===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.52
retrieving revision 1.230
diff -u -p -r1.52 -r1.230
--- mandoc/roff.c	2008/12/08 16:29:57	1.52
+++ mandoc/roff.c	2014/10/16 01:11:20	1.230
@@ -1,1692 +1,2417 @@
-/* $Id: roff.c,v 1.52 2008/12/08 16:29:57 kristaps Exp $ */
+/*	$Id: roff.c,v 1.230 2014/10/16 01:11:20 schwarze Exp $ */
 /*
- * Copyright (c) 2008 Kristaps Dzonsons <kristaps@kth.se>
+ * Copyright (c) 2010, 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
+ * Copyright (c) 2010-2014 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
- * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
- * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
- * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
- * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
- * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
-#include <sys/param.h>
+#include "config.h"
+
 #include <sys/types.h>
 
 #include <assert.h>
 #include <ctype.h>
-#include <err.h>
-#include <stdarg.h>
-#include <stdlib.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
-#include <time.h>
 
-#include "libmdocml.h"
-#include "private.h"
-#include "roff.h"
+#include "mandoc.h"
+#include "mandoc_aux.h"
+#include "libmandoc.h"
+#include "libroff.h"
 
-/* FIXME: First letters of quoted-text interpreted in rofffindtok. */
-/* FIXME: `No' not implemented. */
-/* TODO: warn if Pp occurs before/after Sh etc. (see mdoc.samples). */
-/* TODO: warn about empty lists. */
-/* TODO: (warn) some sections need specific elements. */
-/* TODO: (warn) NAME section has particular order. */
-/* TODO: unify empty-content tags a la <br />. */
-/* TODO: macros with a set number of arguments? */
-/* TODO: validate Dt macro arguments. */
-/* FIXME: Bl -diag supposed to ignore callable children. */
-/* FIXME: Nm has newline when used in NAME section. */
+/* Maximum number of nested if-else conditionals. */
+#define	RSTACK_MAX	128
 
+/* Maximum number of string expansions per line, to break infinite loops. */
+#define	EXPAND_LIMIT	1000
+
+enum	rofft {
+	ROFF_ad,
+	ROFF_am,
+	ROFF_ami,
+	ROFF_am1,
+	ROFF_as,
+	ROFF_cc,
+	ROFF_ce,
+	ROFF_de,
+	ROFF_dei,
+	ROFF_de1,
+	ROFF_ds,
+	ROFF_el,
+	ROFF_fam,
+	ROFF_hw,
+	ROFF_hy,
+	ROFF_ie,
+	ROFF_if,
+	ROFF_ig,
+	ROFF_it,
+	ROFF_ne,
+	ROFF_nh,
+	ROFF_nr,
+	ROFF_ns,
+	ROFF_pl,
+	ROFF_ps,
+	ROFF_rm,
+	ROFF_rr,
+	ROFF_so,
+	ROFF_ta,
+	ROFF_tr,
+	ROFF_Dd,
+	ROFF_TH,
+	ROFF_TS,
+	ROFF_TE,
+	ROFF_T_,
+	ROFF_EQ,
+	ROFF_EN,
+	ROFF_cblock,
+	ROFF_USERDEF,
+	ROFF_MAX
+};
+
+/*
+ * An incredibly-simple string buffer.
+ */
+struct	roffstr {
+	char		*p; /* nil-terminated buffer */
+	size_t		 sz; /* saved strlen(p) */
+};
+
+/*
+ * A key-value roffstr pair as part of a singly-linked list.
+ */
+struct	roffkv {
+	struct roffstr	 key;
+	struct roffstr	 val;
+	struct roffkv	*next; /* next in list */
+};
+
+/*
+ * A single number register as part of a singly-linked list.
+ */
+struct	roffreg {
+	struct roffstr	 key;
+	int		 val;
+	struct roffreg	*next;
+};
+
+struct	roff {
+	struct mparse	*parse; /* parse point */
+	struct roffnode	*last; /* leaf of stack */
+	int		*rstack; /* stack of inverted `ie' values */
+	struct roffreg	*regtab; /* number registers */
+	struct roffkv	*strtab; /* user-defined strings & macros */
+	struct roffkv	*xmbtab; /* multi-byte trans table (`tr') */
+	struct roffstr	*xtab; /* single-byte trans table (`tr') */
+	const char	*current_string; /* value of last called user macro */
+	struct tbl_node	*first_tbl; /* first table parsed */
+	struct tbl_node	*last_tbl; /* last table parsed */
+	struct tbl_node	*tbl; /* current table being parsed */
+	struct eqn_node	*last_eqn; /* last equation parsed */
+	struct eqn_node	*first_eqn; /* first equation parsed */
+	struct eqn_node	*eqn; /* current equation being parsed */
+	int		 eqn_inline; /* current equation is inline */
+	int		 options; /* parse options */
+	int		 rstacksz; /* current size limit of rstack */
+	int		 rstackpos; /* position in rstack */
+	int		 format; /* current file in mdoc or man format */
+	char		 control; /* control character */
+};
+
 struct	roffnode {
-	int		  tok;			/* Token id. */
-	struct roffnode	 *parent;		/* Parent (or NULL). */
+	enum rofft	 tok; /* type of node */
+	struct roffnode	*parent; /* up one in stack */
+	int		 line; /* parse line */
+	int		 col; /* parse col */
+	char		*name; /* node name, e.g. macro name */
+	char		*end; /* end-rules: custom token */
+	int		 endspan; /* end-rules: next-line or infty */
+	int		 rule; /* current evaluation rule */
 };
 
-struct	rofftree {
-	struct roffnode	 *last;			/* Last parsed node. */
-	char		 *cur;			/* Line start. */
-	struct tm	  tm;			/* `Dd' results. */
-	char		  name[64];		/* `Nm' results. */
-	char		  os[64];		/* `Os' results. */
-	char		  title[64];		/* `Dt' results. */
-	enum roffmsec	  section;
-	char		  volume[64];		/* `Dt' results. */
-	int		  state;
-#define	ROFF_PRELUDE	 (1 << 1)		/* In roff prelude. */
-#define	ROFF_PRELUDE_Os	 (1 << 2)		/* `Os' is parsed. */
-#define	ROFF_PRELUDE_Dt	 (1 << 3)		/* `Dt' is parsed. */
-#define	ROFF_PRELUDE_Dd	 (1 << 4)		/* `Dd' is parsed. */
-#define	ROFF_BODY	 (1 << 5)		/* In roff body. */
-	struct roffcb	  cb;			/* Callbacks. */
-	void		 *arg;			/* Callbacks' arg. */
-	int		  csec;			/* Current section. */
-	int		  asec;			/* Thus-far sections. */
+#define	ROFF_ARGS	 struct roff *r, /* parse ctx */ \
+			 enum rofft tok, /* tok of macro */ \
+			 char **bufp, /* input buffer */ \
+			 size_t *szp, /* size of input buffer */ \
+			 int ln, /* parse line */ \
+			 int ppos, /* original pos in buffer */ \
+			 int pos, /* current pos in buffer */ \
+			 int *offs /* reset offset of buffer data */
+
+typedef	enum rofferr (*roffproc)(ROFF_ARGS);
+
+struct	roffmac {
+	const char	*name; /* macro name */
+	roffproc	 proc; /* process new macro */
+	roffproc	 text; /* process as child text of macro */
+	roffproc	 sub; /* process as child of macro */
+	int		 flags;
+#define	ROFFMAC_STRUCT	(1 << 0) /* always interpret */
+	struct roffmac	*next;
 };
 
-static	struct roffnode	 *roffnode_new(int, struct rofftree *);
-static	void		  roffnode_free(struct rofftree *);
-static	void		  roff_warn(const struct rofftree *, 
-				const char *, char *, ...);
-static	void		  roff_err(const struct rofftree *, 
-				const char *, char *, ...);
-static	int		  roffpurgepunct(struct rofftree *, char **);
-static	int		  roffscan(int, const int *);
-static	int		  rofffindtok(const char *);
-static	int		  rofffindarg(const char *);
-static	int		  rofffindcallable(const char *);
-static	int		  roffismsec(const char *);
-static	int		  roffissec(const char **);
-static	int		  roffispunct(const char *);
-static	int		  roffchecksec(struct rofftree *, 
-				const char *, int);
-static	int		  roffargs(const struct rofftree *,
-				int, char *, char **);
-static	int		  roffargok(int, int);
-static	int		  roffnextopt(const struct rofftree *,
-				int, char ***, char **);
-static	int		  roffparseopts(struct rofftree *, int, 
-				char ***, int *, char **);
-static	int		  roffcall(struct rofftree *, int, char **);
-static	int		  roffexit(struct rofftree *, int);
-static	int 		  roffparse(struct rofftree *, char *);
-static	int		  textparse(struct rofftree *, char *);
-static	int		  roffdata(struct rofftree *, int, char *);
-static	int		  roffspecial(struct rofftree *, int, 
-				const char *, const int *,
-				const char **, size_t, char **);
-static	int		  roffsetname(struct rofftree *, char **);
+struct	predef {
+	const char	*name; /* predefined input name */
+	const char	*str; /* replacement symbol */
+};
 
-#ifdef __linux__ 
-extern	size_t		  strlcat(char *, const char *, size_t);
-extern	size_t		  strlcpy(char *, const char *, size_t);
-extern	int		  vsnprintf(char *, size_t, 
-				const char *, va_list);
-extern	char		 *strptime(const char *, const char *,
-				struct tm *);
-#endif
+#define	PREDEF(__name, __str) \
+	{ (__name), (__str) },
 
-int
-roff_free(struct rofftree *tree, int flush)
-{
-	int		 error, t;
-	struct roffnode	*n;
+static	enum rofft	 roffhash_find(const char *, size_t);
+static	void		 roffhash_init(void);
+static	void		 roffnode_cleanscope(struct roff *);
+static	void		 roffnode_pop(struct roff *);
+static	void		 roffnode_push(struct roff *, enum rofft,
+				const char *, int, int);
+static	enum rofferr	 roff_block(ROFF_ARGS);
+static	enum rofferr	 roff_block_text(ROFF_ARGS);
+static	enum rofferr	 roff_block_sub(ROFF_ARGS);
+static	enum rofferr	 roff_cblock(ROFF_ARGS);
+static	enum rofferr	 roff_cc(ROFF_ARGS);
+static	void		 roff_ccond(struct roff *, int, int);
+static	enum rofferr	 roff_cond(ROFF_ARGS);
+static	enum rofferr	 roff_cond_text(ROFF_ARGS);
+static	enum rofferr	 roff_cond_sub(ROFF_ARGS);
+static	enum rofferr	 roff_ds(ROFF_ARGS);
+static	enum rofferr	 roff_eqndelim(struct roff *,
+				char **, size_t *, int);
+static	int		 roff_evalcond(const char *, int *);
+static	int		 roff_evalnum(const char *, int *, int *, int);
+static	int		 roff_evalpar(const char *, int *, int *);
+static	int		 roff_evalstrcond(const char *, int *);
+static	void		 roff_free1(struct roff *);
+static	void		 roff_freereg(struct roffreg *);
+static	void		 roff_freestr(struct roffkv *);
+static	size_t		 roff_getname(struct roff *, char **, int, int);
+static	int		 roff_getnum(const char *, int *, int *);
+static	int		 roff_getop(const char *, int *, char *);
+static	int		 roff_getregn(const struct roff *,
+				const char *, size_t);
+static	int		 roff_getregro(const char *name);
+static	const char	*roff_getstrn(const struct roff *,
+				const char *, size_t);
+static	enum rofferr	 roff_it(ROFF_ARGS);
+static	enum rofferr	 roff_line_ignore(ROFF_ARGS);
+static	enum rofferr	 roff_nr(ROFF_ARGS);
+static	void		 roff_openeqn(struct roff *, const char *,
+				int, int, const char *);
+static	enum rofft	 roff_parse(struct roff *, char *, int *,
+				int, int);
+static	enum rofferr	 roff_parsetext(char **, size_t *, int, int *);
+static	enum rofferr	 roff_res(struct roff *,
+				char **, size_t *, int, int);
+static	enum rofferr	 roff_rm(ROFF_ARGS);
+static	enum rofferr	 roff_rr(ROFF_ARGS);
+static	void		 roff_setstr(struct roff *,
+				const char *, const char *, int);
+static	void		 roff_setstrn(struct roffkv **, const char *,
+				size_t, const char *, size_t, int);
+static	enum rofferr	 roff_so(ROFF_ARGS);
+static	enum rofferr	 roff_tr(ROFF_ARGS);
+static	enum rofferr	 roff_Dd(ROFF_ARGS);
+static	enum rofferr	 roff_TH(ROFF_ARGS);
+static	enum rofferr	 roff_TE(ROFF_ARGS);
+static	enum rofferr	 roff_TS(ROFF_ARGS);
+static	enum rofferr	 roff_EQ(ROFF_ARGS);
+static	enum rofferr	 roff_EN(ROFF_ARGS);
+static	enum rofferr	 roff_T_(ROFF_ARGS);
+static	enum rofferr	 roff_userdef(ROFF_ARGS);
 
-	error = 0;
+/* See roffhash_find() */
 
-	if ( ! flush)
-		goto end;
+#define	ASCII_HI	 126
+#define	ASCII_LO	 33
+#define	HASHWIDTH	(ASCII_HI - ASCII_LO + 1)
 
-	error = 1;
+static	struct roffmac	*hash[HASHWIDTH];
 
-	if (ROFF_PRELUDE & tree->state) {
-		roff_err(tree, NULL, "prelude never finished");
-		goto end;
-	} else if ( ! (ROFFSec_NAME & tree->asec)) {
-		roff_err(tree, NULL, "missing `NAME' section");
-		goto end;
-	} else if ( ! (ROFFSec_NMASK & tree->asec))
-		roff_warn(tree, NULL, "missing suggested `NAME', "
-				"`SYNOPSIS', `DESCRIPTION' sections");
+static	struct roffmac	 roffs[ROFF_MAX] = {
+	{ "ad", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "am", roff_block, roff_block_text, roff_block_sub, 0, NULL },
+	{ "ami", roff_block, roff_block_text, roff_block_sub, 0, NULL },
+	{ "am1", roff_block, roff_block_text, roff_block_sub, 0, NULL },
+	{ "as", roff_ds, NULL, NULL, 0, NULL },
+	{ "cc", roff_cc, NULL, NULL, 0, NULL },
+	{ "ce", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "de", roff_block, roff_block_text, roff_block_sub, 0, NULL },
+	{ "dei", roff_block, roff_block_text, roff_block_sub, 0, NULL },
+	{ "de1", roff_block, roff_block_text, roff_block_sub, 0, NULL },
+	{ "ds", roff_ds, NULL, NULL, 0, NULL },
+	{ "el", roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT, NULL },
+	{ "fam", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "hw", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "hy", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "ie", roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT, NULL },
+	{ "if", roff_cond, roff_cond_text, roff_cond_sub, ROFFMAC_STRUCT, NULL },
+	{ "ig", roff_block, roff_block_text, roff_block_sub, 0, NULL },
+	{ "it", roff_it, NULL, NULL, 0, NULL },
+	{ "ne", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "nh", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "nr", roff_nr, NULL, NULL, 0, NULL },
+	{ "ns", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "pl", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "ps", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "rm", roff_rm, NULL, NULL, 0, NULL },
+	{ "rr", roff_rr, NULL, NULL, 0, NULL },
+	{ "so", roff_so, NULL, NULL, 0, NULL },
+	{ "ta", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "tr", roff_tr, NULL, NULL, 0, NULL },
+	{ "Dd", roff_Dd, NULL, NULL, 0, NULL },
+	{ "TH", roff_TH, NULL, NULL, 0, NULL },
+	{ "TS", roff_TS, NULL, NULL, 0, NULL },
+	{ "TE", roff_TE, NULL, NULL, 0, NULL },
+	{ "T&", roff_T_, NULL, NULL, 0, NULL },
+	{ "EQ", roff_EQ, NULL, NULL, 0, NULL },
+	{ "EN", roff_EN, NULL, NULL, 0, NULL },
+	{ ".", roff_cblock, NULL, NULL, 0, NULL },
+	{ NULL, roff_userdef, NULL, NULL, 0, NULL },
+};
 
-	for (n = tree->last; n; n = n->parent) {
-		if (0 != tokens[n->tok].ctx) 
-			continue;
-		roff_err(tree, NULL, "closing explicit scope `%s'", 
-				toknames[n->tok]);
-		goto end;
-	}
+/* not currently implemented: Ds em Eq LP Me PP pp Or Rd Sf SH */
+const	char *const __mdoc_reserved[] = {
+	"Ac", "Ad", "An", "Ao", "Ap", "Aq", "Ar", "At",
+	"Bc", "Bd", "Bf", "Bk", "Bl", "Bo", "Bq",
+	"Brc", "Bro", "Brq", "Bsx", "Bt", "Bx",
+	"Cd", "Cm", "Db", "Dc", "Dd", "Dl", "Do", "Dq",
+	"Dt", "Dv", "Dx", "D1",
+	"Ec", "Ed", "Ef", "Ek", "El", "Em",
+	"En", "Eo", "Er", "Es", "Ev", "Ex",
+	"Fa", "Fc", "Fd", "Fl", "Fn", "Fo", "Fr", "Ft", "Fx",
+	"Hf", "Ic", "In", "It", "Lb", "Li", "Lk", "Lp",
+	"Ms", "Mt", "Nd", "Nm", "No", "Ns", "Nx",
+	"Oc", "Oo", "Op", "Os", "Ot", "Ox",
+	"Pa", "Pc", "Pf", "Po", "Pp", "Pq",
+	"Qc", "Ql", "Qo", "Qq", "Re", "Rs", "Rv",
+	"Sc", "Sh", "Sm", "So", "Sq",
+	"Ss", "St", "Sx", "Sy",
+	"Ta", "Tn", "Ud", "Ux", "Va", "Vt", "Xc", "Xo", "Xr",
+	"%A", "%B", "%C", "%D", "%I", "%J", "%N", "%O",
+	"%P", "%Q", "%R", "%T", "%U", "%V",
+	NULL
+};
 
-	while (tree->last) {
-		t = tree->last->tok;
-		if ( ! roffexit(tree, t))
-			goto end;
-	}
+/* not currently implemented: BT DE DS ME MT PT SY TQ YS */
+const	char *const __man_reserved[] = {
+	"AT", "B", "BI", "BR", "DT",
+	"EE", "EN", "EQ", "EX", "HP", "I", "IB", "IP", "IR",
+	"LP", "OP", "P", "PD", "PP",
+	"R", "RB", "RE", "RI", "RS", "SB", "SH", "SM", "SS",
+	"TE", "TH", "TP", "TS", "T&", "UC", "UE", "UR",
+	NULL
+};
 
-	if ( ! (*tree->cb.rofftail)(tree->arg))
-		goto end;
+/* Array of injected predefined strings. */
+#define	PREDEFS_MAX	 38
+static	const struct predef predefs[PREDEFS_MAX] = {
+#include "predefs.in"
+};
 
-	error = 0;
+/* See roffhash_find() */
+#define	ROFF_HASH(p)	(p[0] - ASCII_LO)
 
-end:
+static	int	 roffit_lines;  /* number of lines to delay */
+static	char	*roffit_macro;  /* nil-terminated macro line */
 
-	while (tree->last) 
-		roffnode_free(tree);
 
-	free(tree);
+static void
+roffhash_init(void)
+{
+	struct roffmac	 *n;
+	int		  buc, i;
 
-	return(error ? 0 : 1);
+	for (i = 0; i < (int)ROFF_USERDEF; i++) {
+		assert(roffs[i].name[0] >= ASCII_LO);
+		assert(roffs[i].name[0] <= ASCII_HI);
+
+		buc = ROFF_HASH(roffs[i].name);
+
+		if (NULL != (n = hash[buc])) {
+			for ( ; n->next; n = n->next)
+				/* Do nothing. */ ;
+			n->next = &roffs[i];
+		} else
+			hash[buc] = &roffs[i];
+	}
 }
 
+/*
+ * Look up a roff token by its name.  Returns ROFF_MAX if no macro by
+ * the nil-terminated string name could be found.
+ */
+static enum rofft
+roffhash_find(const char *p, size_t s)
+{
+	int		 buc;
+	struct roffmac	*n;
 
-struct rofftree *
-roff_alloc(const struct roffcb *cb, void *args)
+	/*
+	 * libroff has an extremely simple hashtable, for the time
+	 * being, which simply keys on the first character, which must
+	 * be printable, then walks a chain.  It works well enough until
+	 * optimised.
+	 */
+
+	if (p[0] < ASCII_LO || p[0] > ASCII_HI)
+		return(ROFF_MAX);
+
+	buc = ROFF_HASH(p);
+
+	if (NULL == (n = hash[buc]))
+		return(ROFF_MAX);
+	for ( ; n; n = n->next)
+		if (0 == strncmp(n->name, p, s) && '\0' == n->name[(int)s])
+			return((enum rofft)(n - roffs));
+
+	return(ROFF_MAX);
+}
+
+/*
+ * Pop the current node off of the stack of roff instructions currently
+ * pending.
+ */
+static void
+roffnode_pop(struct roff *r)
 {
-	struct rofftree	*tree;
+	struct roffnode	*p;
 
-	assert(args);
-	assert(cb);
+	assert(r->last);
+	p = r->last;
 
-	if (NULL == (tree = calloc(1, sizeof(struct rofftree))))
-		err(1, "calloc");
+	r->last = r->last->parent;
+	free(p->name);
+	free(p->end);
+	free(p);
+}
 
-	tree->state = ROFF_PRELUDE;
-	tree->arg = args;
-	tree->section = ROFF_MSEC_MAX;
+/*
+ * Push a roff node onto the instruction stack.  This must later be
+ * removed with roffnode_pop().
+ */
+static void
+roffnode_push(struct roff *r, enum rofft tok, const char *name,
+		int line, int col)
+{
+	struct roffnode	*p;
 
-	(void)memcpy(&tree->cb, cb, sizeof(struct roffcb));
+	p = mandoc_calloc(1, sizeof(struct roffnode));
+	p->tok = tok;
+	if (name)
+		p->name = mandoc_strdup(name);
+	p->parent = r->last;
+	p->line = line;
+	p->col = col;
+	p->rule = p->parent ? p->parent->rule : 0;
 
-	return(tree);
+	r->last = p;
 }
 
+static void
+roff_free1(struct roff *r)
+{
+	struct tbl_node	*tbl;
+	struct eqn_node	*e;
+	int		 i;
 
-int
-roff_engine(struct rofftree *tree, char *buf)
+	while (NULL != (tbl = r->first_tbl)) {
+		r->first_tbl = tbl->next;
+		tbl_free(tbl);
+	}
+	r->first_tbl = r->last_tbl = r->tbl = NULL;
+
+	while (NULL != (e = r->first_eqn)) {
+		r->first_eqn = e->next;
+		eqn_free(e);
+	}
+	r->first_eqn = r->last_eqn = r->eqn = NULL;
+
+	while (r->last)
+		roffnode_pop(r);
+
+	free (r->rstack);
+	r->rstack = NULL;
+	r->rstacksz = 0;
+	r->rstackpos = -1;
+
+	roff_freereg(r->regtab);
+	r->regtab = NULL;
+
+	roff_freestr(r->strtab);
+	roff_freestr(r->xmbtab);
+	r->strtab = r->xmbtab = NULL;
+
+	if (r->xtab)
+		for (i = 0; i < 128; i++)
+			free(r->xtab[i].p);
+	free(r->xtab);
+	r->xtab = NULL;
+}
+
+void
+roff_reset(struct roff *r)
 {
 
-	tree->cur = buf;
-	assert(buf);
+	roff_free1(r);
+	r->format = r->options & (MPARSE_MDOC | MPARSE_MAN);
+	r->control = 0;
+}
 
-	if (0 == *buf) {
-		roff_err(tree, buf, "blank line");
-		return(0);
-	} else if ('.' != *buf)
-		return(textparse(tree, buf));
+void
+roff_free(struct roff *r)
+{
 
-	return(roffparse(tree, buf));
+	roff_free1(r);
+	free(r);
 }
 
+struct roff *
+roff_alloc(struct mparse *parse, int options)
+{
+	struct roff	*r;
 
-static int
-textparse(struct rofftree *tree, char *buf)
+	r = mandoc_calloc(1, sizeof(struct roff));
+	r->parse = parse;
+	r->options = options;
+	r->format = options & (MPARSE_MDOC | MPARSE_MAN);
+	r->rstackpos = -1;
+
+	roffhash_init();
+
+	return(r);
+}
+
+/*
+ * In the current line, expand escape sequences that tend to get
+ * used in numerical expressions and conditional requests.
+ * Also check the syntax of the remaining escape sequences.
+ */
+static enum rofferr
+roff_res(struct roff *r, char **bufp, size_t *szp, int ln, int pos)
 {
-	char		*bufp;
+	char		 ubuf[24]; /* buffer to print the number */
+	const char	*start;	/* start of the string to process */
+	char		*stesc;	/* start of an escape sequence ('\\') */
+	const char	*stnam;	/* start of the name, after "[(*" */
+	const char	*cp;	/* end of the name, e.g. before ']' */
+	const char	*res;	/* the string to be substituted */
+	char		*nbuf;	/* new buffer to copy bufp to */
+	size_t		 maxl;  /* expected length of the escape name */
+	size_t		 naml;	/* actual length of the escape name */
+	int		 expand_count;	/* to avoid infinite loops */
+	int		 npos;	/* position in numeric expression */
+	int		 arg_complete; /* argument not interrupted by eol */
+	char		 term;	/* character terminating the escape */
 
-	/* TODO: literal parsing. */
+	expand_count = 0;
+	start = *bufp + pos;
+	stesc = strchr(start, '\0') - 1;
+	while (stesc-- > start) {
 
-	if ( ! (ROFF_BODY & tree->state)) {
-		roff_err(tree, buf, "data not in body");
-		return(0);
-	}
+		/* Search backwards for the next backslash. */
 
-	/* LINTED */
-	while (*buf) {
-		while (*buf && isspace(*buf))
-			buf++;
+		if ('\\' != *stesc)
+			continue;
 
-		if (0 == *buf)
+		/* If it is escaped, skip it. */
+
+		for (cp = stesc - 1; cp >= start; cp--)
+			if ('\\' != *cp)
+				break;
+
+		if (0 == (stesc - cp) % 2) {
+			stesc = (char *)cp;
+			continue;
+		}
+
+		/* Decide whether to expand or to check only. */
+
+		term = '\0';
+		cp = stesc + 1;
+		switch (*cp) {
+		case '*':
+			res = NULL;
 			break;
+		case 'B':
+			/* FALLTHROUGH */
+		case 'w':
+			term = cp[1];
+			/* FALLTHROUGH */
+		case 'n':
+			res = ubuf;
+			break;
+		default:
+			if (ESCAPE_ERROR == mandoc_escape(&cp, NULL, NULL))
+				mandoc_vmsg(MANDOCERR_ESC_BAD,
+				    r->parse, ln, (int)(stesc - *bufp),
+				    "%.*s", (int)(cp - stesc), stesc);
+			continue;
+		}
 
-		bufp = buf++;
+		if (EXPAND_LIMIT < ++expand_count) {
+			mandoc_msg(MANDOCERR_ROFFLOOP, r->parse,
+			    ln, (int)(stesc - *bufp), NULL);
+			return(ROFF_IGN);
+		}
 
-		while (*buf && ! isspace(*buf))
-			buf++;
+		/*
+		 * The third character decides the length
+		 * of the name of the string or register.
+		 * Save a pointer to the name.
+		 */
 
-		if (0 != *buf) {
-			*buf++ = 0;
-			if ( ! roffdata(tree, 1, bufp))
-				return(0);
+		if ('\0' == term) {
+			switch (*++cp) {
+			case '\0':
+				maxl = 0;
+				break;
+			case '(':
+				cp++;
+				maxl = 2;
+				break;
+			case '[':
+				cp++;
+				term = ']';
+				maxl = 0;
+				break;
+			default:
+				maxl = 1;
+				break;
+			}
+		} else {
+			cp += 2;
+			maxl = 0;
+		}
+		stnam = cp;
+
+		/* Advance to the end of the name. */
+
+		arg_complete = 1;
+		for (naml = 0; 0 == maxl || naml < maxl; naml++, cp++) {
+			if ('\0' == *cp) {
+				mandoc_msg(MANDOCERR_ESC_BAD, r->parse,
+				    ln, (int)(stesc - *bufp), stesc);
+				arg_complete = 0;
+				break;
+			}
+			if (0 == maxl && *cp == term) {
+				cp++;
+				break;
+			}
+		}
+
+		/*
+		 * Retrieve the replacement string; if it is
+		 * undefined, resume searching for escapes.
+		 */
+
+		switch (stesc[1]) {
+		case '*':
+			if (arg_complete)
+				res = roff_getstrn(r, stnam, naml);
+			break;
+		case 'B':
+			npos = 0;
+			ubuf[0] = arg_complete &&
+			    roff_evalnum(stnam, &npos, NULL, 0) &&
+			    stnam + npos + 1 == cp ? '1' : '0';
+			ubuf[1] = '\0';
+			break;
+		case 'n':
+			if (arg_complete)
+				(void)snprintf(ubuf, sizeof(ubuf), "%d",
+				    roff_getregn(r, stnam, naml));
+			else
+				ubuf[0] = '\0';
+			break;
+		case 'w':
+			/* use even incomplete args */
+			(void)snprintf(ubuf, sizeof(ubuf), "%d",
+			    24 * (int)naml);
+			break;
+		}
+
+		if (NULL == res) {
+			mandoc_vmsg(MANDOCERR_STR_UNDEF,
+			    r->parse, ln, (int)(stesc - *bufp),
+			    "%.*s", (int)naml, stnam);
+			res = "";
+		}
+
+		/* Replace the escape sequence by the string. */
+
+		*stesc = '\0';
+		*szp = mandoc_asprintf(&nbuf, "%s%s%s",
+		    *bufp, res, cp) + 1;
+
+		/* Prepare for the next replacement. */
+
+		start = nbuf + pos;
+		stesc = nbuf + (stesc - *bufp) + strlen(res);
+		free(*bufp);
+		*bufp = nbuf;
+	}
+	return(ROFF_CONT);
+}
+
+/*
+ * Process text streams:
+ * Convert all breakable hyphens into ASCII_HYPH.
+ * Decrement and spring input line trap.
+ */
+static enum rofferr
+roff_parsetext(char **bufp, size_t *szp, int pos, int *offs)
+{
+	size_t		 sz;
+	const char	*start;
+	char		*p;
+	int		 isz;
+	enum mandoc_esc	 esc;
+
+	start = p = *bufp + pos;
+
+	while ('\0' != *p) {
+		sz = strcspn(p, "-\\");
+		p += sz;
+
+		if ('\0' == *p)
+			break;
+
+		if ('\\' == *p) {
+			/* Skip over escapes. */
+			p++;
+			esc = mandoc_escape((const char **)&p, NULL, NULL);
+			if (ESCAPE_ERROR == esc)
+				break;
 			continue;
+		} else if (p == start) {
+			p++;
+			continue;
 		}
 
-		if ( ! roffdata(tree, 1, bufp))
-			return(0);
-		break;
+		if (isalpha((unsigned char)p[-1]) &&
+		    isalpha((unsigned char)p[1]))
+			*p = ASCII_HYPH;
+		p++;
 	}
 
-	return(1);
+	/* Spring the input line trap. */
+	if (1 == roffit_lines) {
+		isz = mandoc_asprintf(&p, "%s\n.%s", *bufp, roffit_macro);
+		free(*bufp);
+		*bufp = p;
+		*szp = isz + 1;
+		*offs = 0;
+		free(roffit_macro);
+		roffit_lines = 0;
+		return(ROFF_REPARSE);
+	} else if (1 < roffit_lines)
+		--roffit_lines;
+	return(ROFF_CONT);
 }
 
-
-static int
-roffargs(const struct rofftree *tree, 
-		int tok, char *buf, char **argv)
+enum rofferr
+roff_parseln(struct roff *r, int ln, char **bufp,
+		size_t *szp, int pos, int *offs)
 {
-	int		 i;
-	char		*p;
+	enum rofft	 t;
+	enum rofferr	 e;
+	int		 ppos, ctl;
 
-	assert(tok >= 0 && tok < ROFF_MAX);
-	assert('.' == *buf);
+	/* Handle in-line equation delimiters. */
 
-	p = buf;
+	if (r->last_eqn != NULL && r->last_eqn->delim &&
+	    (r->eqn == NULL || r->eqn_inline)) {
+		e = roff_eqndelim(r, bufp, szp, pos);
+		if (e == ROFF_REPARSE)
+			return(e);
+		assert(e == ROFF_CONT);
+	}
 
+	/* Expand some escape sequences. */
+
+	e = roff_res(r, bufp, szp, ln, pos);
+	if (ROFF_IGN == e)
+		return(e);
+	assert(ROFF_CONT == e);
+
+	ppos = pos;
+	ctl = roff_getcontrol(r, *bufp, &pos);
+
 	/*
-	 * This is an ugly little loop.  It parses a line into
-	 * space-delimited tokens.  If a quote mark is encountered, a
-	 * token is alloted the entire quoted text.  If whitespace is
-	 * escaped, it's included in the prior alloted token.
+	 * First, if a scope is open and we're not a macro, pass the
+	 * text through the macro's filter.  If a scope isn't open and
+	 * we're not a macro, just let it through.
+	 * Finally, if there's an equation scope open, divert it into it
+	 * no matter our state.
 	 */
 
-	/* LINTED */
-	for (i = 0; *buf && i < ROFF_MAXLINEARG; i++) {
-		if ('\"' == *buf) {
-			argv[i] = ++buf;
-			while (*buf && '\"' != *buf)
-				buf++;
-			if (0 == *buf) {
-				roff_err(tree, argv[i], "unclosed "
-						"quote in argument "
-						"list for `%s'", 
-						toknames[tok]);
-				return(0);
-			}
-		} else { 
-			argv[i] = buf++;
-			while (*buf) {
-				if ( ! isspace(*buf)) {
-					buf++;
-					continue;
-				}
-				if (*(buf - 1) == '\\') {
-					buf++;
-					continue;
-				}
-				break;
-			}
-			if (0 == *buf)
-				continue;
-		}
-		*buf++ = 0;
-		while (*buf && isspace(*buf))
-			buf++;
+	if (r->last && ! ctl) {
+		t = r->last->tok;
+		assert(roffs[t].text);
+		e = (*roffs[t].text)(r, t, bufp, szp, ln, pos, pos, offs);
+		assert(ROFF_IGN == e || ROFF_CONT == e);
+		if (ROFF_CONT != e)
+			return(e);
 	}
+	if (r->eqn)
+		return(eqn_read(&r->eqn, ln, *bufp, ppos, offs));
+	if ( ! ctl) {
+		if (r->tbl)
+			return(tbl_read(r->tbl, ln, *bufp, pos));
+		return(roff_parsetext(bufp, szp, pos, offs));
+	}
 
-	assert(i > 0);
-	if (ROFF_MAXLINEARG == i && *buf) {
-		roff_err(tree, p, "too many arguments for `%s'", toknames
-				[tok]);
-		return(0);
+	/* Skip empty request lines. */
+
+	if ((*bufp)[pos] == '"') {
+		mandoc_msg(MANDOCERR_COMMENT_BAD, r->parse,
+		    ln, pos, NULL);
+		return(ROFF_IGN);
+	} else if ((*bufp)[pos] == '\0')
+		return(ROFF_IGN);
+
+	/*
+	 * If a scope is open, go to the child handler for that macro,
+	 * as it may want to preprocess before doing anything with it.
+	 * Don't do so if an equation is open.
+	 */
+
+	if (r->last) {
+		t = r->last->tok;
+		assert(roffs[t].sub);
+		return((*roffs[t].sub)(r, t, bufp, szp,
+		    ln, ppos, pos, offs));
 	}
 
-	argv[i] = NULL;
-	return(1);
+	/*
+	 * Lastly, as we've no scope open, try to look up and execute
+	 * the new macro.  If no macro is found, simply return and let
+	 * the compilers handle it.
+	 */
+
+	if (ROFF_MAX == (t = roff_parse(r, *bufp, &pos, ln, ppos)))
+		return(ROFF_CONT);
+
+	assert(roffs[t].proc);
+	return((*roffs[t].proc)(r, t, bufp, szp, ln, ppos, pos, offs));
 }
 
+void
+roff_endparse(struct roff *r)
+{
 
-static int
-roffscan(int tok, const int *tokv)
+	if (r->last)
+		mandoc_msg(MANDOCERR_BLK_NOEND, r->parse,
+		    r->last->line, r->last->col,
+		    roffs[r->last->tok].name);
+
+	if (r->eqn) {
+		mandoc_msg(MANDOCERR_BLK_NOEND, r->parse,
+		    r->eqn->eqn.ln, r->eqn->eqn.pos, "EQ");
+		eqn_end(&r->eqn);
+	}
+
+	if (r->tbl) {
+		mandoc_msg(MANDOCERR_BLK_NOEND, r->parse,
+		    r->tbl->line, r->tbl->pos, "TS");
+		tbl_end(&r->tbl);
+	}
+}
+
+/*
+ * Parse a roff node's type from the input buffer.  This must be in the
+ * form of ".foo xxx" in the usual way.
+ */
+static enum rofft
+roff_parse(struct roff *r, char *buf, int *pos, int ln, int ppos)
 {
+	char		*cp;
+	const char	*mac;
+	size_t		 maclen;
+	enum rofft	 t;
 
-	if (NULL == tokv)
-		return(1);
+	cp = buf + *pos;
 
-	for ( ; ROFF_MAX != *tokv; tokv++) 
-		if (tok == *tokv)
-			return(1);
+	if ('\0' == *cp || '"' == *cp || '\t' == *cp || ' ' == *cp)
+		return(ROFF_MAX);
 
-	return(0);
+	mac = cp;
+	maclen = roff_getname(r, &cp, ln, ppos);
+
+	t = (r->current_string = roff_getstrn(r, mac, maclen))
+	    ? ROFF_USERDEF : roffhash_find(mac, maclen);
+
+	if (ROFF_MAX != t)
+		*pos = cp - buf;
+
+	return(t);
 }
 
+static enum rofferr
+roff_cblock(ROFF_ARGS)
+{
 
-static int
-roffparse(struct rofftree *tree, char *buf)
+	/*
+	 * A block-close `..' should only be invoked as a child of an
+	 * ignore macro, otherwise raise a warning and just ignore it.
+	 */
+
+	if (NULL == r->last) {
+		mandoc_msg(MANDOCERR_BLK_NOTOPEN, r->parse,
+		    ln, ppos, "..");
+		return(ROFF_IGN);
+	}
+
+	switch (r->last->tok) {
+	case ROFF_am:
+		/* ROFF_am1 is remapped to ROFF_am in roff_block(). */
+		/* FALLTHROUGH */
+	case ROFF_ami:
+		/* FALLTHROUGH */
+	case ROFF_de:
+		/* ROFF_de1 is remapped to ROFF_de in roff_block(). */
+		/* FALLTHROUGH */
+	case ROFF_dei:
+		/* FALLTHROUGH */
+	case ROFF_ig:
+		break;
+	default:
+		mandoc_msg(MANDOCERR_BLK_NOTOPEN, r->parse,
+		    ln, ppos, "..");
+		return(ROFF_IGN);
+	}
+
+	if ((*bufp)[pos])
+		mandoc_vmsg(MANDOCERR_ARG_SKIP, r->parse, ln, pos,
+		    ".. %s", *bufp + pos);
+
+	roffnode_pop(r);
+	roffnode_cleanscope(r);
+	return(ROFF_IGN);
+
+}
+
+static void
+roffnode_cleanscope(struct roff *r)
 {
-	int		  tok, t;
-	struct roffnode	 *n;
-	char		 *argv[ROFF_MAXLINEARG];
-	char		**argvp;
 
-	if (0 != *buf && 0 != *(buf + 1) && 0 != *(buf + 2))
-		if (0 == strncmp(buf, ".\\\"", 3))
-			return(1);
+	while (r->last) {
+		if (--r->last->endspan != 0)
+			break;
+		roffnode_pop(r);
+	}
+}
 
-	if (ROFF_MAX == (tok = rofffindtok(buf + 1))) {
-		roff_err(tree, buf, "bogus line macro");
-		return(0);
-	} else if ( ! roffargs(tree, tok, buf, argv)) 
-		return(0);
+static void
+roff_ccond(struct roff *r, int ln, int ppos)
+{
 
-	argvp = (char **)argv;
+	if (NULL == r->last) {
+		mandoc_msg(MANDOCERR_BLK_NOTOPEN, r->parse,
+		    ln, ppos, "\\}");
+		return;
+	}
 
-	/* 
-	 * Prelude macros break some assumptions, so branch now. 
-	 */
-	
-	if (ROFF_PRELUDE & tree->state) {
-		assert(NULL == tree->last);
-		return(roffcall(tree, tok, argvp));
-	} 
+	switch (r->last->tok) {
+	case ROFF_el:
+		/* FALLTHROUGH */
+	case ROFF_ie:
+		/* FALLTHROUGH */
+	case ROFF_if:
+		break;
+	default:
+		mandoc_msg(MANDOCERR_BLK_NOTOPEN, r->parse,
+		    ln, ppos, "\\}");
+		return;
+	}
 
-	assert(ROFF_BODY & tree->state);
+	if (r->last->endspan > -1) {
+		mandoc_msg(MANDOCERR_BLK_NOTOPEN, r->parse,
+		    ln, ppos, "\\}");
+		return;
+	}
 
-	/* 
-	 * First check that our possible parents and parent's possible
-	 * children are satisfied.  
-	 */
+	roffnode_pop(r);
+	roffnode_cleanscope(r);
+	return;
+}
 
-	if (tree->last && ! roffscan
-			(tree->last->tok, tokens[tok].parents)) {
-		roff_err(tree, *argvp, "`%s' has invalid parent `%s'",
-				toknames[tok], 
-				toknames[tree->last->tok]);
-		return(0);
-	} 
+static enum rofferr
+roff_block(ROFF_ARGS)
+{
+	const char	*name;
+	char		*iname, *cp;
+	size_t		 namesz;
 
-	if (tree->last && ! roffscan
-			(tok, tokens[tree->last->tok].children)) {
-		roff_err(tree, *argvp, "`%s' is invalid child of `%s'",
-				toknames[tok],
-				toknames[tree->last->tok]);
-		return(0);
+	/* Ignore groff compatibility mode for now. */
+
+	if (ROFF_de1 == tok)
+		tok = ROFF_de;
+	else if (ROFF_am1 == tok)
+		tok = ROFF_am;
+
+	/* Parse the macro name argument. */
+
+	cp = *bufp + pos;
+	if (ROFF_ig == tok) {
+		iname = NULL;
+		namesz = 0;
+	} else {
+		iname = cp;
+		namesz = roff_getname(r, &cp, ln, ppos);
+		iname[namesz] = '\0';
 	}
 
-	/*
-	 * Branch if we're not a layout token.
-	 */
+	/* Resolve the macro name argument if it is indirect. */
 
-	if (ROFF_LAYOUT != tokens[tok].type)
-		return(roffcall(tree, tok, argvp));
-	if (0 == tokens[tok].ctx)
-		return(roffcall(tree, tok, argvp));
+	if (namesz && (ROFF_dei == tok || ROFF_ami == tok)) {
+		if (NULL == (name = roff_getstrn(r, iname, namesz))) {
+			mandoc_vmsg(MANDOCERR_STR_UNDEF,
+			    r->parse, ln, (int)(iname - *bufp),
+			    "%.*s", (int)namesz, iname);
+			namesz = 0;
+		} else
+			namesz = strlen(name);
+	} else
+		name = iname;
 
+	if (0 == namesz && ROFF_ig != tok) {
+		mandoc_msg(MANDOCERR_REQ_EMPTY, r->parse,
+		    ln, ppos, roffs[tok].name);
+		return(ROFF_IGN);
+	}
+
+	roffnode_push(r, tok, name, ln, ppos);
+
 	/*
-	 * First consider implicit-end tags, like as follows:
-	 *	.Sh SECTION 1
-	 *	.Sh SECTION 2
-	 * In this, we want to close the scope of the NAME section.  If
-	 * there's an intermediary implicit-end tag, such as
-	 *	.Sh SECTION 1
-	 *	.Ss Subsection 1
-	 *	.Sh SECTION 2
-	 * then it must be closed as well.
+	 * At the beginning of a `de' macro, clear the existing string
+	 * with the same name, if there is one.  New content will be
+	 * appended from roff_block_text() in multiline mode.
 	 */
 
-	if (tok == tokens[tok].ctx) {
-		/* 
-		 * First search up to the point where we must close.
-		 * If one doesn't exist, then we can open a new scope.
-		 */
+	if (ROFF_de == tok || ROFF_dei == tok)
+		roff_setstrn(&r->strtab, name, namesz, "", 0, 0);
 
-		for (n = tree->last; n; n = n->parent) {
-			assert(0 == tokens[n->tok].ctx ||
-					n->tok == tokens[n->tok].ctx);
-			if (n->tok == tok)
-				break;
-			if (ROFF_SHALLOW & tokens[tok].flags) {
-				n = NULL;
-				break;
-			}
-			if (tokens[n->tok].ctx == n->tok)
-				continue;
-			roff_err(tree, *argv, "`%s' breaks `%s' scope",
-					toknames[tok], toknames[n->tok]);
-			return(0);
-		}
+	if ('\0' == *cp)
+		return(ROFF_IGN);
 
-		/*
-		 * Create a new scope, as no previous one exists to
-		 * close out.
-		 */
+	/* Get the custom end marker. */
 
-		if (NULL == n)
-			return(roffcall(tree, tok, argvp));
+	iname = cp;
+	namesz = roff_getname(r, &cp, ln, ppos);
 
-		/* 
-		 * Close out all intermediary scoped blocks, then hang
-		 * the current scope from our predecessor's parent.
-		 */
+	/* Resolve the end marker if it is indirect. */
 
-		do {
-			t = tree->last->tok;
-			if ( ! roffexit(tree, t))
-				return(0);
-		} while (t != tok);
+	if (namesz && (ROFF_dei == tok || ROFF_ami == tok)) {
+		if (NULL == (name = roff_getstrn(r, iname, namesz))) {
+			mandoc_vmsg(MANDOCERR_STR_UNDEF,
+			    r->parse, ln, (int)(iname - *bufp),
+			    "%.*s", (int)namesz, iname);
+			namesz = 0;
+		} else
+			namesz = strlen(name);
+	} else
+		name = iname;
 
-		return(roffcall(tree, tok, argvp));
-	}
+	if (namesz)
+		r->last->end = mandoc_strndup(name, namesz);
 
+	if ('\0' != *cp)
+		mandoc_vmsg(MANDOCERR_ARG_EXCESS, r->parse,
+		    ln, pos, ".%s ... %s", roffs[tok].name, cp);
+
+	return(ROFF_IGN);
+}
+
+static enum rofferr
+roff_block_sub(ROFF_ARGS)
+{
+	enum rofft	t;
+	int		i, j;
+
 	/*
-	 * Now consider explicit-end tags, where we want to close back
-	 * to a specific tag.  Example:
-	 * 	.Bl
-	 * 	.It Item.
-	 * 	.El
-	 * In this, the `El' tag closes out the scope of `Bl'.
+	 * First check whether a custom macro exists at this level.  If
+	 * it does, then check against it.  This is some of groff's
+	 * stranger behaviours.  If we encountered a custom end-scope
+	 * tag and that tag also happens to be a "real" macro, then we
+	 * need to try interpreting it again as a real macro.  If it's
+	 * not, then return ignore.  Else continue.
 	 */
 
-	assert(tok != tokens[tok].ctx && 0 != tokens[tok].ctx);
+	if (r->last->end) {
+		for (i = pos, j = 0; r->last->end[j]; j++, i++)
+			if ((*bufp)[i] != r->last->end[j])
+				break;
 
-	/* LINTED */
-	for (n = tree->last; n; n = n->parent)
-		if (n->tok != tokens[tok].ctx) {
-			if (n->tok == tokens[n->tok].ctx)
-				continue;
-			roff_err(tree, *argv, "`%s' breaks `%s' scope",
-					toknames[tok], toknames[n->tok]);
-			return(0);
-		} else
-			break;
+		if ('\0' == r->last->end[j] &&
+		    ('\0' == (*bufp)[i] ||
+		     ' '  == (*bufp)[i] ||
+		     '\t' == (*bufp)[i])) {
+			roffnode_pop(r);
+			roffnode_cleanscope(r);
 
+			while (' ' == (*bufp)[i] || '\t' == (*bufp)[i])
+				i++;
 
-	if (NULL == n) {
-		roff_err(tree, *argv, "`%s' has no starting tag `%s'",
-				toknames[tok], 
-				toknames[tokens[tok].ctx]);
-		return(0);
+			pos = i;
+			if (ROFF_MAX != roff_parse(r, *bufp, &pos, ln, ppos))
+				return(ROFF_RERUN);
+			return(ROFF_IGN);
+		}
 	}
 
-	/* LINTED */
-	do {
-		t = tree->last->tok;
-		if ( ! roffexit(tree, t))
-			return(0);
-	} while (t != tokens[tok].ctx);
+	/*
+	 * If we have no custom end-query or lookup failed, then try
+	 * pulling it out of the hashtable.
+	 */
 
-	return(1);
-}
+	t = roff_parse(r, *bufp, &pos, ln, ppos);
 
+	if (ROFF_cblock != t) {
+		if (ROFF_ig != tok)
+			roff_setstr(r, r->last->name, *bufp + ppos, 2);
+		return(ROFF_IGN);
+	}
 
-static int
-rofffindarg(const char *name)
+	assert(roffs[t].proc);
+	return((*roffs[t].proc)(r, t, bufp, szp, ln, ppos, pos, offs));
+}
+
+static enum rofferr
+roff_block_text(ROFF_ARGS)
 {
-	size_t		 i;
 
-	/* FIXME: use a table, this is slow but ok for now. */
+	if (ROFF_ig != tok)
+		roff_setstr(r, r->last->name, *bufp + pos, 2);
 
-	/* LINTED */
-	for (i = 0; i < ROFF_ARGMAX; i++)
-		/* LINTED */
-		if (0 == strcmp(name, tokargnames[i]))
-			return((int)i);
-	
-	return(ROFF_ARGMAX);
+	return(ROFF_IGN);
 }
 
-
-static int
-rofffindtok(const char *buf)
+static enum rofferr
+roff_cond_sub(ROFF_ARGS)
 {
-	char		 token[4];
-	int		 i;
+	enum rofft	 t;
+	char		*ep;
+	int		 rr;
 
-	for (i = 0; *buf && ! isspace(*buf) && i < 3; i++, buf++)
-		token[i] = *buf;
+	rr = r->last->rule;
+	roffnode_cleanscope(r);
+	t = roff_parse(r, *bufp, &pos, ln, ppos);
 
-	if (i == 3) 
-		return(ROFF_MAX);
+	/*
+	 * Fully handle known macros when they are structurally
+	 * required or when the conditional evaluated to true.
+	 */
 
-	token[i] = 0;
+	if ((ROFF_MAX != t) &&
+	    (rr || ROFFMAC_STRUCT & roffs[t].flags)) {
+		assert(roffs[t].proc);
+		return((*roffs[t].proc)(r, t, bufp, szp,
+		    ln, ppos, pos, offs));
+	}
 
-	/* FIXME: use a table, this is slow but ok for now. */
+	/*
+	 * If `\}' occurs on a macro line without a preceding macro,
+	 * drop the line completely.
+	 */
 
-	/* LINTED */
-	for (i = 0; i < ROFF_MAX; i++)
-		/* LINTED */
-		if (0 == strcmp(toknames[i], token))
-			return((int)i);
+	ep = *bufp + pos;
+	if ('\\' == ep[0] && '}' == ep[1])
+		rr = 0;
 
-	return(ROFF_MAX);
+	/* Always check for the closing delimiter `\}'. */
+
+	while (NULL != (ep = strchr(ep, '\\'))) {
+		if ('}' == *(++ep)) {
+			*ep = '&';
+			roff_ccond(r, ln, ep - *bufp - 1);
+		}
+		++ep;
+	}
+	return(rr ? ROFF_CONT : ROFF_IGN);
 }
 
-
-static int
-roffchecksec(struct rofftree *tree, const char *start, int sec)
+static enum rofferr
+roff_cond_text(ROFF_ARGS)
 {
-	int		 prior;
+	char		*ep;
+	int		 rr;
 
-	switch (sec) {
-	case(ROFFSec_SYNOP):
-		if ((prior = ROFFSec_NAME) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_DESC):
-		if ((prior = ROFFSec_SYNOP) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_RETVAL):
-		if ((prior = ROFFSec_DESC) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_ENV):
-		if ((prior = ROFFSec_RETVAL) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_FILES):
-		if ((prior = ROFFSec_ENV) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_EX):
-		if ((prior = ROFFSec_FILES) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_DIAG):
-		if ((prior = ROFFSec_EX) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_ERRS):
-		if ((prior = ROFFSec_DIAG) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_SEEALSO):
-		if ((prior = ROFFSec_ERRS) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_STAND):
-		if ((prior = ROFFSec_SEEALSO) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_HIST):
-		if ((prior = ROFFSec_STAND) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_AUTH):
-		if ((prior = ROFFSec_HIST) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_CAVEATS):
-		if ((prior = ROFFSec_AUTH) & tree->asec)
-			return(1);
-		break;
-	case(ROFFSec_BUGS):
-		if ((prior = ROFFSec_CAVEATS) & tree->asec)
-			return(1);
-		break;
-	default:
-		return(1);
-	}
+	rr = r->last->rule;
+	roffnode_cleanscope(r);
 
-	roff_warn(tree, start, "section violates conventional order");
-	return(1);
+	ep = *bufp + pos;
+	while (NULL != (ep = strchr(ep, '\\'))) {
+		if ('}' == *(++ep)) {
+			*ep = '&';
+			roff_ccond(r, ln, ep - *bufp - 1);
+		}
+		++ep;
+	}
+	return(rr ? ROFF_CONT : ROFF_IGN);
 }
 
-
+/*
+ * Parse a single signed integer number.  Stop at the first non-digit.
+ * If there is at least one digit, return success and advance the
+ * parse point, else return failure and let the parse point unchanged.
+ * Ignore overflows, treat them just like the C language.
+ */
 static int
-roffissec(const char **p)
+roff_getnum(const char *v, int *pos, int *res)
 {
+	int	 myres, n, p;
 
-	assert(*p);
-	if (NULL != *(p + 1)) {
-		if (NULL != *(p + 2))
-			return(ROFFSec_OTHER);
-		if (0 == strcmp(*p, "RETURN") &&
-				0 == strcmp(*(p + 1), "VALUES"))
-			return(ROFFSec_RETVAL);
-		if (0 == strcmp(*p, "SEE") &&
-				0 == strcmp(*(p + 1), "ALSO"))
-			return(ROFFSec_SEEALSO);
-		return(ROFFSec_OTHER);
-	}
+	if (NULL == res)
+		res = &myres;
 
-	if (0 == strcmp(*p, "NAME"))
-		return(ROFFSec_NAME);
-	else if (0 == strcmp(*p, "SYNOPSIS"))
-		return(ROFFSec_SYNOP);
-	else if (0 == strcmp(*p, "DESCRIPTION"))
-		return(ROFFSec_DESC);
-	else if (0 == strcmp(*p, "ENVIRONMENT"))
-		return(ROFFSec_ENV);
-	else if (0 == strcmp(*p, "FILES"))
-		return(ROFFSec_FILES);
-	else if (0 == strcmp(*p, "EXAMPLES"))
-		return(ROFFSec_EX);
-	else if (0 == strcmp(*p, "DIAGNOSTICS")) 
-		return(ROFFSec_DIAG);
-	else if (0 == strcmp(*p, "ERRORS"))
-		return(ROFFSec_ERRS);
-	else if (0 == strcmp(*p, "STANDARDS"))
-		return(ROFFSec_STAND);
-	else if (0 == strcmp(*p, "HISTORY"))
-		return(ROFFSec_HIST);
-	else if (0 == strcmp(*p, "AUTHORS"))
-		return(ROFFSec_AUTH);
-	else if (0 == strcmp(*p, "CAVEATS"))
-		return(ROFFSec_CAVEATS);
-	else if (0 == strcmp(*p, "BUGS"))
-		return(ROFFSec_BUGS);
+	p = *pos;
+	n = v[p] == '-';
+	if (n)
+		p++;
 
-	return(ROFFSec_OTHER);
-}
+	for (*res = 0; isdigit((unsigned char)v[p]); p++)
+		*res = 10 * *res + v[p] - '0';
+	if (p == *pos + n)
+		return 0;
 
+	if (n)
+		*res = -*res;
 
+	*pos = p;
+	return 1;
+}
+
+/*
+ * Evaluate a string comparison condition.
+ * The first character is the delimiter.
+ * Succeed if the string up to its second occurrence
+ * matches the string up to its third occurence.
+ * Advance the cursor after the third occurrence
+ * or lacking that, to the end of the line.
+ */
 static int
-roffismsec(const char *p)
+roff_evalstrcond(const char *v, int *pos)
 {
+	const char	*s1, *s2, *s3;
+	int		 match;
 
-	if (0 == strcmp(p, "1"))
-		return(ROFF_MSEC_1);
-	else if (0 == strcmp(p, "2"))
-		return(ROFF_MSEC_2);
-	else if (0 == strcmp(p, "3"))
-		return(ROFF_MSEC_3);
-	else if (0 == strcmp(p, "3p"))
-		return(ROFF_MSEC_3p);
-	else if (0 == strcmp(p, "4"))
-		return(ROFF_MSEC_4);
-	else if (0 == strcmp(p, "5"))
-		return(ROFF_MSEC_5);
-	else if (0 == strcmp(p, "6"))
-		return(ROFF_MSEC_6);
-	else if (0 == strcmp(p, "7"))
-		return(ROFF_MSEC_7);
-	else if (0 == strcmp(p, "8"))
-		return(ROFF_MSEC_8);
-	else if (0 == strcmp(p, "9"))
-		return(ROFF_MSEC_9);
-	else if (0 == strcmp(p, "unass"))
-		return(ROFF_MSEC_UNASS);
-	else if (0 == strcmp(p, "draft"))
-		return(ROFF_MSEC_DRAFT);
-	else if (0 == strcmp(p, "paper"))
-		return(ROFF_MSEC_PAPER);
+	match = 0;
+	s1 = v + *pos;		/* initial delimiter */
+	s2 = s1 + 1;		/* for scanning the first string */
+	s3 = strchr(s2, *s1);	/* for scanning the second string */
 
-	return(ROFF_MSEC_MAX);
-}
+	if (NULL == s3)		/* found no middle delimiter */
+		goto out;
 
+	while ('\0' != *++s3) {
+		if (*s2 != *s3) {  /* mismatch */
+			s3 = strchr(s3, *s1);
+			break;
+		}
+		if (*s3 == *s1) {  /* found the final delimiter */
+			match = 1;
+			break;
+		}
+		s2++;
+	}
 
+out:
+	if (NULL == s3)
+		s3 = strchr(s2, '\0');
+	else
+		s3++;
+	*pos = s3 - v;
+	return(match);
+}
+
+/*
+ * Evaluate an optionally negated single character, numerical,
+ * or string condition.
+ */
 static int
-roffispunct(const char *p)
+roff_evalcond(const char *v, int *pos)
 {
+	int	 wanttrue, number;
 
-	if (0 == *p)
-		return(0);
-	if (0 != *(p + 1))
-		return(0);
+	if ('!' == v[*pos]) {
+		wanttrue = 0;
+		(*pos)++;
+	} else
+		wanttrue = 1;
 
-	switch (*p) {
-	case('{'):
+	switch (v[*pos]) {
+	case 'n':
 		/* FALLTHROUGH */
-	case('.'):
+	case 'o':
+		(*pos)++;
+		return(wanttrue);
+	case 'c':
 		/* FALLTHROUGH */
-	case(','):
+	case 'd':
 		/* FALLTHROUGH */
-	case(';'):
+	case 'e':
 		/* FALLTHROUGH */
-	case(':'):
+	case 'r':
 		/* FALLTHROUGH */
-	case('?'):
-		/* FALLTHROUGH */
-	case('!'):
-		/* FALLTHROUGH */
-	case('('):
-		/* FALLTHROUGH */
-	case(')'):
-		/* FALLTHROUGH */
-	case('['):
-		/* FALLTHROUGH */
-	case(']'):
-		/* FALLTHROUGH */
-	case('}'):
-		return(1);
+	case 't':
+		(*pos)++;
+		return(!wanttrue);
 	default:
 		break;
 	}
 
-	return(0);
+	if (roff_evalnum(v, pos, &number, 0))
+		return((number > 0) == wanttrue);
+	else
+		return(roff_evalstrcond(v, pos) == wanttrue);
 }
 
-
-static int
-rofffindcallable(const char *name)
+static enum rofferr
+roff_line_ignore(ROFF_ARGS)
 {
-	int		 c;
 
-	if (ROFF_MAX == (c = rofffindtok(name)))
-		return(ROFF_MAX);
-	assert(c >= 0 && c < ROFF_MAX);
-	return(ROFF_CALLABLE & tokens[c].flags ? c : ROFF_MAX);
+	return(ROFF_IGN);
 }
 
-
-static struct roffnode *
-roffnode_new(int tokid, struct rofftree *tree)
+static enum rofferr
+roff_cond(ROFF_ARGS)
 {
-	struct roffnode	*p;
-	
-	if (NULL == (p = malloc(sizeof(struct roffnode))))
-		err(1, "malloc");
 
-	p->tok = tokid;
-	p->parent = tree->last;
-	tree->last = p;
+	roffnode_push(r, tok, NULL, ln, ppos);
 
-	return(p);
-}
+	/*
+	 * An `.el' has no conditional body: it will consume the value
+	 * of the current rstack entry set in prior `ie' calls or
+	 * defaults to DENY.
+	 *
+	 * If we're not an `el', however, then evaluate the conditional.
+	 */
 
+	r->last->rule = ROFF_el == tok ?
+	    (r->rstackpos < 0 ? 0 : r->rstack[r->rstackpos--]) :
+	    roff_evalcond(*bufp, &pos);
 
-static int
-roffargok(int tokid, int argid)
-{
-	const int	*c;
+	/*
+	 * An if-else will put the NEGATION of the current evaluated
+	 * conditional into the stack of rules.
+	 */
 
-	if (NULL == (c = tokens[tokid].args))
-		return(0);
+	if (ROFF_ie == tok) {
+		if (r->rstackpos + 1 == r->rstacksz) {
+			r->rstacksz += 16;
+			r->rstack = mandoc_reallocarray(r->rstack,
+			    r->rstacksz, sizeof(int));
+		}
+		r->rstack[++r->rstackpos] = !r->last->rule;
+	}
 
-	for ( ; ROFF_ARGMAX != *c; c++) 
-		if (argid == *c)
-			return(1);
+	/* If the parent has false as its rule, then so do we. */
 
-	return(0);
-}
+	if (r->last->parent && !r->last->parent->rule)
+		r->last->rule = 0;
 
+	/*
+	 * Determine scope.
+	 * If there is nothing on the line after the conditional,
+	 * not even whitespace, use next-line scope.
+	 */
 
-static void
-roffnode_free(struct rofftree *tree)
-{
-	struct roffnode	*p;
+	if ('\0' == (*bufp)[pos]) {
+		r->last->endspan = 2;
+		goto out;
+	}
 
-	assert(tree->last);
+	while (' ' == (*bufp)[pos])
+		pos++;
 
-	p = tree->last;
-	tree->last = tree->last->parent;
-	free(p);
+	/* An opening brace requests multiline scope. */
+
+	if ('\\' == (*bufp)[pos] && '{' == (*bufp)[pos + 1]) {
+		r->last->endspan = -1;
+		pos += 2;
+		goto out;
+	}
+
+	/*
+	 * Anything else following the conditional causes
+	 * single-line scope.  Warn if the scope contains
+	 * nothing but trailing whitespace.
+	 */
+
+	if ('\0' == (*bufp)[pos])
+		mandoc_msg(MANDOCERR_COND_EMPTY, r->parse,
+		    ln, ppos, roffs[tok].name);
+
+	r->last->endspan = 1;
+
+out:
+	*offs = pos;
+	return(ROFF_RERUN);
 }
 
+static enum rofferr
+roff_ds(ROFF_ARGS)
+{
+	char		*string;
+	const char	*name;
+	size_t		 namesz;
 
+	/*
+	 * The first word is the name of the string.
+	 * If it is empty or terminated by an escape sequence,
+	 * abort the `ds' request without defining anything.
+	 */
+
+	name = string = *bufp + pos;
+	if ('\0' == *name)
+		return(ROFF_IGN);
+
+	namesz = roff_getname(r, &string, ln, pos);
+	if ('\\' == name[namesz])
+		return(ROFF_IGN);
+
+	/* Read past the initial double-quote, if any. */
+	if ('"' == *string)
+		string++;
+
+	/* The rest is the value. */
+	roff_setstrn(&r->strtab, name, namesz, string, strlen(string),
+	    ROFF_as == tok);
+	return(ROFF_IGN);
+}
+
+/*
+ * Parse a single operator, one or two characters long.
+ * If the operator is recognized, return success and advance the
+ * parse point, else return failure and let the parse point unchanged.
+ */
 static int
-roffspecial(struct rofftree *tree, int tok, const char *start, 
-		const int *argc, const char **argv, 
-		size_t sz, char **ordp)
+roff_getop(const char *v, int *pos, char *res)
 {
 
-	switch (tok) {
-	case (ROFF_At):
-		if (0 == sz)
+	*res = v[*pos];
+
+	switch (*res) {
+	case '+':
+		/* FALLTHROUGH */
+	case '-':
+		/* FALLTHROUGH */
+	case '*':
+		/* FALLTHROUGH */
+	case '/':
+		/* FALLTHROUGH */
+	case '%':
+		/* FALLTHROUGH */
+	case '&':
+		/* FALLTHROUGH */
+	case ':':
+		break;
+	case '<':
+		switch (v[*pos + 1]) {
+		case '=':
+			*res = 'l';
+			(*pos)++;
 			break;
-		if (0 == strcmp(*ordp, "v1"))
+		case '>':
+			*res = '!';
+			(*pos)++;
 			break;
-		else if (0 == strcmp(*ordp, "v2")) 
+		case '?':
+			*res = 'i';
+			(*pos)++;
 			break;
-		else if (0 == strcmp(*ordp, "v3")) 
+		default:
 			break;
-		else if (0 == strcmp(*ordp, "v6")) 
+		}
+		break;
+	case '>':
+		switch (v[*pos + 1]) {
+		case '=':
+			*res = 'g';
+			(*pos)++;
 			break;
-		else if (0 == strcmp(*ordp, "v7")) 
+		case '?':
+			*res = 'a';
+			(*pos)++;
 			break;
-		else if (0 == strcmp(*ordp, "32v"))
+		default:
 			break;
-		else if (0 == strcmp(*ordp, "V.1"))
-			break;
-		else if (0 == strcmp(*ordp, "V.4"))
-			break;
-		roff_err(tree, *ordp, "invalid `At' arg");
-		return(0);
-	
-	case (ROFF_Xr):
-		if (2 == sz) {
-			assert(ordp[1]);
-			if (ROFF_MSEC_MAX != roffismsec(ordp[1]))
-				break;
-			roff_warn(tree, start, "invalid `%s' manual "
-					"section", toknames[tok]);
 		}
-		/* FALLTHROUGH */
-
-	case (ROFF_Sx):
-		/* FALLTHROUGH*/
-	case (ROFF_Fn):
-		if (0 != sz) 
-			break;
-		roff_err(tree, start, "`%s' expects at least "
-				"one arg", toknames[tok]);
-		return(0);
-
-	case (ROFF_Nm):
-		if (0 == sz) {
-			if (0 == tree->name[0]) {
-				roff_err(tree, start, "`Nm' not set");
-				return(0);
-			}
-			ordp[0] = tree->name;
-			ordp[1] = NULL;
-		} else if ( ! roffsetname(tree, ordp))
-			return(0);
 		break;
-
-	case (ROFF_Rv):
-		/* FALLTHROUGH*/
-	case (ROFF_Ex):
-		if (1 == sz) 
-			break;
-		roff_err(tree, start, "`%s' expects one arg", 
-				toknames[tok]);
-		return(0);
-
-	case (ROFF_Sm):
-		if (1 != sz) {
-			roff_err(tree, start, "`Sm' expects one arg");
-			return(0);
-		} 
-		
-		if (0 != strcmp(ordp[0], "on") &&
-				0 != strcmp(ordp[0], "off")) {
-			roff_err(tree, start, "`Sm' has invalid argument");
-			return(0);
-		}
+	case '=':
+		if ('=' == v[*pos + 1])
+			(*pos)++;
 		break;
-	
-	case (ROFF_Ud):
-		/* FALLTHROUGH */
-	case (ROFF_Ux):
-		/* FALLTHROUGH */
-	case (ROFF_Bt):
-		if (0 != sz) {
-			roff_err(tree, start, "`%s' expects no args",
-					toknames[tok]);
-			return(0);
-		}
-		break;
 	default:
-		break;
+		return(0);
 	}
+	(*pos)++;
 
-	return((*tree->cb.roffspecial)(tree->arg, tok, tree->cur, 
-				argc, argv, (const char **)ordp));
+	return(*res);
 }
 
-
+/*
+ * Evaluate either a parenthesized numeric expression
+ * or a single signed integer number.
+ */
 static int
-roffexit(struct rofftree *tree, int tok)
+roff_evalpar(const char *v, int *pos, int *res)
 {
 
-	assert(tokens[tok].cb);
-	return((*tokens[tok].cb)(tok, tree, NULL, ROFF_EXIT));
-}
+	if ('(' != v[*pos])
+		return(roff_getnum(v, pos, res));
 
+	(*pos)++;
+	if ( ! roff_evalnum(v, pos, res, 1))
+		return(0);
 
-static int
-roffcall(struct rofftree *tree, int tok, char **argv)
-{
-	int		 i;
-	enum roffmsec	 c;
+	/*
+	 * Omission of the closing parenthesis
+	 * is an error in validation mode,
+	 * but ignored in evaluation mode.
+	 */
 
-	if (NULL == tokens[tok].cb) {
-		roff_err(tree, *argv, "`%s' is unsupported", 
-				toknames[tok]);
+	if (')' == v[*pos])
+		(*pos)++;
+	else if (NULL == res)
 		return(0);
-	}
-	if (tokens[tok].sections && ROFF_MSEC_MAX != tree->section) {
-		i = 0;
-		while (ROFF_MSEC_MAX != 
-				(c = tokens[tok].sections[i++]))
-			if (c == tree->section)
-				break;
-		if (ROFF_MSEC_MAX == c) {
-			roff_warn(tree, *argv, "`%s' is not a valid "
-					"macro in this manual section",
-					toknames[tok]);
-		}
-	}
 
-	return((*tokens[tok].cb)(tok, tree, argv, ROFF_ENTER));
+	return(1);
 }
 
-
+/*
+ * Evaluate a complete numeric expression.
+ * Proceed left to right, there is no concept of precedence.
+ */
 static int
-roffnextopt(const struct rofftree *tree, int tok, 
-		char ***in, char **val)
+roff_evalnum(const char *v, int *pos, int *res, int skipwhite)
 {
-	char		*arg, **argv;
-	int		 v;
+	int		 mypos, operand2;
+	char		 operator;
 
-	*val = NULL;
-	argv = *in;
-	assert(argv);
+	if (NULL == pos) {
+		mypos = 0;
+		pos = &mypos;
+	}
 
-	if (NULL == (arg = *argv))
-		return(-1);
-	if ('-' != *arg)
-		return(-1);
+	if (skipwhite)
+		while (isspace((unsigned char)v[*pos]))
+			(*pos)++;
 
-	if (ROFF_ARGMAX == (v = rofffindarg(arg + 1))) {
-		roff_warn(tree, arg, "argument-like parameter `%s' to "
-				"`%s'", arg, toknames[tok]);
-		return(-1);
-	} 
-	
-	if ( ! roffargok(tok, v)) {
-		roff_warn(tree, arg, "invalid argument parameter `%s' to "
-				"`%s'", tokargnames[v], toknames[tok]);
-		return(-1);
-	} 
-	
-	if ( ! (ROFF_VALUE & tokenargs[v]))
-		return(v);
+	if ( ! roff_evalpar(v, pos, res))
+		return(0);
 
-	*in = ++argv;
+	while (1) {
+		if (skipwhite)
+			while (isspace((unsigned char)v[*pos]))
+				(*pos)++;
 
-	if (NULL == *argv) {
-		roff_err(tree, arg, "empty value of `%s' for `%s'",
-				tokargnames[v], toknames[tok]);
-		return(ROFF_ARGMAX);
-	}
+		if ( ! roff_getop(v, pos, &operator))
+			break;
 
-	return(v);
-}
+		if (skipwhite)
+			while (isspace((unsigned char)v[*pos]))
+				(*pos)++;
 
+		if ( ! roff_evalpar(v, pos, &operand2))
+			return(0);
 
-static int
-roffpurgepunct(struct rofftree *tree, char **argv)
-{
-	int		 i;
+		if (skipwhite)
+			while (isspace((unsigned char)v[*pos]))
+				(*pos)++;
 
-	i = 0;
-	while (argv[i])
-		i++;
-	assert(i > 0);
-	if ( ! roffispunct(argv[--i]))
-		return(1);
-	while (i >= 0 && roffispunct(argv[i]))
-		i--;
-	i++;
+		if (NULL == res)
+			continue;
 
-	/* LINTED */
-	while (argv[i])
-		if ( ! roffdata(tree, 0, argv[i++]))
-			return(0);
+		switch (operator) {
+		case '+':
+			*res += operand2;
+			break;
+		case '-':
+			*res -= operand2;
+			break;
+		case '*':
+			*res *= operand2;
+			break;
+		case '/':
+			*res /= operand2;
+			break;
+		case '%':
+			*res %= operand2;
+			break;
+		case '<':
+			*res = *res < operand2;
+			break;
+		case '>':
+			*res = *res > operand2;
+			break;
+		case 'l':
+			*res = *res <= operand2;
+			break;
+		case 'g':
+			*res = *res >= operand2;
+			break;
+		case '=':
+			*res = *res == operand2;
+			break;
+		case '!':
+			*res = *res != operand2;
+			break;
+		case '&':
+			*res = *res && operand2;
+			break;
+		case ':':
+			*res = *res || operand2;
+			break;
+		case 'i':
+			if (operand2 < *res)
+				*res = operand2;
+			break;
+		case 'a':
+			if (operand2 > *res)
+				*res = operand2;
+			break;
+		default:
+			abort();
+		}
+	}
 	return(1);
 }
 
-
-static int
-roffparseopts(struct rofftree *tree, int tok, 
-		char ***args, int *argc, char **argv)
+void
+roff_setreg(struct roff *r, const char *name, int val, char sign)
 {
-	int		 i, c;
-	char		*v;
+	struct roffreg	*reg;
 
-	i = 0;
+	/* Search for an existing register with the same name. */
+	reg = r->regtab;
 
-	while (-1 != (c = roffnextopt(tree, tok, args, &v))) {
-		if (ROFF_ARGMAX == c) 
-			return(0);
+	while (reg && strcmp(name, reg->key.p))
+		reg = reg->next;
 
-		argc[i] = c;
-		argv[i] = v;
-		i++;
-		*args = *args + 1;
+	if (NULL == reg) {
+		/* Create a new register. */
+		reg = mandoc_malloc(sizeof(struct roffreg));
+		reg->key.p = mandoc_strdup(name);
+		reg->key.sz = strlen(name);
+		reg->val = 0;
+		reg->next = r->regtab;
+		r->regtab = reg;
 	}
 
-	argc[i] = ROFF_ARGMAX;
-	argv[i] = NULL;
-	return(1);
+	if ('+' == sign)
+		reg->val += val;
+	else if ('-' == sign)
+		reg->val -= val;
+	else
+		reg->val = val;
 }
 
-
+/*
+ * Handle some predefined read-only number registers.
+ * For now, return -1 if the requested register is not predefined;
+ * in case a predefined read-only register having the value -1
+ * were to turn up, another special value would have to be chosen.
+ */
 static int
-roffdata(struct rofftree *tree, int space, char *buf)
+roff_getregro(const char *name)
 {
 
-	if (0 == *buf)
+	switch (*name) {
+	case 'A':  /* ASCII approximation mode is always off. */
+		return(0);
+	case 'g':  /* Groff compatibility mode is always on. */
 		return(1);
-	return((*tree->cb.roffdata)(tree->arg, 
-				space != 0, tree->cur, buf));
+	case 'H':  /* Fixed horizontal resolution. */
+		return (24);
+	case 'j':  /* Always adjust left margin only. */
+		return(0);
+	case 'T':  /* Some output device is always defined. */
+		return(1);
+	case 'V':  /* Fixed vertical resolution. */
+		return (40);
+	default:
+		return (-1);
+	}
 }
 
-
-/* ARGSUSED */
-static	int
-roff_Dd(ROFFCALL_ARGS)
+int
+roff_getreg(const struct roff *r, const char *name)
 {
-	time_t		 t;
-	char		*p, buf[32];
+	struct roffreg	*reg;
+	int		 val;
 
-	if (ROFF_BODY & tree->state) {
-		assert( ! (ROFF_PRELUDE & tree->state));
-		assert(ROFF_PRELUDE_Dd & tree->state);
-		return(roff_text(tok, tree, argv, type));
+	if ('.' == name[0] && '\0' != name[1] && '\0' == name[2]) {
+		val = roff_getregro(name + 1);
+		if (-1 != val)
+			return (val);
 	}
 
-	assert(ROFF_PRELUDE & tree->state);
-	assert( ! (ROFF_BODY & tree->state));
+	for (reg = r->regtab; reg; reg = reg->next)
+		if (0 == strcmp(name, reg->key.p))
+			return(reg->val);
 
-	if (ROFF_PRELUDE_Dd & tree->state) {
-		roff_err(tree, *argv, "repeated `Dd' in prelude");
-		return(0);
-	} else if (ROFF_PRELUDE_Dt & tree->state) {
-		roff_err(tree, *argv, "out-of-order `Dd' in prelude");
-		return(0);
-	}
+	return(0);
+}
 
-	assert(NULL == tree->last);
+static int
+roff_getregn(const struct roff *r, const char *name, size_t len)
+{
+	struct roffreg	*reg;
+	int		 val;
 
-	argv++;
+	if ('.' == name[0] && 2 == len) {
+		val = roff_getregro(name + 1);
+		if (-1 != val)
+			return (val);
+	}
 
-	if (0 == strcmp(*argv, "$Mdocdate: December 8 2008 $")) {
-		t = time(NULL);
-		if (NULL == localtime_r(&t, &tree->tm))
-			err(1, "localtime_r");
-		tree->state |= ROFF_PRELUDE_Dd;
-		return(1);
-	} 
+	for (reg = r->regtab; reg; reg = reg->next)
+		if (len == reg->key.sz &&
+		    0 == strncmp(name, reg->key.p, len))
+			return(reg->val);
 
-	/* Build this from Mdocdate or raw date. */
-	
-	buf[0] = 0;
-	p = *argv;
+	return(0);
+}
 
-	if (0 != strcmp(*argv, "$Mdocdate:")) {
-		while (*argv) {
-			if (strlcat(buf, *argv++, sizeof(buf))
-					< sizeof(buf)) 
-				continue;
-			roff_err(tree, p, "bad `Dd' date");
-			return(0);
-		}
-		if (strptime(buf, "%b%d,%Y", &tree->tm)) {
-			tree->state |= ROFF_PRELUDE_Dd;
-			return(1);
-		}
-		roff_err(tree, *argv, "bad `Dd' date");
-		return(0);
-	}
+static void
+roff_freereg(struct roffreg *reg)
+{
+	struct roffreg	*old_reg;
 
-	argv++;
-	while (*argv && **argv != '$') {
-		if (strlcat(buf, *argv++, sizeof(buf))
-				>= sizeof(buf)) {
-			roff_err(tree, p, "bad `Dd' Mdocdate");
-			return(0);
-		} 
-		if (strlcat(buf, " ", sizeof(buf))
-				>= sizeof(buf)) {
-			roff_err(tree, p, "bad `Dd' Mdocdate");
-			return(0);
-		}
+	while (NULL != reg) {
+		free(reg->key.p);
+		old_reg = reg;
+		reg = reg->next;
+		free(old_reg);
 	}
-	if (NULL == *argv) {
-		roff_err(tree, p, "bad `Dd' Mdocdate");
-		return(0);
-	}
+}
 
-	if (NULL == strptime(buf, "%b %d %Y", &tree->tm)) {
-		roff_err(tree, *argv, "bad `Dd' Mdocdate");
-		return(0);
-	}
+static enum rofferr
+roff_nr(ROFF_ARGS)
+{
+	char		*key, *val;
+	size_t		 keysz;
+	int		 iv;
+	char		 sign;
 
-	tree->state |= ROFF_PRELUDE_Dd;
-	return(1);
-}
+	key = val = *bufp + pos;
+	if ('\0' == *key)
+		return(ROFF_IGN);
 
+	keysz = roff_getname(r, &val, ln, pos);
+	if ('\\' == key[keysz])
+		return(ROFF_IGN);
+	key[keysz] = '\0';
 
-/* ARGSUSED */
-static	int
-roff_Dt(ROFFCALL_ARGS)
+	sign = *val;
+	if ('+' == sign || '-' == sign)
+		val++;
+
+	if (roff_evalnum(val, NULL, &iv, 0))
+		roff_setreg(r, key, iv, sign);
+
+	return(ROFF_IGN);
+}
+
+static enum rofferr
+roff_rr(ROFF_ARGS)
 {
+	struct roffreg	*reg, **prev;
+	char		*name, *cp;
+	size_t		 namesz;
 
-	if (ROFF_BODY & tree->state) {
-		assert( ! (ROFF_PRELUDE & tree->state));
-		assert(ROFF_PRELUDE_Dt & tree->state);
-		return(roff_text(tok, tree, argv, type));
+	name = cp = *bufp + pos;
+	if ('\0' == *name)
+		return(ROFF_IGN);
+	namesz = roff_getname(r, &cp, ln, pos);
+	name[namesz] = '\0';
+
+	prev = &r->regtab;
+	while (1) {
+		reg = *prev;
+		if (NULL == reg || !strcmp(name, reg->key.p))
+			break;
+		prev = &reg->next;
 	}
+	if (NULL != reg) {
+		*prev = reg->next;
+		free(reg->key.p);
+		free(reg);
+	}
+	return(ROFF_IGN);
+}
 
-	assert(ROFF_PRELUDE & tree->state);
-	assert( ! (ROFF_BODY & tree->state));
+static enum rofferr
+roff_rm(ROFF_ARGS)
+{
+	const char	 *name;
+	char		 *cp;
+	size_t		  namesz;
 
-	if ( ! (ROFF_PRELUDE_Dd & tree->state)) {
-		roff_err(tree, *argv, "out-of-order `Dt' in prelude");
-		return(0);
-	} else if (ROFF_PRELUDE_Dt & tree->state) {
-		roff_err(tree, *argv, "repeated `Dt' in prelude");
-		return(0);
+	cp = *bufp + pos;
+	while ('\0' != *cp) {
+		name = cp;
+		namesz = roff_getname(r, &cp, ln, (int)(cp - *bufp));
+		roff_setstrn(&r->strtab, name, namesz, NULL, 0, 0);
+		if ('\\' == name[namesz])
+			break;
 	}
+	return(ROFF_IGN);
+}
 
-	argv++;
-	if (NULL == *argv) {
-		roff_err(tree, *argv, "`Dt' needs document title");
-		return(0);
-	} else if (strlcpy(tree->title, *argv, sizeof(tree->title))
-			>= sizeof(tree->title)) {
-		roff_err(tree, *argv, "`Dt' document title too long");
-		return(0);
+static enum rofferr
+roff_it(ROFF_ARGS)
+{
+	char		*cp;
+	size_t		 len;
+	int		 iv;
+
+	/* Parse the number of lines. */
+	cp = *bufp + pos;
+	len = strcspn(cp, " \t");
+	cp[len] = '\0';
+	if ((iv = mandoc_strntoi(cp, len, 10)) <= 0) {
+		mandoc_msg(MANDOCERR_IT_NONUM, r->parse,
+		    ln, ppos, *bufp + 1);
+		return(ROFF_IGN);
 	}
+	cp += len + 1;
 
-	argv++;
-	if (NULL == *argv) {
-		roff_err(tree, *argv, "`Dt' needs section");
-		return(0);
-	} 
+	/* Arm the input line trap. */
+	roffit_lines = iv;
+	roffit_macro = mandoc_strdup(cp);
+	return(ROFF_IGN);
+}
 
-	if (ROFF_MSEC_MAX == (tree->section = roffismsec(*argv))) {
-		roff_err(tree, *argv, "bad `Dt' section");
-		return(0);
-	}
+static enum rofferr
+roff_Dd(ROFF_ARGS)
+{
+	const char *const	*cp;
 
-	argv++;
-	if (NULL == *argv) {
-		tree->volume[0] = 0;
-	} else if (strlcpy(tree->volume, *argv, sizeof(tree->volume))
-			>= sizeof(tree->volume)) {
-		roff_err(tree, *argv, "`Dt' volume too long");
-		return(0);
-	}
+	if ((r->options & (MPARSE_MDOC | MPARSE_QUICK)) == 0)
+		for (cp = __mdoc_reserved; *cp; cp++)
+			roff_setstr(r, *cp, NULL, 0);
 
-	assert(NULL == tree->last);
-	tree->state |= ROFF_PRELUDE_Dt;
+	if (r->format == 0)
+		r->format = MPARSE_MDOC;
 
-	return(1);
+	return(ROFF_CONT);
 }
 
-
-static int
-roffsetname(struct rofftree *tree, char **ordp)
+static enum rofferr
+roff_TH(ROFF_ARGS)
 {
-	
-	assert(*ordp);
+	const char *const	*cp;
 
-	/* FIXME: not all sections can set this. */
+	if ((r->options & MPARSE_QUICK) == 0)
+		for (cp = __man_reserved; *cp; cp++)
+			roff_setstr(r, *cp, NULL, 0);
 
-	if (NULL != *(ordp + 1)) {
-		roff_err(tree, *ordp, "too many `Nm' args");
-		return(0);
-	} 
-	
-	if (strlcpy(tree->name, *ordp, sizeof(tree->name)) 
-			>= sizeof(tree->name)) {
-		roff_err(tree, *ordp, "`Nm' arg too long");
-		return(0);
-	}
+	if (r->format == 0)
+		r->format = MPARSE_MAN;
 
-	return(1);
+	return(ROFF_CONT);
 }
 
+static enum rofferr
+roff_TE(ROFF_ARGS)
+{
 
-/* ARGSUSED */
-static	int
-roff_Ns(ROFFCALL_ARGS)
+	if (NULL == r->tbl)
+		mandoc_msg(MANDOCERR_BLK_NOTOPEN, r->parse,
+		    ln, ppos, "TE");
+	else
+		tbl_end(&r->tbl);
+
+	return(ROFF_IGN);
+}
+
+static enum rofferr
+roff_T_(ROFF_ARGS)
 {
-	int		 j, c, first;
-	char		*morep[1];
 
-	first = (*argv++ == tree->cur);
-	morep[0] = NULL;
+	if (NULL == r->tbl)
+		mandoc_msg(MANDOCERR_BLK_NOTOPEN, r->parse,
+		    ln, ppos, "T&");
+	else
+		tbl_restart(ppos, ln, r->tbl);
 
-	if ( ! roffspecial(tree, tok, *argv, NULL, NULL, 0, morep))
-		return(0);
+	return(ROFF_IGN);
+}
 
-	while (*argv) {
-		if (ROFF_MAX != (c = rofffindcallable(*argv))) {
-			if ( ! roffcall(tree, c, argv))
-				return(0);
-			break;
-		}
+/*
+ * Handle in-line equation delimiters.
+ */
+static enum rofferr
+roff_eqndelim(struct roff *r, char **bufp, size_t *szp, int pos)
+{
+	char	*cp1, *cp2;
 
-		if ( ! roffispunct(*argv)) {
-			if ( ! roffdata(tree, 1, *argv++))
-				return(0);
-			continue;
-		}
+	/*
+	 * Outside equations, look for an opening delimiter.
+	 * If we are inside an equation, we already know it is
+	 * in-line, or this function wouldn't have been called;
+	 * so look for a closing delimiter.
+	 */
 
-		for (j = 0; argv[j]; j++)
-			if ( ! roffispunct(argv[j]))
-				break;
+	cp1 = *bufp + pos;
+	cp2 = strchr(cp1, r->eqn == NULL ?
+	    r->last_eqn->odelim : r->last_eqn->cdelim);
+	if (cp2 == NULL)
+		return(ROFF_CONT);
 
-		if (argv[j]) {
-			if ( ! roffdata(tree, 0, *argv++))
-				return(0);
-			continue;
-		}
+	/* Found a delimiter; get rid of surrounding blanks. */
 
-		break;
-	}
+	cp1 = cp2++;
+	while (cp2[0] == ' ')
+		cp2++;
+	while (cp1[-1] == ' ')
+		cp1--;
+	*cp1 = '\0';
 
-	if ( ! first)
-		return(1);
+	/* Replace the delimiter with an equation macro. */
 
-	return(roffpurgepunct(tree, argv));
-}
+	*szp = mandoc_asprintf(&cp1, "%s\n.E%c\n\\&%s", *bufp,
+	    r->eqn == NULL ? 'Q' : 'N', cp2) + 1;
+	free(*bufp);
+	*bufp = cp1;
 
+	/* Toggle the in-line state of the eqn subsystem. */
 
-/* ARGSUSED */
-static	int
-roff_Os(ROFFCALL_ARGS)
+	r->eqn_inline = r->eqn == NULL;
+	return(ROFF_REPARSE);
+}
+
+static void
+roff_openeqn(struct roff *r, const char *name, int line,
+		int offs, const char *buf)
 {
-	char		*p;
+	struct eqn_node *e;
+	int		 poff;
 
-	if (ROFF_BODY & tree->state) {
-		assert( ! (ROFF_PRELUDE & tree->state));
-		assert(ROFF_PRELUDE_Os & tree->state);
-		return(roff_text(tok, tree, argv, type));
-	}
+	assert(NULL == r->eqn);
+	e = eqn_alloc(name, offs, line, r->parse);
 
-	assert(ROFF_PRELUDE & tree->state);
-	if ( ! (ROFF_PRELUDE_Dt & tree->state) ||
-			! (ROFF_PRELUDE_Dd & tree->state)) {
-		roff_err(tree, *argv, "out-of-order `Os' in prelude");
-		return(0);
+	if (r->last_eqn) {
+		r->last_eqn->next = e;
+		e->delim = r->last_eqn->delim;
+		e->odelim = r->last_eqn->odelim;
+		e->cdelim = r->last_eqn->cdelim;
+	} else
+		r->first_eqn = r->last_eqn = e;
+
+	r->eqn = r->last_eqn = e;
+
+	if (buf) {
+		poff = 0;
+		eqn_read(&r->eqn, line, buf, offs, &poff);
 	}
+}
 
-	tree->os[0] = 0;
+static enum rofferr
+roff_EQ(ROFF_ARGS)
+{
 
-	p = *++argv;
+	roff_openeqn(r, *bufp + pos, ln, ppos, NULL);
+	return(ROFF_IGN);
+}
 
-	while (*argv) {
-		if (strlcat(tree->os, *argv++, sizeof(tree->os))
-				< sizeof(tree->os)) 
-			continue;
-		roff_err(tree, p, "`Os' value too long");
-		return(0);
-	}
+static enum rofferr
+roff_EN(ROFF_ARGS)
+{
 
-	if (0 == tree->os[0])
-		if (strlcpy(tree->os, "LOCAL", sizeof(tree->os))
-				>= sizeof(tree->os)) {
-			roff_err(tree, p, "`Os' value too long");
-			return(0);
-		}
+	mandoc_msg(MANDOCERR_BLK_NOTOPEN, r->parse, ln, ppos, "EN");
+	return(ROFF_IGN);
+}
 
-	tree->state |= ROFF_PRELUDE_Os;
-	tree->state &= ~ROFF_PRELUDE;
-	tree->state |= ROFF_BODY;
+static enum rofferr
+roff_TS(ROFF_ARGS)
+{
+	struct tbl_node	*tbl;
 
-	assert(ROFF_MSEC_MAX != tree->section);
-	assert(0 != tree->title[0]);
-	assert(0 != tree->os[0]);
+	if (r->tbl) {
+		mandoc_msg(MANDOCERR_BLK_BROKEN, r->parse,
+		    ln, ppos, "TS breaks TS");
+		tbl_end(&r->tbl);
+	}
 
-	assert(NULL == tree->last);
+	tbl = tbl_alloc(ppos, ln, r->parse);
 
-	return((*tree->cb.roffhead)(tree->arg, &tree->tm,
-				tree->os, tree->title, tree->section,
-				tree->volume));
+	if (r->last_tbl)
+		r->last_tbl->next = tbl;
+	else
+		r->first_tbl = r->last_tbl = tbl;
+
+	r->tbl = r->last_tbl = tbl;
+	return(ROFF_IGN);
 }
 
-
-/* ARGSUSED */
-static int
-roff_layout(ROFFCALL_ARGS) 
+static enum rofferr
+roff_cc(ROFF_ARGS)
 {
-	int		 i, c, argcp[ROFF_MAXLINEARG];
-	char		*argvp[ROFF_MAXLINEARG];
+	const char	*p;
 
-	/*
-	 * The roff_layout function is for multi-line macros.  A layout
-	 * has a start and end point, which is either declared
-	 * explicitly or implicitly.  An explicit start and end is
-	 * embodied by `.Bl' and `.El', with the former being the start
-	 * and the latter being an end.  The `.Sh' and `.Ss' tags, on
-	 * the other hand, are implicit.  The scope of a layout is the
-	 * space between start and end.  Explicit layouts may not close
-	 * out implicit ones and vice versa; implicit layouts may close
-	 * out other implicit layouts.
-	 */
+	p = *bufp + pos;
 
-	assert( ! (ROFF_CALLABLE & tokens[tok].flags));
+	if ('\0' == *p || '.' == (r->control = *p++))
+		r->control = 0;
 
-	if (ROFF_PRELUDE & tree->state) {
-		roff_err(tree, *argv, "bad `%s' in prelude", 
-				toknames[tok]);
-		return(0);
-	} else if (ROFF_EXIT == type) {
-		roffnode_free(tree);
-		if ( ! (*tree->cb.roffblkbodyout)(tree->arg, tok))
-			return(0);
-		return((*tree->cb.roffblkout)(tree->arg, tok));
-	} 
+	if ('\0' != *p)
+		mandoc_msg(MANDOCERR_ARGCOUNT, r->parse, ln, ppos, NULL);
 
-	assert( ! (ROFF_CALLABLE & tokens[tok].flags));
+	return(ROFF_IGN);
+}
 
-	++argv;
+static enum rofferr
+roff_tr(ROFF_ARGS)
+{
+	const char	*p, *first, *second;
+	size_t		 fsz, ssz;
+	enum mandoc_esc	 esc;
 
-	if ( ! roffparseopts(tree, tok, &argv, argcp, argvp))
-		return(0);
-	if (NULL == roffnode_new(tok, tree))
-		return(0);
+	p = *bufp + pos;
 
-	/*
-	 * Layouts have two parts: the layout body and header.  The
-	 * layout header is the trailing text of the line macro, while
-	 * the layout body is everything following until termination.
-	 * Example:
-	 *
-	 * .It Fl f ) ;
-	 * Bar.
-	 *
-	 * ...Produces...
-	 *
-	 * <block>
-	 * 	<head>
-	 * 		<!Fl f!> ;
-	 * 	</head>
-	 * 	
-	 *	<body>
-	 *		Bar.
-	 *	</body>
-	 * </block>
-	 */
+	if ('\0' == *p) {
+		mandoc_msg(MANDOCERR_ARGCOUNT, r->parse, ln, ppos, NULL);
+		return(ROFF_IGN);
+	}
 
-	if ( ! (*tree->cb.roffblkin)(tree->arg, tok, argcp, 
-				(const char **)argvp))
-		return(0);
+	while ('\0' != *p) {
+		fsz = ssz = 1;
 
-	/* +++ Begin run macro-specific hooks over argv. */
+		first = p++;
+		if ('\\' == *first) {
+			esc = mandoc_escape(&p, NULL, NULL);
+			if (ESCAPE_ERROR == esc) {
+				mandoc_msg(MANDOCERR_ESC_BAD, r->parse,
+				    ln, (int)(p - *bufp), first);
+				return(ROFF_IGN);
+			}
+			fsz = (size_t)(p - first);
+		}
 
-	switch (tok) {
-	case (ROFF_Sh):
-		if (NULL == *argv) {
-			roff_err(tree, *(argv - 1), 
-					"`Sh' expects arguments");
-			return(0);
+		second = p++;
+		if ('\\' == *second) {
+			esc = mandoc_escape(&p, NULL, NULL);
+			if (ESCAPE_ERROR == esc) {
+				mandoc_msg(MANDOCERR_ESC_BAD, r->parse,
+				    ln, (int)(p - *bufp), second);
+				return(ROFF_IGN);
+			}
+			ssz = (size_t)(p - second);
+		} else if ('\0' == *second) {
+			mandoc_msg(MANDOCERR_ARGCOUNT, r->parse,
+			    ln, (int)(p - *bufp), NULL);
+			second = " ";
+			p--;
 		}
-		tree->csec = roffissec((const char **)argv);
-		if ( ! (ROFFSec_OTHER & tree->csec) &&
-				tree->asec & tree->csec) 
-			roff_warn(tree, *argv, "section repeated");
-		if (0 == tree->asec && ! (ROFFSec_NAME & tree->csec)) {
-			roff_err(tree, *argv, "`NAME' section "
-					"must be first");
-			return(0);
-		} else if ( ! roffchecksec(tree, *argv, tree->csec))
-			return(0);
 
-		tree->asec |= tree->csec;
-		break;
-	default:
-		break;
+		if (fsz > 1) {
+			roff_setstrn(&r->xmbtab, first, fsz,
+			    second, ssz, 0);
+			continue;
+		}
+
+		if (NULL == r->xtab)
+			r->xtab = mandoc_calloc(128,
+			    sizeof(struct roffstr));
+
+		free(r->xtab[(int)*first].p);
+		r->xtab[(int)*first].p = mandoc_strndup(second, ssz);
+		r->xtab[(int)*first].sz = ssz;
 	}
 
-	/* --- End run macro-specific hooks over argv. */
+	return(ROFF_IGN);
+}
 
-	if (NULL == *argv)
-		return((*tree->cb.roffblkbodyin)
-				(tree->arg, tok, argcp, 
-				 (const char **)argvp));
+static enum rofferr
+roff_so(ROFF_ARGS)
+{
+	char *name;
 
-	if ( ! (*tree->cb.roffblkheadin)(tree->arg, tok, argcp, 
-				(const char **)argvp))
-		return(0);
+	name = *bufp + pos;
+	mandoc_vmsg(MANDOCERR_SO, r->parse, ln, ppos, "so %s", name);
 
 	/*
-	 * If there are no parsable parts, then write remaining tokens
-	 * into the layout header and exit.
+	 * Handle `so'.  Be EXTREMELY careful, as we shouldn't be
+	 * opening anything that's not in our cwd or anything beneath
+	 * it.  Thus, explicitly disallow traversing up the file-system
+	 * or using absolute paths.
 	 */
 
-	if ( ! (ROFF_PARSED & tokens[tok].flags)) {
-		i = 0;
-		while (*argv)
-			if ( ! roffdata(tree, i++, *argv++))
-				return(0);
-
-		if ( ! (*tree->cb.roffblkheadout)(tree->arg, tok))
-			return(0);
-		return((*tree->cb.roffblkbodyin)(tree->arg, tok, argcp,
-				 (const char **)argvp));
+	if ('/' == *name || strstr(name, "../") || strstr(name, "/..")) {
+		mandoc_vmsg(MANDOCERR_SO_PATH, r->parse, ln, ppos,
+		    ".so %s", name);
+		return(ROFF_ERR);
 	}
 
+	*offs = pos;
+	return(ROFF_SO);
+}
+
+static enum rofferr
+roff_userdef(ROFF_ARGS)
+{
+	const char	 *arg[9];
+	char		 *cp, *n1, *n2;
+	int		  i;
+
 	/*
-	 * Parsable elements may be in the header (or be the header, for
-	 * that matter).  Follow the regular parsing rules for these.
+	 * Collect pointers to macro argument strings
+	 * and NUL-terminate them.
 	 */
+	cp = *bufp + pos;
+	for (i = 0; i < 9; i++)
+		arg[i] = '\0' == *cp ? "" :
+		    mandoc_getarg(r->parse, &cp, ln, &pos);
 
-	i = 0;
-	while (*argv) {
-		if (ROFF_MAX == (c = rofffindcallable(*argv))) {
-			assert(tree->arg);
-			if ( ! roffdata(tree, i++, *argv++))
-				return(0);
+	/*
+	 * Expand macro arguments.
+	 */
+	*szp = 0;
+	n1 = cp = mandoc_strdup(r->current_string);
+	while (NULL != (cp = strstr(cp, "\\$"))) {
+		i = cp[2] - '1';
+		if (0 > i || 8 < i) {
+			/* Not an argument invocation. */
+			cp += 2;
 			continue;
 		}
-		if ( ! roffcall(tree, c, argv))
-			return(0);
-		break;
+		*cp = '\0';
+		*szp = mandoc_asprintf(&n2, "%s%s%s",
+		    n1, arg[i], cp + 3) + 1;
+		cp = n2 + (cp - n1);
+		free(n1);
+		n1 = n2;
 	}
 
-	/* 
-	 * If there's trailing punctuation in the header, then write it
-	 * out now.  Here we mimic the behaviour of a line-dominant text
-	 * macro.
-	 */
-
-	if (NULL == *argv) {
-		if ( ! (*tree->cb.roffblkheadout)(tree->arg, tok))
-			return(0);
-		return((*tree->cb.roffblkbodyin)
-				(tree->arg, tok, argcp, 
-				 (const char **)argvp));
-	}
-
 	/*
-	 * Expensive.  Scan to the end of line then work backwards until
-	 * a token isn't punctuation.
+	 * Replace the macro invocation
+	 * by the expanded macro.
 	 */
+	free(*bufp);
+	*bufp = n1;
+	if (0 == *szp)
+		*szp = strlen(*bufp) + 1;
 
-	if ( ! roffpurgepunct(tree, argv))
-		return(0);
-	if ( ! (*tree->cb.roffblkheadout)(tree->arg, tok))
-		return(0);
-	return((*tree->cb.roffblkbodyin)(tree->arg, 
-				tok, argcp, (const char **)argvp));
+	return(*szp > 1 && '\n' == (*bufp)[(int)*szp - 2] ?
+	   ROFF_REPARSE : ROFF_APPEND);
 }
 
-
-/* ARGSUSED */
-static int
-roff_ordered(ROFFCALL_ARGS) 
+static size_t
+roff_getname(struct roff *r, char **cpp, int ln, int pos)
 {
-	int		 i, first, c, argcp[ROFF_MAXLINEARG];
-	char		*ordp[ROFF_MAXLINEARG], *p,
-			*argvp[ROFF_MAXLINEARG];
+	char	 *name, *cp;
+	size_t	  namesz;
 
-	/*
-	 * Ordered macros pass their arguments directly to handlers,
-	 * instead of considering it free-form text.  Thus, the
-	 * following macro looks as follows:
-	 *
-	 * .Xr foo 1 ) ,
-	 *
-	 * .Xr arg1 arg2 punctuation
-	 */
-
-	if (ROFF_PRELUDE & tree->state) {
-		roff_err(tree, *argv, "`%s' disallowed in prelude", 
-				toknames[tok]);
+	name = *cpp;
+	if ('\0' == *name)
 		return(0);
+
+	/* Read until end of name and terminate it with NUL. */
+	for (cp = name; 1; cp++) {
+		if ('\0' == *cp || ' ' == *cp) {
+			namesz = cp - name;
+			break;
+		}
+		if ('\\' != *cp)
+			continue;
+		namesz = cp - name;
+		if ('{' == cp[1] || '}' == cp[1])
+			break;
+		cp++;
+		if ('\\' == *cp)
+			continue;
+		mandoc_vmsg(MANDOCERR_NAMESC, r->parse, ln, pos,
+		    "%.*s", (int)(cp - name + 1), name);
+		mandoc_escape((const char **)&cp, NULL, NULL);
+		break;
 	}
 
-	first = (*argv == tree->cur);
-	p = *argv++;
-	ordp[0] = NULL;
+	/* Read past spaces. */
+	while (' ' == *cp)
+		cp++;
 
-	if ( ! roffparseopts(tree, tok, &argv, argcp, argvp))
-		return(0);
+	*cpp = cp;
+	return(namesz);
+}
 
-	if (NULL == *argv)
-		return(roffspecial(tree, tok, p, argcp, 
-					(const char **)argvp, 0, ordp));
+/*
+ * Store *string into the user-defined string called *name.
+ * To clear an existing entry, call with (*r, *name, NULL, 0).
+ * append == 0: replace mode
+ * append == 1: single-line append mode
+ * append == 2: multiline append mode, append '\n' after each call
+ */
+static void
+roff_setstr(struct roff *r, const char *name, const char *string,
+	int append)
+{
 
-	i = 0;
-	while (*argv && i < ROFF_MAXLINEARG) {
-		c = ROFF_PARSED & tokens[tok].flags ?
-			rofffindcallable(*argv) : ROFF_MAX;
+	roff_setstrn(&r->strtab, name, strlen(name), string,
+	    string ? strlen(string) : 0, append);
+}
 
-		if (ROFF_MAX == c && ! roffispunct(*argv)) {
-			ordp[i++] = *argv++;
-			continue;
-		}
-		ordp[i] = NULL;
+static void
+roff_setstrn(struct roffkv **r, const char *name, size_t namesz,
+		const char *string, size_t stringsz, int append)
+{
+	struct roffkv	*n;
+	char		*c;
+	int		 i;
+	size_t		 oldch, newch;
 
-		if (ROFF_MAX == c)
-			break;
+	/* Search for an existing string with the same name. */
+	n = *r;
 
-		if ( ! roffspecial(tree, tok, p, argcp, 
-					(const char **)argvp,
-					(size_t)i, ordp))
-			return(0);
+	while (n && (namesz != n->key.sz ||
+			strncmp(n->key.p, name, namesz)))
+		n = n->next;
 
-		return(roffcall(tree, c, argv));
+	if (NULL == n) {
+		/* Create a new string table entry. */
+		n = mandoc_malloc(sizeof(struct roffkv));
+		n->key.p = mandoc_strndup(name, namesz);
+		n->key.sz = namesz;
+		n->val.p = NULL;
+		n->val.sz = 0;
+		n->next = *r;
+		*r = n;
+	} else if (0 == append) {
+		free(n->val.p);
+		n->val.p = NULL;
+		n->val.sz = 0;
 	}
 
-	assert(i != ROFF_MAXLINEARG);
-	ordp[i] = NULL;
+	if (NULL == string)
+		return;
 
-	if ( ! roffspecial(tree, tok, p, argcp, 
-				(const char**)argvp,
-				(size_t)i, ordp))
-		return(0);
+	/*
+	 * One additional byte for the '\n' in multiline mode,
+	 * and one for the terminating '\0'.
+	 */
+	newch = stringsz + (1 < append ? 2u : 1u);
 
-	/* FIXME: error if there's stuff after the punctuation. */
+	if (NULL == n->val.p) {
+		n->val.p = mandoc_malloc(newch);
+		*n->val.p = '\0';
+		oldch = 0;
+	} else {
+		oldch = n->val.sz;
+		n->val.p = mandoc_realloc(n->val.p, oldch + newch);
+	}
 
-	if ( ! first || NULL == *argv)
-		return(1);
+	/* Skip existing content in the destination buffer. */
+	c = n->val.p + (int)oldch;
 
-	return(roffpurgepunct(tree, argv));
-}
+	/* Append new content to the destination buffer. */
+	i = 0;
+	while (i < (int)stringsz) {
+		/*
+		 * Rudimentary roff copy mode:
+		 * Handle escaped backslashes.
+		 */
+		if ('\\' == string[i] && '\\' == string[i + 1])
+			i++;
+		*c++ = string[i++];
+	}
 
+	/* Append terminating bytes. */
+	if (1 < append)
+		*c++ = '\n';
 
-/* ARGSUSED */
-static int
-roff_text(ROFFCALL_ARGS) 
+	*c = '\0';
+	n->val.sz = (int)(c - n->val.p);
+}
+
+static const char *
+roff_getstrn(const struct roff *r, const char *name, size_t len)
 {
-	int		 i, j, first, c, argcp[ROFF_MAXLINEARG];
-	char		*argvp[ROFF_MAXLINEARG];
+	const struct roffkv *n;
+	int i;
 
-	/*
-	 * Text macros are similar to special tokens, except that
-	 * arguments are instead flushed as pure data: we're only
-	 * concerned with the macro and its arguments.  Example:
-	 * 
-	 * .Fl v W f ;
-	 *
-	 * ...Produces...
-	 *
-	 * <fl> v W f </fl> ;
-	 */
+	for (n = r->strtab; n; n = n->next)
+		if (0 == strncmp(name, n->key.p, len) &&
+		    '\0' == n->key.p[(int)len])
+			return(n->val.p);
 
-	if (ROFF_PRELUDE & tree->state) {
-		roff_err(tree, *argv, "`%s' disallowed in prelude", 
-				toknames[tok]);
-		return(0);
+	for (i = 0; i < PREDEFS_MAX; i++)
+		if (0 == strncmp(name, predefs[i].name, len) &&
+				'\0' == predefs[i].name[(int)len])
+			return(predefs[i].str);
+
+	return(NULL);
+}
+
+static void
+roff_freestr(struct roffkv *r)
+{
+	struct roffkv	 *n, *nn;
+
+	for (n = r; n; n = nn) {
+		free(n->key.p);
+		free(n->val.p);
+		nn = n->next;
+		free(n);
 	}
+}
 
-	first = (*argv == tree->cur);
-	argv++;
+const struct tbl_span *
+roff_span(const struct roff *r)
+{
 
-	if ( ! roffparseopts(tree, tok, &argv, argcp, argvp))
-		return(0);
-	if ( ! (*tree->cb.roffin)(tree->arg, tok, argcp, 
-				(const char **)argvp))
-		return(0);
-	if (NULL == *argv)
-		return((*tree->cb.roffout)(tree->arg, tok));
+	return(r->tbl ? tbl_span(r->tbl) : NULL);
+}
 
-	if ( ! (ROFF_PARSED & tokens[tok].flags)) {
-		i = 0;
-		while (*argv)
-			if ( ! roffdata(tree, i++, *argv++))
-				return(0);
+const struct eqn *
+roff_eqn(const struct roff *r)
+{
 
-		return((*tree->cb.roffout)(tree->arg, tok));
-	}
+	return(r->last_eqn ? &r->last_eqn->eqn : NULL);
+}
 
+/*
+ * Duplicate an input string, making the appropriate character
+ * conversations (as stipulated by `tr') along the way.
+ * Returns a heap-allocated string with all the replacements made.
+ */
+char *
+roff_strdup(const struct roff *r, const char *p)
+{
+	const struct roffkv *cp;
+	char		*res;
+	const char	*pp;
+	size_t		 ssz, sz;
+	enum mandoc_esc	 esc;
+
+	if (NULL == r->xmbtab && NULL == r->xtab)
+		return(mandoc_strdup(p));
+	else if ('\0' == *p)
+		return(mandoc_strdup(""));
+
 	/*
-	 * Deal with punctuation.  Ugly.  Work ahead until we encounter
-	 * terminating punctuation.  If we encounter it and all
-	 * subsequent tokens are punctuation, then stop processing (the
-	 * line-dominant macro will print these tokens after closure).
-	 * If the punctuation is followed by non-punctuation, then close
-	 * and re-open our scope, then continue.
+	 * Step through each character looking for term matches
+	 * (remember that a `tr' can be invoked with an escape, which is
+	 * a glyph but the escape is multi-character).
+	 * We only do this if the character hash has been initialised
+	 * and the string is >0 length.
 	 */
 
-	i = 0;
-	while (*argv) {
-		if (ROFF_MAX != (c = rofffindcallable(*argv))) {
-			if ( ! (ROFF_LSCOPE & tokens[tok].flags))
-				if ( ! (*tree->cb.roffout)(tree->arg, tok))
-					return(0);
-	
-			if ( ! roffcall(tree, c, argv))
-				return(0);
-	
-			if (ROFF_LSCOPE & tokens[tok].flags)
-				if ( ! (*tree->cb.roffout)(tree->arg, tok))
-					return(0);
-	
-			break;
-		}
+	res = NULL;
+	ssz = 0;
 
-		if ( ! roffispunct(*argv)) {
-			if ( ! roffdata(tree, i++, *argv++))
-				return(0);
+	while ('\0' != *p) {
+		if ('\\' != *p && r->xtab && r->xtab[(int)*p].p) {
+			sz = r->xtab[(int)*p].sz;
+			res = mandoc_realloc(res, ssz + sz + 1);
+			memcpy(res + ssz, r->xtab[(int)*p].p, sz);
+			ssz += sz;
+			p++;
 			continue;
+		} else if ('\\' != *p) {
+			res = mandoc_realloc(res, ssz + 2);
+			res[ssz++] = *p++;
+			continue;
 		}
 
-		i = 1;
-		for (j = 0; argv[j]; j++)
-			if ( ! roffispunct(argv[j]))
+		/* Search for term matches. */
+		for (cp = r->xmbtab; cp; cp = cp->next)
+			if (0 == strncmp(p, cp->key.p, cp->key.sz))
 				break;
 
-		if (argv[j]) {
-			if (ROFF_LSCOPE & tokens[tok].flags) {
-				if ( ! roffdata(tree, 0, *argv++))
-					return(0);
-				continue;
-			}
-			if ( ! (*tree->cb.roffout)(tree->arg, tok))
-				return(0);
-			if ( ! roffdata(tree, 0, *argv++))
-				return(0);
-			if ( ! (*tree->cb.roffin)(tree->arg, tok, 
-						argcp, 
-						(const char **)argvp))
-				return(0);
-
-			i = 0;
+		if (NULL != cp) {
+			/*
+			 * A match has been found.
+			 * Append the match to the array and move
+			 * forward by its keysize.
+			 */
+			res = mandoc_realloc(res,
+			    ssz + cp->val.sz + 1);
+			memcpy(res + ssz, cp->val.p, cp->val.sz);
+			ssz += cp->val.sz;
+			p += (int)cp->key.sz;
 			continue;
 		}
 
-		if ( ! (*tree->cb.roffout)(tree->arg, tok))
-			return(0);
-		break;
+		/*
+		 * Handle escapes carefully: we need to copy
+		 * over just the escape itself, or else we might
+		 * do replacements within the escape itself.
+		 * Make sure to pass along the bogus string.
+		 */
+		pp = p++;
+		esc = mandoc_escape(&p, NULL, NULL);
+		if (ESCAPE_ERROR == esc) {
+			sz = strlen(pp);
+			res = mandoc_realloc(res, ssz + sz + 1);
+			memcpy(res + ssz, pp, sz);
+			break;
+		}
+		/*
+		 * We bail out on bad escapes.
+		 * No need to warn: we already did so when
+		 * roff_res() was called.
+		 */
+		sz = (int)(p - pp);
+		res = mandoc_realloc(res, ssz + sz + 1);
+		memcpy(res + ssz, pp, sz);
+		ssz += sz;
 	}
 
-	if (NULL == *argv)
-		return((*tree->cb.roffout)(tree->arg, tok));
-	if ( ! first)
-		return(1);
-
-	return(roffpurgepunct(tree, argv));
+	res[(int)ssz] = '\0';
+	return(res);
 }
 
-
-/* ARGSUSED */
-static int
-roff_noop(ROFFCALL_ARGS)
+int
+roff_getformat(const struct roff *r)
 {
 
-	return(1);
+	return(r->format);
 }
 
-
-/* ARGSUSED */
-static int
-roff_depr(ROFFCALL_ARGS)
+/*
+ * Find out whether a line is a macro line or not.
+ * If it is, adjust the current position and return one; if it isn't,
+ * return zero and don't change the current position.
+ * If the control character has been set with `.cc', then let that grain
+ * precedence.
+ * This is slighly contrary to groff, where using the non-breaking
+ * control character when `cc' has been invoked will cause the
+ * non-breaking macro contents to be printed verbatim.
+ */
+int
+roff_getcontrol(const struct roff *r, const char *cp, int *ppos)
 {
+	int		pos;
 
-	roff_err(tree, *argv, "`%s' is deprecated", toknames[tok]);
-	return(0);
-}
+	pos = *ppos;
 
+	if (0 != r->control && cp[pos] == r->control)
+		pos++;
+	else if (0 != r->control)
+		return(0);
+	else if ('\\' == cp[pos] && '.' == cp[pos + 1])
+		pos += 2;
+	else if ('.' == cp[pos] || '\'' == cp[pos])
+		pos++;
+	else
+		return(0);
 
-static void
-roff_warn(const struct rofftree *tree, const char *pos, char *fmt, ...)
-{
-	va_list		 ap;
-	char		 buf[128];
+	while (' ' == cp[pos] || '\t' == cp[pos])
+		pos++;
 
-	va_start(ap, fmt);
-	(void)vsnprintf(buf, sizeof(buf), fmt, ap);
-	va_end(ap);
-
-	(*tree->cb.roffmsg)(tree->arg, 
-			ROFF_WARN, tree->cur, pos, buf);
+	*ppos = pos;
+	return(1);
 }
-
-
-static void
-roff_err(const struct rofftree *tree, const char *pos, char *fmt, ...)
-{
-	va_list		 ap;
-	char		 buf[128];
-
-	va_start(ap, fmt);
-	(void)vsnprintf(buf, sizeof(buf), fmt, ap);
-	va_end(ap);
-
-	(*tree->cb.roffmsg)(tree->arg, 
-			ROFF_ERROR, tree->cur, pos, buf);
-}
-