Fix a crash triggered by .Bl -tag .It Xo .El .Sh found by florian@.

* When allocating a body end marker, copy the pointer to the normalized
block information from the body block, avoiding the risk of subsequent
null pointer derefence.
* When inserting the body end marker into the syntax tree, do not try to
copy that pointer from the parent block, because not being a direkt child
of the block it belongs to is the whole point of a body end marker.
* Even non-callable blocks (like Bd and Bl) can break other blocks;
when this happens, postpone closing them out in the usual way.

12 files changed, 147 insertions, 11 deletions

diff --git a/regress/usr.bin/mandoc/mdoc/Bd/Makefile b/regress/usr.bin/mandoc/mdoc/Bd/Makefile
index 5b270baab53..25556d48e73 100644
--- a/regress/usr.bin/mandoc/mdoc/Bd/Makefile
+++ b/regress/usr.bin/mandoc/mdoc/Bd/Makefile
@@ -1,5 +1,12 @@
-# $OpenBSD: Makefile,v 1.6 2012/07/07 14:10:55 schwarze Exp $
+# $OpenBSD: Makefile,v 1.7 2012/11/16 13:25:34 schwarze Exp $
 
-REGRESS_TARGETS=empty blank offset-empty spacing
+REGRESS_TARGETS = empty blank offset-empty spacing break broken
+
+# groff-1.20.1 defect:    
+# - a display breaking another block continues indefinitely
+
+SKIP_GROFF = break
+
+SKIP_TMAN = break broken
 
 .include <bsd.regress.mk>
diff --git a/regress/usr.bin/mandoc/mdoc/Bd/break.in b/regress/usr.bin/mandoc/mdoc/Bd/break.in
new file mode 100644
index 00000000000..7eaf663a565
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Bd/break.in
@@ -0,0 +1,15 @@
+.Dd November 10, 2012
+.Dt BD-BREAK 1
+.Os OpenBSD
+.Sh NAME
+.Nm Bd-break
+.Nd display breaking another block
+.Sh DESCRIPTION
+before both
+.Bd -ragged -offset indent
+before bracket
+.Bo inside both
+.Ed
+after display
+.Bc
+after both
diff --git a/regress/usr.bin/mandoc/mdoc/Bd/break.out_ascii b/regress/usr.bin/mandoc/mdoc/Bd/break.out_ascii
new file mode 100644
index 00000000000..bb04bce8011
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Bd/break.out_ascii
@@ -0,0 +1,12 @@
+BD-BREAK(1)                OpenBSD Reference Manual                BD-BREAK(1)
+
+NNAAMMEE
+     BBdd--bbrreeaakk - display breaking another block
+
+DDEESSCCRRIIPPTTIIOONN
+     before both
+
+           before bracket [inside both
+     after display] after both
+
+OpenBSD                        November 10, 2012                       OpenBSD
diff --git a/regress/usr.bin/mandoc/mdoc/Bd/broken.in b/regress/usr.bin/mandoc/mdoc/Bd/broken.in
new file mode 100644
index 00000000000..b7271a672c7
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Bd/broken.in
@@ -0,0 +1,14 @@
+.Dd November 10, 2012
+.Dt BD-BROKEN 1
+.Os OpenBSD
+.Sh NAME
+.Nm Bd-broken
+.Nd display broken by another block
+.Sh DESCRIPTION
+before both
+.Bo before display
+.Bd -ragged -offset indent
+inside both
+.Bc
+after bracket
+.Ed
diff --git a/regress/usr.bin/mandoc/mdoc/Bd/broken.out_ascii b/regress/usr.bin/mandoc/mdoc/Bd/broken.out_ascii
new file mode 100644
index 00000000000..f59c4830c1c
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Bd/broken.out_ascii
@@ -0,0 +1,11 @@
+BD-BROKEN(1)               OpenBSD Reference Manual               BD-BROKEN(1)
+
+NNAAMMEE
+     BBdd--bbrrookkeenn - display broken by another block
+
+DDEESSCCRRIIPPTTIIOONN
+     before both [before display
+
+           inside both] after bracket
+
+OpenBSD                        November 10, 2012                       OpenBSD
diff --git a/regress/usr.bin/mandoc/mdoc/Bl/Makefile b/regress/usr.bin/mandoc/mdoc/Bl/Makefile
index c123efe26ea..06dabcfb0c5 100644
--- a/regress/usr.bin/mandoc/mdoc/Bl/Makefile
+++ b/regress/usr.bin/mandoc/mdoc/Bl/Makefile
@@ -1,15 +1,17 @@
-# $OpenBSD: Makefile,v 1.12 2012/07/10 20:36:33 schwarze Exp $
+# $OpenBSD: Makefile,v 1.13 2012/11/16 13:25:34 schwarze Exp $
 
 REGRESS_TARGETS  = item inset diag ohang bullet dash enum hang tag
 REGRESS_TARGETS += column extend nested
 
-REGRESS_TARGETS+=multitype multitag empty unclosed
+REGRESS_TARGETS += multitype multitag empty unclosed break broken
 
-# groff-1.20.1 mishandles empty lists,
-# ruining indentation and sometimes causing empty lines.
+# groff-1.20.1 defects:
+# - empty lists ruin indentation and sometimes cause empty lines
+# - breaking lists continue indefinitely
+# - breaking a list aborts processing
 
-SKIP_GROFF ?= empty
+SKIP_GROFF ?= empty break broken
 
-SKIP_TMAN ?= column nested multitype multitag
+SKIP_TMAN ?= column nested multitype multitag break broken
 
 .include <bsd.regress.mk>
diff --git a/regress/usr.bin/mandoc/mdoc/Bl/break.in b/regress/usr.bin/mandoc/mdoc/Bl/break.in
new file mode 100644
index 00000000000..478b8abc370
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Bl/break.in
@@ -0,0 +1,26 @@
+.Dd November 16, 2012
+.Dt BL-BREAK 1
+.Os OpenBSD
+.Sh NAME
+.Nm Bl-break
+.Nd list breaking another block
+.Sh DESCRIPTION
+before both
+.Bl -enum -offset indent
+.It
+before bracket
+.Bo inside both
+.El
+after list
+.Bc
+after both
+.Sh EXAMPLES
+.Bl -enum -offset indent
+.It
+before display
+.Bd -ragged -offset indent
+inside both
+.El
+after display
+.Ed
+after both
diff --git a/regress/usr.bin/mandoc/mdoc/Bl/break.out_ascii b/regress/usr.bin/mandoc/mdoc/Bl/break.out_ascii
new file mode 100644
index 00000000000..f505cb79f35
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Bl/break.out_ascii
@@ -0,0 +1,18 @@
+BL-BREAK(1)                OpenBSD Reference Manual                BL-BREAK(1)
+
+NNAAMMEE
+     BBll--bbrreeaakk - list breaking another block
+
+DDEESSCCRRIIPPTTIIOONN
+     before both
+
+           1.   before bracket [inside both after list]
+     after both
+
+EEXXAAMMPPLLEESS
+           1.   before display
+
+                      inside both after display
+     after both
+
+OpenBSD                        November 16, 2012                       OpenBSD
diff --git a/regress/usr.bin/mandoc/mdoc/Bl/broken.in b/regress/usr.bin/mandoc/mdoc/Bl/broken.in
new file mode 100644
index 00000000000..22595cadc2b
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Bl/broken.in
@@ -0,0 +1,16 @@
+.Dd November 10, 2012
+.Dt BL-BROKEN 1
+.Os OpenBSD
+.Sh NAME
+.Nm Bl-broken
+.Nd list broken by another block
+.Sh DESCRIPTION
+before both
+.Bo before list
+.Bl -enum -offset indent
+.It
+inside both
+.Bc
+after bracket
+.El
+after both
diff --git a/regress/usr.bin/mandoc/mdoc/Bl/broken.out_ascii b/regress/usr.bin/mandoc/mdoc/Bl/broken.out_ascii
new file mode 100644
index 00000000000..2f1575930e2
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Bl/broken.out_ascii
@@ -0,0 +1,12 @@
+BL-BROKEN(1)               OpenBSD Reference Manual               BL-BROKEN(1)
+
+NNAAMMEE
+     BBll--bbrrookkeenn - list broken by another block
+
+DDEESSCCRRIIPPTTIIOONN
+     before both [before list
+
+           1.   inside both] after bracket
+     after both
+
+OpenBSD                        November 10, 2012                       OpenBSD
diff --git a/usr.bin/mandoc/mdoc.c b/usr.bin/mandoc/mdoc.c
index 9ffc5dab783..c5171c49d66 100644
--- a/usr.bin/mandoc/mdoc.c
+++ b/usr.bin/mandoc/mdoc.c
@@ -1,4 +1,4 @@
-/*	$Id: mdoc.c,v 1.91 2012/07/18 11:09:30 schwarze Exp $ */
+/*	$Id: mdoc.c,v 1.92 2012/11/16 13:25:34 schwarze Exp $ */
 /*
  * Copyright (c) 2008, 2009, 2010, 2011 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012 Ingo Schwarze <schwarze@openbsd.org>
@@ -371,6 +371,8 @@ node_append(struct mdoc *mdoc, struct mdoc_node *p)
 
 	switch (p->type) {
 	case (MDOC_BODY):
+		if (ENDBODY_NOT != p->end)
+			break;
 		/* FALLTHROUGH */
 	case (MDOC_TAIL):
 		/* FALLTHROUGH */
@@ -497,6 +499,7 @@ mdoc_endbody_alloc(struct mdoc *m, int line, int pos, enum mdoct tok,
 
 	p = node_alloc(m, line, pos, tok, MDOC_BODY);
 	p->pending = body;
+	p->norm = body->norm;
 	p->end = end;
 	if ( ! node_append(m, p))
 		return(0);
diff --git a/usr.bin/mandoc/mdoc_macro.c b/usr.bin/mandoc/mdoc_macro.c
index ea0af8c83d7..18493ae5282 100644
--- a/usr.bin/mandoc/mdoc_macro.c
+++ b/usr.bin/mandoc/mdoc_macro.c
@@ -1,4 +1,4 @@
-/*	$Id: mdoc_macro.c,v 1.74 2012/07/18 16:20:14 schwarze Exp $ */
+/*	$Id: mdoc_macro.c,v 1.75 2012/11/16 13:25:34 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012 Ingo Schwarze <schwarze@openbsd.org>
@@ -734,7 +734,7 @@ blk_exp_close(MACRO_PROT_ARGS)
 		if (later &&
 		    MDOC_EXPLICIT & mdoc_macros[later->tok].flags)
 			continue;
-		if (MDOC_CALLABLE & mdoc_macros[n->tok].flags)
+		if (MDOC_It != n->tok)
 			later = n;
 	}