Segfault fixes from kristaps@.

Note that .It and .Nm blocks without bodies cannot be generated by
valid mdoc(7) syntax but are a adequate representations of invalid
mdoc(7) constructs like Bl -hang It Bo Sh and Sh SYNOPSIS Nm Bo Sh.

8 files changed, 62 insertions, 9 deletions

diff --git a/regress/usr.bin/mandoc/mdoc/Bl/break.in b/regress/usr.bin/mandoc/mdoc/Bl/break.in
index 478b8abc370..a397042d27b 100644
--- a/regress/usr.bin/mandoc/mdoc/Bl/break.in
+++ b/regress/usr.bin/mandoc/mdoc/Bl/break.in
@@ -24,3 +24,8 @@ inside both
 after display
 .Ed
 after both
+.Sh CAVEATS
+.Bl -hang
+.It before broken block Bo inside both
+.El
+after list
diff --git a/regress/usr.bin/mandoc/mdoc/Bl/break.out_ascii b/regress/usr.bin/mandoc/mdoc/Bl/break.out_ascii
index f505cb79f35..bc3e2769440 100644
--- a/regress/usr.bin/mandoc/mdoc/Bl/break.out_ascii
+++ b/regress/usr.bin/mandoc/mdoc/Bl/break.out_ascii
@@ -15,4 +15,7 @@ EEXXAAMMPPLLEESS
                       inside both after display
      after both
 
+CCAAVVEEAATTSS
+     before broken block [inside both after list]
+
 OpenBSD                        November 16, 2012                       OpenBSD
diff --git a/regress/usr.bin/mandoc/mdoc/Bl/break.out_lint b/regress/usr.bin/mandoc/mdoc/Bl/break.out_lint
index 79eade5f655..b99744f21b2 100644
--- a/regress/usr.bin/mandoc/mdoc/Bl/break.out_lint
+++ b/regress/usr.bin/mandoc/mdoc/Bl/break.out_lint
@@ -1,2 +1,5 @@
 mandoc: break.in:13:2: WARNING: blocks badly nested: El breaks Bo
 mandoc: break.in:23:2: WARNING: blocks badly nested: El breaks Bd
+mandoc: break.in:30:2: WARNING: blocks badly nested: El breaks It
+mandoc: break.in:29:25: ERROR: appending missing end of block: Bo
+mandoc: break.in:28:2: ERROR: appending missing end of block: Bl
diff --git a/regress/usr.bin/mandoc/mdoc/Nm/Makefile b/regress/usr.bin/mandoc/mdoc/Nm/Makefile
index 8ec5dd751d2..02342262c48 100644
--- a/regress/usr.bin/mandoc/mdoc/Nm/Makefile
+++ b/regress/usr.bin/mandoc/mdoc/Nm/Makefile
@@ -1,9 +1,21 @@
-# $OpenBSD: Makefile,v 1.8 2014/08/11 04:18:18 schwarze Exp $
+# $OpenBSD: Makefile,v 1.9 2014/08/17 18:42:07 schwarze Exp $
 
-REGRESS_TARGETS = empty font emptyNAME emptyNAMEuse badNAME badNAMEuse long
+REGRESS_TARGETS	 = badNAME badNAMEuse break empty emptyNAME emptyNAMEuse
+REGRESS_TARGETS	+= font long
 
-LINT_TARGETS = badNAME badNAMEuse
+LINT_TARGETS	 = badNAME badNAMEuse break
 
-SKIP_GROFF = emptyNAMEuse badNAMEuse
+# groff-1.22.2/mandoc difference:
+# When the first Nm does not have an argument but a later one has,
+# mandoc retroactively uses the later name for the earlier instances
+# of Nm, too, while groff does not.
+
+SKIP_GROFF	 = badNAMEuse emptyNAMEuse
+
+# groff-1.22.2 defect:
+# When a SYNOPSIS Nm block head breaks a sub block, all the
+# remaining content in the document gets lost.
+
+SKIP_GROFF	+= break
 
 .include <bsd.regress.mk>
diff --git a/regress/usr.bin/mandoc/mdoc/Nm/break.in b/regress/usr.bin/mandoc/mdoc/Nm/break.in
new file mode 100644
index 00000000000..203ba98e3c5
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Nm/break.in
@@ -0,0 +1,12 @@
+.Dd August 17, 2014
+.Dt NM-BREAK 1
+.Os OpenBSD
+.Sh NAME
+.Nm Nm-break
+.Nd name block head breaking another block
+.Sh SYNOPSIS
+.Nm before Bo within
+.Sh DESCRIPTION
+initial text
+.Nm
+final text
diff --git a/regress/usr.bin/mandoc/mdoc/Nm/break.out_ascii b/regress/usr.bin/mandoc/mdoc/Nm/break.out_ascii
new file mode 100644
index 00000000000..8c62c9f7d3c
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Nm/break.out_ascii
@@ -0,0 +1,12 @@
+NM-BREAK(1)                OpenBSD Reference Manual                NM-BREAK(1)
+
+NNAAMMEE
+     NNmm--bbrreeaakk - name block head breaking another block
+
+SSYYNNOOPPSSIISS
+     bbeeffoorree [[wwiitthhiinn]]
+
+DDEESSCCRRIIPPTTIIOONN
+     initial text NNmm--bbrreeaakk final text
+
+OpenBSD                         August 17, 2014                        OpenBSD
diff --git a/regress/usr.bin/mandoc/mdoc/Nm/break.out_lint b/regress/usr.bin/mandoc/mdoc/Nm/break.out_lint
new file mode 100644
index 00000000000..409b5812ae8
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Nm/break.out_lint
@@ -0,0 +1 @@
+mandoc: break.in:9:2: ERROR: inserting missing end of block: Sh breaks Bo
diff --git a/usr.bin/mandoc/mdoc_term.c b/usr.bin/mandoc/mdoc_term.c
index e30b0950a92..b37173034d9 100644
--- a/usr.bin/mandoc/mdoc_term.c
+++ b/usr.bin/mandoc/mdoc_term.c
@@ -1,4 +1,4 @@
-/*	$Id: mdoc_term.c,v 1.177 2014/08/08 16:17:09 schwarze Exp $ */
+/*	$Id: mdoc_term.c,v 1.178 2014/08/17 18:42:07 schwarze Exp $ */
 /*
  * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012, 2013, 2014 Ingo Schwarze <schwarze@openbsd.org>
@@ -804,7 +804,8 @@ termp_it_pre(DECL_ARGS)
 		 * the "overstep" effect in term_flushln() and treat
 		 * this as a `-ohang' list instead.
 		 */
-		if (n->next->child &&
+		if (NULL != n->next &&
+		    NULL != n->next->child &&
 		    (MDOC_Bl == n->next->child->tok ||
 		     MDOC_Bd == n->next->child->tok))
 			break;
@@ -860,7 +861,9 @@ termp_it_pre(DECL_ARGS)
 		 * don't want to recalculate rmargin and offsets when
 		 * using `Bd' or `Bl' within `-hang' overstep lists.
 		 */
-		if (MDOC_HEAD == n->type && n->next->child &&
+		if (MDOC_HEAD == n->type &&
+		    NULL != n->next &&
+		    NULL != n->next->child &&
 		    (MDOC_Bl == n->next->child->tok ||
 		     MDOC_Bd == n->next->child->tok))
 			break;
@@ -1025,7 +1028,8 @@ termp_nm_pre(DECL_ARGS)
 	if (MDOC_HEAD == n->type)
 		synopsis_pre(p, n->parent);
 
-	if (MDOC_HEAD == n->type && n->next->child) {
+	if (MDOC_HEAD == n->type &&
+	    NULL != n->next && NULL != n->next->child) {
 		p->flags |= TERMP_NOSPACE | TERMP_NOBREAK | TERMP_BRIND;
 		p->trailspace = 1;
 		p->rmargin = p->offset + term_len(p, 1);
@@ -1053,7 +1057,8 @@ termp_nm_post(DECL_ARGS)
 
 	if (MDOC_BLOCK == n->type) {
 		p->flags &= ~(TERMP_KEEP | TERMP_PREKEEP);
-	} else if (MDOC_HEAD == n->type && n->next->child) {
+	} else if (MDOC_HEAD == n->type &&
+	    NULL != n->next && NULL != n->next->child) {
 		term_flushln(p);
 		p->flags &= ~(TERMP_NOBREAK | TERMP_BRIND | TERMP_HANG);
 		p->trailspace = 0;