===================================================================
RCS file: /cvs/mandoc/tbl_data.c,v
retrieving revision 1.44
retrieving revision 1.48
diff -u -p -r1.44 -r1.48
--- mandoc/tbl_data.c	2017/07/04 21:08:29	1.44
+++ mandoc/tbl_data.c	2018/12/12 21:54:35	1.48
@@ -1,7 +1,7 @@
-/*	$Id: tbl_data.c,v 1.44 2017/07/04 21:08:29 schwarze Exp $ */
+/*	$Id: tbl_data.c,v 1.48 2018/12/12 21:54:35 schwarze Exp $ */
 /*
  * Copyright (c) 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2011, 2015, 2017 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2011, 2015, 2017, 2018 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -25,8 +25,9 @@
 #include <string.h>
 #include <time.h>
 
-#include "mandoc.h"
 #include "mandoc_aux.h"
+#include "mandoc.h"
+#include "tbl.h"
 #include "libmandoc.h"
 #include "libroff.h"
 
@@ -40,10 +41,20 @@ static void
 getdata(struct tbl_node *tbl, struct tbl_span *dp,
 		int ln, const char *p, int *pos)
 {
-	struct tbl_dat	*dat;
+	struct tbl_dat	*dat, *pdat;
 	struct tbl_cell	*cp;
+	struct tbl_span	*pdp;
 	int		 sv;
 
+	/*
+	 * Determine the length of the string in the cell
+	 * and advance the parse point to the end of the cell.
+	 */
+
+	sv = *pos;
+	while (p[*pos] != '\0' && p[*pos] != tbl->opts.tab)
+		(*pos)++;
+
 	/* Advance to the next layout cell, skipping spanners. */
 
 	cp = dp->last == NULL ? dp->layout->first : dp->last->layout->next;
@@ -66,33 +77,67 @@ getdata(struct tbl_node *tbl, struct tbl_span *dp,
 			dp->layout->last = cp;
 		} else {
 			mandoc_msg(MANDOCERR_TBLDATA_EXTRA, tbl->parse,
-			    ln, *pos, p + *pos);
-			while (p[*pos])
+			    ln, sv, p + sv);
+			while (p[*pos] != '\0')
 				(*pos)++;
 			return;
 		}
 	}
 
-	dat = mandoc_calloc(1, sizeof(*dat));
+	dat = mandoc_malloc(sizeof(*dat));
 	dat->layout = cp;
+	dat->next = NULL;
+	dat->string = NULL;
+	dat->hspans = 0;
+	dat->vspans = 0;
+	dat->block = 0;
 	dat->pos = TBL_DATA_NONE;
-	dat->spans = 0;
+
+	/*
+	 * Increment the number of vertical spans in a data cell above,
+	 * if this cell vertically extends one or more cells above.
+	 * The iteration must be done over data rows,
+	 * not over layout rows, because one layout row
+	 * can be reused for more than one data row.
+	 */
+
+	if (cp->pos == TBL_CELL_DOWN ||
+	    (*pos - sv == 2 && p[sv] == '\\' && p[sv + 1] == '^')) {
+		pdp = dp;
+		while ((pdp = pdp->prev) != NULL) {
+			pdat = pdp->first;
+			while (pdat != NULL &&
+			    pdat->layout->col < dat->layout->col)
+				pdat = pdat->next;
+			if (pdat == NULL)
+				break;
+			if (pdat->layout->pos != TBL_CELL_DOWN &&
+			    strcmp(pdat->string, "\\^") != 0) {
+				pdat->vspans++;
+				break;
+			}
+		}
+	}
+
+	/*
+	 * Count the number of horizontal spans to the right of this cell.
+	 * This is purely a matter of the layout, independent of the data.
+	 */
+
 	for (cp = cp->next; cp != NULL; cp = cp->next)
 		if (cp->pos == TBL_CELL_SPAN)
-			dat->spans++;
+			dat->hspans++;
 		else
 			break;
 
+	/* Append the new data cell to the data row. */
+
 	if (dp->last == NULL)
 		dp->first = dat;
 	else
 		dp->last->next = dat;
 	dp->last = dat;
 
-	sv = *pos;
-	while (p[*pos] && p[*pos] != tbl->opts.tab)
-		(*pos)++;
-
 	/*
 	 * Check for a continued-data scope opening.  This consists of a
 	 * trailing `T{' at the end of the line.  Subsequent lines,
@@ -106,7 +151,7 @@ getdata(struct tbl_node *tbl, struct tbl_span *dp,
 
 	dat->string = mandoc_strndup(p + sv, *pos - sv);
 
-	if (p[*pos])
+	if (p[*pos] != '\0')
 		(*pos)++;
 
 	if ( ! strcmp(dat->string, "_"))
@@ -128,7 +173,7 @@ getdata(struct tbl_node *tbl, struct tbl_span *dp,
 		    tbl->parse, ln, sv, dat->string);
 }
 
-int
+void
 tbl_cdata(struct tbl_node *tbl, int ln, const char *p, int pos)
 {
 	struct tbl_dat	*dat;
@@ -143,10 +188,10 @@ tbl_cdata(struct tbl_node *tbl, int ln, const char *p,
 			pos++;
 			while (p[pos] != '\0')
 				getdata(tbl, tbl->last_span, ln, p, &pos);
-			return 1;
+			return;
 		} else if (p[pos] == '\0') {
 			tbl->part = TBL_PART_DATA;
-			return 1;
+			return;
 		}
 
 		/* Fallthrough: T} is part of a word. */
@@ -166,8 +211,6 @@ tbl_cdata(struct tbl_node *tbl, int ln, const char *p,
 	if (dat->layout->pos == TBL_CELL_DOWN)
 		mandoc_msg(MANDOCERR_TBLDATA_SPAN, tbl->parse,
 		    ln, pos, dat->string);
-
-	return 0;
 }
 
 static struct tbl_span *