const char	*p, *kp, *vp;
	size_t		 ksz, vsz;
	int		 font;

	/* Parse the character to be replaced. */

	kp = buf->buf + pos;
	p = kp + 1;
	if (*kp == '\0' || (*kp == '\\' &&
	     mandoc_escape(&p, NULL, NULL) != ESCAPE_SPECIAL) ||
	    (*p != ' ' && *p != '\0')) {
		mandoc_msg(MANDOCERR_CHAR_ARG, ln, pos, "char %s", kp);
		return ROFF_IGN;
	}
	ksz = p - kp;
	while (*p == ' ')
		p++;

	/*
	 * If the replacement string contains a font escape sequence,
	 * we have to restore the font at the end.
	 */

	vp = p;
	vsz = strlen(p);
	font = 0;
	while (*p != '\0') {
		if (*p++ != '\\')
			continue;
		switch (mandoc_escape(&p, NULL, NULL)) {
		case ESCAPE_FONT:
		case ESCAPE_FONTROMAN:
		case ESCAPE_FONTITALIC:
		case ESCAPE_FONTBOLD:
		case ESCAPE_FONTBI:
		case ESCAPE_FONTCR:
		case ESCAPE_FONTCB:
		case ESCAPE_FONTCI:
		case ESCAPE_FONTPREV:
			font++;
			break;
		default:
			break;
		}
	}
	if (font > 1)
		mandoc_msg(MANDOCERR_CHAR_FONT,
		    ln, (int)(vp - buf->buf), "%s", vp);

	/*
	 * Approximate the effect of .char using the .tr tables.
	 * XXX In groff, .char and .tr interact differently.
	 */

	if (ksz == 1) {
		if (r->xtab == NULL)
			r->xtab = mandoc_calloc(128, sizeof(*r->xtab));
		assert((unsigned int)*kp < 128);
		free(r->xtab[(int)*kp].p);
		r->xtab[(int)*kp].sz = mandoc_asprintf(&r->xtab[(int)*kp].p,
		    "%s%s", vp, font ? "\fP" : "");
	} else {
		roff_setstrn(&r->xmbtab, kp, ksz, vp, vsz, 0);
		if (font)
			roff_setstrn(&r->xmbtab, kp, ksz, "\\fP", 3, 1);
	}
	return ROFF_IGN;
}

static int
roff_ec(ROFF_ARGS)
{
	const char	*p;

	p = buf->buf + pos;
	if (*p == '\0')
		r->escape = '\\';
	else {
		r->escape = *p;
		if (*++p != '\0')
			mandoc_msg(MANDOCERR_ARG_EXCESS, ln,
			    (int)(p - buf->buf), "ec ... %s", p);
	}
	return ROFF_IGN;
}

static int
roff_eo(ROFF_ARGS)
{
	r->escape = '\0';
	if (buf->buf[pos] != '\0')
		mandoc_msg(MANDOCERR_ARG_SKIP,
		    ln, pos, "eo %s", buf->buf + pos);
	return ROFF_IGN;
}

static int
roff_mc(ROFF_ARGS)
{
	struct roff_node	*n;
	char			*cp;

	/* Parse the first argument. */

	cp = buf->buf + pos;
	if (*cp != '\0')
		cp++;
	if (buf->buf[pos] == '\\') {
		switch (mandoc_escape((const char **)&cp, NULL, NULL)) {
		case ESCAPE_SPECIAL:
		case ESCAPE_UNICODE:
		case ESCAPE_NUMBERED:
			break;
		default:
			*cp = '\0';
			mandoc_msg(MANDOCERR_MC_ESC, ln, pos,
			    "mc %s", buf->buf + pos);
			buf->buf[pos] = '\0';
			break;
		}
	}

	/* Ignore additional arguments. */

	while (*cp == ' ')
		*cp++ = '\0';
	if (*cp != '\0') {
		mandoc_msg(MANDOCERR_MC_DIST, ln, (int)(cp - buf->buf),
		    "mc ... %s", cp);
		*cp = '\0';
	}

	/* Create the .mc node. */

	roff_elem_alloc(r->man, ln, ppos, tok);
	n = r->man->last;
	if (buf->buf[pos] != '\0')
		roff_word_alloc(r->man, ln, pos, buf->buf + pos);
	n->flags |= NODE_LINE | NODE_VALID | NODE_ENDED;
	r->man->last = n;
	r->man->next = ROFF_NEXT_SIBLING;
	return ROFF_IGN;
}

static int
roff_nop(ROFF_ARGS)
{
	while (buf->buf[pos] == ' ')
		pos++;
	*offs = pos;
	return ROFF_RERUN;
}

static int
roff_tr(ROFF_ARGS)
{
	const char	*p, *first, *second;
	size_t		 fsz, ssz;

	p = buf->buf + pos;

	if (*p == '\0') {
		mandoc_msg(MANDOCERR_REQ_EMPTY, ln, ppos, "tr");
		return ROFF_IGN;
	}

	while (*p != '\0') {
		fsz = ssz = 1;

		first = p++;
		if (*first == '\\') {
			if (mandoc_escape(&p, NULL, NULL) == ESCAPE_ERROR)
				return ROFF_IGN;
			fsz = (size_t)(p - first);
		}

		second = p++;
		if (*second == '\\') {
			if (mandoc_escape(&p, NULL, NULL) == ESCAPE_ERROR)
				return ROFF_IGN;
			ssz = (size_t)(p - second);
		} else if (*second == '\0') {
			mandoc_msg(MANDOCERR_TR_ODD, ln,
			    (int)(first - buf->buf), "tr %s", first);
			second = " ";
			p--;
		}

		if (fsz > 1) {
			roff_setstrn(&r->xmbtab, first, fsz,
			    second, ssz, 0);
			continue;
		}

		if (r->xtab == NULL)
			r->xtab = mandoc_calloc(128,
			    sizeof(struct roffstr));

		free(r->xtab[(int)*first].p);
		r->xtab[(int)*first].p = mandoc_strndup(second, ssz);
		r->xtab[(int)*first].sz = ssz;
	}

	return ROFF_IGN;
}

/*
 * Implementation of the .return request.
 * There is no need to call roff_userret() from here.
 * The read module will call that after rewinding the reader stack
 * to the place from where the current macro was called.
 */
static int
roff_return(ROFF_ARGS)
{
	if (r->mstackpos >= 0)
		return ROFF_IGN | ROFF_USERRET;

	mandoc_msg(MANDOCERR_REQ_NOMAC, ln, ppos, "return");
	return ROFF_IGN;
}

static int
roff_rn(ROFF_ARGS)
{
	const char	*value;
	char		*oldn, *newn, *end;
	size_t		 oldsz, newsz;
	int		 deftype;

	oldn = newn = buf->buf + pos;
	if (*oldn == '\0')
		return ROFF_IGN;

	oldsz = roff_getname(r, &newn, ln, pos);
	if (oldn[oldsz] == '\\' || oldn[oldsz] == '\t' || *newn == '\0')
		return ROFF_IGN;

	end = newn;
	newsz = roff_getname(r, &end, ln, newn - buf->buf);
	if (newsz == 0)
		return ROFF_IGN;

	deftype = ROFFDEF_ANY;
	value = roff_getstrn(r, oldn, oldsz, &deftype);
	switch (deftype) {
	case ROFFDEF_USER:
		roff_setstrn(&r->strtab, newn, newsz, value, strlen(value), 0);
		roff_setstrn(&r->strtab, oldn, oldsz, NULL, 0, 0);
		roff_setstrn(&r->rentab, newn, newsz, NULL, 0, 0);
		break;
	case ROFFDEF_PRE:
		roff_setstrn(&r->strtab, newn, newsz, value, strlen(value), 0);
		roff_setstrn(&r->rentab, newn, newsz, NULL, 0, 0);
		break;
	case ROFFDEF_REN:
		roff_setstrn(&r->rentab, newn, newsz, value, strlen(value), 0);
		roff_setstrn(&r->rentab, oldn, oldsz, NULL, 0, 0);
		roff_setstrn(&r->strtab, newn, newsz, NULL, 0, 0);
		break;
	case ROFFDEF_STD:
		roff_setstrn(&r->rentab, newn, newsz, oldn, oldsz, 0);
		roff_setstrn(&r->strtab, newn, newsz, NULL, 0, 0);
		break;
	default:
		roff_setstrn(&r->strtab, newn, newsz, NULL, 0, 0);
		roff_setstrn(&r->rentab, newn, newsz, NULL, 0, 0);
		break;
	}
	return ROFF_IGN;
}

static int
roff_shift(ROFF_ARGS)
{
	struct mctx	*ctx;
	int		 argpos, levels, i;

	argpos = pos;
	levels = 1;
	if (buf->buf[pos] != '\0' &&
	    roff_evalnum(r, ln, buf->buf, &pos, &levels, 0) == 0) {
		mandoc_msg(MANDOCERR_CE_NONUM,
		    ln, pos, "shift %s", buf->buf + pos);
		levels = 1;
	}
	if (r->mstackpos < 0) {
		mandoc_msg(MANDOCERR_REQ_NOMAC, ln, ppos, "shift");
		return ROFF_IGN;
	}
	ctx = r->mstack + r->mstackpos;
	if (levels > ctx->argc) {
		mandoc_msg(MANDOCERR_SHIFT,
		    ln, argpos, "%d, but max is %d", levels, ctx->argc);
		levels = ctx->argc;
	}
	if (levels < 0) {
		mandoc_msg(MANDOCERR_ARG_NEG, ln, argpos, "shift %d", levels);
		levels = 0;
	}
	if (levels == 0)
		return ROFF_IGN;
	for (i = 0; i < levels; i++)
		free(ctx->argv[i]);
	ctx->argc -= levels;
	for (i = 0; i < ctx->argc; i++)
		ctx->argv[i] = ctx->argv[i + levels];
	return ROFF_IGN;
}

static int
roff_so(ROFF_ARGS)
{
	char *name, *cp;

	name = buf->buf + pos;
	mandoc_msg(MANDOCERR_SO, ln, ppos, "so %s", name);

	/*
	 * Handle `so'.  Be EXTREMELY careful, as we shouldn't be
	 * opening anything that's not in our cwd or anything beneath
	 * it.  Thus, explicitly disallow traversing up the file-system
	 * or using absolute paths.
	 */

	if (*name == '/' || strstr(name, "../") || strstr(name, "/..")) {
		mandoc_msg(MANDOCERR_SO_PATH, ln, ppos, ".so %s", name);
		buf->sz = mandoc_asprintf(&cp,
		    ".sp\nSee the file %s.\n.sp", name) + 1;
		free(buf->buf);
		buf->buf = cp;
		*offs = 0;
		return ROFF_REPARSE;
	}

	*offs = pos;
	return ROFF_SO;
}

/* --- user defined strings and macros ------------------------------------ */

static int
roff_userdef(ROFF_ARGS)
{
	struct mctx	 *ctx;
	char		 *arg, *ap, *dst, *src;
	size_t		  sz;

	/* If the macro is empty, ignore it altogether. */

	if (*r->current_string == '\0')
		return ROFF_IGN;

	/* Initialize a new macro stack context. */

	if (++r->mstackpos == r->mstacksz) {
		r->mstack = mandoc_recallocarray(r->mstack,
		    r->mstacksz, r->mstacksz + 8, sizeof(*r->mstack));
		r->mstacksz += 8;
	}
	ctx = r->mstack + r->mstackpos;
	ctx->argc = 0;

	/*
	 * Collect pointers to macro argument strings,
	 * NUL-terminating them and escaping quotes.
	 */

	src = buf->buf + pos;
	while (*src != '\0') {
		if (ctx->argc == ctx->argsz) {
			ctx->argsz += 8;
			ctx->argv = mandoc_reallocarray(ctx->argv,
			    ctx->argsz, sizeof(*ctx->argv));
		}
		arg = roff_getarg(r, &src, ln, &pos);
		sz = 1;  /* For the terminating NUL. */
		for (ap = arg; *ap != '\0'; ap++)
			sz += *ap == '"' ? 4 : 1;
		ctx->argv[ctx->argc++] = dst = mandoc_malloc(sz);
		for (ap = arg; *ap != '\0'; ap++) {
			if (*ap == '"') {
				memcpy(dst, "\\(dq", 4);
				dst += 4;
			} else
				*dst++ = *ap;
		}
		*dst = '\0';
		free(arg);
	}

	/* Replace the macro invocation by the macro definition. */

	free(buf->buf);
	buf->buf = mandoc_strdup(r->current_string);
	buf->sz = strlen(buf->buf) + 1;
	*offs = 0;

	return buf->buf[buf->sz - 2] == '\n' ?
	    ROFF_REPARSE | ROFF_USERCALL : ROFF_IGN | ROFF_APPEND;
}

/*
 * Calling a high-level macro that was renamed with .rn.
 * r->current_string has already been set up by roff_parse().
 */
static int
roff_renamed(ROFF_ARGS)
{
	char	*nbuf;

	buf->sz = mandoc_asprintf(&nbuf, ".%s%s%s", r->current_string,
	    buf->buf[pos] == '\0' ? "" : " ", buf->buf + pos) + 1;
	free(buf->buf);
	buf->buf = nbuf;
	*offs = 0;
	return ROFF_CONT;
}

/*
 * Measure the length in bytes of the roff identifier at *cpp
 * and advance the pointer to the next word.
 */
static size_t
roff_getname(struct roff *r, char **cpp, int ln, int pos)
{
	char	 *name, *cp;
	int	  namesz, inam, iend;

	name = *cpp;
	if (*name == '\0')
		return 0;

	/* Advance cp to the byte after the end of the name. */

	cp = name;
	namesz = 0;
	for (;;) {
		if (*cp == '\0')
			break;
		if (*cp == ' ' || *cp == '\t') {
			cp++;
			break;
		}
		if (*cp != '\\') {
			if (name + namesz < cp) {
				name[namesz] = *cp;
				*cp = ' ';
			}
			namesz++;
			cp++;
			continue;
		}
		if (cp[1] == '{' || cp[1] == '}')
			break;
		if (roff_escape(cp, 0, 0, NULL, &inam,
		    NULL, NULL, &iend) != ESCAPE_UNDEF) {
			mandoc_msg(MANDOCERR_NAMESC, ln, pos,
			    "%.*s%.*s", namesz, name, iend, cp);
			cp += iend;
			break;
		}

		/*
		 * In an identifier, \\, \., \G and so on
		 * are reduced to \, ., G and so on,
		 * vaguely similar to copy mode.
		 */

		name[namesz++] = cp[inam];
		while (iend--) {
			if (cp >= name + namesz)
				*cp = ' ';
			cp++;
		}
	}

	/* Read past spaces. */

	while (*cp == ' ')
		cp++;

	*cpp = cp;
	return namesz;
}

/*
 * Store *string into the user-defined string called *name.
 * To clear an existing entry, call with (*r, *name, NULL, 0).
 * append == 0: replace mode
 * append == 1: single-line append mode
 * append == 2: multiline append mode, append '\n' after each call
 */
static void
roff_setstr(struct roff *r, const char *name, const char *string,
	int append)
{
	size_t	 namesz;

	namesz = strlen(name);
	roff_setstrn(&r->strtab, name, namesz, string,
	    string ? strlen(string) : 0, append);
	roff_setstrn(&r->rentab, name, namesz, NULL, 0, 0);
}

static void
roff_setstrn(struct roffkv **r, const char *name, size_t namesz,
		const char *string, size_t stringsz, int append)
{
	struct roffkv	*n;
	char		*c;
	int		 i;
	size_t		 oldch, newch;

	/* Search for an existing string with the same name. */
	n = *r;

	while (n && (namesz != n->key.sz ||
			strncmp(n->key.p, name, namesz)))
		n = n->next;

	if (NULL == n) {
		/* Create a new string table entry. */
		n = mandoc_malloc(sizeof(struct roffkv));
		n->key.p = mandoc_strndup(name, namesz);
		n->key.sz = namesz;
		n->val.p = NULL;
		n->val.sz = 0;
		n->next = *r;
		*r = n;
	} else if (0 == append) {
		free(n->val.p);
		n->val.p = NULL;
		n->val.sz = 0;
	}

	if (NULL == string)
		return;

	/*
	 * One additional byte for the '\n' in multiline mode,
	 * and one for the terminating '\0'.
	 */
	newch = stringsz + (1 < append ? 2u : 1u);

	if (NULL == n->val.p) {
		n->val.p = mandoc_malloc(newch);
		*n->val.p = '\0';
		oldch = 0;
	} else {
		oldch = n->val.sz;
		n->val.p = mandoc_realloc(n->val.p, oldch + newch);
	}

	/* Skip existing content in the destination buffer. */
	c = n->val.p + (int)oldch;

	/* Append new content to the destination buffer. */
	i = 0;
	while (i < (int)stringsz) {
		/*
		 * Rudimentary roff copy mode:
		 * Handle escaped backslashes.
		 */
		if ('\\' == string[i] && '\\' == string[i + 1])
			i++;
		*c++ = string[i++];
	}

	/* Append terminating bytes. */
	if (1 < append)
		*c++ = '\n';

	*c = '\0';
	n->val.sz = (int)(c - n->val.p);
}

static const char *
roff_getstrn(struct roff *r, const char *name, size_t len,
    int *deftype)
{
	const struct roffkv	*n;
	int			 found, i;
	enum roff_tok		 tok;

	found = 0;
	for (n = r->strtab; n != NULL; n = n->next) {
		if (strncmp(name, n->key.p, len) != 0 ||
		    n->key.p[len] != '\0' || n->val.p == NULL)
			continue;
		if (*deftype & ROFFDEF_USER) {
			*deftype = ROFFDEF_USER;
			return n->val.p;
		} else {
			found = 1;
			break;
		}
	}
	for (n = r->rentab; n != NULL; n = n->next) {
		if (strncmp(name, n->key.p, len) != 0 ||
		    n->key.p[len] != '\0' || n->val.p == NULL)
			continue;
		if (*deftype & ROFFDEF_REN) {
			*deftype = ROFFDEF_REN;
			return n->val.p;
		} else {
			found = 1;
			break;
		}
	}
	for (i = 0; i < PREDEFS_MAX; i++) {
		if (strncmp(name, predefs[i].name, len) != 0 ||
		    predefs[i].name[len] != '\0')
			continue;
		if (*deftype & ROFFDEF_PRE) {
			*deftype = ROFFDEF_PRE;
			return predefs[i].str;
		} else {
			found = 1;
			break;
		}
	}
	if (r->man->meta.macroset != MACROSET_MAN) {
		for (tok = MDOC_Dd; tok < MDOC_MAX; tok++) {
			if (strncmp(name, roff_name[tok], len) != 0 ||
			    roff_name[tok][len] != '\0')
				continue;
			if (*deftype & ROFFDEF_STD) {
				*deftype = ROFFDEF_STD;
				return NULL;
			} else {
				found = 1;
				break;
			}
		}
	}
	if (r->man->meta.macroset != MACROSET_MDOC) {
		for (tok = MAN_TH; tok < MAN_MAX; tok++) {
			if (strncmp(name, roff_name[tok], len) != 0 ||
			    roff_name[tok][len] != '\0')
				continue;
			if (*deftype & ROFFDEF_STD) {
				*deftype = ROFFDEF_STD;
				return NULL;
			} else {
				found = 1;
				break;
			}
		}
	}

	if (found == 0 && *deftype != ROFFDEF_ANY) {
		if (*deftype & ROFFDEF_REN) {
			/*
			 * This might still be a request,
			 * so do not treat it as undefined yet.
			 */
			*deftype = ROFFDEF_UNDEF;
			return NULL;
		}

		/* Using an undefined string defines it to be empty. */

		roff_setstrn(&r->strtab, name, len, "", 0, 0);
		roff_setstrn(&r->rentab, name, len, NULL, 0, 0);
	}

	*deftype = 0;
	return NULL;
}

static void
roff_freestr(struct roffkv *r)
{
	struct roffkv	 *n, *nn;

	for (n = r; n; n = nn) {
		free(n->key.p);
		free(n->val.p);
		nn = n->next;
		free(n);
	}
}

/* --- accessors and utility functions ------------------------------------ */

/*
 * Duplicate an input string, making the appropriate character
 * conversations (as stipulated by `tr') along the way.
 * Returns a heap-allocated string with all the replacements made.
 */
char *
roff_strdup(const struct roff *r, const char *p)
{
	const struct roffkv *cp;
	char		*res;
	const char	*pp;
	size_t		 ssz, sz;
	enum mandoc_esc	 esc;

	if (NULL == r->xmbtab && NULL == r->xtab)
		return mandoc_strdup(p);
	else if ('\0' == *p)
		return mandoc_strdup("");

	/*
	 * Step through each character looking for term matches
	 * (remember that a `tr' can be invoked with an escape, which is
	 * a glyph but the escape is multi-character).
	 * We only do this if the character hash has been initialised
	 * and the string is >0 length.
	 */

	res = NULL;
	ssz = 0;

	while ('\0' != *p) {
		assert((unsigned int)*p < 128);
		if ('\\' != *p && r->xtab && r->xtab[(unsigned int)*p].p) {
			sz = r->xtab[(int)*p].sz;
			res = mandoc_realloc(res, ssz + sz + 1);
			memcpy(res + ssz, r->xtab[(int)*p].p, sz);
			ssz += sz;
			p++;
			continue;
		} else if ('\\' != *p) {
			res = mandoc_realloc(res, ssz + 2);
			res[ssz++] = *p++;
			continue;
		}

		/* Search for term matches. */
		for (cp = r->xmbtab; cp; cp = cp->next)
			if (0 == strncmp(p, cp->key.p, cp->key.sz))
				break;

		if (NULL != cp) {
			/*
			 * A match has been found.
			 * Append the match to the array and move
			 * forward by its keysize.
			 */
			res = mandoc_realloc(res,
			    ssz + cp->val.sz + 1);
			memcpy(res + ssz, cp->val.p, cp->val.sz);
			ssz += cp->val.sz;
			p += (int)cp->key.sz;
			continue;
		}

		/*
		 * Handle escapes carefully: we need to copy
		 * over just the escape itself, or else we might
		 * do replacements within the escape itself.
		 * Make sure to pass along the bogus string.
		 */
		pp = p++;
		esc = mandoc_escape(&p, NULL, NULL);
		if (ESCAPE_ERROR == esc) {
			sz = strlen(pp);
			res = mandoc_realloc(res, ssz + sz + 1);
			memcpy(res + ssz, pp, sz);
			break;
		}
		/*
		 * We bail out on bad escapes.
		 * No need to warn: we already did so when
		 * roff_expand() was called.
		 */
		sz = (int)(p - pp);
		res = mandoc_realloc(res, ssz + sz + 1);
		memcpy(res + ssz, pp, sz);
		ssz += sz;
	}

	res[(int)ssz] = '\0';
	return res;
}

int
roff_getformat(const struct roff *r)
{

	return r->format;
}

/*
 * Find out whether a line is a macro line or not.
 * If it is, adjust the current position and return one; if it isn't,
 * return zero and don't change the current position.
 * If the control character has been set with `.cc', then let that grain
 * precedence.
 * This is slightly contrary to groff, where using the non-breaking
 * control character when `cc' has been invoked will cause the
 * non-breaking macro contents to be printed verbatim.
 */
int
roff_getcontrol(const struct roff *r, const char *cp, int *ppos)
{
	int		pos;

	pos = *ppos;

	if (r->control != '\0' && cp[pos] == r->control)
		pos++;
	else if (r->control != '\0')
		return 0;
	else if ('\\' == cp[pos] && '.' == cp[pos + 1])
		pos += 2;
	else if ('.' == cp[pos] || '\'' == cp[pos])
		pos++;
	else
		return 0;

	while (' ' == cp[pos] || '\t' == cp[pos])
		pos++;

	*ppos = pos;
	return 1;
}