===================================================================
RCS file: /cvs/mandoc/roff.c,v
retrieving revision 1.103
retrieving revision 1.115
diff -u -p -r1.103 -r1.115
--- mandoc/roff.c	2010/12/01 10:21:25	1.103
+++ mandoc/roff.c	2011/01/01 15:45:18	1.115
@@ -1,4 +1,4 @@
-/*	$Id: roff.c,v 1.103 2010/12/01 10:21:25 kristaps Exp $ */
+/*	$Id: roff.c,v 1.115 2011/01/01 15:45:18 kristaps Exp $ */
 /*
  * Copyright (c) 2010 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010 Ingo Schwarze <schwarze@openbsd.org>
@@ -7,9 +7,9 @@
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
@@ -29,6 +29,7 @@
 
 #include "mandoc.h"
 #include "roff.h"
+#include "libroff.h"
 #include "libmandoc.h"
 
 #define	RSTACK_MAX	128
@@ -36,14 +37,6 @@
 #define	ROFF_CTL(c) \
 	('.' == (c) || '\'' == (c))
 
-#if 1
-#define	ROFF_DEBUG(fmt, args...) \
-	do { /* Nothing. */ } while (/*CONSTCOND*/ 0)
-#else
-#define	ROFF_DEBUG(fmt, args...) \
-	do { fprintf(stderr, fmt , ##args); } while (/*CONSTCOND*/ 0)
-#endif
-
 enum	rofft {
 	ROFF_ad,
 	ROFF_am,
@@ -60,11 +53,16 @@ enum	rofft {
 	ROFF_ig,
 	ROFF_ne,
 	ROFF_nh,
+	ROFF_nr,
 	ROFF_rm,
+	ROFF_so,
 	ROFF_tr,
+	ROFF_TS,
+	ROFF_TE,
+	ROFF_T_,
 	ROFF_cblock,
 	ROFF_ccond, /* FIXME: remove this. */
-	ROFF_nr,
+	ROFF_USERDEF,
 	ROFF_MAX
 };
 
@@ -73,7 +71,6 @@ enum	roffrule {
 	ROFFRULE_DENY
 };
 
-
 struct	roffstr {
 	char		*name; /* key of symbol */
 	char		*string; /* current value */
@@ -87,7 +84,11 @@ struct	roff {
 	enum roffrule	 rstack[RSTACK_MAX]; /* stack of !`ie' rules */
 	int		 rstackpos; /* position in rstack */
 	struct regset	*regs; /* read/writable registers */
-	struct roffstr	*first_string;
+	struct roffstr	*first_string; /* user-defined strings & macros */
+	const char	*current_string; /* value of last called user macro */
+	struct tbl	*first_tbl; /* first table parsed */
+	struct tbl	*last_tbl; /* last table parsed */
+	struct tbl	*tbl; /* current table being parsed */
 };
 
 struct	roffnode {
@@ -95,6 +96,7 @@ struct	roffnode {
 	struct roffnode	*parent; /* up one in stack */
 	int		 line; /* parse line */
 	int		 col; /* parse col */
+	char		*name; /* node name, e.g. macro name */
 	char		*end; /* end-rules: custom token */
 	int		 endspan; /* end-rules: next-line or infty */
 	enum roffrule	 rule; /* current evaluation rule */
@@ -135,12 +137,17 @@ static	void		 roff_freestr(struct roff *);
 static	const char	*roff_getstrn(const struct roff *, 
 				const char *, size_t);
 static	enum rofferr	 roff_line_ignore(ROFF_ARGS);
+static	enum rofferr	 roff_line_error(ROFF_ARGS);
 static	enum rofferr	 roff_nr(ROFF_ARGS);
 static	int		 roff_res(struct roff *, 
 				char **, size_t *, int);
 static	void		 roff_setstr(struct roff *,
-				const char *, const char *);
-static	char		*roff_strdup(const char *);
+				const char *, const char *, int);
+static	enum rofferr	 roff_so(ROFF_ARGS);
+static	enum rofferr	 roff_TE(ROFF_ARGS);
+static	enum rofferr	 roff_TS(ROFF_ARGS);
+static	enum rofferr	 roff_T_(ROFF_ARGS);
+static	enum rofferr	 roff_userdef(ROFF_ARGS);
 
 /* See roff_hash_find() */
 
@@ -166,21 +173,26 @@ static	struct roffmac	 roffs[ROFF_MAX] = {
 	{ "ig", roff_block, roff_block_text, roff_block_sub, 0, NULL },
 	{ "ne", roff_line_ignore, NULL, NULL, 0, NULL },
 	{ "nh", roff_line_ignore, NULL, NULL, 0, NULL },
-	{ "rm", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "nr", roff_nr, NULL, NULL, 0, NULL },
+	{ "rm", roff_line_error, NULL, NULL, 0, NULL },
+	{ "so", roff_so, NULL, NULL, 0, NULL },
 	{ "tr", roff_line_ignore, NULL, NULL, 0, NULL },
+	{ "TS", roff_TS, NULL, NULL, 0, NULL },
+	{ "TE", roff_TE, NULL, NULL, 0, NULL },
+	{ "T&", roff_T_, NULL, NULL, 0, NULL },
 	{ ".", roff_cblock, NULL, NULL, 0, NULL },
 	{ "\\}", roff_ccond, NULL, NULL, 0, NULL },
-	{ "nr", roff_nr, NULL, NULL, 0, NULL },
+	{ NULL, roff_userdef, NULL, NULL, 0, NULL },
 };
 
 static	void		 roff_free1(struct roff *);
-static	enum rofft	 roff_hash_find(const char *);
+static	enum rofft	 roff_hash_find(const char *, size_t);
 static	void		 roff_hash_init(void);
 static	void		 roffnode_cleanscope(struct roff *);
-static	void		 roffnode_push(struct roff *, 
-				enum rofft, int, int);
+static	void		 roffnode_push(struct roff *, enum rofft,
+				const char *, int, int);
 static	void		 roffnode_pop(struct roff *);
-static	enum rofft	 roff_parse(const char *, int *);
+static	enum rofft	 roff_parse(struct roff *, const char *, int *);
 static	int		 roff_parse_nat(const char *, unsigned int *);
 
 /* See roff_hash_find() */
@@ -192,7 +204,7 @@ roff_hash_init(void)
 	struct roffmac	 *n;
 	int		  buc, i;
 
-	for (i = 0; i < (int)ROFF_MAX; i++) {
+	for (i = 0; i < (int)ROFF_USERDEF; i++) {
 		assert(roffs[i].name[0] >= ASCII_LO);
 		assert(roffs[i].name[0] <= ASCII_HI);
 
@@ -213,7 +225,7 @@ roff_hash_init(void)
  * the nil-terminated string name could be found.
  */
 static enum rofft
-roff_hash_find(const char *p)
+roff_hash_find(const char *p, size_t s)
 {
 	int		 buc;
 	struct roffmac	*n;
@@ -233,7 +245,7 @@ roff_hash_find(const char *p)
 	if (NULL == (n = hash[buc]))
 		return(ROFF_MAX);
 	for ( ; n; n = n->next)
-		if (0 == strcmp(n->name, p))
+		if (0 == strncmp(n->name, p, s) && '\0' == n->name[(int)s])
 			return((enum rofft)(n - roffs));
 
 	return(ROFF_MAX);
@@ -256,10 +268,9 @@ roffnode_pop(struct roff *r)
 		if (r->rstackpos > -1)
 			r->rstackpos--;
 
-	ROFF_DEBUG("roff: popping scope\n");
 	r->last = r->last->parent;
-	if (p->end)
-		free(p->end);
+	free(p->name);
+	free(p->end);
 	free(p);
 }
 
@@ -269,12 +280,15 @@ roffnode_pop(struct roff *r)
  * removed with roffnode_pop().
  */
 static void
-roffnode_push(struct roff *r, enum rofft tok, int line, int col)
+roffnode_push(struct roff *r, enum rofft tok, const char *name,
+		int line, int col)
 {
 	struct roffnode	*p;
 
 	p = mandoc_calloc(1, sizeof(struct roffnode));
 	p->tok = tok;
+	if (name)
+		p->name = mandoc_strdup(name);
 	p->parent = r->last;
 	p->line = line;
 	p->col = col;
@@ -287,9 +301,19 @@ roffnode_push(struct roff *r, enum rofft tok, int line
 static void
 roff_free1(struct roff *r)
 {
+	struct tbl	*t;
 
+	while (r->first_tbl) {
+		t = r->first_tbl;
+		r->first_tbl = t->next;
+		tbl_free(t);
+	}
+
+	r->first_tbl = r->last_tbl = r->tbl = NULL;
+
 	while (r->last)
 		roffnode_pop(r);
+
 	roff_freestr(r);
 }
 
@@ -335,15 +359,40 @@ roff_alloc(struct regset *regs, void *data, const mand
 static int
 roff_res(struct roff *r, char **bufp, size_t *szp, int pos)
 {
-	const char	*cp, *cpp, *st, *res;
+	const char	*stesc;	/* start of an escape sequence ('\\') */
+	const char	*stnam;	/* start of the name, after "[(*" */
+	const char	*cp;	/* end of the name, e.g. before ']' */
+	const char	*res;	/* the string to be substituted */
 	int		 i, maxl;
 	size_t		 nsz;
 	char		*n;
 
-	/* LINTED */
-	for (cp = &(*bufp)[pos]; (cpp = strstr(cp, "\\*")); cp++) {
-		cp = cpp + 2;
+	/* Search for a leading backslash and save a pointer to it. */
+
+	cp = *bufp + pos;
+	while (NULL != (cp = strchr(cp, '\\'))) {
+		stesc = cp++;
+
+		/*
+		 * The second character must be an asterisk.
+		 * If it isn't, skip it anyway:  It is escaped,
+		 * so it can't start another escape sequence.
+		 */
+
+		if ('\0' == *cp)
+			return(1);
+		if ('*' != *cp++)
+			continue;
+
+		/*
+		 * The third character decides the length
+		 * of the name of the string.
+		 * Save a pointer to the name.
+		 */
+
 		switch (*cp) {
+		case ('\0'):
+			return(1);
 		case ('('):
 			cp++;
 			maxl = 2;
@@ -356,8 +405,9 @@ roff_res(struct roff *r, char **bufp, size_t *szp, int
 			maxl = 1;
 			break;
 		}
+		stnam = cp;
 
-		st = cp;
+		/* Advance to the end of the name. */
 
 		for (i = 0; 0 == maxl || i < maxl; i++, cp++) {
 			if ('\0' == *cp)
@@ -366,21 +416,24 @@ roff_res(struct roff *r, char **bufp, size_t *szp, int
 				break;
 		}
 
-		res = roff_getstrn(r, st, (size_t)i);
+		/*
+		 * Retrieve the replacement string; if it is
+		 * undefined, resume searching for escapes.
+		 */
 
+		res = roff_getstrn(r, stnam, (size_t)i);
+
 		if (NULL == res) {
 			cp -= maxl ? 1 : 0;
 			continue;
 		}
 
-		ROFF_DEBUG("roff: splicing reserved: [%.*s]\n", i, st);
+		/* Replace the escape sequence by the string. */
 
 		nsz = *szp + strlen(res) + 1;
 		n = mandoc_malloc(nsz);
 
-		*n = '\0';
-
-		strlcat(n, *bufp, (size_t)(cpp - *bufp + 1));
+		strlcpy(n, *bufp, (size_t)(stesc - *bufp + 1));
 		strlcat(n, res, nsz);
 		strlcat(n, cp + (maxl ? 0 : 1), nsz);
 
@@ -400,6 +453,7 @@ roff_parseln(struct roff *r, int ln, char **bufp, 
 		size_t *szp, int pos, int *offs)
 {
 	enum rofft	 t;
+	enum rofferr	 e;
 	int		 ppos;
 
 	/*
@@ -408,7 +462,7 @@ roff_parseln(struct roff *r, int ln, char **bufp, 
 	 */
 
 	if (r->first_string && ! roff_res(r, bufp, szp, pos))
-		return(ROFF_RERUN);
+		return(ROFF_REPARSE);
 
 	/*
 	 * First, if a scope is open and we're not a macro, pass the
@@ -419,13 +473,17 @@ roff_parseln(struct roff *r, int ln, char **bufp, 
 	if (r->last && ! ROFF_CTL((*bufp)[pos])) {
 		t = r->last->tok;
 		assert(roffs[t].text);
-		ROFF_DEBUG("roff: intercept scoped text: %s, [%s]\n", 
-				roffs[t].name, &(*bufp)[pos]);
-		return((*roffs[t].text)
-				(r, t, bufp, szp, 
-				 ln, pos, pos, offs));
-	} else if ( ! ROFF_CTL((*bufp)[pos]))
+		e = (*roffs[t].text)
+			(r, t, bufp, szp, ln, pos, pos, offs);
+		assert(ROFF_IGN == e || ROFF_CONT == e);
+		if (ROFF_CONT == e && r->tbl)
+			return(tbl_read(r->tbl, ln, *bufp, *offs));
+		return(e);
+	} else if ( ! ROFF_CTL((*bufp)[pos])) {
+		if (r->tbl)
+			return(tbl_read(r->tbl, ln, *bufp, *offs));
 		return(ROFF_CONT);
+	}
 
 	/*
 	 * If a scope is open, go to the child handler for that macro,
@@ -435,8 +493,6 @@ roff_parseln(struct roff *r, int ln, char **bufp, 
 	if (r->last) {
 		t = r->last->tok;
 		assert(roffs[t].sub);
-		ROFF_DEBUG("roff: intercept scoped context: %s, [%s]\n", 
-				roffs[t].name, &(*bufp)[pos]);
 		return((*roffs[t].sub)
 				(r, t, bufp, szp, 
 				 ln, pos, pos, offs));
@@ -449,11 +505,9 @@ roff_parseln(struct roff *r, int ln, char **bufp, 
 	 */
 
 	ppos = pos;
-	if (ROFF_MAX == (t = roff_parse(*bufp, &pos)))
+	if (ROFF_MAX == (t = roff_parse(r, *bufp, &pos)))
 		return(ROFF_CONT);
 
-	ROFF_DEBUG("roff: intercept new-scope: %s, [%s]\n", 
-			roffs[t].name, &(*bufp)[pos]);
 	assert(roffs[t].proc);
 	return((*roffs[t].proc)
 			(r, t, bufp, szp, 
@@ -465,10 +519,11 @@ int
 roff_endparse(struct roff *r)
 {
 
-	if (NULL == r->last)
-		return(1);
-	return((*r->msg)(MANDOCERR_SCOPEEXIT, r->data, r->last->line, 
-				r->last->col, NULL));
+	/* FIXME: if r->tbl */
+	if (r->last)
+		(*r->msg)(MANDOCERR_SCOPEEXIT, r->data, 
+				r->last->line, r->last->col, NULL);
+	return(1);
 }
 
 
@@ -477,35 +532,28 @@ roff_endparse(struct roff *r)
  * form of ".foo xxx" in the usual way.
  */
 static enum rofft
-roff_parse(const char *buf, int *pos)
+roff_parse(struct roff *r, const char *buf, int *pos)
 {
-	int		 j;
-	char		 mac[5];
+	const char	*mac;
+	size_t		 maclen;
 	enum rofft	 t;
 
 	assert(ROFF_CTL(buf[*pos]));
 	(*pos)++;
 
-	while (buf[*pos] && (' ' == buf[*pos] || '\t' == buf[*pos]))
+	while (' ' == buf[*pos] || '\t' == buf[*pos])
 		(*pos)++;
 
 	if ('\0' == buf[*pos])
 		return(ROFF_MAX);
 
-	for (j = 0; j < 4; j++, (*pos)++)
-		if ('\0' == (mac[j] = buf[*pos]))
-			break;
-		else if (' ' == buf[*pos] || (j && '\\' == buf[*pos]))
-			break;
+	mac = buf + *pos;
+	maclen = strcspn(mac, " \\\t\0");
 
-	if (j == 4 || j < 1)
-		return(ROFF_MAX);
+	t = (r->current_string = roff_getstrn(r, mac, maclen))
+	    ? ROFF_USERDEF : roff_hash_find(mac, maclen);
 
-	mac[j] = '\0';
-
-	if (ROFF_MAX == (t = roff_hash_find(mac)))
-		return(t);
-
+	*pos += maclen;
 	while (buf[*pos] && ' ' == buf[*pos])
 		(*pos)++;
 
@@ -544,8 +592,7 @@ roff_cblock(ROFF_ARGS)
 	 */
 
 	if (NULL == r->last) {
-		if ( ! (*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL))
-			return(ROFF_ERR);
+		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
 		return(ROFF_IGN);
 	}
 
@@ -557,22 +604,19 @@ roff_cblock(ROFF_ARGS)
 	case (ROFF_am1):
 		/* FALLTHROUGH */
 	case (ROFF_de):
+		/* ROFF_de1 is remapped to ROFF_de in roff_block(). */
 		/* FALLTHROUGH */
 	case (ROFF_dei):
 		/* FALLTHROUGH */
-	case (ROFF_de1):
-		/* FALLTHROUGH */
 	case (ROFF_ig):
 		break;
 	default:
-		if ( ! (*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL))
-			return(ROFF_ERR);
+		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
 		return(ROFF_IGN);
 	}
 
 	if ((*bufp)[pos])
-		if ( ! (*r->msg)(MANDOCERR_ARGSLOST, r->data, ln, pos, NULL))
-			return(ROFF_ERR);
+		(*r->msg)(MANDOCERR_ARGSLOST, r->data, ln, pos, NULL);
 
 	roffnode_pop(r);
 	roffnode_cleanscope(r);
@@ -599,8 +643,7 @@ roff_ccond(ROFF_ARGS)
 {
 
 	if (NULL == r->last) {
-		if ( ! (*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL))
-			return(ROFF_ERR);
+		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
 		return(ROFF_IGN);
 	}
 
@@ -612,20 +655,17 @@ roff_ccond(ROFF_ARGS)
 	case (ROFF_if):
 		break;
 	default:
-		if ( ! (*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL))
-			return(ROFF_ERR);
+		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
 		return(ROFF_IGN);
 	}
 
 	if (r->last->endspan > -1) {
-		if ( ! (*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL))
-			return(ROFF_ERR);
+		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
 		return(ROFF_IGN);
 	}
 
 	if ((*bufp)[pos])
-		if ( ! (*r->msg)(MANDOCERR_ARGSLOST, r->data, ln, pos, NULL))
-			return(ROFF_ERR);
+		(*r->msg)(MANDOCERR_ARGSLOST, r->data, ln, pos, NULL);
 
 	roffnode_pop(r);
 	roffnode_cleanscope(r);
@@ -639,25 +679,55 @@ roff_block(ROFF_ARGS)
 {
 	int		sv;
 	size_t		sz;
+	char		*name;
 
-	if (ROFF_ig != tok && '\0' == (*bufp)[pos]) {
-		if ( ! (*r->msg)(MANDOCERR_NOARGS, r->data, ln, ppos, NULL))
-			return(ROFF_ERR);
-		return(ROFF_IGN);
-	} else if (ROFF_ig != tok) {
+	name = NULL;
+
+	if (ROFF_ig != tok) {
+		if ('\0' == (*bufp)[pos]) {
+			(*r->msg)(MANDOCERR_NOARGS, r->data, ln, ppos, NULL);
+			return(ROFF_IGN);
+		}
+
+		/*
+		 * Re-write `de1', since we don't really care about
+		 * groff's strange compatibility mode, into `de'.
+		 */
+
+		if (ROFF_de1 == tok)
+			tok = ROFF_de;
+		if (ROFF_de == tok)
+			name = *bufp + pos;
+		else
+			(*r->msg)(MANDOCERR_REQUEST, r->data, ln, ppos,
+			    roffs[tok].name);
+
 		while ((*bufp)[pos] && ' ' != (*bufp)[pos])
 			pos++;
+
 		while (' ' == (*bufp)[pos])
-			pos++;
+			(*bufp)[pos++] = '\0';
 	}
 
-	roffnode_push(r, tok, ln, ppos);
+	roffnode_push(r, tok, name, ln, ppos);
 
+	/*
+	 * At the beginning of a `de' macro, clear the existing string
+	 * with the same name, if there is one.  New content will be
+	 * added from roff_block_text() in multiline mode.
+	 */
+
+	if (ROFF_de == tok)
+		roff_setstr(r, name, "", 0);
+
 	if ('\0' == (*bufp)[pos])
 		return(ROFF_IGN);
 
+	/* If present, process the custom end-of-line marker. */
+
 	sv = pos;
-	while ((*bufp)[pos] && ' ' != (*bufp)[pos] && 
+	while ((*bufp)[pos] &&
+			' ' != (*bufp)[pos] && 
 			'\t' != (*bufp)[pos])
 		pos++;
 
@@ -679,8 +749,7 @@ roff_block(ROFF_ARGS)
 	r->last->end[(int)sz] = '\0';
 
 	if ((*bufp)[pos])
-		if ( ! (*r->msg)(MANDOCERR_ARGSLOST, r->data, ln, pos, NULL))
-			return(ROFF_ERR);
+		(*r->msg)(MANDOCERR_ARGSLOST, r->data, ln, pos, NULL);
 
 	return(ROFF_IGN);
 }
@@ -718,7 +787,7 @@ roff_block_sub(ROFF_ARGS)
 			roffnode_pop(r);
 			roffnode_cleanscope(r);
 
-			if (ROFF_MAX != roff_parse(*bufp, &pos))
+			if (ROFF_MAX != roff_parse(r, *bufp, &pos))
 				return(ROFF_RERUN);
 			return(ROFF_IGN);
 		}
@@ -730,11 +799,17 @@ roff_block_sub(ROFF_ARGS)
 	 */
 
 	ppos = pos;
-	t = roff_parse(*bufp, &pos);
+	t = roff_parse(r, *bufp, &pos);
 
-	/* If we're not a comment-end, then throw it away. */
-	if (ROFF_cblock != t)
+	/*
+	 * Macros other than block-end are only significant
+	 * in `de' blocks; elsewhere, simply throw them away.
+	 */
+	if (ROFF_cblock != t) {
+		if (ROFF_de == tok)
+			roff_setstr(r, r->last->name, *bufp + ppos, 1);
 		return(ROFF_IGN);
+	}
 
 	assert(roffs[t].proc);
 	return((*roffs[t].proc)(r, t, bufp, szp, 
@@ -747,6 +822,9 @@ static enum rofferr
 roff_block_text(ROFF_ARGS)
 {
 
+	if (ROFF_de == tok)
+		roff_setstr(r, r->last->name, *bufp + pos, 1);
+
 	return(ROFF_IGN);
 }
 
@@ -768,10 +846,10 @@ roff_cond_sub(ROFF_ARGS)
 
 	roffnode_cleanscope(r);
 
-	if (ROFF_MAX == (t = roff_parse(*bufp, &pos))) {
+	if (ROFF_MAX == (t = roff_parse(r, *bufp, &pos))) {
 		if ('\\' == (*bufp)[pos] && '}' == (*bufp)[pos + 1])
 			return(roff_ccond
-				(r, ROFF_ccond, bufp, szp, 
+				(r, ROFF_ccond, bufp, szp,
 				 ln, pos, pos + 2, offs));
 		return(ROFFRULE_DENY == rr ? ROFF_IGN : ROFF_CONT);
 	}
@@ -846,7 +924,6 @@ roff_evalcond(const char *v, int *pos)
 	return(ROFFRULE_DENY);
 }
 
-
 /* ARGSUSED */
 static enum rofferr
 roff_line_ignore(ROFF_ARGS)
@@ -855,7 +932,15 @@ roff_line_ignore(ROFF_ARGS)
 	return(ROFF_IGN);
 }
 
+/* ARGSUSED */
+static enum rofferr
+roff_line_error(ROFF_ARGS)
+{
 
+	(*r->msg)(MANDOCERR_REQUEST, r->data, ln, ppos, roffs[tok].name);
+	return(ROFF_IGN);
+}
+
 /* ARGSUSED */
 static enum rofferr
 roff_cond(ROFF_ARGS)
@@ -897,18 +982,14 @@ roff_cond(ROFF_ARGS)
 	 */
 
 	if ('\0' == (*bufp)[pos] && sv != pos) {
-		if ((*r->msg)(MANDOCERR_NOARGS, r->data, ln, ppos, NULL))
-			return(ROFF_IGN);
-		return(ROFF_ERR);
+		(*r->msg)(MANDOCERR_NOARGS, r->data, ln, ppos, NULL);
+		return(ROFF_IGN);
 	}
 
-	roffnode_push(r, tok, ln, ppos);
+	roffnode_push(r, tok, NULL, ln, ppos);
 
 	r->last->rule = rule;
 
-	ROFF_DEBUG("roff: cond: %s -> %s\n", roffs[tok].name, 
-			ROFFRULE_ALLOW == rule ?  "allow" : "deny");
-
 	if (ROFF_ie == tok) {
 		/*
 		 * An if-else will put the NEGATION of the current
@@ -923,11 +1004,8 @@ roff_cond(ROFF_ARGS)
 
 	/* If the parent has false as its rule, then so do we. */
 
-	if (r->last->parent && ROFFRULE_DENY == r->last->parent->rule) {
+	if (r->last->parent && ROFFRULE_DENY == r->last->parent->rule)
 		r->last->rule = ROFFRULE_DENY;
-		ROFF_DEBUG("roff: cond override: %s -> deny\n",
-				roffs[tok].name);
-	}
 
 	/*
 	 * Determine scope.  If we're invoked with "\{" trailing the
@@ -940,11 +1018,7 @@ roff_cond(ROFF_ARGS)
 	if ('\\' == (*bufp)[pos] && '{' == (*bufp)[pos + 1]) {
 		r->last->endspan = -1;
 		pos += 2;
-		ROFF_DEBUG("roff: cond-scope: %s, multi-line\n", 
-				roffs[tok].name);
-	} else
-		ROFF_DEBUG("roff: cond-scope: %s, one-line\n", 
-				roffs[tok].name);
+	} 
 
 	/*
 	 * If there are no arguments on the line, the next-line scope is
@@ -999,7 +1073,7 @@ roff_ds(ROFF_ARGS)
 		string++;
 
 	/* The rest is the value. */
-	roff_setstr(r, name, string);
+	roff_setstr(r, name, string, 0);
 	return(ROFF_IGN);
 }
 
@@ -1037,59 +1111,244 @@ roff_nr(ROFF_ARGS)
 		rg[(int)REG_nS].set = 1;
 		if ( ! roff_parse_nat(val, &rg[(int)REG_nS].v.u))
 			rg[(int)REG_nS].v.u = 0;
+	}
 
-		ROFF_DEBUG("roff: register nS: %u\n", 
-				rg[(int)REG_nS].v.u);
-	} else
-		ROFF_DEBUG("roff: ignoring register: %s\n", key);
+	return(ROFF_IGN);
+}
 
+/* ARGSUSED */
+static enum rofferr
+roff_TE(ROFF_ARGS)
+{
+
+	if (NULL == r->tbl)
+		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
+	else
+		tbl_end(r->tbl);
+
+	r->tbl = NULL;
 	return(ROFF_IGN);
 }
 
+/* ARGSUSED */
+static enum rofferr
+roff_T_(ROFF_ARGS)
+{
 
-static char *
-roff_strdup(const char *name)
+	if (NULL == r->tbl)
+		(*r->msg)(MANDOCERR_NOSCOPE, r->data, ln, ppos, NULL);
+	else
+		tbl_restart(r->tbl);
+
+	return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_TS(ROFF_ARGS)
 {
-	char		*namecopy, *sv;
+	struct tbl	*t;
 
-	/* 
-	 * This isn't a nice simple mandoc_strdup() because we must
-	 * handle roff's stupid double-escape rule. 
+	if (r->tbl) {
+		(*r->msg)(MANDOCERR_SCOPEBROKEN, r->data, ln, ppos, NULL);
+		tbl_end(r->tbl);
+	}
+
+	t = tbl_alloc(ppos, ln, r->data, r->msg);
+
+	if (r->last_tbl)
+		r->last_tbl->next = t;
+	else
+		r->first_tbl = r->last_tbl = t;
+
+	r->tbl = r->last_tbl = t;
+	return(ROFF_IGN);
+}
+
+/* ARGSUSED */
+static enum rofferr
+roff_so(ROFF_ARGS)
+{
+	char *name;
+
+	(*r->msg)(MANDOCERR_SO, r->data, ln, ppos, NULL);
+
+	/*
+	 * Handle `so'.  Be EXTREMELY careful, as we shouldn't be
+	 * opening anything that's not in our cwd or anything beneath
+	 * it.  Thus, explicitly disallow traversing up the file-system
+	 * or using absolute paths.
 	 */
-	sv = namecopy = mandoc_malloc(strlen(name) + 1);
-	while (*name) {
-		if ('\\' == *name && '\\' == *(name + 1))
-			name++;
-		*namecopy++ = *name++;
+
+	name = *bufp + pos;
+	if ('/' == *name || strstr(name, "../") || strstr(name, "/..")) {
+		(*r->msg)(MANDOCERR_SOPATH, r->data, ln, pos, NULL);
+		return(ROFF_ERR);
 	}
 
-	*namecopy = '\0';
-	return(sv);
+	*offs = pos;
+	return(ROFF_SO);
 }
 
+/* ARGSUSED */
+static enum rofferr
+roff_userdef(ROFF_ARGS)
+{
+	const char	 *arg[9];
+	char		 *cp, *n1, *n2;
+	int		  i, quoted, pairs;
 
+	/*
+	 * Collect pointers to macro argument strings
+	 * and null-terminate them.
+	 */
+	cp = *bufp + pos;
+	for (i = 0; i < 9; i++) {
+		/* Quoting can only start with a new word. */
+		if ('"' == *cp) {
+			quoted = 1;
+			cp++;
+		} else
+			quoted = 0;
+		arg[i] = cp;
+		for (pairs = 0; '\0' != *cp; cp++) {
+			/* Unquoted arguments end at blanks. */
+			if (0 == quoted) {
+				if (' ' == *cp)
+					break;
+				continue;
+			}
+			/* After pairs of quotes, move left. */
+			if (pairs)
+				cp[-pairs] = cp[0];
+			/* Pairs of quotes do not end words, ... */
+			if ('"' == cp[0] && '"' == cp[1]) {
+				pairs++;
+				cp++;
+				continue;
+			}
+			/* ... but solitary quotes do. */
+			if ('"' != *cp)
+				continue;
+			if (pairs)
+				cp[-pairs] = '\0';
+			*cp = ' ';
+			break;
+		}
+		/* Last argument; the remaining ones are empty strings. */
+		if ('\0' == *cp)
+			continue;
+		/* Null-terminate argument and move to the next one. */
+		*cp++ = '\0';
+		while (' ' == *cp)
+			cp++;
+	}
+
+	/*
+	 * Expand macro arguments.
+	 */
+	*szp = 0;
+	n1 = cp = mandoc_strdup(r->current_string);
+	while (NULL != (cp = strstr(cp, "\\$"))) {
+		i = cp[2] - '1';
+		if (0 > i || 8 < i) {
+			/* Not an argument invocation. */
+			cp += 2;
+			continue;
+		}
+
+		*szp = strlen(n1) - 3 + strlen(arg[i]) + 1;
+		n2 = mandoc_malloc(*szp);
+
+		strlcpy(n2, n1, (size_t)(cp - n1 + 1));
+		strlcat(n2, arg[i], *szp);
+		strlcat(n2, cp + 3, *szp);
+
+		cp = n2 + (cp - n1);
+		free(n1);
+		n1 = n2;
+	}
+
+	/*
+	 * Replace the macro invocation
+	 * by the expanded macro.
+	 */
+	free(*bufp);
+	*bufp = n1;
+	if (0 == *szp)
+		*szp = strlen(*bufp) + 1;
+
+	return(*szp > 1 && '\n' == (*bufp)[(int)*szp - 2] ?
+	   ROFF_REPARSE : ROFF_APPEND);
+}
+
+/*
+ * Store *string into the user-defined string called *name.
+ * In multiline mode, append to an existing entry and append '\n';
+ * else replace the existing entry, if there is one.
+ * To clear an existing entry, call with (*r, *name, NULL, 0).
+ */
 static void
-roff_setstr(struct roff *r, const char *name, const char *string)
+roff_setstr(struct roff *r, const char *name, const char *string,
+	int multiline)
 {
 	struct roffstr	 *n;
-	char		 *namecopy;
+	char		 *c;
+	size_t		  oldch, newch;
 
+	/* Search for an existing string with the same name. */
 	n = r->first_string;
 	while (n && strcmp(name, n->name))
 		n = n->next;
 
 	if (NULL == n) {
-		namecopy = mandoc_strdup(name);
+		/* Create a new string table entry. */
 		n = mandoc_malloc(sizeof(struct roffstr));
-		n->name = namecopy;
+		n->name = mandoc_strdup(name);
+		n->string = NULL;
 		n->next = r->first_string;
 		r->first_string = n;
-	} else
+	} else if (0 == multiline) {
+		/* In multiline mode, append; else replace. */
 		free(n->string);
+		n->string = NULL;
+	}
 
-	/* Don't use mandoc_strdup: clean out double-escapes. */
-	n->string = string ? roff_strdup(string) : NULL;
-	ROFF_DEBUG("roff: new symbol: [%s] = [%s]\n", name, n->string);
+	if (NULL == string)
+		return;
+
+	/*
+	 * One additional byte for the '\n' in multiline mode,
+	 * and one for the terminating '\0'.
+	 */
+	newch = strlen(string) + (multiline ? 2 : 1);
+	if (NULL == n->string) {
+		n->string = mandoc_malloc(newch);
+		*n->string = '\0';
+		oldch = 0;
+	} else {
+		oldch = strlen(n->string);
+		n->string = mandoc_realloc(n->string, oldch + newch);
+	}
+
+	/* Skip existing content in the destination buffer. */
+	c = n->string + oldch;
+
+	/* Append new content to the destination buffer. */
+	while (*string) {
+		/*
+		 * Rudimentary roff copy mode:
+		 * Handle escaped backslashes.
+		 */
+		if ('\\' == *string && '\\' == *(string + 1))
+			string++;
+		*c++ = *string++;
+	}
+
+	/* Append terminating bytes. */
+	if (multiline)
+		*c++ = '\n';
+	*c = '\0';
 }
 
 
@@ -1119,4 +1378,11 @@ roff_freestr(struct roff *r)
 	}
 
 	r->first_string = NULL;
+}
+
+const struct tbl_span *
+roff_span(const struct roff *r)
+{
+	
+	return(r->tbl ? tbl_span(r->tbl) : NULL);
 }