xref: /vim-8.2.3635/src/regexp.c (revision 94688b8a)
1 /* vi:set ts=8 sts=4 sw=4 noet:
2  *
3  * Handling of regular expressions: vim_regcomp(), vim_regexec(), vim_regsub()
4  *
5  * NOTICE:
6  *
7  * This is NOT the original regular expression code as written by Henry
8  * Spencer.  This code has been modified specifically for use with the VIM
9  * editor, and should not be used separately from Vim.  If you want a good
10  * regular expression library, get the original code.  The copyright notice
11  * that follows is from the original.
12  *
13  * END NOTICE
14  *
15  *	Copyright (c) 1986 by University of Toronto.
16  *	Written by Henry Spencer.  Not derived from licensed software.
17  *
18  *	Permission is granted to anyone to use this software for any
19  *	purpose on any computer system, and to redistribute it freely,
20  *	subject to the following restrictions:
21  *
22  *	1. The author is not responsible for the consequences of use of
23  *		this software, no matter how awful, even if they arise
24  *		from defects in it.
25  *
26  *	2. The origin of this software must not be misrepresented, either
27  *		by explicit claim or by omission.
28  *
29  *	3. Altered versions must be plainly marked as such, and must not
30  *		be misrepresented as being the original software.
31  *
32  * Beware that some of this code is subtly aware of the way operator
33  * precedence is structured in regular expressions.  Serious changes in
34  * regular-expression syntax might require a total rethink.
35  *
36  * Changes have been made by Tony Andrews, Olaf 'Rhialto' Seibert, Robert
37  * Webb, Ciaran McCreesh and Bram Moolenaar.
38  * Named character class support added by Walter Briscoe (1998 Jul 01)
39  */
40 
41 /* Uncomment the first if you do not want to see debugging logs or files
42  * related to regular expressions, even when compiling with -DDEBUG.
43  * Uncomment the second to get the regexp debugging. */
44 /* #undef DEBUG */
45 /* #define DEBUG */
46 
47 #include "vim.h"
48 
49 #ifdef DEBUG
50 /* show/save debugging data when BT engine is used */
51 # define BT_REGEXP_DUMP
52 /* save the debugging data to a file instead of displaying it */
53 # define BT_REGEXP_LOG
54 # define BT_REGEXP_DEBUG_LOG
55 # define BT_REGEXP_DEBUG_LOG_NAME	"bt_regexp_debug.log"
56 #endif
57 
58 /*
59  * The "internal use only" fields in regexp.h are present to pass info from
60  * compile to execute that permits the execute phase to run lots faster on
61  * simple cases.  They are:
62  *
63  * regstart	char that must begin a match; NUL if none obvious; Can be a
64  *		multi-byte character.
65  * reganch	is the match anchored (at beginning-of-line only)?
66  * regmust	string (pointer into program) that match must include, or NULL
67  * regmlen	length of regmust string
68  * regflags	RF_ values or'ed together
69  *
70  * Regstart and reganch permit very fast decisions on suitable starting points
71  * for a match, cutting down the work a lot.  Regmust permits fast rejection
72  * of lines that cannot possibly match.  The regmust tests are costly enough
73  * that vim_regcomp() supplies a regmust only if the r.e. contains something
74  * potentially expensive (at present, the only such thing detected is * or +
75  * at the start of the r.e., which can involve a lot of backup).  Regmlen is
76  * supplied because the test in vim_regexec() needs it and vim_regcomp() is
77  * computing it anyway.
78  */
79 
80 /*
81  * Structure for regexp "program".  This is essentially a linear encoding
82  * of a nondeterministic finite-state machine (aka syntax charts or
83  * "railroad normal form" in parsing technology).  Each node is an opcode
84  * plus a "next" pointer, possibly plus an operand.  "Next" pointers of
85  * all nodes except BRANCH and BRACES_COMPLEX implement concatenation; a "next"
86  * pointer with a BRANCH on both ends of it is connecting two alternatives.
87  * (Here we have one of the subtle syntax dependencies:	an individual BRANCH
88  * (as opposed to a collection of them) is never concatenated with anything
89  * because of operator precedence).  The "next" pointer of a BRACES_COMPLEX
90  * node points to the node after the stuff to be repeated.
91  * The operand of some types of node is a literal string; for others, it is a
92  * node leading into a sub-FSM.  In particular, the operand of a BRANCH node
93  * is the first node of the branch.
94  * (NB this is *not* a tree structure: the tail of the branch connects to the
95  * thing following the set of BRANCHes.)
96  *
97  * pattern	is coded like:
98  *
99  *			  +-----------------+
100  *			  |		    V
101  * <aa>\|<bb>	BRANCH <aa> BRANCH <bb> --> END
102  *		     |	    ^	 |	    ^
103  *		     +------+	 +----------+
104  *
105  *
106  *		       +------------------+
107  *		       V		  |
108  * <aa>*	BRANCH BRANCH <aa> --> BACK BRANCH --> NOTHING --> END
109  *		     |	    |		    ^			   ^
110  *		     |	    +---------------+			   |
111  *		     +---------------------------------------------+
112  *
113  *
114  *		       +----------------------+
115  *		       V		      |
116  * <aa>\+	BRANCH <aa> --> BRANCH --> BACK  BRANCH --> NOTHING --> END
117  *		     |		     |		 ^			^
118  *		     |		     +-----------+			|
119  *		     +--------------------------------------------------+
120  *
121  *
122  *					+-------------------------+
123  *					V			  |
124  * <aa>\{}	BRANCH BRACE_LIMITS --> BRACE_COMPLEX <aa> --> BACK  END
125  *		     |				    |		     ^
126  *		     |				    +----------------+
127  *		     +-----------------------------------------------+
128  *
129  *
130  * <aa>\@!<bb>	BRANCH NOMATCH <aa> --> END  <bb> --> END
131  *		     |	     |		      ^       ^
132  *		     |	     +----------------+       |
133  *		     +--------------------------------+
134  *
135  *						      +---------+
136  *						      |		V
137  * \z[abc]	BRANCH BRANCH  a  BRANCH  b  BRANCH  c	BRANCH	NOTHING --> END
138  *		     |	    |	       |	  |	^		    ^
139  *		     |	    |	       |	  +-----+		    |
140  *		     |	    |	       +----------------+		    |
141  *		     |	    +---------------------------+		    |
142  *		     +------------------------------------------------------+
143  *
144  * They all start with a BRANCH for "\|" alternatives, even when there is only
145  * one alternative.
146  */
147 
148 /*
149  * The opcodes are:
150  */
151 
152 /* definition	number		   opnd?    meaning */
153 #define END		0	/*	End of program or NOMATCH operand. */
154 #define BOL		1	/*	Match "" at beginning of line. */
155 #define EOL		2	/*	Match "" at end of line. */
156 #define BRANCH		3	/* node Match this alternative, or the
157 				 *	next... */
158 #define BACK		4	/*	Match "", "next" ptr points backward. */
159 #define EXACTLY		5	/* str	Match this string. */
160 #define NOTHING		6	/*	Match empty string. */
161 #define STAR		7	/* node Match this (simple) thing 0 or more
162 				 *	times. */
163 #define PLUS		8	/* node Match this (simple) thing 1 or more
164 				 *	times. */
165 #define MATCH		9	/* node match the operand zero-width */
166 #define NOMATCH		10	/* node check for no match with operand */
167 #define BEHIND		11	/* node look behind for a match with operand */
168 #define NOBEHIND	12	/* node look behind for no match with operand */
169 #define SUBPAT		13	/* node match the operand here */
170 #define BRACE_SIMPLE	14	/* node Match this (simple) thing between m and
171 				 *	n times (\{m,n\}). */
172 #define BOW		15	/*	Match "" after [^a-zA-Z0-9_] */
173 #define EOW		16	/*	Match "" at    [^a-zA-Z0-9_] */
174 #define BRACE_LIMITS	17	/* nr nr  define the min & max for BRACE_SIMPLE
175 				 *	and BRACE_COMPLEX. */
176 #define NEWL		18	/*	Match line-break */
177 #define BHPOS		19	/*	End position for BEHIND or NOBEHIND */
178 
179 
180 /* character classes: 20-48 normal, 50-78 include a line-break */
181 #define ADD_NL		30
182 #define FIRST_NL	ANY + ADD_NL
183 #define ANY		20	/*	Match any one character. */
184 #define ANYOF		21	/* str	Match any character in this string. */
185 #define ANYBUT		22	/* str	Match any character not in this
186 				 *	string. */
187 #define IDENT		23	/*	Match identifier char */
188 #define SIDENT		24	/*	Match identifier char but no digit */
189 #define KWORD		25	/*	Match keyword char */
190 #define SKWORD		26	/*	Match word char but no digit */
191 #define FNAME		27	/*	Match file name char */
192 #define SFNAME		28	/*	Match file name char but no digit */
193 #define PRINT		29	/*	Match printable char */
194 #define SPRINT		30	/*	Match printable char but no digit */
195 #define WHITE		31	/*	Match whitespace char */
196 #define NWHITE		32	/*	Match non-whitespace char */
197 #define DIGIT		33	/*	Match digit char */
198 #define NDIGIT		34	/*	Match non-digit char */
199 #define HEX		35	/*	Match hex char */
200 #define NHEX		36	/*	Match non-hex char */
201 #define OCTAL		37	/*	Match octal char */
202 #define NOCTAL		38	/*	Match non-octal char */
203 #define WORD		39	/*	Match word char */
204 #define NWORD		40	/*	Match non-word char */
205 #define HEAD		41	/*	Match head char */
206 #define NHEAD		42	/*	Match non-head char */
207 #define ALPHA		43	/*	Match alpha char */
208 #define NALPHA		44	/*	Match non-alpha char */
209 #define LOWER		45	/*	Match lowercase char */
210 #define NLOWER		46	/*	Match non-lowercase char */
211 #define UPPER		47	/*	Match uppercase char */
212 #define NUPPER		48	/*	Match non-uppercase char */
213 #define LAST_NL		NUPPER + ADD_NL
214 #define WITH_NL(op)	((op) >= FIRST_NL && (op) <= LAST_NL)
215 
216 #define MOPEN		80  /* -89	 Mark this point in input as start of
217 				 *	 \( subexpr.  MOPEN + 0 marks start of
218 				 *	 match. */
219 #define MCLOSE		90  /* -99	 Analogous to MOPEN.  MCLOSE + 0 marks
220 				 *	 end of match. */
221 #define BACKREF		100 /* -109 node Match same string again \1-\9 */
222 
223 #ifdef FEAT_SYN_HL
224 # define ZOPEN		110 /* -119	 Mark this point in input as start of
225 				 *	 \z( subexpr. */
226 # define ZCLOSE		120 /* -129	 Analogous to ZOPEN. */
227 # define ZREF		130 /* -139 node Match external submatch \z1-\z9 */
228 #endif
229 
230 #define BRACE_COMPLEX	140 /* -149 node Match nodes between m & n times */
231 
232 #define NOPEN		150	/*	Mark this point in input as start of
233 					\%( subexpr. */
234 #define NCLOSE		151	/*	Analogous to NOPEN. */
235 
236 #define MULTIBYTECODE	200	/* mbc	Match one multi-byte character */
237 #define RE_BOF		201	/*	Match "" at beginning of file. */
238 #define RE_EOF		202	/*	Match "" at end of file. */
239 #define CURSOR		203	/*	Match location of cursor. */
240 
241 #define RE_LNUM		204	/* nr cmp  Match line number */
242 #define RE_COL		205	/* nr cmp  Match column number */
243 #define RE_VCOL		206	/* nr cmp  Match virtual column number */
244 
245 #define RE_MARK		207	/* mark cmp  Match mark position */
246 #define RE_VISUAL	208	/*	Match Visual area */
247 #define RE_COMPOSING	209	/* any composing characters */
248 
249 /*
250  * Magic characters have a special meaning, they don't match literally.
251  * Magic characters are negative.  This separates them from literal characters
252  * (possibly multi-byte).  Only ASCII characters can be Magic.
253  */
254 #define Magic(x)	((int)(x) - 256)
255 #define un_Magic(x)	((x) + 256)
256 #define is_Magic(x)	((x) < 0)
257 
258     static int
259 no_Magic(int x)
260 {
261     if (is_Magic(x))
262 	return un_Magic(x);
263     return x;
264 }
265 
266     static int
267 toggle_Magic(int x)
268 {
269     if (is_Magic(x))
270 	return un_Magic(x);
271     return Magic(x);
272 }
273 
274 /*
275  * The first byte of the regexp internal "program" is actually this magic
276  * number; the start node begins in the second byte.  It's used to catch the
277  * most severe mutilation of the program by the caller.
278  */
279 
280 #define REGMAGIC	0234
281 
282 /*
283  * Opcode notes:
284  *
285  * BRANCH	The set of branches constituting a single choice are hooked
286  *		together with their "next" pointers, since precedence prevents
287  *		anything being concatenated to any individual branch.  The
288  *		"next" pointer of the last BRANCH in a choice points to the
289  *		thing following the whole choice.  This is also where the
290  *		final "next" pointer of each individual branch points; each
291  *		branch starts with the operand node of a BRANCH node.
292  *
293  * BACK		Normal "next" pointers all implicitly point forward; BACK
294  *		exists to make loop structures possible.
295  *
296  * STAR,PLUS	'=', and complex '*' and '+', are implemented as circular
297  *		BRANCH structures using BACK.  Simple cases (one character
298  *		per match) are implemented with STAR and PLUS for speed
299  *		and to minimize recursive plunges.
300  *
301  * BRACE_LIMITS	This is always followed by a BRACE_SIMPLE or BRACE_COMPLEX
302  *		node, and defines the min and max limits to be used for that
303  *		node.
304  *
305  * MOPEN,MCLOSE	...are numbered at compile time.
306  * ZOPEN,ZCLOSE	...ditto
307  */
308 
309 /*
310  * A node is one char of opcode followed by two chars of "next" pointer.
311  * "Next" pointers are stored as two 8-bit bytes, high order first.  The
312  * value is a positive offset from the opcode of the node containing it.
313  * An operand, if any, simply follows the node.  (Note that much of the
314  * code generation knows about this implicit relationship.)
315  *
316  * Using two bytes for the "next" pointer is vast overkill for most things,
317  * but allows patterns to get big without disasters.
318  */
319 #define OP(p)		((int)*(p))
320 #define NEXT(p)		(((*((p) + 1) & 0377) << 8) + (*((p) + 2) & 0377))
321 #define OPERAND(p)	((p) + 3)
322 /* Obtain an operand that was stored as four bytes, MSB first. */
323 #define OPERAND_MIN(p)	(((long)(p)[3] << 24) + ((long)(p)[4] << 16) \
324 			+ ((long)(p)[5] << 8) + (long)(p)[6])
325 /* Obtain a second operand stored as four bytes. */
326 #define OPERAND_MAX(p)	OPERAND_MIN((p) + 4)
327 /* Obtain a second single-byte operand stored after a four bytes operand. */
328 #define OPERAND_CMP(p)	(p)[7]
329 
330 /*
331  * Utility definitions.
332  */
333 #define UCHARAT(p)	((int)*(char_u *)(p))
334 
335 /* Used for an error (down from) vim_regcomp(): give the error message, set
336  * rc_did_emsg and return NULL */
337 #define EMSG_RET_NULL(m) return (emsg((m)), rc_did_emsg = TRUE, (void *)NULL)
338 #define IEMSG_RET_NULL(m) return (iemsg((m)), rc_did_emsg = TRUE, (void *)NULL)
339 #define EMSG_RET_FAIL(m) return (emsg((m)), rc_did_emsg = TRUE, FAIL)
340 #define EMSG2_RET_NULL(m, c) return (semsg((const char *)(m), (c) ? "" : "\\"), rc_did_emsg = TRUE, (void *)NULL)
341 #define EMSG3_RET_NULL(m, c, a) return (semsg((const char *)(m), (c) ? "" : "\\", (a)), rc_did_emsg = TRUE, (void *)NULL)
342 #define EMSG2_RET_FAIL(m, c) return (semsg((const char *)(m), (c) ? "" : "\\"), rc_did_emsg = TRUE, FAIL)
343 #define EMSG_ONE_RET_NULL EMSG2_RET_NULL(_("E369: invalid item in %s%%[]"), reg_magic == MAGIC_ALL)
344 
345 
346 #define MAX_LIMIT	(32767L << 16L)
347 
348 static int cstrncmp(char_u *s1, char_u *s2, int *n);
349 static char_u *cstrchr(char_u *, int);
350 
351 #ifdef BT_REGEXP_DUMP
352 static void	regdump(char_u *, bt_regprog_T *);
353 #endif
354 #ifdef DEBUG
355 static char_u	*regprop(char_u *);
356 #endif
357 
358 static int re_mult_next(char *what);
359 
360 static char_u e_missingbracket[] = N_("E769: Missing ] after %s[");
361 static char_u e_reverse_range[] = N_("E944: Reverse range in character class");
362 static char_u e_large_class[] = N_("E945: Range too large in character class");
363 static char_u e_unmatchedpp[] = N_("E53: Unmatched %s%%(");
364 static char_u e_unmatchedp[] = N_("E54: Unmatched %s(");
365 static char_u e_unmatchedpar[] = N_("E55: Unmatched %s)");
366 #ifdef FEAT_SYN_HL
367 static char_u e_z_not_allowed[] = N_("E66: \\z( not allowed here");
368 static char_u e_z1_not_allowed[] = N_("E67: \\z1 - \\z9 not allowed here");
369 #endif
370 static char_u e_missing_sb[] = N_("E69: Missing ] after %s%%[");
371 static char_u e_empty_sb[]  = N_("E70: Empty %s%%[]");
372 static char_u e_recursive[]  = N_("E956: Cannot use pattern recursively");
373 
374 #define NOT_MULTI	0
375 #define MULTI_ONE	1
376 #define MULTI_MULT	2
377 /*
378  * Return NOT_MULTI if c is not a "multi" operator.
379  * Return MULTI_ONE if c is a single "multi" operator.
380  * Return MULTI_MULT if c is a multi "multi" operator.
381  */
382     static int
383 re_multi_type(int c)
384 {
385     if (c == Magic('@') || c == Magic('=') || c == Magic('?'))
386 	return MULTI_ONE;
387     if (c == Magic('*') || c == Magic('+') || c == Magic('{'))
388 	return MULTI_MULT;
389     return NOT_MULTI;
390 }
391 
392 /*
393  * Flags to be passed up and down.
394  */
395 #define HASWIDTH	0x1	/* Known never to match null string. */
396 #define SIMPLE		0x2	/* Simple enough to be STAR/PLUS operand. */
397 #define SPSTART		0x4	/* Starts with * or +. */
398 #define HASNL		0x8	/* Contains some \n. */
399 #define HASLOOKBH	0x10	/* Contains "\@<=" or "\@<!". */
400 #define WORST		0	/* Worst case. */
401 
402 /*
403  * When regcode is set to this value, code is not emitted and size is computed
404  * instead.
405  */
406 #define JUST_CALC_SIZE	((char_u *) -1)
407 
408 static char_u		*reg_prev_sub = NULL;
409 
410 /*
411  * REGEXP_INRANGE contains all characters which are always special in a []
412  * range after '\'.
413  * REGEXP_ABBR contains all characters which act as abbreviations after '\'.
414  * These are:
415  *  \n	- New line (NL).
416  *  \r	- Carriage Return (CR).
417  *  \t	- Tab (TAB).
418  *  \e	- Escape (ESC).
419  *  \b	- Backspace (Ctrl_H).
420  *  \d  - Character code in decimal, eg \d123
421  *  \o	- Character code in octal, eg \o80
422  *  \x	- Character code in hex, eg \x4a
423  *  \u	- Multibyte character code, eg \u20ac
424  *  \U	- Long multibyte character code, eg \U12345678
425  */
426 static char_u REGEXP_INRANGE[] = "]^-n\\";
427 static char_u REGEXP_ABBR[] = "nrtebdoxuU";
428 
429 /*
430  * Translate '\x' to its control character, except "\n", which is Magic.
431  */
432     static int
433 backslash_trans(int c)
434 {
435     switch (c)
436     {
437 	case 'r':   return CAR;
438 	case 't':   return TAB;
439 	case 'e':   return ESC;
440 	case 'b':   return BS;
441     }
442     return c;
443 }
444 
445 /*
446  * Check for a character class name "[:name:]".  "pp" points to the '['.
447  * Returns one of the CLASS_ items. CLASS_NONE means that no item was
448  * recognized.  Otherwise "pp" is advanced to after the item.
449  */
450     static int
451 get_char_class(char_u **pp)
452 {
453     static const char *(class_names[]) =
454     {
455 	"alnum:]",
456 #define CLASS_ALNUM 0
457 	"alpha:]",
458 #define CLASS_ALPHA 1
459 	"blank:]",
460 #define CLASS_BLANK 2
461 	"cntrl:]",
462 #define CLASS_CNTRL 3
463 	"digit:]",
464 #define CLASS_DIGIT 4
465 	"graph:]",
466 #define CLASS_GRAPH 5
467 	"lower:]",
468 #define CLASS_LOWER 6
469 	"print:]",
470 #define CLASS_PRINT 7
471 	"punct:]",
472 #define CLASS_PUNCT 8
473 	"space:]",
474 #define CLASS_SPACE 9
475 	"upper:]",
476 #define CLASS_UPPER 10
477 	"xdigit:]",
478 #define CLASS_XDIGIT 11
479 	"tab:]",
480 #define CLASS_TAB 12
481 	"return:]",
482 #define CLASS_RETURN 13
483 	"backspace:]",
484 #define CLASS_BACKSPACE 14
485 	"escape:]",
486 #define CLASS_ESCAPE 15
487 	"ident:]",
488 #define CLASS_IDENT 16
489 	"keyword:]",
490 #define CLASS_KEYWORD 17
491 	"fname:]",
492 #define CLASS_FNAME 18
493     };
494 #define CLASS_NONE 99
495     int i;
496 
497     if ((*pp)[1] == ':')
498     {
499 	for (i = 0; i < (int)(sizeof(class_names) / sizeof(*class_names)); ++i)
500 	    if (STRNCMP(*pp + 2, class_names[i], STRLEN(class_names[i])) == 0)
501 	    {
502 		*pp += STRLEN(class_names[i]) + 2;
503 		return i;
504 	    }
505     }
506     return CLASS_NONE;
507 }
508 
509 /*
510  * Specific version of character class functions.
511  * Using a table to keep this fast.
512  */
513 static short	class_tab[256];
514 
515 #define	    RI_DIGIT	0x01
516 #define	    RI_HEX	0x02
517 #define	    RI_OCTAL	0x04
518 #define	    RI_WORD	0x08
519 #define	    RI_HEAD	0x10
520 #define	    RI_ALPHA	0x20
521 #define	    RI_LOWER	0x40
522 #define	    RI_UPPER	0x80
523 #define	    RI_WHITE	0x100
524 
525     static void
526 init_class_tab(void)
527 {
528     int		i;
529     static int	done = FALSE;
530 
531     if (done)
532 	return;
533 
534     for (i = 0; i < 256; ++i)
535     {
536 	if (i >= '0' && i <= '7')
537 	    class_tab[i] = RI_DIGIT + RI_HEX + RI_OCTAL + RI_WORD;
538 	else if (i >= '8' && i <= '9')
539 	    class_tab[i] = RI_DIGIT + RI_HEX + RI_WORD;
540 	else if (i >= 'a' && i <= 'f')
541 	    class_tab[i] = RI_HEX + RI_WORD + RI_HEAD + RI_ALPHA + RI_LOWER;
542 #ifdef EBCDIC
543 	else if ((i >= 'g' && i <= 'i') || (i >= 'j' && i <= 'r')
544 						    || (i >= 's' && i <= 'z'))
545 #else
546 	else if (i >= 'g' && i <= 'z')
547 #endif
548 	    class_tab[i] = RI_WORD + RI_HEAD + RI_ALPHA + RI_LOWER;
549 	else if (i >= 'A' && i <= 'F')
550 	    class_tab[i] = RI_HEX + RI_WORD + RI_HEAD + RI_ALPHA + RI_UPPER;
551 #ifdef EBCDIC
552 	else if ((i >= 'G' && i <= 'I') || ( i >= 'J' && i <= 'R')
553 						    || (i >= 'S' && i <= 'Z'))
554 #else
555 	else if (i >= 'G' && i <= 'Z')
556 #endif
557 	    class_tab[i] = RI_WORD + RI_HEAD + RI_ALPHA + RI_UPPER;
558 	else if (i == '_')
559 	    class_tab[i] = RI_WORD + RI_HEAD;
560 	else
561 	    class_tab[i] = 0;
562     }
563     class_tab[' '] |= RI_WHITE;
564     class_tab['\t'] |= RI_WHITE;
565     done = TRUE;
566 }
567 
568 #define ri_digit(c)	(c < 0x100 && (class_tab[c] & RI_DIGIT))
569 #define ri_hex(c)	(c < 0x100 && (class_tab[c] & RI_HEX))
570 #define ri_octal(c)	(c < 0x100 && (class_tab[c] & RI_OCTAL))
571 #define ri_word(c)	(c < 0x100 && (class_tab[c] & RI_WORD))
572 #define ri_head(c)	(c < 0x100 && (class_tab[c] & RI_HEAD))
573 #define ri_alpha(c)	(c < 0x100 && (class_tab[c] & RI_ALPHA))
574 #define ri_lower(c)	(c < 0x100 && (class_tab[c] & RI_LOWER))
575 #define ri_upper(c)	(c < 0x100 && (class_tab[c] & RI_UPPER))
576 #define ri_white(c)	(c < 0x100 && (class_tab[c] & RI_WHITE))
577 
578 /* flags for regflags */
579 #define RF_ICASE    1	/* ignore case */
580 #define RF_NOICASE  2	/* don't ignore case */
581 #define RF_HASNL    4	/* can match a NL */
582 #define RF_ICOMBINE 8	/* ignore combining characters */
583 #define RF_LOOKBH   16	/* uses "\@<=" or "\@<!" */
584 
585 /*
586  * Global work variables for vim_regcomp().
587  */
588 
589 static char_u	*regparse;	/* Input-scan pointer. */
590 static int	prevchr_len;	/* byte length of previous char */
591 static int	num_complex_braces; /* Complex \{...} count */
592 static int	regnpar;	/* () count. */
593 #ifdef FEAT_SYN_HL
594 static int	regnzpar;	/* \z() count. */
595 static int	re_has_z;	/* \z item detected */
596 #endif
597 static char_u	*regcode;	/* Code-emit pointer, or JUST_CALC_SIZE */
598 static long	regsize;	/* Code size. */
599 static int	reg_toolong;	/* TRUE when offset out of range */
600 static char_u	had_endbrace[NSUBEXP];	/* flags, TRUE if end of () found */
601 static unsigned	regflags;	/* RF_ flags for prog */
602 static long	brace_min[10];	/* Minimums for complex brace repeats */
603 static long	brace_max[10];	/* Maximums for complex brace repeats */
604 static int	brace_count[10]; /* Current counts for complex brace repeats */
605 #if defined(FEAT_SYN_HL) || defined(PROTO)
606 static int	had_eol;	/* TRUE when EOL found by vim_regcomp() */
607 #endif
608 static int	one_exactly = FALSE;	/* only do one char for EXACTLY */
609 
610 static int	reg_magic;	/* magicness of the pattern: */
611 #define MAGIC_NONE	1	/* "\V" very unmagic */
612 #define MAGIC_OFF	2	/* "\M" or 'magic' off */
613 #define MAGIC_ON	3	/* "\m" or 'magic' */
614 #define MAGIC_ALL	4	/* "\v" very magic */
615 
616 static int	reg_string;	/* matching with a string instead of a buffer
617 				   line */
618 static int	reg_strict;	/* "[abc" is illegal */
619 
620 /*
621  * META contains all characters that may be magic, except '^' and '$'.
622  */
623 
624 #ifdef EBCDIC
625 static char_u META[] = "%&()*+.123456789<=>?@ACDFHIKLMOPSUVWX[_acdfhiklmnopsuvwxz{|~";
626 #else
627 /* META[] is used often enough to justify turning it into a table. */
628 static char_u META_flags[] = {
629     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
630     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
631 /*		   %  &     (  )  *  +	      .    */
632     0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0,
633 /*     1  2  3	4  5  6  7  8  9	<  =  >  ? */
634     0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1,
635 /*  @  A     C	D     F     H  I     K	L  M	 O */
636     1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1,
637 /*  P	     S	   U  V  W  X	  Z  [		 _ */
638     1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1,
639 /*     a     c	d     f     h  i     k	l  m  n  o */
640     0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1,
641 /*  p	     s	   u  v  w  x	  z  {	|     ~    */
642     1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 1
643 };
644 #endif
645 
646 static int	curchr;		/* currently parsed character */
647 /* Previous character.  Note: prevchr is sometimes -1 when we are not at the
648  * start, eg in /[ ^I]^ the pattern was never found even if it existed,
649  * because ^ was taken to be magic -- webb */
650 static int	prevchr;
651 static int	prevprevchr;	/* previous-previous character */
652 static int	nextchr;	/* used for ungetchr() */
653 
654 /* arguments for reg() */
655 #define REG_NOPAREN	0	/* toplevel reg() */
656 #define REG_PAREN	1	/* \(\) */
657 #define REG_ZPAREN	2	/* \z(\) */
658 #define REG_NPAREN	3	/* \%(\) */
659 
660 typedef struct
661 {
662      char_u	*regparse;
663      int	prevchr_len;
664      int	curchr;
665      int	prevchr;
666      int	prevprevchr;
667      int	nextchr;
668      int	at_start;
669      int	prev_at_start;
670      int	regnpar;
671 } parse_state_T;
672 
673 /*
674  * Forward declarations for vim_regcomp()'s friends.
675  */
676 static void	initchr(char_u *);
677 static int	getchr(void);
678 static void	skipchr_keepstart(void);
679 static int	peekchr(void);
680 static void	skipchr(void);
681 static void	ungetchr(void);
682 static long	gethexchrs(int maxinputlen);
683 static long	getoctchrs(void);
684 static long	getdecchrs(void);
685 static int	coll_get_char(void);
686 static void	regcomp_start(char_u *expr, int flags);
687 static char_u	*reg(int, int *);
688 static char_u	*regbranch(int *flagp);
689 static char_u	*regconcat(int *flagp);
690 static char_u	*regpiece(int *);
691 static char_u	*regatom(int *);
692 static char_u	*regnode(int);
693 static int	use_multibytecode(int c);
694 static int	prog_magic_wrong(void);
695 static char_u	*regnext(char_u *);
696 static void	regc(int b);
697 static void	regmbc(int c);
698 #define REGMBC(x) regmbc(x);
699 #define CASEMBC(x) case x:
700 static void	reginsert(int, char_u *);
701 static void	reginsert_nr(int op, long val, char_u *opnd);
702 static void	reginsert_limits(int, long, long, char_u *);
703 static char_u	*re_put_long(char_u *pr, long_u val);
704 static int	read_limits(long *, long *);
705 static void	regtail(char_u *, char_u *);
706 static void	regoptail(char_u *, char_u *);
707 static int	reg_iswordc(int);
708 
709 static regengine_T bt_regengine;
710 static regengine_T nfa_regengine;
711 
712 /*
713  * Return TRUE if compiled regular expression "prog" can match a line break.
714  */
715     int
716 re_multiline(regprog_T *prog)
717 {
718     return (prog->regflags & RF_HASNL);
719 }
720 
721 /*
722  * Check for an equivalence class name "[=a=]".  "pp" points to the '['.
723  * Returns a character representing the class. Zero means that no item was
724  * recognized.  Otherwise "pp" is advanced to after the item.
725  */
726     static int
727 get_equi_class(char_u **pp)
728 {
729     int		c;
730     int		l = 1;
731     char_u	*p = *pp;
732 
733     if (p[1] == '=')
734     {
735 	if (has_mbyte)
736 	    l = (*mb_ptr2len)(p + 2);
737 	if (p[l + 2] == '=' && p[l + 3] == ']')
738 	{
739 	    if (has_mbyte)
740 		c = mb_ptr2char(p + 2);
741 	    else
742 		c = p[2];
743 	    *pp += l + 4;
744 	    return c;
745 	}
746     }
747     return 0;
748 }
749 
750 #ifdef EBCDIC
751 /*
752  * Table for equivalence class "c". (IBM-1047)
753  */
754 char *EQUIVAL_CLASS_C[16] = {
755     "A\x62\x63\x64\x65\x66\x67",
756     "C\x68",
757     "E\x71\x72\x73\x74",
758     "I\x75\x76\x77\x78",
759     "N\x69",
760     "O\xEB\xEC\xED\xEE\xEF\x80",
761     "U\xFB\xFC\xFD\xFE",
762     "Y\xBA",
763     "a\x42\x43\x44\x45\x46\x47",
764     "c\x48",
765     "e\x51\x52\x53\x54",
766     "i\x55\x56\x57\x58",
767     "n\x49",
768     "o\xCB\xCC\xCD\xCE\xCF\x70",
769     "u\xDB\xDC\xDD\xDE",
770     "y\x8D\xDF",
771 };
772 #endif
773 
774 /*
775  * Produce the bytes for equivalence class "c".
776  * Currently only handles latin1, latin9 and utf-8.
777  * NOTE: When changing this function, also change nfa_emit_equi_class()
778  */
779     static void
780 reg_equi_class(int c)
781 {
782     if (enc_utf8 || STRCMP(p_enc, "latin1") == 0
783 					 || STRCMP(p_enc, "iso-8859-15") == 0)
784     {
785 #ifdef EBCDIC
786 	int i;
787 
788 	/* This might be slower than switch/case below. */
789 	for (i = 0; i < 16; i++)
790 	{
791 	    if (vim_strchr(EQUIVAL_CLASS_C[i], c) != NULL)
792 	    {
793 		char *p = EQUIVAL_CLASS_C[i];
794 
795 		while (*p != 0)
796 		    regmbc(*p++);
797 		return;
798 	    }
799 	}
800 #else
801 	switch (c)
802 	{
803 	    /* Do not use '\300' style, it results in a negative number. */
804 	    case 'A': case 0xc0: case 0xc1: case 0xc2:
805 	    case 0xc3: case 0xc4: case 0xc5:
806 	    CASEMBC(0x100) CASEMBC(0x102) CASEMBC(0x104) CASEMBC(0x1cd)
807 	    CASEMBC(0x1de) CASEMBC(0x1e0) CASEMBC(0x1ea2)
808 		      regmbc('A'); regmbc(0xc0); regmbc(0xc1);
809 		      regmbc(0xc2); regmbc(0xc3); regmbc(0xc4);
810 		      regmbc(0xc5);
811 		      REGMBC(0x100) REGMBC(0x102) REGMBC(0x104)
812 		      REGMBC(0x1cd) REGMBC(0x1de) REGMBC(0x1e0)
813 		      REGMBC(0x1ea2)
814 		      return;
815 	    case 'B': CASEMBC(0x1e02) CASEMBC(0x1e06)
816 		      regmbc('B'); REGMBC(0x1e02) REGMBC(0x1e06)
817 		      return;
818 	    case 'C': case 0xc7:
819 	    CASEMBC(0x106) CASEMBC(0x108) CASEMBC(0x10a) CASEMBC(0x10c)
820 		      regmbc('C'); regmbc(0xc7);
821 		      REGMBC(0x106) REGMBC(0x108) REGMBC(0x10a)
822 		      REGMBC(0x10c)
823 		      return;
824 	    case 'D': CASEMBC(0x10e) CASEMBC(0x110) CASEMBC(0x1e0a)
825 	    CASEMBC(0x1e0e) CASEMBC(0x1e10)
826 		      regmbc('D'); REGMBC(0x10e) REGMBC(0x110)
827 		      REGMBC(0x1e0a) REGMBC(0x1e0e) REGMBC(0x1e10)
828 		      return;
829 	    case 'E': case 0xc8: case 0xc9: case 0xca: case 0xcb:
830 	    CASEMBC(0x112) CASEMBC(0x114) CASEMBC(0x116) CASEMBC(0x118)
831 	    CASEMBC(0x11a) CASEMBC(0x1eba) CASEMBC(0x1ebc)
832 		      regmbc('E'); regmbc(0xc8); regmbc(0xc9);
833 		      regmbc(0xca); regmbc(0xcb);
834 		      REGMBC(0x112) REGMBC(0x114) REGMBC(0x116)
835 		      REGMBC(0x118) REGMBC(0x11a) REGMBC(0x1eba)
836 		      REGMBC(0x1ebc)
837 		      return;
838 	    case 'F': CASEMBC(0x1e1e)
839 		      regmbc('F'); REGMBC(0x1e1e)
840 		      return;
841 	    case 'G': CASEMBC(0x11c) CASEMBC(0x11e) CASEMBC(0x120)
842 	    CASEMBC(0x122) CASEMBC(0x1e4) CASEMBC(0x1e6) CASEMBC(0x1f4)
843 	    CASEMBC(0x1e20)
844 		      regmbc('G'); REGMBC(0x11c) REGMBC(0x11e)
845 		      REGMBC(0x120) REGMBC(0x122) REGMBC(0x1e4)
846 		      REGMBC(0x1e6) REGMBC(0x1f4) REGMBC(0x1e20)
847 		      return;
848 	    case 'H': CASEMBC(0x124) CASEMBC(0x126) CASEMBC(0x1e22)
849 	    CASEMBC(0x1e26) CASEMBC(0x1e28)
850 		      regmbc('H'); REGMBC(0x124) REGMBC(0x126)
851 		      REGMBC(0x1e22) REGMBC(0x1e26) REGMBC(0x1e28)
852 		      return;
853 	    case 'I': case 0xcc: case 0xcd: case 0xce: case 0xcf:
854 	    CASEMBC(0x128) CASEMBC(0x12a) CASEMBC(0x12c) CASEMBC(0x12e)
855 	    CASEMBC(0x130) CASEMBC(0x1cf) CASEMBC(0x1ec8)
856 		      regmbc('I'); regmbc(0xcc); regmbc(0xcd);
857 		      regmbc(0xce); regmbc(0xcf);
858 		      REGMBC(0x128) REGMBC(0x12a) REGMBC(0x12c)
859 		      REGMBC(0x12e) REGMBC(0x130) REGMBC(0x1cf)
860 		      REGMBC(0x1ec8)
861 		      return;
862 	    case 'J': CASEMBC(0x134)
863 		      regmbc('J'); REGMBC(0x134)
864 		      return;
865 	    case 'K': CASEMBC(0x136) CASEMBC(0x1e8) CASEMBC(0x1e30)
866 	    CASEMBC(0x1e34)
867 		      regmbc('K'); REGMBC(0x136) REGMBC(0x1e8)
868 		      REGMBC(0x1e30) REGMBC(0x1e34)
869 		      return;
870 	    case 'L': CASEMBC(0x139) CASEMBC(0x13b) CASEMBC(0x13d)
871 	    CASEMBC(0x13f) CASEMBC(0x141) CASEMBC(0x1e3a)
872 		      regmbc('L'); REGMBC(0x139) REGMBC(0x13b)
873 		      REGMBC(0x13d) REGMBC(0x13f) REGMBC(0x141)
874 		      REGMBC(0x1e3a)
875 		      return;
876 	    case 'M': CASEMBC(0x1e3e) CASEMBC(0x1e40)
877 		      regmbc('M'); REGMBC(0x1e3e) REGMBC(0x1e40)
878 		      return;
879 	    case 'N': case 0xd1:
880 	    CASEMBC(0x143) CASEMBC(0x145) CASEMBC(0x147) CASEMBC(0x1e44)
881 	    CASEMBC(0x1e48)
882 		      regmbc('N'); regmbc(0xd1);
883 		      REGMBC(0x143) REGMBC(0x145) REGMBC(0x147)
884 		      REGMBC(0x1e44) REGMBC(0x1e48)
885 		      return;
886 	    case 'O': case 0xd2: case 0xd3: case 0xd4: case 0xd5:
887 	    case 0xd6: case 0xd8:
888 	    CASEMBC(0x14c) CASEMBC(0x14e) CASEMBC(0x150) CASEMBC(0x1a0)
889 	    CASEMBC(0x1d1) CASEMBC(0x1ea) CASEMBC(0x1ec) CASEMBC(0x1ece)
890 		      regmbc('O'); regmbc(0xd2); regmbc(0xd3);
891 		      regmbc(0xd4); regmbc(0xd5); regmbc(0xd6);
892 		      regmbc(0xd8);
893 		      REGMBC(0x14c) REGMBC(0x14e) REGMBC(0x150)
894 		      REGMBC(0x1a0) REGMBC(0x1d1) REGMBC(0x1ea)
895 		      REGMBC(0x1ec) REGMBC(0x1ece)
896 		      return;
897 	    case 'P': case 0x1e54: case 0x1e56:
898 		      regmbc('P'); REGMBC(0x1e54) REGMBC(0x1e56)
899 		      return;
900 	    case 'R': CASEMBC(0x154) CASEMBC(0x156) CASEMBC(0x158)
901 	    CASEMBC(0x1e58) CASEMBC(0x1e5e)
902 		      regmbc('R'); REGMBC(0x154) REGMBC(0x156) REGMBC(0x158)
903 		      REGMBC(0x1e58) REGMBC(0x1e5e)
904 		      return;
905 	    case 'S': CASEMBC(0x15a) CASEMBC(0x15c) CASEMBC(0x15e)
906 	    CASEMBC(0x160) CASEMBC(0x1e60)
907 		      regmbc('S'); REGMBC(0x15a) REGMBC(0x15c)
908 		      REGMBC(0x15e) REGMBC(0x160) REGMBC(0x1e60)
909 		      return;
910 	    case 'T': CASEMBC(0x162) CASEMBC(0x164) CASEMBC(0x166)
911 	    CASEMBC(0x1e6a) CASEMBC(0x1e6e)
912 		      regmbc('T'); REGMBC(0x162) REGMBC(0x164)
913 		      REGMBC(0x166) REGMBC(0x1e6a) REGMBC(0x1e6e)
914 		      return;
915 	    case 'U': case 0xd9: case 0xda: case 0xdb: case 0xdc:
916 	    CASEMBC(0x168) CASEMBC(0x16a) CASEMBC(0x16c) CASEMBC(0x16e)
917 	    CASEMBC(0x170) CASEMBC(0x172) CASEMBC(0x1af) CASEMBC(0x1d3)
918 	    CASEMBC(0x1ee6)
919 		      regmbc('U'); regmbc(0xd9); regmbc(0xda);
920 		      regmbc(0xdb); regmbc(0xdc);
921 		      REGMBC(0x168) REGMBC(0x16a) REGMBC(0x16c)
922 		      REGMBC(0x16e) REGMBC(0x170) REGMBC(0x172)
923 		      REGMBC(0x1af) REGMBC(0x1d3) REGMBC(0x1ee6)
924 		      return;
925 	    case 'V': CASEMBC(0x1e7c)
926 		      regmbc('V'); REGMBC(0x1e7c)
927 		      return;
928 	    case 'W': CASEMBC(0x174) CASEMBC(0x1e80) CASEMBC(0x1e82)
929 	    CASEMBC(0x1e84) CASEMBC(0x1e86)
930 		      regmbc('W'); REGMBC(0x174) REGMBC(0x1e80)
931 		      REGMBC(0x1e82) REGMBC(0x1e84) REGMBC(0x1e86)
932 		      return;
933 	    case 'X': CASEMBC(0x1e8a) CASEMBC(0x1e8c)
934 		      regmbc('X'); REGMBC(0x1e8a) REGMBC(0x1e8c)
935 		      return;
936 	    case 'Y': case 0xdd:
937 	    CASEMBC(0x176) CASEMBC(0x178) CASEMBC(0x1e8e) CASEMBC(0x1ef2)
938 	    CASEMBC(0x1ef6) CASEMBC(0x1ef8)
939 		      regmbc('Y'); regmbc(0xdd);
940 		      REGMBC(0x176) REGMBC(0x178) REGMBC(0x1e8e)
941 		      REGMBC(0x1ef2) REGMBC(0x1ef6) REGMBC(0x1ef8)
942 		      return;
943 	    case 'Z': CASEMBC(0x179) CASEMBC(0x17b) CASEMBC(0x17d)
944 	    CASEMBC(0x1b5) CASEMBC(0x1e90) CASEMBC(0x1e94)
945 		      regmbc('Z'); REGMBC(0x179) REGMBC(0x17b)
946 		      REGMBC(0x17d) REGMBC(0x1b5) REGMBC(0x1e90)
947 		      REGMBC(0x1e94)
948 		      return;
949 	    case 'a': case 0xe0: case 0xe1: case 0xe2:
950 	    case 0xe3: case 0xe4: case 0xe5:
951 	    CASEMBC(0x101) CASEMBC(0x103) CASEMBC(0x105) CASEMBC(0x1ce)
952 	    CASEMBC(0x1df) CASEMBC(0x1e1) CASEMBC(0x1ea3)
953 		      regmbc('a'); regmbc(0xe0); regmbc(0xe1);
954 		      regmbc(0xe2); regmbc(0xe3); regmbc(0xe4);
955 		      regmbc(0xe5);
956 		      REGMBC(0x101) REGMBC(0x103) REGMBC(0x105)
957 		      REGMBC(0x1ce) REGMBC(0x1df) REGMBC(0x1e1)
958 		      REGMBC(0x1ea3)
959 		      return;
960 	    case 'b': CASEMBC(0x1e03) CASEMBC(0x1e07)
961 		      regmbc('b'); REGMBC(0x1e03) REGMBC(0x1e07)
962 		      return;
963 	    case 'c': case 0xe7:
964 	    CASEMBC(0x107) CASEMBC(0x109) CASEMBC(0x10b) CASEMBC(0x10d)
965 		      regmbc('c'); regmbc(0xe7);
966 		      REGMBC(0x107) REGMBC(0x109) REGMBC(0x10b)
967 		      REGMBC(0x10d)
968 		      return;
969 	    case 'd': CASEMBC(0x10f) CASEMBC(0x111) CASEMBC(0x1e0b)
970 	    CASEMBC(0x1e0f) CASEMBC(0x1e11)
971 		      regmbc('d'); REGMBC(0x10f) REGMBC(0x111)
972 		      REGMBC(0x1e0b) REGMBC(0x1e0f) REGMBC(0x1e11)
973 		      return;
974 	    case 'e': case 0xe8: case 0xe9: case 0xea: case 0xeb:
975 	    CASEMBC(0x113) CASEMBC(0x115) CASEMBC(0x117) CASEMBC(0x119)
976 	    CASEMBC(0x11b) CASEMBC(0x1ebb) CASEMBC(0x1ebd)
977 		      regmbc('e'); regmbc(0xe8); regmbc(0xe9);
978 		      regmbc(0xea); regmbc(0xeb);
979 		      REGMBC(0x113) REGMBC(0x115) REGMBC(0x117)
980 		      REGMBC(0x119) REGMBC(0x11b) REGMBC(0x1ebb)
981 		      REGMBC(0x1ebd)
982 		      return;
983 	    case 'f': CASEMBC(0x1e1f)
984 		      regmbc('f'); REGMBC(0x1e1f)
985 		      return;
986 	    case 'g': CASEMBC(0x11d) CASEMBC(0x11f) CASEMBC(0x121)
987 	    CASEMBC(0x123) CASEMBC(0x1e5) CASEMBC(0x1e7) CASEMBC(0x1f5)
988 	    CASEMBC(0x1e21)
989 		      regmbc('g'); REGMBC(0x11d) REGMBC(0x11f)
990 		      REGMBC(0x121) REGMBC(0x123) REGMBC(0x1e5)
991 		      REGMBC(0x1e7) REGMBC(0x1f5) REGMBC(0x1e21)
992 		      return;
993 	    case 'h': CASEMBC(0x125) CASEMBC(0x127) CASEMBC(0x1e23)
994 	    CASEMBC(0x1e27) CASEMBC(0x1e29) CASEMBC(0x1e96)
995 		      regmbc('h'); REGMBC(0x125) REGMBC(0x127)
996 		      REGMBC(0x1e23) REGMBC(0x1e27) REGMBC(0x1e29)
997 		      REGMBC(0x1e96)
998 		      return;
999 	    case 'i': case 0xec: case 0xed: case 0xee: case 0xef:
1000 	    CASEMBC(0x129) CASEMBC(0x12b) CASEMBC(0x12d) CASEMBC(0x12f)
1001 	    CASEMBC(0x1d0) CASEMBC(0x1ec9)
1002 		      regmbc('i'); regmbc(0xec); regmbc(0xed);
1003 		      regmbc(0xee); regmbc(0xef);
1004 		      REGMBC(0x129) REGMBC(0x12b) REGMBC(0x12d)
1005 		      REGMBC(0x12f) REGMBC(0x1d0) REGMBC(0x1ec9)
1006 		      return;
1007 	    case 'j': CASEMBC(0x135) CASEMBC(0x1f0)
1008 		      regmbc('j'); REGMBC(0x135) REGMBC(0x1f0)
1009 		      return;
1010 	    case 'k': CASEMBC(0x137) CASEMBC(0x1e9) CASEMBC(0x1e31)
1011 	    CASEMBC(0x1e35)
1012 		      regmbc('k'); REGMBC(0x137) REGMBC(0x1e9)
1013 		      REGMBC(0x1e31) REGMBC(0x1e35)
1014 		      return;
1015 	    case 'l': CASEMBC(0x13a) CASEMBC(0x13c) CASEMBC(0x13e)
1016 	    CASEMBC(0x140) CASEMBC(0x142) CASEMBC(0x1e3b)
1017 		      regmbc('l'); REGMBC(0x13a) REGMBC(0x13c)
1018 		      REGMBC(0x13e) REGMBC(0x140) REGMBC(0x142)
1019 		      REGMBC(0x1e3b)
1020 		      return;
1021 	    case 'm': CASEMBC(0x1e3f) CASEMBC(0x1e41)
1022 		      regmbc('m'); REGMBC(0x1e3f) REGMBC(0x1e41)
1023 		      return;
1024 	    case 'n': case 0xf1:
1025 	    CASEMBC(0x144) CASEMBC(0x146) CASEMBC(0x148) CASEMBC(0x149)
1026 	    CASEMBC(0x1e45) CASEMBC(0x1e49)
1027 		      regmbc('n'); regmbc(0xf1);
1028 		      REGMBC(0x144) REGMBC(0x146) REGMBC(0x148)
1029 		      REGMBC(0x149) REGMBC(0x1e45) REGMBC(0x1e49)
1030 		      return;
1031 	    case 'o': case 0xf2: case 0xf3: case 0xf4: case 0xf5:
1032 	    case 0xf6: case 0xf8:
1033 	    CASEMBC(0x14d) CASEMBC(0x14f) CASEMBC(0x151) CASEMBC(0x1a1)
1034 	    CASEMBC(0x1d2) CASEMBC(0x1eb) CASEMBC(0x1ed) CASEMBC(0x1ecf)
1035 		      regmbc('o'); regmbc(0xf2); regmbc(0xf3);
1036 		      regmbc(0xf4); regmbc(0xf5); regmbc(0xf6);
1037 		      regmbc(0xf8);
1038 		      REGMBC(0x14d) REGMBC(0x14f) REGMBC(0x151)
1039 		      REGMBC(0x1a1) REGMBC(0x1d2) REGMBC(0x1eb)
1040 		      REGMBC(0x1ed) REGMBC(0x1ecf)
1041 		      return;
1042 	    case 'p': CASEMBC(0x1e55) CASEMBC(0x1e57)
1043 		      regmbc('p'); REGMBC(0x1e55) REGMBC(0x1e57)
1044 		      return;
1045 	    case 'r': CASEMBC(0x155) CASEMBC(0x157) CASEMBC(0x159)
1046 	    CASEMBC(0x1e59) CASEMBC(0x1e5f)
1047 		      regmbc('r'); REGMBC(0x155) REGMBC(0x157) REGMBC(0x159)
1048 		      REGMBC(0x1e59) REGMBC(0x1e5f)
1049 		      return;
1050 	    case 's': CASEMBC(0x15b) CASEMBC(0x15d) CASEMBC(0x15f)
1051 	    CASEMBC(0x161) CASEMBC(0x1e61)
1052 		      regmbc('s'); REGMBC(0x15b) REGMBC(0x15d)
1053 		      REGMBC(0x15f) REGMBC(0x161) REGMBC(0x1e61)
1054 		      return;
1055 	    case 't': CASEMBC(0x163) CASEMBC(0x165) CASEMBC(0x167)
1056 	    CASEMBC(0x1e6b) CASEMBC(0x1e6f) CASEMBC(0x1e97)
1057 		      regmbc('t'); REGMBC(0x163) REGMBC(0x165) REGMBC(0x167)
1058 		      REGMBC(0x1e6b) REGMBC(0x1e6f) REGMBC(0x1e97)
1059 		      return;
1060 	    case 'u': case 0xf9: case 0xfa: case 0xfb: case 0xfc:
1061 	    CASEMBC(0x169) CASEMBC(0x16b) CASEMBC(0x16d) CASEMBC(0x16f)
1062 	    CASEMBC(0x171) CASEMBC(0x173) CASEMBC(0x1b0) CASEMBC(0x1d4)
1063 	    CASEMBC(0x1ee7)
1064 		      regmbc('u'); regmbc(0xf9); regmbc(0xfa);
1065 		      regmbc(0xfb); regmbc(0xfc);
1066 		      REGMBC(0x169) REGMBC(0x16b) REGMBC(0x16d)
1067 		      REGMBC(0x16f) REGMBC(0x171) REGMBC(0x173)
1068 		      REGMBC(0x1b0) REGMBC(0x1d4) REGMBC(0x1ee7)
1069 		      return;
1070 	    case 'v': CASEMBC(0x1e7d)
1071 		      regmbc('v'); REGMBC(0x1e7d)
1072 		      return;
1073 	    case 'w': CASEMBC(0x175) CASEMBC(0x1e81) CASEMBC(0x1e83)
1074 	    CASEMBC(0x1e85) CASEMBC(0x1e87) CASEMBC(0x1e98)
1075 		      regmbc('w'); REGMBC(0x175) REGMBC(0x1e81)
1076 		      REGMBC(0x1e83) REGMBC(0x1e85) REGMBC(0x1e87)
1077 		      REGMBC(0x1e98)
1078 		      return;
1079 	    case 'x': CASEMBC(0x1e8b) CASEMBC(0x1e8d)
1080 		      regmbc('x'); REGMBC(0x1e8b) REGMBC(0x1e8d)
1081 		      return;
1082 	    case 'y': case 0xfd: case 0xff:
1083 	    CASEMBC(0x177) CASEMBC(0x1e8f) CASEMBC(0x1e99)
1084 	    CASEMBC(0x1ef3) CASEMBC(0x1ef7) CASEMBC(0x1ef9)
1085 		      regmbc('y'); regmbc(0xfd); regmbc(0xff);
1086 		      REGMBC(0x177) REGMBC(0x1e8f) REGMBC(0x1e99)
1087 		      REGMBC(0x1ef3) REGMBC(0x1ef7) REGMBC(0x1ef9)
1088 		      return;
1089 	    case 'z': CASEMBC(0x17a) CASEMBC(0x17c) CASEMBC(0x17e)
1090 	    CASEMBC(0x1b6) CASEMBC(0x1e91) CASEMBC(0x1e95)
1091 		      regmbc('z'); REGMBC(0x17a) REGMBC(0x17c)
1092 		      REGMBC(0x17e) REGMBC(0x1b6) REGMBC(0x1e91)
1093 		      REGMBC(0x1e95)
1094 		      return;
1095 	}
1096 #endif
1097     }
1098     regmbc(c);
1099 }
1100 
1101 /*
1102  * Check for a collating element "[.a.]".  "pp" points to the '['.
1103  * Returns a character. Zero means that no item was recognized.  Otherwise
1104  * "pp" is advanced to after the item.
1105  * Currently only single characters are recognized!
1106  */
1107     static int
1108 get_coll_element(char_u **pp)
1109 {
1110     int		c;
1111     int		l = 1;
1112     char_u	*p = *pp;
1113 
1114     if (p[0] != NUL && p[1] == '.')
1115     {
1116 	if (has_mbyte)
1117 	    l = (*mb_ptr2len)(p + 2);
1118 	if (p[l + 2] == '.' && p[l + 3] == ']')
1119 	{
1120 	    if (has_mbyte)
1121 		c = mb_ptr2char(p + 2);
1122 	    else
1123 		c = p[2];
1124 	    *pp += l + 4;
1125 	    return c;
1126 	}
1127     }
1128     return 0;
1129 }
1130 
1131 static int reg_cpo_lit; /* 'cpoptions' contains 'l' flag */
1132 static int reg_cpo_bsl; /* 'cpoptions' contains '\' flag */
1133 
1134     static void
1135 get_cpo_flags(void)
1136 {
1137     reg_cpo_lit = vim_strchr(p_cpo, CPO_LITERAL) != NULL;
1138     reg_cpo_bsl = vim_strchr(p_cpo, CPO_BACKSL) != NULL;
1139 }
1140 
1141 /*
1142  * Skip over a "[]" range.
1143  * "p" must point to the character after the '['.
1144  * The returned pointer is on the matching ']', or the terminating NUL.
1145  */
1146     static char_u *
1147 skip_anyof(char_u *p)
1148 {
1149     int		l;
1150 
1151     if (*p == '^')	/* Complement of range. */
1152 	++p;
1153     if (*p == ']' || *p == '-')
1154 	++p;
1155     while (*p != NUL && *p != ']')
1156     {
1157 	if (has_mbyte && (l = (*mb_ptr2len)(p)) > 1)
1158 	    p += l;
1159 	else
1160 	    if (*p == '-')
1161 	    {
1162 		++p;
1163 		if (*p != ']' && *p != NUL)
1164 		    MB_PTR_ADV(p);
1165 	    }
1166 	else if (*p == '\\'
1167 		&& !reg_cpo_bsl
1168 		&& (vim_strchr(REGEXP_INRANGE, p[1]) != NULL
1169 		    || (!reg_cpo_lit && vim_strchr(REGEXP_ABBR, p[1]) != NULL)))
1170 	    p += 2;
1171 	else if (*p == '[')
1172 	{
1173 	    if (get_char_class(&p) == CLASS_NONE
1174 		    && get_equi_class(&p) == 0
1175 		    && get_coll_element(&p) == 0
1176 		    && *p != NUL)
1177 		++p; /* it is not a class name and not NUL */
1178 	}
1179 	else
1180 	    ++p;
1181     }
1182 
1183     return p;
1184 }
1185 
1186 /*
1187  * Skip past regular expression.
1188  * Stop at end of "startp" or where "dirc" is found ('/', '?', etc).
1189  * Take care of characters with a backslash in front of it.
1190  * Skip strings inside [ and ].
1191  * When "newp" is not NULL and "dirc" is '?', make an allocated copy of the
1192  * expression and change "\?" to "?".  If "*newp" is not NULL the expression
1193  * is changed in-place.
1194  */
1195     char_u *
1196 skip_regexp(
1197     char_u	*startp,
1198     int		dirc,
1199     int		magic,
1200     char_u	**newp)
1201 {
1202     int		mymagic;
1203     char_u	*p = startp;
1204 
1205     if (magic)
1206 	mymagic = MAGIC_ON;
1207     else
1208 	mymagic = MAGIC_OFF;
1209     get_cpo_flags();
1210 
1211     for (; p[0] != NUL; MB_PTR_ADV(p))
1212     {
1213 	if (p[0] == dirc)	/* found end of regexp */
1214 	    break;
1215 	if ((p[0] == '[' && mymagic >= MAGIC_ON)
1216 		|| (p[0] == '\\' && p[1] == '[' && mymagic <= MAGIC_OFF))
1217 	{
1218 	    p = skip_anyof(p + 1);
1219 	    if (p[0] == NUL)
1220 		break;
1221 	}
1222 	else if (p[0] == '\\' && p[1] != NUL)
1223 	{
1224 	    if (dirc == '?' && newp != NULL && p[1] == '?')
1225 	    {
1226 		/* change "\?" to "?", make a copy first. */
1227 		if (*newp == NULL)
1228 		{
1229 		    *newp = vim_strsave(startp);
1230 		    if (*newp != NULL)
1231 			p = *newp + (p - startp);
1232 		}
1233 		if (*newp != NULL)
1234 		    STRMOVE(p, p + 1);
1235 		else
1236 		    ++p;
1237 	    }
1238 	    else
1239 		++p;    /* skip next character */
1240 	    if (*p == 'v')
1241 		mymagic = MAGIC_ALL;
1242 	    else if (*p == 'V')
1243 		mymagic = MAGIC_NONE;
1244 	}
1245     }
1246     return p;
1247 }
1248 
1249 /*
1250  * Return TRUE if the back reference is legal. We must have seen the close
1251  * brace.
1252  * TODO: Should also check that we don't refer to something that is repeated
1253  * (+*=): what instance of the repetition should we match?
1254  */
1255     static int
1256 seen_endbrace(int refnum)
1257 {
1258     if (!had_endbrace[refnum])
1259     {
1260 	char_u *p;
1261 
1262 	/* Trick: check if "@<=" or "@<!" follows, in which case
1263 	 * the \1 can appear before the referenced match. */
1264 	for (p = regparse; *p != NUL; ++p)
1265 	    if (p[0] == '@' && p[1] == '<' && (p[2] == '!' || p[2] == '='))
1266 		break;
1267 	if (*p == NUL)
1268 	{
1269 	    emsg(_("E65: Illegal back reference"));
1270 	    rc_did_emsg = TRUE;
1271 	    return FALSE;
1272 	}
1273     }
1274     return TRUE;
1275 }
1276 
1277 /*
1278  * bt_regcomp() - compile a regular expression into internal code for the
1279  * traditional back track matcher.
1280  * Returns the program in allocated space.  Returns NULL for an error.
1281  *
1282  * We can't allocate space until we know how big the compiled form will be,
1283  * but we can't compile it (and thus know how big it is) until we've got a
1284  * place to put the code.  So we cheat:  we compile it twice, once with code
1285  * generation turned off and size counting turned on, and once "for real".
1286  * This also means that we don't allocate space until we are sure that the
1287  * thing really will compile successfully, and we never have to move the
1288  * code and thus invalidate pointers into it.  (Note that it has to be in
1289  * one piece because vim_free() must be able to free it all.)
1290  *
1291  * Whether upper/lower case is to be ignored is decided when executing the
1292  * program, it does not matter here.
1293  *
1294  * Beware that the optimization-preparation code in here knows about some
1295  * of the structure of the compiled regexp.
1296  * "re_flags": RE_MAGIC and/or RE_STRING.
1297  */
1298     static regprog_T *
1299 bt_regcomp(char_u *expr, int re_flags)
1300 {
1301     bt_regprog_T    *r;
1302     char_u	*scan;
1303     char_u	*longest;
1304     int		len;
1305     int		flags;
1306 
1307     if (expr == NULL)
1308 	EMSG_RET_NULL(_(e_null));
1309 
1310     init_class_tab();
1311 
1312     /*
1313      * First pass: determine size, legality.
1314      */
1315     regcomp_start(expr, re_flags);
1316     regcode = JUST_CALC_SIZE;
1317     regc(REGMAGIC);
1318     if (reg(REG_NOPAREN, &flags) == NULL)
1319 	return NULL;
1320 
1321     /* Allocate space. */
1322     r = (bt_regprog_T *)lalloc(sizeof(bt_regprog_T) + regsize, TRUE);
1323     if (r == NULL)
1324 	return NULL;
1325     r->re_in_use = FALSE;
1326 
1327     /*
1328      * Second pass: emit code.
1329      */
1330     regcomp_start(expr, re_flags);
1331     regcode = r->program;
1332     regc(REGMAGIC);
1333     if (reg(REG_NOPAREN, &flags) == NULL || reg_toolong)
1334     {
1335 	vim_free(r);
1336 	if (reg_toolong)
1337 	    EMSG_RET_NULL(_("E339: Pattern too long"));
1338 	return NULL;
1339     }
1340 
1341     /* Dig out information for optimizations. */
1342     r->regstart = NUL;		/* Worst-case defaults. */
1343     r->reganch = 0;
1344     r->regmust = NULL;
1345     r->regmlen = 0;
1346     r->regflags = regflags;
1347     if (flags & HASNL)
1348 	r->regflags |= RF_HASNL;
1349     if (flags & HASLOOKBH)
1350 	r->regflags |= RF_LOOKBH;
1351 #ifdef FEAT_SYN_HL
1352     /* Remember whether this pattern has any \z specials in it. */
1353     r->reghasz = re_has_z;
1354 #endif
1355     scan = r->program + 1;	/* First BRANCH. */
1356     if (OP(regnext(scan)) == END)   /* Only one top-level choice. */
1357     {
1358 	scan = OPERAND(scan);
1359 
1360 	/* Starting-point info. */
1361 	if (OP(scan) == BOL || OP(scan) == RE_BOF)
1362 	{
1363 	    r->reganch++;
1364 	    scan = regnext(scan);
1365 	}
1366 
1367 	if (OP(scan) == EXACTLY)
1368 	{
1369 	    if (has_mbyte)
1370 		r->regstart = (*mb_ptr2char)(OPERAND(scan));
1371 	    else
1372 		r->regstart = *OPERAND(scan);
1373 	}
1374 	else if ((OP(scan) == BOW
1375 		    || OP(scan) == EOW
1376 		    || OP(scan) == NOTHING
1377 		    || OP(scan) == MOPEN + 0 || OP(scan) == NOPEN
1378 		    || OP(scan) == MCLOSE + 0 || OP(scan) == NCLOSE)
1379 		 && OP(regnext(scan)) == EXACTLY)
1380 	{
1381 	    if (has_mbyte)
1382 		r->regstart = (*mb_ptr2char)(OPERAND(regnext(scan)));
1383 	    else
1384 		r->regstart = *OPERAND(regnext(scan));
1385 	}
1386 
1387 	/*
1388 	 * If there's something expensive in the r.e., find the longest
1389 	 * literal string that must appear and make it the regmust.  Resolve
1390 	 * ties in favor of later strings, since the regstart check works
1391 	 * with the beginning of the r.e. and avoiding duplication
1392 	 * strengthens checking.  Not a strong reason, but sufficient in the
1393 	 * absence of others.
1394 	 */
1395 	/*
1396 	 * When the r.e. starts with BOW, it is faster to look for a regmust
1397 	 * first. Used a lot for "#" and "*" commands. (Added by mool).
1398 	 */
1399 	if ((flags & SPSTART || OP(scan) == BOW || OP(scan) == EOW)
1400 							  && !(flags & HASNL))
1401 	{
1402 	    longest = NULL;
1403 	    len = 0;
1404 	    for (; scan != NULL; scan = regnext(scan))
1405 		if (OP(scan) == EXACTLY && STRLEN(OPERAND(scan)) >= (size_t)len)
1406 		{
1407 		    longest = OPERAND(scan);
1408 		    len = (int)STRLEN(OPERAND(scan));
1409 		}
1410 	    r->regmust = longest;
1411 	    r->regmlen = len;
1412 	}
1413     }
1414 #ifdef BT_REGEXP_DUMP
1415     regdump(expr, r);
1416 #endif
1417     r->engine = &bt_regengine;
1418     return (regprog_T *)r;
1419 }
1420 
1421 /*
1422  * Free a compiled regexp program, returned by bt_regcomp().
1423  */
1424     static void
1425 bt_regfree(regprog_T *prog)
1426 {
1427     vim_free(prog);
1428 }
1429 
1430 /*
1431  * Setup to parse the regexp.  Used once to get the length and once to do it.
1432  */
1433     static void
1434 regcomp_start(
1435     char_u	*expr,
1436     int		re_flags)	    /* see vim_regcomp() */
1437 {
1438     initchr(expr);
1439     if (re_flags & RE_MAGIC)
1440 	reg_magic = MAGIC_ON;
1441     else
1442 	reg_magic = MAGIC_OFF;
1443     reg_string = (re_flags & RE_STRING);
1444     reg_strict = (re_flags & RE_STRICT);
1445     get_cpo_flags();
1446 
1447     num_complex_braces = 0;
1448     regnpar = 1;
1449     vim_memset(had_endbrace, 0, sizeof(had_endbrace));
1450 #ifdef FEAT_SYN_HL
1451     regnzpar = 1;
1452     re_has_z = 0;
1453 #endif
1454     regsize = 0L;
1455     reg_toolong = FALSE;
1456     regflags = 0;
1457 #if defined(FEAT_SYN_HL) || defined(PROTO)
1458     had_eol = FALSE;
1459 #endif
1460 }
1461 
1462 #if defined(FEAT_SYN_HL) || defined(PROTO)
1463 /*
1464  * Check if during the previous call to vim_regcomp the EOL item "$" has been
1465  * found.  This is messy, but it works fine.
1466  */
1467     int
1468 vim_regcomp_had_eol(void)
1469 {
1470     return had_eol;
1471 }
1472 #endif
1473 
1474 // variables used for parsing
1475 static int	at_start;	// True when on the first character
1476 static int	prev_at_start;  // True when on the second character
1477 
1478 /*
1479  * Parse regular expression, i.e. main body or parenthesized thing.
1480  *
1481  * Caller must absorb opening parenthesis.
1482  *
1483  * Combining parenthesis handling with the base level of regular expression
1484  * is a trifle forced, but the need to tie the tails of the branches to what
1485  * follows makes it hard to avoid.
1486  */
1487     static char_u *
1488 reg(
1489     int		paren,	/* REG_NOPAREN, REG_PAREN, REG_NPAREN or REG_ZPAREN */
1490     int		*flagp)
1491 {
1492     char_u	*ret;
1493     char_u	*br;
1494     char_u	*ender;
1495     int		parno = 0;
1496     int		flags;
1497 
1498     *flagp = HASWIDTH;		/* Tentatively. */
1499 
1500 #ifdef FEAT_SYN_HL
1501     if (paren == REG_ZPAREN)
1502     {
1503 	/* Make a ZOPEN node. */
1504 	if (regnzpar >= NSUBEXP)
1505 	    EMSG_RET_NULL(_("E50: Too many \\z("));
1506 	parno = regnzpar;
1507 	regnzpar++;
1508 	ret = regnode(ZOPEN + parno);
1509     }
1510     else
1511 #endif
1512 	if (paren == REG_PAREN)
1513     {
1514 	/* Make a MOPEN node. */
1515 	if (regnpar >= NSUBEXP)
1516 	    EMSG2_RET_NULL(_("E51: Too many %s("), reg_magic == MAGIC_ALL);
1517 	parno = regnpar;
1518 	++regnpar;
1519 	ret = regnode(MOPEN + parno);
1520     }
1521     else if (paren == REG_NPAREN)
1522     {
1523 	/* Make a NOPEN node. */
1524 	ret = regnode(NOPEN);
1525     }
1526     else
1527 	ret = NULL;
1528 
1529     /* Pick up the branches, linking them together. */
1530     br = regbranch(&flags);
1531     if (br == NULL)
1532 	return NULL;
1533     if (ret != NULL)
1534 	regtail(ret, br);	/* [MZ]OPEN -> first. */
1535     else
1536 	ret = br;
1537     /* If one of the branches can be zero-width, the whole thing can.
1538      * If one of the branches has * at start or matches a line-break, the
1539      * whole thing can. */
1540     if (!(flags & HASWIDTH))
1541 	*flagp &= ~HASWIDTH;
1542     *flagp |= flags & (SPSTART | HASNL | HASLOOKBH);
1543     while (peekchr() == Magic('|'))
1544     {
1545 	skipchr();
1546 	br = regbranch(&flags);
1547 	if (br == NULL || reg_toolong)
1548 	    return NULL;
1549 	regtail(ret, br);	/* BRANCH -> BRANCH. */
1550 	if (!(flags & HASWIDTH))
1551 	    *flagp &= ~HASWIDTH;
1552 	*flagp |= flags & (SPSTART | HASNL | HASLOOKBH);
1553     }
1554 
1555     /* Make a closing node, and hook it on the end. */
1556     ender = regnode(
1557 #ifdef FEAT_SYN_HL
1558 	    paren == REG_ZPAREN ? ZCLOSE + parno :
1559 #endif
1560 	    paren == REG_PAREN ? MCLOSE + parno :
1561 	    paren == REG_NPAREN ? NCLOSE : END);
1562     regtail(ret, ender);
1563 
1564     /* Hook the tails of the branches to the closing node. */
1565     for (br = ret; br != NULL; br = regnext(br))
1566 	regoptail(br, ender);
1567 
1568     /* Check for proper termination. */
1569     if (paren != REG_NOPAREN && getchr() != Magic(')'))
1570     {
1571 #ifdef FEAT_SYN_HL
1572 	if (paren == REG_ZPAREN)
1573 	    EMSG_RET_NULL(_("E52: Unmatched \\z("));
1574 	else
1575 #endif
1576 	    if (paren == REG_NPAREN)
1577 	    EMSG2_RET_NULL(_(e_unmatchedpp), reg_magic == MAGIC_ALL);
1578 	else
1579 	    EMSG2_RET_NULL(_(e_unmatchedp), reg_magic == MAGIC_ALL);
1580     }
1581     else if (paren == REG_NOPAREN && peekchr() != NUL)
1582     {
1583 	if (curchr == Magic(')'))
1584 	    EMSG2_RET_NULL(_(e_unmatchedpar), reg_magic == MAGIC_ALL);
1585 	else
1586 	    EMSG_RET_NULL(_(e_trailing));	/* "Can't happen". */
1587 	/* NOTREACHED */
1588     }
1589     /*
1590      * Here we set the flag allowing back references to this set of
1591      * parentheses.
1592      */
1593     if (paren == REG_PAREN)
1594 	had_endbrace[parno] = TRUE;	/* have seen the close paren */
1595     return ret;
1596 }
1597 
1598 /*
1599  * Parse one alternative of an | operator.
1600  * Implements the & operator.
1601  */
1602     static char_u *
1603 regbranch(int *flagp)
1604 {
1605     char_u	*ret;
1606     char_u	*chain = NULL;
1607     char_u	*latest;
1608     int		flags;
1609 
1610     *flagp = WORST | HASNL;		/* Tentatively. */
1611 
1612     ret = regnode(BRANCH);
1613     for (;;)
1614     {
1615 	latest = regconcat(&flags);
1616 	if (latest == NULL)
1617 	    return NULL;
1618 	/* If one of the branches has width, the whole thing has.  If one of
1619 	 * the branches anchors at start-of-line, the whole thing does.
1620 	 * If one of the branches uses look-behind, the whole thing does. */
1621 	*flagp |= flags & (HASWIDTH | SPSTART | HASLOOKBH);
1622 	/* If one of the branches doesn't match a line-break, the whole thing
1623 	 * doesn't. */
1624 	*flagp &= ~HASNL | (flags & HASNL);
1625 	if (chain != NULL)
1626 	    regtail(chain, latest);
1627 	if (peekchr() != Magic('&'))
1628 	    break;
1629 	skipchr();
1630 	regtail(latest, regnode(END)); /* operand ends */
1631 	if (reg_toolong)
1632 	    break;
1633 	reginsert(MATCH, latest);
1634 	chain = latest;
1635     }
1636 
1637     return ret;
1638 }
1639 
1640 /*
1641  * Parse one alternative of an | or & operator.
1642  * Implements the concatenation operator.
1643  */
1644     static char_u *
1645 regconcat(int *flagp)
1646 {
1647     char_u	*first = NULL;
1648     char_u	*chain = NULL;
1649     char_u	*latest;
1650     int		flags;
1651     int		cont = TRUE;
1652 
1653     *flagp = WORST;		/* Tentatively. */
1654 
1655     while (cont)
1656     {
1657 	switch (peekchr())
1658 	{
1659 	    case NUL:
1660 	    case Magic('|'):
1661 	    case Magic('&'):
1662 	    case Magic(')'):
1663 			    cont = FALSE;
1664 			    break;
1665 	    case Magic('Z'):
1666 			    regflags |= RF_ICOMBINE;
1667 			    skipchr_keepstart();
1668 			    break;
1669 	    case Magic('c'):
1670 			    regflags |= RF_ICASE;
1671 			    skipchr_keepstart();
1672 			    break;
1673 	    case Magic('C'):
1674 			    regflags |= RF_NOICASE;
1675 			    skipchr_keepstart();
1676 			    break;
1677 	    case Magic('v'):
1678 			    reg_magic = MAGIC_ALL;
1679 			    skipchr_keepstart();
1680 			    curchr = -1;
1681 			    break;
1682 	    case Magic('m'):
1683 			    reg_magic = MAGIC_ON;
1684 			    skipchr_keepstart();
1685 			    curchr = -1;
1686 			    break;
1687 	    case Magic('M'):
1688 			    reg_magic = MAGIC_OFF;
1689 			    skipchr_keepstart();
1690 			    curchr = -1;
1691 			    break;
1692 	    case Magic('V'):
1693 			    reg_magic = MAGIC_NONE;
1694 			    skipchr_keepstart();
1695 			    curchr = -1;
1696 			    break;
1697 	    default:
1698 			    latest = regpiece(&flags);
1699 			    if (latest == NULL || reg_toolong)
1700 				return NULL;
1701 			    *flagp |= flags & (HASWIDTH | HASNL | HASLOOKBH);
1702 			    if (chain == NULL)	/* First piece. */
1703 				*flagp |= flags & SPSTART;
1704 			    else
1705 				regtail(chain, latest);
1706 			    chain = latest;
1707 			    if (first == NULL)
1708 				first = latest;
1709 			    break;
1710 	}
1711     }
1712     if (first == NULL)		/* Loop ran zero times. */
1713 	first = regnode(NOTHING);
1714     return first;
1715 }
1716 
1717 /*
1718  * Parse something followed by possible [*+=].
1719  *
1720  * Note that the branching code sequences used for = and the general cases
1721  * of * and + are somewhat optimized:  they use the same NOTHING node as
1722  * both the endmarker for their branch list and the body of the last branch.
1723  * It might seem that this node could be dispensed with entirely, but the
1724  * endmarker role is not redundant.
1725  */
1726     static char_u *
1727 regpiece(int *flagp)
1728 {
1729     char_u	    *ret;
1730     int		    op;
1731     char_u	    *next;
1732     int		    flags;
1733     long	    minval;
1734     long	    maxval;
1735 
1736     ret = regatom(&flags);
1737     if (ret == NULL)
1738 	return NULL;
1739 
1740     op = peekchr();
1741     if (re_multi_type(op) == NOT_MULTI)
1742     {
1743 	*flagp = flags;
1744 	return ret;
1745     }
1746     /* default flags */
1747     *flagp = (WORST | SPSTART | (flags & (HASNL | HASLOOKBH)));
1748 
1749     skipchr();
1750     switch (op)
1751     {
1752 	case Magic('*'):
1753 	    if (flags & SIMPLE)
1754 		reginsert(STAR, ret);
1755 	    else
1756 	    {
1757 		/* Emit x* as (x&|), where & means "self". */
1758 		reginsert(BRANCH, ret); /* Either x */
1759 		regoptail(ret, regnode(BACK));	/* and loop */
1760 		regoptail(ret, ret);	/* back */
1761 		regtail(ret, regnode(BRANCH));	/* or */
1762 		regtail(ret, regnode(NOTHING)); /* null. */
1763 	    }
1764 	    break;
1765 
1766 	case Magic('+'):
1767 	    if (flags & SIMPLE)
1768 		reginsert(PLUS, ret);
1769 	    else
1770 	    {
1771 		/* Emit x+ as x(&|), where & means "self". */
1772 		next = regnode(BRANCH); /* Either */
1773 		regtail(ret, next);
1774 		regtail(regnode(BACK), ret);	/* loop back */
1775 		regtail(next, regnode(BRANCH)); /* or */
1776 		regtail(ret, regnode(NOTHING)); /* null. */
1777 	    }
1778 	    *flagp = (WORST | HASWIDTH | (flags & (HASNL | HASLOOKBH)));
1779 	    break;
1780 
1781 	case Magic('@'):
1782 	    {
1783 		int	lop = END;
1784 		long	nr;
1785 
1786 		nr = getdecchrs();
1787 		switch (no_Magic(getchr()))
1788 		{
1789 		    case '=': lop = MATCH; break;		  /* \@= */
1790 		    case '!': lop = NOMATCH; break;		  /* \@! */
1791 		    case '>': lop = SUBPAT; break;		  /* \@> */
1792 		    case '<': switch (no_Magic(getchr()))
1793 			      {
1794 				  case '=': lop = BEHIND; break;   /* \@<= */
1795 				  case '!': lop = NOBEHIND; break; /* \@<! */
1796 			      }
1797 		}
1798 		if (lop == END)
1799 		    EMSG2_RET_NULL(_("E59: invalid character after %s@"),
1800 						      reg_magic == MAGIC_ALL);
1801 		/* Look behind must match with behind_pos. */
1802 		if (lop == BEHIND || lop == NOBEHIND)
1803 		{
1804 		    regtail(ret, regnode(BHPOS));
1805 		    *flagp |= HASLOOKBH;
1806 		}
1807 		regtail(ret, regnode(END)); /* operand ends */
1808 		if (lop == BEHIND || lop == NOBEHIND)
1809 		{
1810 		    if (nr < 0)
1811 			nr = 0; /* no limit is same as zero limit */
1812 		    reginsert_nr(lop, nr, ret);
1813 		}
1814 		else
1815 		    reginsert(lop, ret);
1816 		break;
1817 	    }
1818 
1819 	case Magic('?'):
1820 	case Magic('='):
1821 	    /* Emit x= as (x|) */
1822 	    reginsert(BRANCH, ret);		/* Either x */
1823 	    regtail(ret, regnode(BRANCH));	/* or */
1824 	    next = regnode(NOTHING);		/* null. */
1825 	    regtail(ret, next);
1826 	    regoptail(ret, next);
1827 	    break;
1828 
1829 	case Magic('{'):
1830 	    if (!read_limits(&minval, &maxval))
1831 		return NULL;
1832 	    if (flags & SIMPLE)
1833 	    {
1834 		reginsert(BRACE_SIMPLE, ret);
1835 		reginsert_limits(BRACE_LIMITS, minval, maxval, ret);
1836 	    }
1837 	    else
1838 	    {
1839 		if (num_complex_braces >= 10)
1840 		    EMSG2_RET_NULL(_("E60: Too many complex %s{...}s"),
1841 						      reg_magic == MAGIC_ALL);
1842 		reginsert(BRACE_COMPLEX + num_complex_braces, ret);
1843 		regoptail(ret, regnode(BACK));
1844 		regoptail(ret, ret);
1845 		reginsert_limits(BRACE_LIMITS, minval, maxval, ret);
1846 		++num_complex_braces;
1847 	    }
1848 	    if (minval > 0 && maxval > 0)
1849 		*flagp = (HASWIDTH | (flags & (HASNL | HASLOOKBH)));
1850 	    break;
1851     }
1852     if (re_multi_type(peekchr()) != NOT_MULTI)
1853     {
1854 	// Can't have a multi follow a multi.
1855 	if (peekchr() == Magic('*'))
1856 	    EMSG2_RET_NULL(_("E61: Nested %s*"), reg_magic >= MAGIC_ON);
1857 	EMSG3_RET_NULL(_("E62: Nested %s%c"), reg_magic == MAGIC_ALL,
1858 							  no_Magic(peekchr()));
1859     }
1860 
1861     return ret;
1862 }
1863 
1864 /* When making changes to classchars also change nfa_classcodes. */
1865 static char_u	*classchars = (char_u *)".iIkKfFpPsSdDxXoOwWhHaAlLuU";
1866 static int	classcodes[] = {
1867     ANY, IDENT, SIDENT, KWORD, SKWORD,
1868     FNAME, SFNAME, PRINT, SPRINT,
1869     WHITE, NWHITE, DIGIT, NDIGIT,
1870     HEX, NHEX, OCTAL, NOCTAL,
1871     WORD, NWORD, HEAD, NHEAD,
1872     ALPHA, NALPHA, LOWER, NLOWER,
1873     UPPER, NUPPER
1874 };
1875 
1876 /*
1877  * Parse the lowest level.
1878  *
1879  * Optimization:  gobbles an entire sequence of ordinary characters so that
1880  * it can turn them into a single node, which is smaller to store and
1881  * faster to run.  Don't do this when one_exactly is set.
1882  */
1883     static char_u *
1884 regatom(int *flagp)
1885 {
1886     char_u	    *ret;
1887     int		    flags;
1888     int		    c;
1889     char_u	    *p;
1890     int		    extra = 0;
1891     int		    save_prev_at_start = prev_at_start;
1892 
1893     *flagp = WORST;		/* Tentatively. */
1894 
1895     c = getchr();
1896     switch (c)
1897     {
1898       case Magic('^'):
1899 	ret = regnode(BOL);
1900 	break;
1901 
1902       case Magic('$'):
1903 	ret = regnode(EOL);
1904 #if defined(FEAT_SYN_HL) || defined(PROTO)
1905 	had_eol = TRUE;
1906 #endif
1907 	break;
1908 
1909       case Magic('<'):
1910 	ret = regnode(BOW);
1911 	break;
1912 
1913       case Magic('>'):
1914 	ret = regnode(EOW);
1915 	break;
1916 
1917       case Magic('_'):
1918 	c = no_Magic(getchr());
1919 	if (c == '^')		/* "\_^" is start-of-line */
1920 	{
1921 	    ret = regnode(BOL);
1922 	    break;
1923 	}
1924 	if (c == '$')		/* "\_$" is end-of-line */
1925 	{
1926 	    ret = regnode(EOL);
1927 #if defined(FEAT_SYN_HL) || defined(PROTO)
1928 	    had_eol = TRUE;
1929 #endif
1930 	    break;
1931 	}
1932 
1933 	extra = ADD_NL;
1934 	*flagp |= HASNL;
1935 
1936 	/* "\_[" is character range plus newline */
1937 	if (c == '[')
1938 	    goto collection;
1939 
1940 	/* "\_x" is character class plus newline */
1941 	/* FALLTHROUGH */
1942 
1943 	/*
1944 	 * Character classes.
1945 	 */
1946       case Magic('.'):
1947       case Magic('i'):
1948       case Magic('I'):
1949       case Magic('k'):
1950       case Magic('K'):
1951       case Magic('f'):
1952       case Magic('F'):
1953       case Magic('p'):
1954       case Magic('P'):
1955       case Magic('s'):
1956       case Magic('S'):
1957       case Magic('d'):
1958       case Magic('D'):
1959       case Magic('x'):
1960       case Magic('X'):
1961       case Magic('o'):
1962       case Magic('O'):
1963       case Magic('w'):
1964       case Magic('W'):
1965       case Magic('h'):
1966       case Magic('H'):
1967       case Magic('a'):
1968       case Magic('A'):
1969       case Magic('l'):
1970       case Magic('L'):
1971       case Magic('u'):
1972       case Magic('U'):
1973 	p = vim_strchr(classchars, no_Magic(c));
1974 	if (p == NULL)
1975 	    EMSG_RET_NULL(_("E63: invalid use of \\_"));
1976 
1977 	/* When '.' is followed by a composing char ignore the dot, so that
1978 	 * the composing char is matched here. */
1979 	if (enc_utf8 && c == Magic('.') && utf_iscomposing(peekchr()))
1980 	{
1981 	    c = getchr();
1982 	    goto do_multibyte;
1983 	}
1984 	ret = regnode(classcodes[p - classchars] + extra);
1985 	*flagp |= HASWIDTH | SIMPLE;
1986 	break;
1987 
1988       case Magic('n'):
1989 	if (reg_string)
1990 	{
1991 	    /* In a string "\n" matches a newline character. */
1992 	    ret = regnode(EXACTLY);
1993 	    regc(NL);
1994 	    regc(NUL);
1995 	    *flagp |= HASWIDTH | SIMPLE;
1996 	}
1997 	else
1998 	{
1999 	    /* In buffer text "\n" matches the end of a line. */
2000 	    ret = regnode(NEWL);
2001 	    *flagp |= HASWIDTH | HASNL;
2002 	}
2003 	break;
2004 
2005       case Magic('('):
2006 	if (one_exactly)
2007 	    EMSG_ONE_RET_NULL;
2008 	ret = reg(REG_PAREN, &flags);
2009 	if (ret == NULL)
2010 	    return NULL;
2011 	*flagp |= flags & (HASWIDTH | SPSTART | HASNL | HASLOOKBH);
2012 	break;
2013 
2014       case NUL:
2015       case Magic('|'):
2016       case Magic('&'):
2017       case Magic(')'):
2018 	if (one_exactly)
2019 	    EMSG_ONE_RET_NULL;
2020 	IEMSG_RET_NULL(_(e_internal));	/* Supposed to be caught earlier. */
2021 	/* NOTREACHED */
2022 
2023       case Magic('='):
2024       case Magic('?'):
2025       case Magic('+'):
2026       case Magic('@'):
2027       case Magic('{'):
2028       case Magic('*'):
2029 	c = no_Magic(c);
2030 	EMSG3_RET_NULL(_("E64: %s%c follows nothing"),
2031 		(c == '*' ? reg_magic >= MAGIC_ON : reg_magic == MAGIC_ALL), c);
2032 	/* NOTREACHED */
2033 
2034       case Magic('~'):		/* previous substitute pattern */
2035 	    if (reg_prev_sub != NULL)
2036 	    {
2037 		char_u	    *lp;
2038 
2039 		ret = regnode(EXACTLY);
2040 		lp = reg_prev_sub;
2041 		while (*lp != NUL)
2042 		    regc(*lp++);
2043 		regc(NUL);
2044 		if (*reg_prev_sub != NUL)
2045 		{
2046 		    *flagp |= HASWIDTH;
2047 		    if ((lp - reg_prev_sub) == 1)
2048 			*flagp |= SIMPLE;
2049 		}
2050 	    }
2051 	    else
2052 		EMSG_RET_NULL(_(e_nopresub));
2053 	    break;
2054 
2055       case Magic('1'):
2056       case Magic('2'):
2057       case Magic('3'):
2058       case Magic('4'):
2059       case Magic('5'):
2060       case Magic('6'):
2061       case Magic('7'):
2062       case Magic('8'):
2063       case Magic('9'):
2064 	    {
2065 		int		    refnum;
2066 
2067 		refnum = c - Magic('0');
2068 		if (!seen_endbrace(refnum))
2069 		    return NULL;
2070 		ret = regnode(BACKREF + refnum);
2071 	    }
2072 	    break;
2073 
2074       case Magic('z'):
2075 	{
2076 	    c = no_Magic(getchr());
2077 	    switch (c)
2078 	    {
2079 #ifdef FEAT_SYN_HL
2080 		case '(': if ((reg_do_extmatch & REX_SET) == 0)
2081 			      EMSG_RET_NULL(_(e_z_not_allowed));
2082 			  if (one_exactly)
2083 			      EMSG_ONE_RET_NULL;
2084 			  ret = reg(REG_ZPAREN, &flags);
2085 			  if (ret == NULL)
2086 			      return NULL;
2087 			  *flagp |= flags & (HASWIDTH|SPSTART|HASNL|HASLOOKBH);
2088 			  re_has_z = REX_SET;
2089 			  break;
2090 
2091 		case '1':
2092 		case '2':
2093 		case '3':
2094 		case '4':
2095 		case '5':
2096 		case '6':
2097 		case '7':
2098 		case '8':
2099 		case '9': if ((reg_do_extmatch & REX_USE) == 0)
2100 			      EMSG_RET_NULL(_(e_z1_not_allowed));
2101 			  ret = regnode(ZREF + c - '0');
2102 			  re_has_z = REX_USE;
2103 			  break;
2104 #endif
2105 
2106 		case 's': ret = regnode(MOPEN + 0);
2107 			  if (re_mult_next("\\zs") == FAIL)
2108 			      return NULL;
2109 			  break;
2110 
2111 		case 'e': ret = regnode(MCLOSE + 0);
2112 			  if (re_mult_next("\\ze") == FAIL)
2113 			      return NULL;
2114 			  break;
2115 
2116 		default:  EMSG_RET_NULL(_("E68: Invalid character after \\z"));
2117 	    }
2118 	}
2119 	break;
2120 
2121       case Magic('%'):
2122 	{
2123 	    c = no_Magic(getchr());
2124 	    switch (c)
2125 	    {
2126 		/* () without a back reference */
2127 		case '(':
2128 		    if (one_exactly)
2129 			EMSG_ONE_RET_NULL;
2130 		    ret = reg(REG_NPAREN, &flags);
2131 		    if (ret == NULL)
2132 			return NULL;
2133 		    *flagp |= flags & (HASWIDTH | SPSTART | HASNL | HASLOOKBH);
2134 		    break;
2135 
2136 		/* Catch \%^ and \%$ regardless of where they appear in the
2137 		 * pattern -- regardless of whether or not it makes sense. */
2138 		case '^':
2139 		    ret = regnode(RE_BOF);
2140 		    break;
2141 
2142 		case '$':
2143 		    ret = regnode(RE_EOF);
2144 		    break;
2145 
2146 		case '#':
2147 		    ret = regnode(CURSOR);
2148 		    break;
2149 
2150 		case 'V':
2151 		    ret = regnode(RE_VISUAL);
2152 		    break;
2153 
2154 		case 'C':
2155 		    ret = regnode(RE_COMPOSING);
2156 		    break;
2157 
2158 		/* \%[abc]: Emit as a list of branches, all ending at the last
2159 		 * branch which matches nothing. */
2160 		case '[':
2161 			  if (one_exactly)	/* doesn't nest */
2162 			      EMSG_ONE_RET_NULL;
2163 			  {
2164 			      char_u	*lastbranch;
2165 			      char_u	*lastnode = NULL;
2166 			      char_u	*br;
2167 
2168 			      ret = NULL;
2169 			      while ((c = getchr()) != ']')
2170 			      {
2171 				  if (c == NUL)
2172 				      EMSG2_RET_NULL(_(e_missing_sb),
2173 						      reg_magic == MAGIC_ALL);
2174 				  br = regnode(BRANCH);
2175 				  if (ret == NULL)
2176 				      ret = br;
2177 				  else
2178 				      regtail(lastnode, br);
2179 
2180 				  ungetchr();
2181 				  one_exactly = TRUE;
2182 				  lastnode = regatom(flagp);
2183 				  one_exactly = FALSE;
2184 				  if (lastnode == NULL)
2185 				      return NULL;
2186 			      }
2187 			      if (ret == NULL)
2188 				  EMSG2_RET_NULL(_(e_empty_sb),
2189 						      reg_magic == MAGIC_ALL);
2190 			      lastbranch = regnode(BRANCH);
2191 			      br = regnode(NOTHING);
2192 			      if (ret != JUST_CALC_SIZE)
2193 			      {
2194 				  regtail(lastnode, br);
2195 				  regtail(lastbranch, br);
2196 				  /* connect all branches to the NOTHING
2197 				   * branch at the end */
2198 				  for (br = ret; br != lastnode; )
2199 				  {
2200 				      if (OP(br) == BRANCH)
2201 				      {
2202 					  regtail(br, lastbranch);
2203 					  br = OPERAND(br);
2204 				      }
2205 				      else
2206 					  br = regnext(br);
2207 				  }
2208 			      }
2209 			      *flagp &= ~(HASWIDTH | SIMPLE);
2210 			      break;
2211 			  }
2212 
2213 		case 'd':   /* %d123 decimal */
2214 		case 'o':   /* %o123 octal */
2215 		case 'x':   /* %xab hex 2 */
2216 		case 'u':   /* %uabcd hex 4 */
2217 		case 'U':   /* %U1234abcd hex 8 */
2218 			  {
2219 			      long i;
2220 
2221 			      switch (c)
2222 			      {
2223 				  case 'd': i = getdecchrs(); break;
2224 				  case 'o': i = getoctchrs(); break;
2225 				  case 'x': i = gethexchrs(2); break;
2226 				  case 'u': i = gethexchrs(4); break;
2227 				  case 'U': i = gethexchrs(8); break;
2228 				  default:  i = -1; break;
2229 			      }
2230 
2231 			      if (i < 0)
2232 				  EMSG2_RET_NULL(
2233 					_("E678: Invalid character after %s%%[dxouU]"),
2234 					reg_magic == MAGIC_ALL);
2235 			      if (use_multibytecode(i))
2236 				  ret = regnode(MULTIBYTECODE);
2237 			      else
2238 				  ret = regnode(EXACTLY);
2239 			      if (i == 0)
2240 				  regc(0x0a);
2241 			      else
2242 				  regmbc(i);
2243 			      regc(NUL);
2244 			      *flagp |= HASWIDTH;
2245 			      break;
2246 			  }
2247 
2248 		default:
2249 			  if (VIM_ISDIGIT(c) || c == '<' || c == '>'
2250 								 || c == '\'')
2251 			  {
2252 			      long_u	n = 0;
2253 			      int	cmp;
2254 
2255 			      cmp = c;
2256 			      if (cmp == '<' || cmp == '>')
2257 				  c = getchr();
2258 			      while (VIM_ISDIGIT(c))
2259 			      {
2260 				  n = n * 10 + (c - '0');
2261 				  c = getchr();
2262 			      }
2263 			      if (c == '\'' && n == 0)
2264 			      {
2265 				  /* "\%'m", "\%<'m" and "\%>'m": Mark */
2266 				  c = getchr();
2267 				  ret = regnode(RE_MARK);
2268 				  if (ret == JUST_CALC_SIZE)
2269 				      regsize += 2;
2270 				  else
2271 				  {
2272 				      *regcode++ = c;
2273 				      *regcode++ = cmp;
2274 				  }
2275 				  break;
2276 			      }
2277 			      else if (c == 'l' || c == 'c' || c == 'v')
2278 			      {
2279 				  if (c == 'l')
2280 				  {
2281 				      ret = regnode(RE_LNUM);
2282 				      if (save_prev_at_start)
2283 					  at_start = TRUE;
2284 				  }
2285 				  else if (c == 'c')
2286 				      ret = regnode(RE_COL);
2287 				  else
2288 				      ret = regnode(RE_VCOL);
2289 				  if (ret == JUST_CALC_SIZE)
2290 				      regsize += 5;
2291 				  else
2292 				  {
2293 				      /* put the number and the optional
2294 				       * comparator after the opcode */
2295 				      regcode = re_put_long(regcode, n);
2296 				      *regcode++ = cmp;
2297 				  }
2298 				  break;
2299 			      }
2300 			  }
2301 
2302 			  EMSG2_RET_NULL(_("E71: Invalid character after %s%%"),
2303 						      reg_magic == MAGIC_ALL);
2304 	    }
2305 	}
2306 	break;
2307 
2308       case Magic('['):
2309 collection:
2310 	{
2311 	    char_u	*lp;
2312 
2313 	    /*
2314 	     * If there is no matching ']', we assume the '[' is a normal
2315 	     * character.  This makes 'incsearch' and ":help [" work.
2316 	     */
2317 	    lp = skip_anyof(regparse);
2318 	    if (*lp == ']')	/* there is a matching ']' */
2319 	    {
2320 		int	startc = -1;	/* > 0 when next '-' is a range */
2321 		int	endc;
2322 
2323 		/*
2324 		 * In a character class, different parsing rules apply.
2325 		 * Not even \ is special anymore, nothing is.
2326 		 */
2327 		if (*regparse == '^')	    /* Complement of range. */
2328 		{
2329 		    ret = regnode(ANYBUT + extra);
2330 		    regparse++;
2331 		}
2332 		else
2333 		    ret = regnode(ANYOF + extra);
2334 
2335 		/* At the start ']' and '-' mean the literal character. */
2336 		if (*regparse == ']' || *regparse == '-')
2337 		{
2338 		    startc = *regparse;
2339 		    regc(*regparse++);
2340 		}
2341 
2342 		while (*regparse != NUL && *regparse != ']')
2343 		{
2344 		    if (*regparse == '-')
2345 		    {
2346 			++regparse;
2347 			/* The '-' is not used for a range at the end and
2348 			 * after or before a '\n'. */
2349 			if (*regparse == ']' || *regparse == NUL
2350 				|| startc == -1
2351 				|| (regparse[0] == '\\' && regparse[1] == 'n'))
2352 			{
2353 			    regc('-');
2354 			    startc = '-';	/* [--x] is a range */
2355 			}
2356 			else
2357 			{
2358 			    /* Also accept "a-[.z.]" */
2359 			    endc = 0;
2360 			    if (*regparse == '[')
2361 				endc = get_coll_element(&regparse);
2362 			    if (endc == 0)
2363 			    {
2364 				if (has_mbyte)
2365 				    endc = mb_ptr2char_adv(&regparse);
2366 				else
2367 				    endc = *regparse++;
2368 			    }
2369 
2370 			    /* Handle \o40, \x20 and \u20AC style sequences */
2371 			    if (endc == '\\' && !reg_cpo_lit && !reg_cpo_bsl)
2372 				endc = coll_get_char();
2373 
2374 			    if (startc > endc)
2375 				EMSG_RET_NULL(_(e_reverse_range));
2376 			    if (has_mbyte && ((*mb_char2len)(startc) > 1
2377 						 || (*mb_char2len)(endc) > 1))
2378 			    {
2379 				/* Limit to a range of 256 chars. */
2380 				if (endc > startc + 256)
2381 				    EMSG_RET_NULL(_(e_large_class));
2382 				while (++startc <= endc)
2383 				    regmbc(startc);
2384 			    }
2385 			    else
2386 			    {
2387 #ifdef EBCDIC
2388 				int	alpha_only = FALSE;
2389 
2390 				/* for alphabetical range skip the gaps
2391 				 * 'i'-'j', 'r'-'s', 'I'-'J' and 'R'-'S'.  */
2392 				if (isalpha(startc) && isalpha(endc))
2393 				    alpha_only = TRUE;
2394 #endif
2395 				while (++startc <= endc)
2396 #ifdef EBCDIC
2397 				    if (!alpha_only || isalpha(startc))
2398 #endif
2399 					regc(startc);
2400 			    }
2401 			    startc = -1;
2402 			}
2403 		    }
2404 		    /*
2405 		     * Only "\]", "\^", "\]" and "\\" are special in Vi.  Vim
2406 		     * accepts "\t", "\e", etc., but only when the 'l' flag in
2407 		     * 'cpoptions' is not included.
2408 		     * Posix doesn't recognize backslash at all.
2409 		     */
2410 		    else if (*regparse == '\\'
2411 			    && !reg_cpo_bsl
2412 			    && (vim_strchr(REGEXP_INRANGE, regparse[1]) != NULL
2413 				|| (!reg_cpo_lit
2414 				    && vim_strchr(REGEXP_ABBR,
2415 						       regparse[1]) != NULL)))
2416 		    {
2417 			regparse++;
2418 			if (*regparse == 'n')
2419 			{
2420 			    /* '\n' in range: also match NL */
2421 			    if (ret != JUST_CALC_SIZE)
2422 			    {
2423 				/* Using \n inside [^] does not change what
2424 				 * matches. "[^\n]" is the same as ".". */
2425 				if (*ret == ANYOF)
2426 				{
2427 				    *ret = ANYOF + ADD_NL;
2428 				    *flagp |= HASNL;
2429 				}
2430 				/* else: must have had a \n already */
2431 			    }
2432 			    regparse++;
2433 			    startc = -1;
2434 			}
2435 			else if (*regparse == 'd'
2436 				|| *regparse == 'o'
2437 				|| *regparse == 'x'
2438 				|| *regparse == 'u'
2439 				|| *regparse == 'U')
2440 			{
2441 			    startc = coll_get_char();
2442 			    if (startc == 0)
2443 				regc(0x0a);
2444 			    else
2445 				regmbc(startc);
2446 			}
2447 			else
2448 			{
2449 			    startc = backslash_trans(*regparse++);
2450 			    regc(startc);
2451 			}
2452 		    }
2453 		    else if (*regparse == '[')
2454 		    {
2455 			int c_class;
2456 			int cu;
2457 
2458 			c_class = get_char_class(&regparse);
2459 			startc = -1;
2460 			/* Characters assumed to be 8 bits! */
2461 			switch (c_class)
2462 			{
2463 			    case CLASS_NONE:
2464 				c_class = get_equi_class(&regparse);
2465 				if (c_class != 0)
2466 				{
2467 				    /* produce equivalence class */
2468 				    reg_equi_class(c_class);
2469 				}
2470 				else if ((c_class =
2471 					    get_coll_element(&regparse)) != 0)
2472 				{
2473 				    /* produce a collating element */
2474 				    regmbc(c_class);
2475 				}
2476 				else
2477 				{
2478 				    /* literal '[', allow [[-x] as a range */
2479 				    startc = *regparse++;
2480 				    regc(startc);
2481 				}
2482 				break;
2483 			    case CLASS_ALNUM:
2484 				for (cu = 1; cu < 128; cu++)
2485 				    if (isalnum(cu))
2486 					regmbc(cu);
2487 				break;
2488 			    case CLASS_ALPHA:
2489 				for (cu = 1; cu < 128; cu++)
2490 				    if (isalpha(cu))
2491 					regmbc(cu);
2492 				break;
2493 			    case CLASS_BLANK:
2494 				regc(' ');
2495 				regc('\t');
2496 				break;
2497 			    case CLASS_CNTRL:
2498 				for (cu = 1; cu <= 127; cu++)
2499 				    if (iscntrl(cu))
2500 					regmbc(cu);
2501 				break;
2502 			    case CLASS_DIGIT:
2503 				for (cu = 1; cu <= 127; cu++)
2504 				    if (VIM_ISDIGIT(cu))
2505 					regmbc(cu);
2506 				break;
2507 			    case CLASS_GRAPH:
2508 				for (cu = 1; cu <= 127; cu++)
2509 				    if (isgraph(cu))
2510 					regmbc(cu);
2511 				break;
2512 			    case CLASS_LOWER:
2513 				for (cu = 1; cu <= 255; cu++)
2514 				    if (MB_ISLOWER(cu) && cu != 170
2515 								 && cu != 186)
2516 					regmbc(cu);
2517 				break;
2518 			    case CLASS_PRINT:
2519 				for (cu = 1; cu <= 255; cu++)
2520 				    if (vim_isprintc(cu))
2521 					regmbc(cu);
2522 				break;
2523 			    case CLASS_PUNCT:
2524 				for (cu = 1; cu < 128; cu++)
2525 				    if (ispunct(cu))
2526 					regmbc(cu);
2527 				break;
2528 			    case CLASS_SPACE:
2529 				for (cu = 9; cu <= 13; cu++)
2530 				    regc(cu);
2531 				regc(' ');
2532 				break;
2533 			    case CLASS_UPPER:
2534 				for (cu = 1; cu <= 255; cu++)
2535 				    if (MB_ISUPPER(cu))
2536 					regmbc(cu);
2537 				break;
2538 			    case CLASS_XDIGIT:
2539 				for (cu = 1; cu <= 255; cu++)
2540 				    if (vim_isxdigit(cu))
2541 					regmbc(cu);
2542 				break;
2543 			    case CLASS_TAB:
2544 				regc('\t');
2545 				break;
2546 			    case CLASS_RETURN:
2547 				regc('\r');
2548 				break;
2549 			    case CLASS_BACKSPACE:
2550 				regc('\b');
2551 				break;
2552 			    case CLASS_ESCAPE:
2553 				regc('\033');
2554 				break;
2555 			    case CLASS_IDENT:
2556 				for (cu = 1; cu <= 255; cu++)
2557 				    if (vim_isIDc(cu))
2558 					regmbc(cu);
2559 				break;
2560 			    case CLASS_KEYWORD:
2561 				for (cu = 1; cu <= 255; cu++)
2562 				    if (reg_iswordc(cu))
2563 					regmbc(cu);
2564 				break;
2565 			    case CLASS_FNAME:
2566 				for (cu = 1; cu <= 255; cu++)
2567 				    if (vim_isfilec(cu))
2568 					regmbc(cu);
2569 				break;
2570 			}
2571 		    }
2572 		    else
2573 		    {
2574 			if (has_mbyte)
2575 			{
2576 			    int	len;
2577 
2578 			    /* produce a multibyte character, including any
2579 			     * following composing characters */
2580 			    startc = mb_ptr2char(regparse);
2581 			    len = (*mb_ptr2len)(regparse);
2582 			    if (enc_utf8 && utf_char2len(startc) != len)
2583 				startc = -1;	/* composing chars */
2584 			    while (--len >= 0)
2585 				regc(*regparse++);
2586 			}
2587 			else
2588 			{
2589 			    startc = *regparse++;
2590 			    regc(startc);
2591 			}
2592 		    }
2593 		}
2594 		regc(NUL);
2595 		prevchr_len = 1;	/* last char was the ']' */
2596 		if (*regparse != ']')
2597 		    EMSG_RET_NULL(_(e_toomsbra));	/* Cannot happen? */
2598 		skipchr();	    /* let's be friends with the lexer again */
2599 		*flagp |= HASWIDTH | SIMPLE;
2600 		break;
2601 	    }
2602 	    else if (reg_strict)
2603 		EMSG2_RET_NULL(_(e_missingbracket), reg_magic > MAGIC_OFF);
2604 	}
2605 	/* FALLTHROUGH */
2606 
2607       default:
2608 	{
2609 	    int		len;
2610 
2611 	    /* A multi-byte character is handled as a separate atom if it's
2612 	     * before a multi and when it's a composing char. */
2613 	    if (use_multibytecode(c))
2614 	    {
2615 do_multibyte:
2616 		ret = regnode(MULTIBYTECODE);
2617 		regmbc(c);
2618 		*flagp |= HASWIDTH | SIMPLE;
2619 		break;
2620 	    }
2621 
2622 	    ret = regnode(EXACTLY);
2623 
2624 	    /*
2625 	     * Append characters as long as:
2626 	     * - there is no following multi, we then need the character in
2627 	     *   front of it as a single character operand
2628 	     * - not running into a Magic character
2629 	     * - "one_exactly" is not set
2630 	     * But always emit at least one character.  Might be a Multi,
2631 	     * e.g., a "[" without matching "]".
2632 	     */
2633 	    for (len = 0; c != NUL && (len == 0
2634 			|| (re_multi_type(peekchr()) == NOT_MULTI
2635 			    && !one_exactly
2636 			    && !is_Magic(c))); ++len)
2637 	    {
2638 		c = no_Magic(c);
2639 		if (has_mbyte)
2640 		{
2641 		    regmbc(c);
2642 		    if (enc_utf8)
2643 		    {
2644 			int	l;
2645 
2646 			/* Need to get composing character too. */
2647 			for (;;)
2648 			{
2649 			    l = utf_ptr2len(regparse);
2650 			    if (!UTF_COMPOSINGLIKE(regparse, regparse + l))
2651 				break;
2652 			    regmbc(utf_ptr2char(regparse));
2653 			    skipchr();
2654 			}
2655 		    }
2656 		}
2657 		else
2658 		    regc(c);
2659 		c = getchr();
2660 	    }
2661 	    ungetchr();
2662 
2663 	    regc(NUL);
2664 	    *flagp |= HASWIDTH;
2665 	    if (len == 1)
2666 		*flagp |= SIMPLE;
2667 	}
2668 	break;
2669     }
2670 
2671     return ret;
2672 }
2673 
2674 /*
2675  * Return TRUE if MULTIBYTECODE should be used instead of EXACTLY for
2676  * character "c".
2677  */
2678     static int
2679 use_multibytecode(int c)
2680 {
2681     return has_mbyte && (*mb_char2len)(c) > 1
2682 		     && (re_multi_type(peekchr()) != NOT_MULTI
2683 			     || (enc_utf8 && utf_iscomposing(c)));
2684 }
2685 
2686 /*
2687  * Emit a node.
2688  * Return pointer to generated code.
2689  */
2690     static char_u *
2691 regnode(int op)
2692 {
2693     char_u  *ret;
2694 
2695     ret = regcode;
2696     if (ret == JUST_CALC_SIZE)
2697 	regsize += 3;
2698     else
2699     {
2700 	*regcode++ = op;
2701 	*regcode++ = NUL;		/* Null "next" pointer. */
2702 	*regcode++ = NUL;
2703     }
2704     return ret;
2705 }
2706 
2707 /*
2708  * Emit (if appropriate) a byte of code
2709  */
2710     static void
2711 regc(int b)
2712 {
2713     if (regcode == JUST_CALC_SIZE)
2714 	regsize++;
2715     else
2716 	*regcode++ = b;
2717 }
2718 
2719 /*
2720  * Emit (if appropriate) a multi-byte character of code
2721  */
2722     static void
2723 regmbc(int c)
2724 {
2725     if (!has_mbyte && c > 0xff)
2726 	return;
2727     if (regcode == JUST_CALC_SIZE)
2728 	regsize += (*mb_char2len)(c);
2729     else
2730 	regcode += (*mb_char2bytes)(c, regcode);
2731 }
2732 
2733 /*
2734  * Insert an operator in front of already-emitted operand
2735  *
2736  * Means relocating the operand.
2737  */
2738     static void
2739 reginsert(int op, char_u *opnd)
2740 {
2741     char_u	*src;
2742     char_u	*dst;
2743     char_u	*place;
2744 
2745     if (regcode == JUST_CALC_SIZE)
2746     {
2747 	regsize += 3;
2748 	return;
2749     }
2750     src = regcode;
2751     regcode += 3;
2752     dst = regcode;
2753     while (src > opnd)
2754 	*--dst = *--src;
2755 
2756     place = opnd;		/* Op node, where operand used to be. */
2757     *place++ = op;
2758     *place++ = NUL;
2759     *place = NUL;
2760 }
2761 
2762 /*
2763  * Insert an operator in front of already-emitted operand.
2764  * Add a number to the operator.
2765  */
2766     static void
2767 reginsert_nr(int op, long val, char_u *opnd)
2768 {
2769     char_u	*src;
2770     char_u	*dst;
2771     char_u	*place;
2772 
2773     if (regcode == JUST_CALC_SIZE)
2774     {
2775 	regsize += 7;
2776 	return;
2777     }
2778     src = regcode;
2779     regcode += 7;
2780     dst = regcode;
2781     while (src > opnd)
2782 	*--dst = *--src;
2783 
2784     place = opnd;		/* Op node, where operand used to be. */
2785     *place++ = op;
2786     *place++ = NUL;
2787     *place++ = NUL;
2788     place = re_put_long(place, (long_u)val);
2789 }
2790 
2791 /*
2792  * Insert an operator in front of already-emitted operand.
2793  * The operator has the given limit values as operands.  Also set next pointer.
2794  *
2795  * Means relocating the operand.
2796  */
2797     static void
2798 reginsert_limits(
2799     int		op,
2800     long	minval,
2801     long	maxval,
2802     char_u	*opnd)
2803 {
2804     char_u	*src;
2805     char_u	*dst;
2806     char_u	*place;
2807 
2808     if (regcode == JUST_CALC_SIZE)
2809     {
2810 	regsize += 11;
2811 	return;
2812     }
2813     src = regcode;
2814     regcode += 11;
2815     dst = regcode;
2816     while (src > opnd)
2817 	*--dst = *--src;
2818 
2819     place = opnd;		/* Op node, where operand used to be. */
2820     *place++ = op;
2821     *place++ = NUL;
2822     *place++ = NUL;
2823     place = re_put_long(place, (long_u)minval);
2824     place = re_put_long(place, (long_u)maxval);
2825     regtail(opnd, place);
2826 }
2827 
2828 /*
2829  * Write a long as four bytes at "p" and return pointer to the next char.
2830  */
2831     static char_u *
2832 re_put_long(char_u *p, long_u val)
2833 {
2834     *p++ = (char_u) ((val >> 24) & 0377);
2835     *p++ = (char_u) ((val >> 16) & 0377);
2836     *p++ = (char_u) ((val >> 8) & 0377);
2837     *p++ = (char_u) (val & 0377);
2838     return p;
2839 }
2840 
2841 /*
2842  * Set the next-pointer at the end of a node chain.
2843  */
2844     static void
2845 regtail(char_u *p, char_u *val)
2846 {
2847     char_u	*scan;
2848     char_u	*temp;
2849     int		offset;
2850 
2851     if (p == JUST_CALC_SIZE)
2852 	return;
2853 
2854     /* Find last node. */
2855     scan = p;
2856     for (;;)
2857     {
2858 	temp = regnext(scan);
2859 	if (temp == NULL)
2860 	    break;
2861 	scan = temp;
2862     }
2863 
2864     if (OP(scan) == BACK)
2865 	offset = (int)(scan - val);
2866     else
2867 	offset = (int)(val - scan);
2868     /* When the offset uses more than 16 bits it can no longer fit in the two
2869      * bytes available.  Use a global flag to avoid having to check return
2870      * values in too many places. */
2871     if (offset > 0xffff)
2872 	reg_toolong = TRUE;
2873     else
2874     {
2875 	*(scan + 1) = (char_u) (((unsigned)offset >> 8) & 0377);
2876 	*(scan + 2) = (char_u) (offset & 0377);
2877     }
2878 }
2879 
2880 /*
2881  * Like regtail, on item after a BRANCH; nop if none.
2882  */
2883     static void
2884 regoptail(char_u *p, char_u *val)
2885 {
2886     /* When op is neither BRANCH nor BRACE_COMPLEX0-9, it is "operandless" */
2887     if (p == NULL || p == JUST_CALC_SIZE
2888 	    || (OP(p) != BRANCH
2889 		&& (OP(p) < BRACE_COMPLEX || OP(p) > BRACE_COMPLEX + 9)))
2890 	return;
2891     regtail(OPERAND(p), val);
2892 }
2893 
2894 /*
2895  * Functions for getting characters from the regexp input.
2896  */
2897 /*
2898  * Start parsing at "str".
2899  */
2900     static void
2901 initchr(char_u *str)
2902 {
2903     regparse = str;
2904     prevchr_len = 0;
2905     curchr = prevprevchr = prevchr = nextchr = -1;
2906     at_start = TRUE;
2907     prev_at_start = FALSE;
2908 }
2909 
2910 /*
2911  * Save the current parse state, so that it can be restored and parsing
2912  * starts in the same state again.
2913  */
2914     static void
2915 save_parse_state(parse_state_T *ps)
2916 {
2917     ps->regparse = regparse;
2918     ps->prevchr_len = prevchr_len;
2919     ps->curchr = curchr;
2920     ps->prevchr = prevchr;
2921     ps->prevprevchr = prevprevchr;
2922     ps->nextchr = nextchr;
2923     ps->at_start = at_start;
2924     ps->prev_at_start = prev_at_start;
2925     ps->regnpar = regnpar;
2926 }
2927 
2928 /*
2929  * Restore a previously saved parse state.
2930  */
2931     static void
2932 restore_parse_state(parse_state_T *ps)
2933 {
2934     regparse = ps->regparse;
2935     prevchr_len = ps->prevchr_len;
2936     curchr = ps->curchr;
2937     prevchr = ps->prevchr;
2938     prevprevchr = ps->prevprevchr;
2939     nextchr = ps->nextchr;
2940     at_start = ps->at_start;
2941     prev_at_start = ps->prev_at_start;
2942     regnpar = ps->regnpar;
2943 }
2944 
2945 
2946 /*
2947  * Get the next character without advancing.
2948  */
2949     static int
2950 peekchr(void)
2951 {
2952     static int	after_slash = FALSE;
2953 
2954     if (curchr == -1)
2955     {
2956 	switch (curchr = regparse[0])
2957 	{
2958 	case '.':
2959 	case '[':
2960 	case '~':
2961 	    /* magic when 'magic' is on */
2962 	    if (reg_magic >= MAGIC_ON)
2963 		curchr = Magic(curchr);
2964 	    break;
2965 	case '(':
2966 	case ')':
2967 	case '{':
2968 	case '%':
2969 	case '+':
2970 	case '=':
2971 	case '?':
2972 	case '@':
2973 	case '!':
2974 	case '&':
2975 	case '|':
2976 	case '<':
2977 	case '>':
2978 	case '#':	/* future ext. */
2979 	case '"':	/* future ext. */
2980 	case '\'':	/* future ext. */
2981 	case ',':	/* future ext. */
2982 	case '-':	/* future ext. */
2983 	case ':':	/* future ext. */
2984 	case ';':	/* future ext. */
2985 	case '`':	/* future ext. */
2986 	case '/':	/* Can't be used in / command */
2987 	    /* magic only after "\v" */
2988 	    if (reg_magic == MAGIC_ALL)
2989 		curchr = Magic(curchr);
2990 	    break;
2991 	case '*':
2992 	    /* * is not magic as the very first character, eg "?*ptr", when
2993 	     * after '^', eg "/^*ptr" and when after "\(", "\|", "\&".  But
2994 	     * "\(\*" is not magic, thus must be magic if "after_slash" */
2995 	    if (reg_magic >= MAGIC_ON
2996 		    && !at_start
2997 		    && !(prev_at_start && prevchr == Magic('^'))
2998 		    && (after_slash
2999 			|| (prevchr != Magic('(')
3000 			    && prevchr != Magic('&')
3001 			    && prevchr != Magic('|'))))
3002 		curchr = Magic('*');
3003 	    break;
3004 	case '^':
3005 	    /* '^' is only magic as the very first character and if it's after
3006 	     * "\(", "\|", "\&' or "\n" */
3007 	    if (reg_magic >= MAGIC_OFF
3008 		    && (at_start
3009 			|| reg_magic == MAGIC_ALL
3010 			|| prevchr == Magic('(')
3011 			|| prevchr == Magic('|')
3012 			|| prevchr == Magic('&')
3013 			|| prevchr == Magic('n')
3014 			|| (no_Magic(prevchr) == '('
3015 			    && prevprevchr == Magic('%'))))
3016 	    {
3017 		curchr = Magic('^');
3018 		at_start = TRUE;
3019 		prev_at_start = FALSE;
3020 	    }
3021 	    break;
3022 	case '$':
3023 	    /* '$' is only magic as the very last char and if it's in front of
3024 	     * either "\|", "\)", "\&", or "\n" */
3025 	    if (reg_magic >= MAGIC_OFF)
3026 	    {
3027 		char_u *p = regparse + 1;
3028 		int is_magic_all = (reg_magic == MAGIC_ALL);
3029 
3030 		/* ignore \c \C \m \M \v \V and \Z after '$' */
3031 		while (p[0] == '\\' && (p[1] == 'c' || p[1] == 'C'
3032 				|| p[1] == 'm' || p[1] == 'M'
3033 				|| p[1] == 'v' || p[1] == 'V' || p[1] == 'Z'))
3034 		{
3035 		    if (p[1] == 'v')
3036 			is_magic_all = TRUE;
3037 		    else if (p[1] == 'm' || p[1] == 'M' || p[1] == 'V')
3038 			is_magic_all = FALSE;
3039 		    p += 2;
3040 		}
3041 		if (p[0] == NUL
3042 			|| (p[0] == '\\'
3043 			    && (p[1] == '|' || p[1] == '&' || p[1] == ')'
3044 				|| p[1] == 'n'))
3045 			|| (is_magic_all
3046 			       && (p[0] == '|' || p[0] == '&' || p[0] == ')'))
3047 			|| reg_magic == MAGIC_ALL)
3048 		    curchr = Magic('$');
3049 	    }
3050 	    break;
3051 	case '\\':
3052 	    {
3053 		int c = regparse[1];
3054 
3055 		if (c == NUL)
3056 		    curchr = '\\';	/* trailing '\' */
3057 		else if (
3058 #ifdef EBCDIC
3059 			vim_strchr(META, c)
3060 #else
3061 			c <= '~' && META_flags[c]
3062 #endif
3063 			)
3064 		{
3065 		    /*
3066 		     * META contains everything that may be magic sometimes,
3067 		     * except ^ and $ ("\^" and "\$" are only magic after
3068 		     * "\V").  We now fetch the next character and toggle its
3069 		     * magicness.  Therefore, \ is so meta-magic that it is
3070 		     * not in META.
3071 		     */
3072 		    curchr = -1;
3073 		    prev_at_start = at_start;
3074 		    at_start = FALSE;	/* be able to say "/\*ptr" */
3075 		    ++regparse;
3076 		    ++after_slash;
3077 		    peekchr();
3078 		    --regparse;
3079 		    --after_slash;
3080 		    curchr = toggle_Magic(curchr);
3081 		}
3082 		else if (vim_strchr(REGEXP_ABBR, c))
3083 		{
3084 		    /*
3085 		     * Handle abbreviations, like "\t" for TAB -- webb
3086 		     */
3087 		    curchr = backslash_trans(c);
3088 		}
3089 		else if (reg_magic == MAGIC_NONE && (c == '$' || c == '^'))
3090 		    curchr = toggle_Magic(c);
3091 		else
3092 		{
3093 		    /*
3094 		     * Next character can never be (made) magic?
3095 		     * Then backslashing it won't do anything.
3096 		     */
3097 		    if (has_mbyte)
3098 			curchr = (*mb_ptr2char)(regparse + 1);
3099 		    else
3100 			curchr = c;
3101 		}
3102 		break;
3103 	    }
3104 
3105 	default:
3106 	    if (has_mbyte)
3107 		curchr = (*mb_ptr2char)(regparse);
3108 	}
3109     }
3110 
3111     return curchr;
3112 }
3113 
3114 /*
3115  * Eat one lexed character.  Do this in a way that we can undo it.
3116  */
3117     static void
3118 skipchr(void)
3119 {
3120     /* peekchr() eats a backslash, do the same here */
3121     if (*regparse == '\\')
3122 	prevchr_len = 1;
3123     else
3124 	prevchr_len = 0;
3125     if (regparse[prevchr_len] != NUL)
3126     {
3127 	if (enc_utf8)
3128 	    /* exclude composing chars that mb_ptr2len does include */
3129 	    prevchr_len += utf_ptr2len(regparse + prevchr_len);
3130 	else if (has_mbyte)
3131 	    prevchr_len += (*mb_ptr2len)(regparse + prevchr_len);
3132 	else
3133 	    ++prevchr_len;
3134     }
3135     regparse += prevchr_len;
3136     prev_at_start = at_start;
3137     at_start = FALSE;
3138     prevprevchr = prevchr;
3139     prevchr = curchr;
3140     curchr = nextchr;	    /* use previously unget char, or -1 */
3141     nextchr = -1;
3142 }
3143 
3144 /*
3145  * Skip a character while keeping the value of prev_at_start for at_start.
3146  * prevchr and prevprevchr are also kept.
3147  */
3148     static void
3149 skipchr_keepstart(void)
3150 {
3151     int as = prev_at_start;
3152     int pr = prevchr;
3153     int prpr = prevprevchr;
3154 
3155     skipchr();
3156     at_start = as;
3157     prevchr = pr;
3158     prevprevchr = prpr;
3159 }
3160 
3161 /*
3162  * Get the next character from the pattern. We know about magic and such, so
3163  * therefore we need a lexical analyzer.
3164  */
3165     static int
3166 getchr(void)
3167 {
3168     int chr = peekchr();
3169 
3170     skipchr();
3171     return chr;
3172 }
3173 
3174 /*
3175  * put character back.  Works only once!
3176  */
3177     static void
3178 ungetchr(void)
3179 {
3180     nextchr = curchr;
3181     curchr = prevchr;
3182     prevchr = prevprevchr;
3183     at_start = prev_at_start;
3184     prev_at_start = FALSE;
3185 
3186     /* Backup regparse, so that it's at the same position as before the
3187      * getchr(). */
3188     regparse -= prevchr_len;
3189 }
3190 
3191 /*
3192  * Get and return the value of the hex string at the current position.
3193  * Return -1 if there is no valid hex number.
3194  * The position is updated:
3195  *     blahblah\%x20asdf
3196  *	   before-^ ^-after
3197  * The parameter controls the maximum number of input characters. This will be
3198  * 2 when reading a \%x20 sequence and 4 when reading a \%u20AC sequence.
3199  */
3200     static long
3201 gethexchrs(int maxinputlen)
3202 {
3203     long_u	nr = 0;
3204     int		c;
3205     int		i;
3206 
3207     for (i = 0; i < maxinputlen; ++i)
3208     {
3209 	c = regparse[0];
3210 	if (!vim_isxdigit(c))
3211 	    break;
3212 	nr <<= 4;
3213 	nr |= hex2nr(c);
3214 	++regparse;
3215     }
3216 
3217     if (i == 0)
3218 	return -1;
3219     return (long)nr;
3220 }
3221 
3222 /*
3223  * Get and return the value of the decimal string immediately after the
3224  * current position. Return -1 for invalid.  Consumes all digits.
3225  */
3226     static long
3227 getdecchrs(void)
3228 {
3229     long_u	nr = 0;
3230     int		c;
3231     int		i;
3232 
3233     for (i = 0; ; ++i)
3234     {
3235 	c = regparse[0];
3236 	if (c < '0' || c > '9')
3237 	    break;
3238 	nr *= 10;
3239 	nr += c - '0';
3240 	++regparse;
3241 	curchr = -1; /* no longer valid */
3242     }
3243 
3244     if (i == 0)
3245 	return -1;
3246     return (long)nr;
3247 }
3248 
3249 /*
3250  * get and return the value of the octal string immediately after the current
3251  * position. Return -1 for invalid, or 0-255 for valid. Smart enough to handle
3252  * numbers > 377 correctly (for example, 400 is treated as 40) and doesn't
3253  * treat 8 or 9 as recognised characters. Position is updated:
3254  *     blahblah\%o210asdf
3255  *	   before-^  ^-after
3256  */
3257     static long
3258 getoctchrs(void)
3259 {
3260     long_u	nr = 0;
3261     int		c;
3262     int		i;
3263 
3264     for (i = 0; i < 3 && nr < 040; ++i)
3265     {
3266 	c = regparse[0];
3267 	if (c < '0' || c > '7')
3268 	    break;
3269 	nr <<= 3;
3270 	nr |= hex2nr(c);
3271 	++regparse;
3272     }
3273 
3274     if (i == 0)
3275 	return -1;
3276     return (long)nr;
3277 }
3278 
3279 /*
3280  * Get a number after a backslash that is inside [].
3281  * When nothing is recognized return a backslash.
3282  */
3283     static int
3284 coll_get_char(void)
3285 {
3286     long	nr = -1;
3287 
3288     switch (*regparse++)
3289     {
3290 	case 'd': nr = getdecchrs(); break;
3291 	case 'o': nr = getoctchrs(); break;
3292 	case 'x': nr = gethexchrs(2); break;
3293 	case 'u': nr = gethexchrs(4); break;
3294 	case 'U': nr = gethexchrs(8); break;
3295     }
3296     if (nr < 0)
3297     {
3298 	/* If getting the number fails be backwards compatible: the character
3299 	 * is a backslash. */
3300 	--regparse;
3301 	nr = '\\';
3302     }
3303     return nr;
3304 }
3305 
3306 /*
3307  * read_limits - Read two integers to be taken as a minimum and maximum.
3308  * If the first character is '-', then the range is reversed.
3309  * Should end with 'end'.  If minval is missing, zero is default, if maxval is
3310  * missing, a very big number is the default.
3311  */
3312     static int
3313 read_limits(long *minval, long *maxval)
3314 {
3315     int		reverse = FALSE;
3316     char_u	*first_char;
3317     long	tmp;
3318 
3319     if (*regparse == '-')
3320     {
3321 	/* Starts with '-', so reverse the range later */
3322 	regparse++;
3323 	reverse = TRUE;
3324     }
3325     first_char = regparse;
3326     *minval = getdigits(&regparse);
3327     if (*regparse == ',')	    /* There is a comma */
3328     {
3329 	if (vim_isdigit(*++regparse))
3330 	    *maxval = getdigits(&regparse);
3331 	else
3332 	    *maxval = MAX_LIMIT;
3333     }
3334     else if (VIM_ISDIGIT(*first_char))
3335 	*maxval = *minval;	    /* It was \{n} or \{-n} */
3336     else
3337 	*maxval = MAX_LIMIT;	    /* It was \{} or \{-} */
3338     if (*regparse == '\\')
3339 	regparse++;	/* Allow either \{...} or \{...\} */
3340     if (*regparse != '}')
3341 	EMSG2_RET_FAIL(_("E554: Syntax error in %s{...}"),
3342 						       reg_magic == MAGIC_ALL);
3343 
3344     /*
3345      * Reverse the range if there was a '-', or make sure it is in the right
3346      * order otherwise.
3347      */
3348     if ((!reverse && *minval > *maxval) || (reverse && *minval < *maxval))
3349     {
3350 	tmp = *minval;
3351 	*minval = *maxval;
3352 	*maxval = tmp;
3353     }
3354     skipchr();		/* let's be friends with the lexer again */
3355     return OK;
3356 }
3357 
3358 /*
3359  * vim_regexec and friends
3360  */
3361 
3362 /*
3363  * Global work variables for vim_regexec().
3364  */
3365 
3366 /*
3367  * Structure used to save the current input state, when it needs to be
3368  * restored after trying a match.  Used by reg_save() and reg_restore().
3369  * Also stores the length of "backpos".
3370  */
3371 typedef struct
3372 {
3373     union
3374     {
3375 	char_u	*ptr;	/* rex.input pointer, for single-line regexp */
3376 	lpos_T	pos;	/* rex.input pos, for multi-line regexp */
3377     } rs_u;
3378     int		rs_len;
3379 } regsave_T;
3380 
3381 /* struct to save start/end pointer/position in for \(\) */
3382 typedef struct
3383 {
3384     union
3385     {
3386 	char_u	*ptr;
3387 	lpos_T	pos;
3388     } se_u;
3389 } save_se_T;
3390 
3391 /* used for BEHIND and NOBEHIND matching */
3392 typedef struct regbehind_S
3393 {
3394     regsave_T	save_after;
3395     regsave_T	save_behind;
3396     int		save_need_clear_subexpr;
3397     save_se_T   save_start[NSUBEXP];
3398     save_se_T   save_end[NSUBEXP];
3399 } regbehind_T;
3400 
3401 static long	bt_regexec_both(char_u *line, colnr_T col, proftime_T *tm, int *timed_out);
3402 static long	regtry(bt_regprog_T *prog, colnr_T col, proftime_T *tm, int *timed_out);
3403 static void	cleanup_subexpr(void);
3404 #ifdef FEAT_SYN_HL
3405 static void	cleanup_zsubexpr(void);
3406 #endif
3407 static void	save_subexpr(regbehind_T *bp);
3408 static void	restore_subexpr(regbehind_T *bp);
3409 static void	reg_nextline(void);
3410 static void	reg_save(regsave_T *save, garray_T *gap);
3411 static void	reg_restore(regsave_T *save, garray_T *gap);
3412 static int	reg_save_equal(regsave_T *save);
3413 static void	save_se_multi(save_se_T *savep, lpos_T *posp);
3414 static void	save_se_one(save_se_T *savep, char_u **pp);
3415 
3416 /* Save the sub-expressions before attempting a match. */
3417 #define save_se(savep, posp, pp) \
3418     REG_MULTI ? save_se_multi((savep), (posp)) : save_se_one((savep), (pp))
3419 
3420 /* After a failed match restore the sub-expressions. */
3421 #define restore_se(savep, posp, pp) { \
3422     if (REG_MULTI) \
3423 	*(posp) = (savep)->se_u.pos; \
3424     else \
3425 	*(pp) = (savep)->se_u.ptr; }
3426 
3427 static int	re_num_cmp(long_u val, char_u *scan);
3428 static int	match_with_backref(linenr_T start_lnum, colnr_T start_col, linenr_T end_lnum, colnr_T end_col, int *bytelen);
3429 static int	regmatch(char_u *prog, proftime_T *tm, int *timed_out);
3430 static int	regrepeat(char_u *p, long maxcount);
3431 
3432 #ifdef DEBUG
3433 int		regnarrate = 0;
3434 #endif
3435 
3436 /*
3437  * Sometimes need to save a copy of a line.  Since alloc()/free() is very
3438  * slow, we keep one allocated piece of memory and only re-allocate it when
3439  * it's too small.  It's freed in bt_regexec_both() when finished.
3440  */
3441 static char_u	*reg_tofree = NULL;
3442 static unsigned	reg_tofreelen;
3443 
3444 /*
3445  * Structure used to store the execution state of the regex engine.
3446  * Which ones are set depends on whether a single-line or multi-line match is
3447  * done:
3448  *			single-line		multi-line
3449  * reg_match		&regmatch_T		NULL
3450  * reg_mmatch		NULL			&regmmatch_T
3451  * reg_startp		reg_match->startp	<invalid>
3452  * reg_endp		reg_match->endp		<invalid>
3453  * reg_startpos		<invalid>		reg_mmatch->startpos
3454  * reg_endpos		<invalid>		reg_mmatch->endpos
3455  * reg_win		NULL			window in which to search
3456  * reg_buf		curbuf			buffer in which to search
3457  * reg_firstlnum	<invalid>		first line in which to search
3458  * reg_maxline		0			last line nr
3459  * reg_line_lbr		FALSE or TRUE		FALSE
3460  */
3461 typedef struct {
3462     regmatch_T		*reg_match;
3463     regmmatch_T		*reg_mmatch;
3464     char_u		**reg_startp;
3465     char_u		**reg_endp;
3466     lpos_T		*reg_startpos;
3467     lpos_T		*reg_endpos;
3468     win_T		*reg_win;
3469     buf_T		*reg_buf;
3470     linenr_T		reg_firstlnum;
3471     linenr_T		reg_maxline;
3472     int			reg_line_lbr;	/* "\n" in string is line break */
3473 
3474     // The current match-position is stord in these variables:
3475     linenr_T	lnum;		// line number, relative to first line
3476     char_u	*line;		// start of current line
3477     char_u	*input;		// current input, points into "regline"
3478 
3479     int	need_clear_subexpr;	// subexpressions still need to be cleared
3480 #ifdef FEAT_SYN_HL
3481     int	need_clear_zsubexpr;	// extmatch subexpressions still need to be
3482 				// cleared
3483 #endif
3484 
3485     /* Internal copy of 'ignorecase'.  It is set at each call to vim_regexec().
3486      * Normally it gets the value of "rm_ic" or "rmm_ic", but when the pattern
3487      * contains '\c' or '\C' the value is overruled. */
3488     int			reg_ic;
3489 
3490     /* Similar to "reg_ic", but only for 'combining' characters.  Set with \Z
3491      * flag in the regexp.  Defaults to false, always. */
3492     int			reg_icombine;
3493 
3494     /* Copy of "rmm_maxcol": maximum column to search for a match.  Zero when
3495      * there is no maximum. */
3496     colnr_T		reg_maxcol;
3497 
3498     // State for the NFA engine regexec.
3499     int nfa_has_zend;	    // NFA regexp \ze operator encountered.
3500     int nfa_has_backref;    // NFA regexp \1 .. \9 encountered.
3501     int nfa_nsubexpr;	    // Number of sub expressions actually being used
3502 			    // during execution. 1 if only the whole match
3503 			    // (subexpr 0) is used.
3504     // listid is global, so that it increases on recursive calls to
3505     // nfa_regmatch(), which means we don't have to clear the lastlist field of
3506     // all the states.
3507     int nfa_listid;
3508     int nfa_alt_listid;
3509 
3510 #ifdef FEAT_SYN_HL
3511     int nfa_has_zsubexpr;   // NFA regexp has \z( ), set zsubexpr.
3512 #endif
3513 } regexec_T;
3514 
3515 static regexec_T	rex;
3516 static int		rex_in_use = FALSE;
3517 
3518 
3519 /* Values for rs_state in regitem_T. */
3520 typedef enum regstate_E
3521 {
3522     RS_NOPEN = 0	/* NOPEN and NCLOSE */
3523     , RS_MOPEN		/* MOPEN + [0-9] */
3524     , RS_MCLOSE		/* MCLOSE + [0-9] */
3525 #ifdef FEAT_SYN_HL
3526     , RS_ZOPEN		/* ZOPEN + [0-9] */
3527     , RS_ZCLOSE		/* ZCLOSE + [0-9] */
3528 #endif
3529     , RS_BRANCH		/* BRANCH */
3530     , RS_BRCPLX_MORE	/* BRACE_COMPLEX and trying one more match */
3531     , RS_BRCPLX_LONG	/* BRACE_COMPLEX and trying longest match */
3532     , RS_BRCPLX_SHORT	/* BRACE_COMPLEX and trying shortest match */
3533     , RS_NOMATCH	/* NOMATCH */
3534     , RS_BEHIND1	/* BEHIND / NOBEHIND matching rest */
3535     , RS_BEHIND2	/* BEHIND / NOBEHIND matching behind part */
3536     , RS_STAR_LONG	/* STAR/PLUS/BRACE_SIMPLE longest match */
3537     , RS_STAR_SHORT	/* STAR/PLUS/BRACE_SIMPLE shortest match */
3538 } regstate_T;
3539 
3540 /*
3541  * When there are alternatives a regstate_T is put on the regstack to remember
3542  * what we are doing.
3543  * Before it may be another type of item, depending on rs_state, to remember
3544  * more things.
3545  */
3546 typedef struct regitem_S
3547 {
3548     regstate_T	rs_state;	/* what we are doing, one of RS_ above */
3549     char_u	*rs_scan;	/* current node in program */
3550     union
3551     {
3552 	save_se_T  sesave;
3553 	regsave_T  regsave;
3554     } rs_un;			/* room for saving rex.input */
3555     short	rs_no;		/* submatch nr or BEHIND/NOBEHIND */
3556 } regitem_T;
3557 
3558 static regitem_T *regstack_push(regstate_T state, char_u *scan);
3559 static void regstack_pop(char_u **scan);
3560 
3561 /* used for STAR, PLUS and BRACE_SIMPLE matching */
3562 typedef struct regstar_S
3563 {
3564     int		nextb;		/* next byte */
3565     int		nextb_ic;	/* next byte reverse case */
3566     long	count;
3567     long	minval;
3568     long	maxval;
3569 } regstar_T;
3570 
3571 /* used to store input position when a BACK was encountered, so that we now if
3572  * we made any progress since the last time. */
3573 typedef struct backpos_S
3574 {
3575     char_u	*bp_scan;	/* "scan" where BACK was encountered */
3576     regsave_T	bp_pos;		/* last input position */
3577 } backpos_T;
3578 
3579 /*
3580  * "regstack" and "backpos" are used by regmatch().  They are kept over calls
3581  * to avoid invoking malloc() and free() often.
3582  * "regstack" is a stack with regitem_T items, sometimes preceded by regstar_T
3583  * or regbehind_T.
3584  * "backpos_T" is a table with backpos_T for BACK
3585  */
3586 static garray_T	regstack = {0, 0, 0, 0, NULL};
3587 static garray_T	backpos = {0, 0, 0, 0, NULL};
3588 
3589 /*
3590  * Both for regstack and backpos tables we use the following strategy of
3591  * allocation (to reduce malloc/free calls):
3592  * - Initial size is fairly small.
3593  * - When needed, the tables are grown bigger (8 times at first, double after
3594  *   that).
3595  * - After executing the match we free the memory only if the array has grown.
3596  *   Thus the memory is kept allocated when it's at the initial size.
3597  * This makes it fast while not keeping a lot of memory allocated.
3598  * A three times speed increase was observed when using many simple patterns.
3599  */
3600 #define REGSTACK_INITIAL	2048
3601 #define BACKPOS_INITIAL		64
3602 
3603 #if defined(EXITFREE) || defined(PROTO)
3604     void
3605 free_regexp_stuff(void)
3606 {
3607     ga_clear(&regstack);
3608     ga_clear(&backpos);
3609     vim_free(reg_tofree);
3610     vim_free(reg_prev_sub);
3611 }
3612 #endif
3613 
3614 /*
3615  * Return TRUE if character 'c' is included in 'iskeyword' option for
3616  * "reg_buf" buffer.
3617  */
3618     static int
3619 reg_iswordc(int c)
3620 {
3621     return vim_iswordc_buf(c, rex.reg_buf);
3622 }
3623 
3624 /*
3625  * Get pointer to the line "lnum", which is relative to "reg_firstlnum".
3626  */
3627     static char_u *
3628 reg_getline(linenr_T lnum)
3629 {
3630     /* when looking behind for a match/no-match lnum is negative.  But we
3631      * can't go before line 1 */
3632     if (rex.reg_firstlnum + lnum < 1)
3633 	return NULL;
3634     if (lnum > rex.reg_maxline)
3635 	/* Must have matched the "\n" in the last line. */
3636 	return (char_u *)"";
3637     return ml_get_buf(rex.reg_buf, rex.reg_firstlnum + lnum, FALSE);
3638 }
3639 
3640 static regsave_T behind_pos;
3641 
3642 #ifdef FEAT_SYN_HL
3643 static char_u	*reg_startzp[NSUBEXP];	/* Workspace to mark beginning */
3644 static char_u	*reg_endzp[NSUBEXP];	/*   and end of \z(...\) matches */
3645 static lpos_T	reg_startzpos[NSUBEXP];	/* idem, beginning pos */
3646 static lpos_T	reg_endzpos[NSUBEXP];	/* idem, end pos */
3647 #endif
3648 
3649 /* TRUE if using multi-line regexp. */
3650 #define REG_MULTI	(rex.reg_match == NULL)
3651 
3652 /*
3653  * Match a regexp against a string.
3654  * "rmp->regprog" is a compiled regexp as returned by vim_regcomp().
3655  * Uses curbuf for line count and 'iskeyword'.
3656  * if "line_lbr" is TRUE  consider a "\n" in "line" to be a line break.
3657  *
3658  * Returns 0 for failure, number of lines contained in the match otherwise.
3659  */
3660     static int
3661 bt_regexec_nl(
3662     regmatch_T	*rmp,
3663     char_u	*line,	/* string to match against */
3664     colnr_T	col,	/* column to start looking for match */
3665     int		line_lbr)
3666 {
3667     rex.reg_match = rmp;
3668     rex.reg_mmatch = NULL;
3669     rex.reg_maxline = 0;
3670     rex.reg_line_lbr = line_lbr;
3671     rex.reg_buf = curbuf;
3672     rex.reg_win = NULL;
3673     rex.reg_ic = rmp->rm_ic;
3674     rex.reg_icombine = FALSE;
3675     rex.reg_maxcol = 0;
3676 
3677     return bt_regexec_both(line, col, NULL, NULL);
3678 }
3679 
3680 /*
3681  * Match a regexp against multiple lines.
3682  * "rmp->regprog" is a compiled regexp as returned by vim_regcomp().
3683  * Uses curbuf for line count and 'iskeyword'.
3684  *
3685  * Return zero if there is no match.  Return number of lines contained in the
3686  * match otherwise.
3687  */
3688     static long
3689 bt_regexec_multi(
3690     regmmatch_T	*rmp,
3691     win_T	*win,		/* window in which to search or NULL */
3692     buf_T	*buf,		/* buffer in which to search */
3693     linenr_T	lnum,		/* nr of line to start looking for match */
3694     colnr_T	col,		/* column to start looking for match */
3695     proftime_T	*tm,		/* timeout limit or NULL */
3696     int		*timed_out)	/* flag set on timeout or NULL */
3697 {
3698     rex.reg_match = NULL;
3699     rex.reg_mmatch = rmp;
3700     rex.reg_buf = buf;
3701     rex.reg_win = win;
3702     rex.reg_firstlnum = lnum;
3703     rex.reg_maxline = rex.reg_buf->b_ml.ml_line_count - lnum;
3704     rex.reg_line_lbr = FALSE;
3705     rex.reg_ic = rmp->rmm_ic;
3706     rex.reg_icombine = FALSE;
3707     rex.reg_maxcol = rmp->rmm_maxcol;
3708 
3709     return bt_regexec_both(NULL, col, tm, timed_out);
3710 }
3711 
3712 /*
3713  * Match a regexp against a string ("line" points to the string) or multiple
3714  * lines ("line" is NULL, use reg_getline()).
3715  * Returns 0 for failure, number of lines contained in the match otherwise.
3716  */
3717     static long
3718 bt_regexec_both(
3719     char_u	*line,
3720     colnr_T	col,		/* column to start looking for match */
3721     proftime_T	*tm,		/* timeout limit or NULL */
3722     int		*timed_out)	/* flag set on timeout or NULL */
3723 {
3724     bt_regprog_T    *prog;
3725     char_u	    *s;
3726     long	    retval = 0L;
3727 
3728     /* Create "regstack" and "backpos" if they are not allocated yet.
3729      * We allocate *_INITIAL amount of bytes first and then set the grow size
3730      * to much bigger value to avoid many malloc calls in case of deep regular
3731      * expressions.  */
3732     if (regstack.ga_data == NULL)
3733     {
3734 	/* Use an item size of 1 byte, since we push different things
3735 	 * onto the regstack. */
3736 	ga_init2(&regstack, 1, REGSTACK_INITIAL);
3737 	(void)ga_grow(&regstack, REGSTACK_INITIAL);
3738 	regstack.ga_growsize = REGSTACK_INITIAL * 8;
3739     }
3740 
3741     if (backpos.ga_data == NULL)
3742     {
3743 	ga_init2(&backpos, sizeof(backpos_T), BACKPOS_INITIAL);
3744 	(void)ga_grow(&backpos, BACKPOS_INITIAL);
3745 	backpos.ga_growsize = BACKPOS_INITIAL * 8;
3746     }
3747 
3748     if (REG_MULTI)
3749     {
3750 	prog = (bt_regprog_T *)rex.reg_mmatch->regprog;
3751 	line = reg_getline((linenr_T)0);
3752 	rex.reg_startpos = rex.reg_mmatch->startpos;
3753 	rex.reg_endpos = rex.reg_mmatch->endpos;
3754     }
3755     else
3756     {
3757 	prog = (bt_regprog_T *)rex.reg_match->regprog;
3758 	rex.reg_startp = rex.reg_match->startp;
3759 	rex.reg_endp = rex.reg_match->endp;
3760     }
3761 
3762     /* Be paranoid... */
3763     if (prog == NULL || line == NULL)
3764     {
3765 	emsg(_(e_null));
3766 	goto theend;
3767     }
3768 
3769     /* Check validity of program. */
3770     if (prog_magic_wrong())
3771 	goto theend;
3772 
3773     /* If the start column is past the maximum column: no need to try. */
3774     if (rex.reg_maxcol > 0 && col >= rex.reg_maxcol)
3775 	goto theend;
3776 
3777     /* If pattern contains "\c" or "\C": overrule value of rex.reg_ic */
3778     if (prog->regflags & RF_ICASE)
3779 	rex.reg_ic = TRUE;
3780     else if (prog->regflags & RF_NOICASE)
3781 	rex.reg_ic = FALSE;
3782 
3783     /* If pattern contains "\Z" overrule value of rex.reg_icombine */
3784     if (prog->regflags & RF_ICOMBINE)
3785 	rex.reg_icombine = TRUE;
3786 
3787     /* If there is a "must appear" string, look for it. */
3788     if (prog->regmust != NULL)
3789     {
3790 	int c;
3791 
3792 	if (has_mbyte)
3793 	    c = (*mb_ptr2char)(prog->regmust);
3794 	else
3795 	    c = *prog->regmust;
3796 	s = line + col;
3797 
3798 	/*
3799 	 * This is used very often, esp. for ":global".  Use three versions of
3800 	 * the loop to avoid overhead of conditions.
3801 	 */
3802 	if (!rex.reg_ic && !has_mbyte)
3803 	    while ((s = vim_strbyte(s, c)) != NULL)
3804 	    {
3805 		if (cstrncmp(s, prog->regmust, &prog->regmlen) == 0)
3806 		    break;		/* Found it. */
3807 		++s;
3808 	    }
3809 	else if (!rex.reg_ic || (!enc_utf8 && mb_char2len(c) > 1))
3810 	    while ((s = vim_strchr(s, c)) != NULL)
3811 	    {
3812 		if (cstrncmp(s, prog->regmust, &prog->regmlen) == 0)
3813 		    break;		/* Found it. */
3814 		MB_PTR_ADV(s);
3815 	    }
3816 	else
3817 	    while ((s = cstrchr(s, c)) != NULL)
3818 	    {
3819 		if (cstrncmp(s, prog->regmust, &prog->regmlen) == 0)
3820 		    break;		/* Found it. */
3821 		MB_PTR_ADV(s);
3822 	    }
3823 	if (s == NULL)		/* Not present. */
3824 	    goto theend;
3825     }
3826 
3827     rex.line = line;
3828     rex.lnum = 0;
3829     reg_toolong = FALSE;
3830 
3831     /* Simplest case: Anchored match need be tried only once. */
3832     if (prog->reganch)
3833     {
3834 	int	c;
3835 
3836 	if (has_mbyte)
3837 	    c = (*mb_ptr2char)(rex.line + col);
3838 	else
3839 	    c = rex.line[col];
3840 	if (prog->regstart == NUL
3841 		|| prog->regstart == c
3842 		|| (rex.reg_ic
3843 		    && (((enc_utf8 && utf_fold(prog->regstart) == utf_fold(c)))
3844 			|| (c < 255 && prog->regstart < 255 &&
3845 			    MB_TOLOWER(prog->regstart) == MB_TOLOWER(c)))))
3846 	    retval = regtry(prog, col, tm, timed_out);
3847 	else
3848 	    retval = 0;
3849     }
3850     else
3851     {
3852 #ifdef FEAT_RELTIME
3853 	int tm_count = 0;
3854 #endif
3855 	/* Messy cases:  unanchored match. */
3856 	while (!got_int)
3857 	{
3858 	    if (prog->regstart != NUL)
3859 	    {
3860 		/* Skip until the char we know it must start with.
3861 		 * Used often, do some work to avoid call overhead. */
3862 		if (!rex.reg_ic && !has_mbyte)
3863 		    s = vim_strbyte(rex.line + col, prog->regstart);
3864 		else
3865 		    s = cstrchr(rex.line + col, prog->regstart);
3866 		if (s == NULL)
3867 		{
3868 		    retval = 0;
3869 		    break;
3870 		}
3871 		col = (int)(s - rex.line);
3872 	    }
3873 
3874 	    /* Check for maximum column to try. */
3875 	    if (rex.reg_maxcol > 0 && col >= rex.reg_maxcol)
3876 	    {
3877 		retval = 0;
3878 		break;
3879 	    }
3880 
3881 	    retval = regtry(prog, col, tm, timed_out);
3882 	    if (retval > 0)
3883 		break;
3884 
3885 	    /* if not currently on the first line, get it again */
3886 	    if (rex.lnum != 0)
3887 	    {
3888 		rex.lnum = 0;
3889 		rex.line = reg_getline((linenr_T)0);
3890 	    }
3891 	    if (rex.line[col] == NUL)
3892 		break;
3893 	    if (has_mbyte)
3894 		col += (*mb_ptr2len)(rex.line + col);
3895 	    else
3896 		++col;
3897 #ifdef FEAT_RELTIME
3898 	    /* Check for timeout once in a twenty times to avoid overhead. */
3899 	    if (tm != NULL && ++tm_count == 20)
3900 	    {
3901 		tm_count = 0;
3902 		if (profile_passed_limit(tm))
3903 		{
3904 		    if (timed_out != NULL)
3905 			*timed_out = TRUE;
3906 		    break;
3907 		}
3908 	    }
3909 #endif
3910 	}
3911     }
3912 
3913 theend:
3914     /* Free "reg_tofree" when it's a bit big.
3915      * Free regstack and backpos if they are bigger than their initial size. */
3916     if (reg_tofreelen > 400)
3917 	VIM_CLEAR(reg_tofree);
3918     if (regstack.ga_maxlen > REGSTACK_INITIAL)
3919 	ga_clear(&regstack);
3920     if (backpos.ga_maxlen > BACKPOS_INITIAL)
3921 	ga_clear(&backpos);
3922 
3923     return retval;
3924 }
3925 
3926 #ifdef FEAT_SYN_HL
3927 /*
3928  * Create a new extmatch and mark it as referenced once.
3929  */
3930     static reg_extmatch_T *
3931 make_extmatch(void)
3932 {
3933     reg_extmatch_T	*em;
3934 
3935     em = (reg_extmatch_T *)alloc_clear((unsigned)sizeof(reg_extmatch_T));
3936     if (em != NULL)
3937 	em->refcnt = 1;
3938     return em;
3939 }
3940 
3941 /*
3942  * Add a reference to an extmatch.
3943  */
3944     reg_extmatch_T *
3945 ref_extmatch(reg_extmatch_T *em)
3946 {
3947     if (em != NULL)
3948 	em->refcnt++;
3949     return em;
3950 }
3951 
3952 /*
3953  * Remove a reference to an extmatch.  If there are no references left, free
3954  * the info.
3955  */
3956     void
3957 unref_extmatch(reg_extmatch_T *em)
3958 {
3959     int i;
3960 
3961     if (em != NULL && --em->refcnt <= 0)
3962     {
3963 	for (i = 0; i < NSUBEXP; ++i)
3964 	    vim_free(em->matches[i]);
3965 	vim_free(em);
3966     }
3967 }
3968 #endif
3969 
3970 /*
3971  * regtry - try match of "prog" with at rex.line["col"].
3972  * Returns 0 for failure, number of lines contained in the match otherwise.
3973  */
3974     static long
3975 regtry(
3976     bt_regprog_T	*prog,
3977     colnr_T		col,
3978     proftime_T		*tm,		/* timeout limit or NULL */
3979     int			*timed_out)	/* flag set on timeout or NULL */
3980 {
3981     rex.input = rex.line + col;
3982     rex.need_clear_subexpr = TRUE;
3983 #ifdef FEAT_SYN_HL
3984     // Clear the external match subpointers if necessary.
3985     rex.need_clear_zsubexpr = (prog->reghasz == REX_SET);
3986 #endif
3987 
3988     if (regmatch(prog->program + 1, tm, timed_out) == 0)
3989 	return 0;
3990 
3991     cleanup_subexpr();
3992     if (REG_MULTI)
3993     {
3994 	if (rex.reg_startpos[0].lnum < 0)
3995 	{
3996 	    rex.reg_startpos[0].lnum = 0;
3997 	    rex.reg_startpos[0].col = col;
3998 	}
3999 	if (rex.reg_endpos[0].lnum < 0)
4000 	{
4001 	    rex.reg_endpos[0].lnum = rex.lnum;
4002 	    rex.reg_endpos[0].col = (int)(rex.input - rex.line);
4003 	}
4004 	else
4005 	    /* Use line number of "\ze". */
4006 	    rex.lnum = rex.reg_endpos[0].lnum;
4007     }
4008     else
4009     {
4010 	if (rex.reg_startp[0] == NULL)
4011 	    rex.reg_startp[0] = rex.line + col;
4012 	if (rex.reg_endp[0] == NULL)
4013 	    rex.reg_endp[0] = rex.input;
4014     }
4015 #ifdef FEAT_SYN_HL
4016     /* Package any found \z(...\) matches for export. Default is none. */
4017     unref_extmatch(re_extmatch_out);
4018     re_extmatch_out = NULL;
4019 
4020     if (prog->reghasz == REX_SET)
4021     {
4022 	int		i;
4023 
4024 	cleanup_zsubexpr();
4025 	re_extmatch_out = make_extmatch();
4026 	for (i = 0; i < NSUBEXP; i++)
4027 	{
4028 	    if (REG_MULTI)
4029 	    {
4030 		/* Only accept single line matches. */
4031 		if (reg_startzpos[i].lnum >= 0
4032 			&& reg_endzpos[i].lnum == reg_startzpos[i].lnum
4033 			&& reg_endzpos[i].col >= reg_startzpos[i].col)
4034 		    re_extmatch_out->matches[i] =
4035 			vim_strnsave(reg_getline(reg_startzpos[i].lnum)
4036 						       + reg_startzpos[i].col,
4037 				   reg_endzpos[i].col - reg_startzpos[i].col);
4038 	    }
4039 	    else
4040 	    {
4041 		if (reg_startzp[i] != NULL && reg_endzp[i] != NULL)
4042 		    re_extmatch_out->matches[i] =
4043 			    vim_strnsave(reg_startzp[i],
4044 					(int)(reg_endzp[i] - reg_startzp[i]));
4045 	    }
4046 	}
4047     }
4048 #endif
4049     return 1 + rex.lnum;
4050 }
4051 
4052 /*
4053  * Get class of previous character.
4054  */
4055     static int
4056 reg_prev_class(void)
4057 {
4058     if (rex.input > rex.line)
4059 	return mb_get_class_buf(rex.input - 1
4060 		       - (*mb_head_off)(rex.line, rex.input - 1), rex.reg_buf);
4061     return -1;
4062 }
4063 
4064 /*
4065  * Return TRUE if the current rex.input position matches the Visual area.
4066  */
4067     static int
4068 reg_match_visual(void)
4069 {
4070     pos_T	top, bot;
4071     linenr_T    lnum;
4072     colnr_T	col;
4073     win_T	*wp = rex.reg_win == NULL ? curwin : rex.reg_win;
4074     int		mode;
4075     colnr_T	start, end;
4076     colnr_T	start2, end2;
4077     colnr_T	cols;
4078 
4079     /* Check if the buffer is the current buffer. */
4080     if (rex.reg_buf != curbuf || VIsual.lnum == 0)
4081 	return FALSE;
4082 
4083     if (VIsual_active)
4084     {
4085 	if (LT_POS(VIsual, wp->w_cursor))
4086 	{
4087 	    top = VIsual;
4088 	    bot = wp->w_cursor;
4089 	}
4090 	else
4091 	{
4092 	    top = wp->w_cursor;
4093 	    bot = VIsual;
4094 	}
4095 	mode = VIsual_mode;
4096     }
4097     else
4098     {
4099 	if (LT_POS(curbuf->b_visual.vi_start, curbuf->b_visual.vi_end))
4100 	{
4101 	    top = curbuf->b_visual.vi_start;
4102 	    bot = curbuf->b_visual.vi_end;
4103 	}
4104 	else
4105 	{
4106 	    top = curbuf->b_visual.vi_end;
4107 	    bot = curbuf->b_visual.vi_start;
4108 	}
4109 	mode = curbuf->b_visual.vi_mode;
4110     }
4111     lnum = rex.lnum + rex.reg_firstlnum;
4112     if (lnum < top.lnum || lnum > bot.lnum)
4113 	return FALSE;
4114 
4115     if (mode == 'v')
4116     {
4117 	col = (colnr_T)(rex.input - rex.line);
4118 	if ((lnum == top.lnum && col < top.col)
4119 		|| (lnum == bot.lnum && col >= bot.col + (*p_sel != 'e')))
4120 	    return FALSE;
4121     }
4122     else if (mode == Ctrl_V)
4123     {
4124 	getvvcol(wp, &top, &start, NULL, &end);
4125 	getvvcol(wp, &bot, &start2, NULL, &end2);
4126 	if (start2 < start)
4127 	    start = start2;
4128 	if (end2 > end)
4129 	    end = end2;
4130 	if (top.col == MAXCOL || bot.col == MAXCOL)
4131 	    end = MAXCOL;
4132 	cols = win_linetabsize(wp, rex.line, (colnr_T)(rex.input - rex.line));
4133 	if (cols < start || cols > end - (*p_sel == 'e'))
4134 	    return FALSE;
4135     }
4136     return TRUE;
4137 }
4138 
4139 #define ADVANCE_REGINPUT() MB_PTR_ADV(rex.input)
4140 
4141 /*
4142  * The arguments from BRACE_LIMITS are stored here.  They are actually local
4143  * to regmatch(), but they are here to reduce the amount of stack space used
4144  * (it can be called recursively many times).
4145  */
4146 static long	bl_minval;
4147 static long	bl_maxval;
4148 
4149 /*
4150  * regmatch - main matching routine
4151  *
4152  * Conceptually the strategy is simple: Check to see whether the current node
4153  * matches, push an item onto the regstack and loop to see whether the rest
4154  * matches, and then act accordingly.  In practice we make some effort to
4155  * avoid using the regstack, in particular by going through "ordinary" nodes
4156  * (that don't need to know whether the rest of the match failed) by a nested
4157  * loop.
4158  *
4159  * Returns TRUE when there is a match.  Leaves rex.input and rex.lnum just after
4160  * the last matched character.
4161  * Returns FALSE when there is no match.  Leaves rex.input and rex.lnum in an
4162  * undefined state!
4163  */
4164     static int
4165 regmatch(
4166     char_u	*scan,		    /* Current node. */
4167     proftime_T	*tm UNUSED,	    /* timeout limit or NULL */
4168     int		*timed_out UNUSED)  /* flag set on timeout or NULL */
4169 {
4170   char_u	*next;		/* Next node. */
4171   int		op;
4172   int		c;
4173   regitem_T	*rp;
4174   int		no;
4175   int		status;		/* one of the RA_ values: */
4176 #define RA_FAIL		1	/* something failed, abort */
4177 #define RA_CONT		2	/* continue in inner loop */
4178 #define RA_BREAK	3	/* break inner loop */
4179 #define RA_MATCH	4	/* successful match */
4180 #define RA_NOMATCH	5	/* didn't match */
4181 #ifdef FEAT_RELTIME
4182   int		tm_count = 0;
4183 #endif
4184 
4185   /* Make "regstack" and "backpos" empty.  They are allocated and freed in
4186    * bt_regexec_both() to reduce malloc()/free() calls. */
4187   regstack.ga_len = 0;
4188   backpos.ga_len = 0;
4189 
4190   /*
4191    * Repeat until "regstack" is empty.
4192    */
4193   for (;;)
4194   {
4195     /* Some patterns may take a long time to match, e.g., "\([a-z]\+\)\+Q".
4196      * Allow interrupting them with CTRL-C. */
4197     fast_breakcheck();
4198 
4199 #ifdef DEBUG
4200     if (scan != NULL && regnarrate)
4201     {
4202 	mch_errmsg((char *)regprop(scan));
4203 	mch_errmsg("(\n");
4204     }
4205 #endif
4206 
4207     /*
4208      * Repeat for items that can be matched sequentially, without using the
4209      * regstack.
4210      */
4211     for (;;)
4212     {
4213 	if (got_int || scan == NULL)
4214 	{
4215 	    status = RA_FAIL;
4216 	    break;
4217 	}
4218 #ifdef FEAT_RELTIME
4219 	/* Check for timeout once in a 100 times to avoid overhead. */
4220 	if (tm != NULL && ++tm_count == 100)
4221 	{
4222 	    tm_count = 0;
4223 	    if (profile_passed_limit(tm))
4224 	    {
4225 		if (timed_out != NULL)
4226 		    *timed_out = TRUE;
4227 		status = RA_FAIL;
4228 		break;
4229 	    }
4230 	}
4231 #endif
4232 	status = RA_CONT;
4233 
4234 #ifdef DEBUG
4235 	if (regnarrate)
4236 	{
4237 	    mch_errmsg((char *)regprop(scan));
4238 	    mch_errmsg("...\n");
4239 # ifdef FEAT_SYN_HL
4240 	    if (re_extmatch_in != NULL)
4241 	    {
4242 		int i;
4243 
4244 		mch_errmsg(_("External submatches:\n"));
4245 		for (i = 0; i < NSUBEXP; i++)
4246 		{
4247 		    mch_errmsg("    \"");
4248 		    if (re_extmatch_in->matches[i] != NULL)
4249 			mch_errmsg((char *)re_extmatch_in->matches[i]);
4250 		    mch_errmsg("\"\n");
4251 		}
4252 	    }
4253 # endif
4254 	}
4255 #endif
4256 	next = regnext(scan);
4257 
4258 	op = OP(scan);
4259 	/* Check for character class with NL added. */
4260 	if (!rex.reg_line_lbr && WITH_NL(op) && REG_MULTI
4261 			     && *rex.input == NUL && rex.lnum <= rex.reg_maxline)
4262 	{
4263 	    reg_nextline();
4264 	}
4265 	else if (rex.reg_line_lbr && WITH_NL(op) && *rex.input == '\n')
4266 	{
4267 	    ADVANCE_REGINPUT();
4268 	}
4269 	else
4270 	{
4271 	  if (WITH_NL(op))
4272 	      op -= ADD_NL;
4273 	  if (has_mbyte)
4274 	      c = (*mb_ptr2char)(rex.input);
4275 	  else
4276 	      c = *rex.input;
4277 	  switch (op)
4278 	  {
4279 	  case BOL:
4280 	    if (rex.input != rex.line)
4281 		status = RA_NOMATCH;
4282 	    break;
4283 
4284 	  case EOL:
4285 	    if (c != NUL)
4286 		status = RA_NOMATCH;
4287 	    break;
4288 
4289 	  case RE_BOF:
4290 	    /* We're not at the beginning of the file when below the first
4291 	     * line where we started, not at the start of the line or we
4292 	     * didn't start at the first line of the buffer. */
4293 	    if (rex.lnum != 0 || rex.input != rex.line
4294 				       || (REG_MULTI && rex.reg_firstlnum > 1))
4295 		status = RA_NOMATCH;
4296 	    break;
4297 
4298 	  case RE_EOF:
4299 	    if (rex.lnum != rex.reg_maxline || c != NUL)
4300 		status = RA_NOMATCH;
4301 	    break;
4302 
4303 	  case CURSOR:
4304 	    /* Check if the buffer is in a window and compare the
4305 	     * rex.reg_win->w_cursor position to the match position. */
4306 	    if (rex.reg_win == NULL
4307 		    || (rex.lnum + rex.reg_firstlnum
4308 						 != rex.reg_win->w_cursor.lnum)
4309 		    || ((colnr_T)(rex.input - rex.line)
4310 						 != rex.reg_win->w_cursor.col))
4311 		status = RA_NOMATCH;
4312 	    break;
4313 
4314 	  case RE_MARK:
4315 	    /* Compare the mark position to the match position. */
4316 	    {
4317 		int	mark = OPERAND(scan)[0];
4318 		int	cmp = OPERAND(scan)[1];
4319 		pos_T	*pos;
4320 
4321 		pos = getmark_buf(rex.reg_buf, mark, FALSE);
4322 		if (pos == NULL		     /* mark doesn't exist */
4323 			|| pos->lnum <= 0    /* mark isn't set in reg_buf */
4324 			|| (pos->lnum == rex.lnum + rex.reg_firstlnum
4325 				? (pos->col == (colnr_T)(rex.input - rex.line)
4326 				    ? (cmp == '<' || cmp == '>')
4327 				    : (pos->col < (colnr_T)(rex.input - rex.line)
4328 					? cmp != '>'
4329 					: cmp != '<'))
4330 				: (pos->lnum < rex.lnum + rex.reg_firstlnum
4331 				    ? cmp != '>'
4332 				    : cmp != '<')))
4333 		    status = RA_NOMATCH;
4334 	    }
4335 	    break;
4336 
4337 	  case RE_VISUAL:
4338 	    if (!reg_match_visual())
4339 		status = RA_NOMATCH;
4340 	    break;
4341 
4342 	  case RE_LNUM:
4343 	    if (!REG_MULTI || !re_num_cmp((long_u)(rex.lnum + rex.reg_firstlnum),
4344 									scan))
4345 		status = RA_NOMATCH;
4346 	    break;
4347 
4348 	  case RE_COL:
4349 	    if (!re_num_cmp((long_u)(rex.input - rex.line) + 1, scan))
4350 		status = RA_NOMATCH;
4351 	    break;
4352 
4353 	  case RE_VCOL:
4354 	    if (!re_num_cmp((long_u)win_linetabsize(
4355 			    rex.reg_win == NULL ? curwin : rex.reg_win,
4356 			    rex.line, (colnr_T)(rex.input - rex.line)) + 1, scan))
4357 		status = RA_NOMATCH;
4358 	    break;
4359 
4360 	  case BOW:	/* \<word; rex.input points to w */
4361 	    if (c == NUL)	/* Can't match at end of line */
4362 		status = RA_NOMATCH;
4363 	    else if (has_mbyte)
4364 	    {
4365 		int this_class;
4366 
4367 		/* Get class of current and previous char (if it exists). */
4368 		this_class = mb_get_class_buf(rex.input, rex.reg_buf);
4369 		if (this_class <= 1)
4370 		    status = RA_NOMATCH;  /* not on a word at all */
4371 		else if (reg_prev_class() == this_class)
4372 		    status = RA_NOMATCH;  /* previous char is in same word */
4373 	    }
4374 	    else
4375 	    {
4376 		if (!vim_iswordc_buf(c, rex.reg_buf) || (rex.input > rex.line
4377 				&& vim_iswordc_buf(rex.input[-1], rex.reg_buf)))
4378 		    status = RA_NOMATCH;
4379 	    }
4380 	    break;
4381 
4382 	  case EOW:	/* word\>; rex.input points after d */
4383 	    if (rex.input == rex.line)    /* Can't match at start of line */
4384 		status = RA_NOMATCH;
4385 	    else if (has_mbyte)
4386 	    {
4387 		int this_class, prev_class;
4388 
4389 		/* Get class of current and previous char (if it exists). */
4390 		this_class = mb_get_class_buf(rex.input, rex.reg_buf);
4391 		prev_class = reg_prev_class();
4392 		if (this_class == prev_class
4393 			|| prev_class == 0 || prev_class == 1)
4394 		    status = RA_NOMATCH;
4395 	    }
4396 	    else
4397 	    {
4398 		if (!vim_iswordc_buf(rex.input[-1], rex.reg_buf)
4399 			|| (rex.input[0] != NUL
4400 					   && vim_iswordc_buf(c, rex.reg_buf)))
4401 		    status = RA_NOMATCH;
4402 	    }
4403 	    break; /* Matched with EOW */
4404 
4405 	  case ANY:
4406 	    /* ANY does not match new lines. */
4407 	    if (c == NUL)
4408 		status = RA_NOMATCH;
4409 	    else
4410 		ADVANCE_REGINPUT();
4411 	    break;
4412 
4413 	  case IDENT:
4414 	    if (!vim_isIDc(c))
4415 		status = RA_NOMATCH;
4416 	    else
4417 		ADVANCE_REGINPUT();
4418 	    break;
4419 
4420 	  case SIDENT:
4421 	    if (VIM_ISDIGIT(*rex.input) || !vim_isIDc(c))
4422 		status = RA_NOMATCH;
4423 	    else
4424 		ADVANCE_REGINPUT();
4425 	    break;
4426 
4427 	  case KWORD:
4428 	    if (!vim_iswordp_buf(rex.input, rex.reg_buf))
4429 		status = RA_NOMATCH;
4430 	    else
4431 		ADVANCE_REGINPUT();
4432 	    break;
4433 
4434 	  case SKWORD:
4435 	    if (VIM_ISDIGIT(*rex.input)
4436 				    || !vim_iswordp_buf(rex.input, rex.reg_buf))
4437 		status = RA_NOMATCH;
4438 	    else
4439 		ADVANCE_REGINPUT();
4440 	    break;
4441 
4442 	  case FNAME:
4443 	    if (!vim_isfilec(c))
4444 		status = RA_NOMATCH;
4445 	    else
4446 		ADVANCE_REGINPUT();
4447 	    break;
4448 
4449 	  case SFNAME:
4450 	    if (VIM_ISDIGIT(*rex.input) || !vim_isfilec(c))
4451 		status = RA_NOMATCH;
4452 	    else
4453 		ADVANCE_REGINPUT();
4454 	    break;
4455 
4456 	  case PRINT:
4457 	    if (!vim_isprintc(PTR2CHAR(rex.input)))
4458 		status = RA_NOMATCH;
4459 	    else
4460 		ADVANCE_REGINPUT();
4461 	    break;
4462 
4463 	  case SPRINT:
4464 	    if (VIM_ISDIGIT(*rex.input) || !vim_isprintc(PTR2CHAR(rex.input)))
4465 		status = RA_NOMATCH;
4466 	    else
4467 		ADVANCE_REGINPUT();
4468 	    break;
4469 
4470 	  case WHITE:
4471 	    if (!VIM_ISWHITE(c))
4472 		status = RA_NOMATCH;
4473 	    else
4474 		ADVANCE_REGINPUT();
4475 	    break;
4476 
4477 	  case NWHITE:
4478 	    if (c == NUL || VIM_ISWHITE(c))
4479 		status = RA_NOMATCH;
4480 	    else
4481 		ADVANCE_REGINPUT();
4482 	    break;
4483 
4484 	  case DIGIT:
4485 	    if (!ri_digit(c))
4486 		status = RA_NOMATCH;
4487 	    else
4488 		ADVANCE_REGINPUT();
4489 	    break;
4490 
4491 	  case NDIGIT:
4492 	    if (c == NUL || ri_digit(c))
4493 		status = RA_NOMATCH;
4494 	    else
4495 		ADVANCE_REGINPUT();
4496 	    break;
4497 
4498 	  case HEX:
4499 	    if (!ri_hex(c))
4500 		status = RA_NOMATCH;
4501 	    else
4502 		ADVANCE_REGINPUT();
4503 	    break;
4504 
4505 	  case NHEX:
4506 	    if (c == NUL || ri_hex(c))
4507 		status = RA_NOMATCH;
4508 	    else
4509 		ADVANCE_REGINPUT();
4510 	    break;
4511 
4512 	  case OCTAL:
4513 	    if (!ri_octal(c))
4514 		status = RA_NOMATCH;
4515 	    else
4516 		ADVANCE_REGINPUT();
4517 	    break;
4518 
4519 	  case NOCTAL:
4520 	    if (c == NUL || ri_octal(c))
4521 		status = RA_NOMATCH;
4522 	    else
4523 		ADVANCE_REGINPUT();
4524 	    break;
4525 
4526 	  case WORD:
4527 	    if (!ri_word(c))
4528 		status = RA_NOMATCH;
4529 	    else
4530 		ADVANCE_REGINPUT();
4531 	    break;
4532 
4533 	  case NWORD:
4534 	    if (c == NUL || ri_word(c))
4535 		status = RA_NOMATCH;
4536 	    else
4537 		ADVANCE_REGINPUT();
4538 	    break;
4539 
4540 	  case HEAD:
4541 	    if (!ri_head(c))
4542 		status = RA_NOMATCH;
4543 	    else
4544 		ADVANCE_REGINPUT();
4545 	    break;
4546 
4547 	  case NHEAD:
4548 	    if (c == NUL || ri_head(c))
4549 		status = RA_NOMATCH;
4550 	    else
4551 		ADVANCE_REGINPUT();
4552 	    break;
4553 
4554 	  case ALPHA:
4555 	    if (!ri_alpha(c))
4556 		status = RA_NOMATCH;
4557 	    else
4558 		ADVANCE_REGINPUT();
4559 	    break;
4560 
4561 	  case NALPHA:
4562 	    if (c == NUL || ri_alpha(c))
4563 		status = RA_NOMATCH;
4564 	    else
4565 		ADVANCE_REGINPUT();
4566 	    break;
4567 
4568 	  case LOWER:
4569 	    if (!ri_lower(c))
4570 		status = RA_NOMATCH;
4571 	    else
4572 		ADVANCE_REGINPUT();
4573 	    break;
4574 
4575 	  case NLOWER:
4576 	    if (c == NUL || ri_lower(c))
4577 		status = RA_NOMATCH;
4578 	    else
4579 		ADVANCE_REGINPUT();
4580 	    break;
4581 
4582 	  case UPPER:
4583 	    if (!ri_upper(c))
4584 		status = RA_NOMATCH;
4585 	    else
4586 		ADVANCE_REGINPUT();
4587 	    break;
4588 
4589 	  case NUPPER:
4590 	    if (c == NUL || ri_upper(c))
4591 		status = RA_NOMATCH;
4592 	    else
4593 		ADVANCE_REGINPUT();
4594 	    break;
4595 
4596 	  case EXACTLY:
4597 	    {
4598 		int	len;
4599 		char_u	*opnd;
4600 
4601 		opnd = OPERAND(scan);
4602 		/* Inline the first byte, for speed. */
4603 		if (*opnd != *rex.input
4604 			&& (!rex.reg_ic
4605 			    || (!enc_utf8
4606 			      && MB_TOLOWER(*opnd) != MB_TOLOWER(*rex.input))))
4607 		    status = RA_NOMATCH;
4608 		else if (*opnd == NUL)
4609 		{
4610 		    /* match empty string always works; happens when "~" is
4611 		     * empty. */
4612 		}
4613 		else
4614 		{
4615 		    if (opnd[1] == NUL && !(enc_utf8 && rex.reg_ic))
4616 		    {
4617 			len = 1;	/* matched a single byte above */
4618 		    }
4619 		    else
4620 		    {
4621 			/* Need to match first byte again for multi-byte. */
4622 			len = (int)STRLEN(opnd);
4623 			if (cstrncmp(opnd, rex.input, &len) != 0)
4624 			    status = RA_NOMATCH;
4625 		    }
4626 		    /* Check for following composing character, unless %C
4627 		     * follows (skips over all composing chars). */
4628 		    if (status != RA_NOMATCH
4629 			    && enc_utf8
4630 			    && UTF_COMPOSINGLIKE(rex.input, rex.input + len)
4631 			    && !rex.reg_icombine
4632 			    && OP(next) != RE_COMPOSING)
4633 		    {
4634 			/* raaron: This code makes a composing character get
4635 			 * ignored, which is the correct behavior (sometimes)
4636 			 * for voweled Hebrew texts. */
4637 			status = RA_NOMATCH;
4638 		    }
4639 		    if (status != RA_NOMATCH)
4640 			rex.input += len;
4641 		}
4642 	    }
4643 	    break;
4644 
4645 	  case ANYOF:
4646 	  case ANYBUT:
4647 	    if (c == NUL)
4648 		status = RA_NOMATCH;
4649 	    else if ((cstrchr(OPERAND(scan), c) == NULL) == (op == ANYOF))
4650 		status = RA_NOMATCH;
4651 	    else
4652 		ADVANCE_REGINPUT();
4653 	    break;
4654 
4655 	  case MULTIBYTECODE:
4656 	    if (has_mbyte)
4657 	    {
4658 		int	i, len;
4659 		char_u	*opnd;
4660 		int	opndc = 0, inpc;
4661 
4662 		opnd = OPERAND(scan);
4663 		/* Safety check (just in case 'encoding' was changed since
4664 		 * compiling the program). */
4665 		if ((len = (*mb_ptr2len)(opnd)) < 2)
4666 		{
4667 		    status = RA_NOMATCH;
4668 		    break;
4669 		}
4670 		if (enc_utf8)
4671 		    opndc = utf_ptr2char(opnd);
4672 		if (enc_utf8 && utf_iscomposing(opndc))
4673 		{
4674 		    /* When only a composing char is given match at any
4675 		     * position where that composing char appears. */
4676 		    status = RA_NOMATCH;
4677 		    for (i = 0; rex.input[i] != NUL;
4678 						i += utf_ptr2len(rex.input + i))
4679 		    {
4680 			inpc = utf_ptr2char(rex.input + i);
4681 			if (!utf_iscomposing(inpc))
4682 			{
4683 			    if (i > 0)
4684 				break;
4685 			}
4686 			else if (opndc == inpc)
4687 			{
4688 			    /* Include all following composing chars. */
4689 			    len = i + utfc_ptr2len(rex.input + i);
4690 			    status = RA_MATCH;
4691 			    break;
4692 			}
4693 		    }
4694 		}
4695 		else
4696 		    for (i = 0; i < len; ++i)
4697 			if (opnd[i] != rex.input[i])
4698 			{
4699 			    status = RA_NOMATCH;
4700 			    break;
4701 			}
4702 		rex.input += len;
4703 	    }
4704 	    else
4705 		status = RA_NOMATCH;
4706 	    break;
4707 	  case RE_COMPOSING:
4708 	    if (enc_utf8)
4709 	    {
4710 		/* Skip composing characters. */
4711 		while (utf_iscomposing(utf_ptr2char(rex.input)))
4712 		    MB_CPTR_ADV(rex.input);
4713 	    }
4714 	    break;
4715 
4716 	  case NOTHING:
4717 	    break;
4718 
4719 	  case BACK:
4720 	    {
4721 		int		i;
4722 		backpos_T	*bp;
4723 
4724 		/*
4725 		 * When we run into BACK we need to check if we don't keep
4726 		 * looping without matching any input.  The second and later
4727 		 * times a BACK is encountered it fails if the input is still
4728 		 * at the same position as the previous time.
4729 		 * The positions are stored in "backpos" and found by the
4730 		 * current value of "scan", the position in the RE program.
4731 		 */
4732 		bp = (backpos_T *)backpos.ga_data;
4733 		for (i = 0; i < backpos.ga_len; ++i)
4734 		    if (bp[i].bp_scan == scan)
4735 			break;
4736 		if (i == backpos.ga_len)
4737 		{
4738 		    /* First time at this BACK, make room to store the pos. */
4739 		    if (ga_grow(&backpos, 1) == FAIL)
4740 			status = RA_FAIL;
4741 		    else
4742 		    {
4743 			/* get "ga_data" again, it may have changed */
4744 			bp = (backpos_T *)backpos.ga_data;
4745 			bp[i].bp_scan = scan;
4746 			++backpos.ga_len;
4747 		    }
4748 		}
4749 		else if (reg_save_equal(&bp[i].bp_pos))
4750 		    /* Still at same position as last time, fail. */
4751 		    status = RA_NOMATCH;
4752 
4753 		if (status != RA_FAIL && status != RA_NOMATCH)
4754 		    reg_save(&bp[i].bp_pos, &backpos);
4755 	    }
4756 	    break;
4757 
4758 	  case MOPEN + 0:   /* Match start: \zs */
4759 	  case MOPEN + 1:   /* \( */
4760 	  case MOPEN + 2:
4761 	  case MOPEN + 3:
4762 	  case MOPEN + 4:
4763 	  case MOPEN + 5:
4764 	  case MOPEN + 6:
4765 	  case MOPEN + 7:
4766 	  case MOPEN + 8:
4767 	  case MOPEN + 9:
4768 	    {
4769 		no = op - MOPEN;
4770 		cleanup_subexpr();
4771 		rp = regstack_push(RS_MOPEN, scan);
4772 		if (rp == NULL)
4773 		    status = RA_FAIL;
4774 		else
4775 		{
4776 		    rp->rs_no = no;
4777 		    save_se(&rp->rs_un.sesave, &rex.reg_startpos[no],
4778 							  &rex.reg_startp[no]);
4779 		    /* We simply continue and handle the result when done. */
4780 		}
4781 	    }
4782 	    break;
4783 
4784 	  case NOPEN:	    /* \%( */
4785 	  case NCLOSE:	    /* \) after \%( */
4786 		if (regstack_push(RS_NOPEN, scan) == NULL)
4787 		    status = RA_FAIL;
4788 		/* We simply continue and handle the result when done. */
4789 		break;
4790 
4791 #ifdef FEAT_SYN_HL
4792 	  case ZOPEN + 1:
4793 	  case ZOPEN + 2:
4794 	  case ZOPEN + 3:
4795 	  case ZOPEN + 4:
4796 	  case ZOPEN + 5:
4797 	  case ZOPEN + 6:
4798 	  case ZOPEN + 7:
4799 	  case ZOPEN + 8:
4800 	  case ZOPEN + 9:
4801 	    {
4802 		no = op - ZOPEN;
4803 		cleanup_zsubexpr();
4804 		rp = regstack_push(RS_ZOPEN, scan);
4805 		if (rp == NULL)
4806 		    status = RA_FAIL;
4807 		else
4808 		{
4809 		    rp->rs_no = no;
4810 		    save_se(&rp->rs_un.sesave, &reg_startzpos[no],
4811 							     &reg_startzp[no]);
4812 		    /* We simply continue and handle the result when done. */
4813 		}
4814 	    }
4815 	    break;
4816 #endif
4817 
4818 	  case MCLOSE + 0:  /* Match end: \ze */
4819 	  case MCLOSE + 1:  /* \) */
4820 	  case MCLOSE + 2:
4821 	  case MCLOSE + 3:
4822 	  case MCLOSE + 4:
4823 	  case MCLOSE + 5:
4824 	  case MCLOSE + 6:
4825 	  case MCLOSE + 7:
4826 	  case MCLOSE + 8:
4827 	  case MCLOSE + 9:
4828 	    {
4829 		no = op - MCLOSE;
4830 		cleanup_subexpr();
4831 		rp = regstack_push(RS_MCLOSE, scan);
4832 		if (rp == NULL)
4833 		    status = RA_FAIL;
4834 		else
4835 		{
4836 		    rp->rs_no = no;
4837 		    save_se(&rp->rs_un.sesave, &rex.reg_endpos[no],
4838 							    &rex.reg_endp[no]);
4839 		    /* We simply continue and handle the result when done. */
4840 		}
4841 	    }
4842 	    break;
4843 
4844 #ifdef FEAT_SYN_HL
4845 	  case ZCLOSE + 1:  /* \) after \z( */
4846 	  case ZCLOSE + 2:
4847 	  case ZCLOSE + 3:
4848 	  case ZCLOSE + 4:
4849 	  case ZCLOSE + 5:
4850 	  case ZCLOSE + 6:
4851 	  case ZCLOSE + 7:
4852 	  case ZCLOSE + 8:
4853 	  case ZCLOSE + 9:
4854 	    {
4855 		no = op - ZCLOSE;
4856 		cleanup_zsubexpr();
4857 		rp = regstack_push(RS_ZCLOSE, scan);
4858 		if (rp == NULL)
4859 		    status = RA_FAIL;
4860 		else
4861 		{
4862 		    rp->rs_no = no;
4863 		    save_se(&rp->rs_un.sesave, &reg_endzpos[no],
4864 							      &reg_endzp[no]);
4865 		    /* We simply continue and handle the result when done. */
4866 		}
4867 	    }
4868 	    break;
4869 #endif
4870 
4871 	  case BACKREF + 1:
4872 	  case BACKREF + 2:
4873 	  case BACKREF + 3:
4874 	  case BACKREF + 4:
4875 	  case BACKREF + 5:
4876 	  case BACKREF + 6:
4877 	  case BACKREF + 7:
4878 	  case BACKREF + 8:
4879 	  case BACKREF + 9:
4880 	    {
4881 		int		len;
4882 
4883 		no = op - BACKREF;
4884 		cleanup_subexpr();
4885 		if (!REG_MULTI)		/* Single-line regexp */
4886 		{
4887 		    if (rex.reg_startp[no] == NULL || rex.reg_endp[no] == NULL)
4888 		    {
4889 			/* Backref was not set: Match an empty string. */
4890 			len = 0;
4891 		    }
4892 		    else
4893 		    {
4894 			/* Compare current input with back-ref in the same
4895 			 * line. */
4896 			len = (int)(rex.reg_endp[no] - rex.reg_startp[no]);
4897 			if (cstrncmp(rex.reg_startp[no], rex.input, &len) != 0)
4898 			    status = RA_NOMATCH;
4899 		    }
4900 		}
4901 		else				/* Multi-line regexp */
4902 		{
4903 		    if (rex.reg_startpos[no].lnum < 0
4904 						|| rex.reg_endpos[no].lnum < 0)
4905 		    {
4906 			/* Backref was not set: Match an empty string. */
4907 			len = 0;
4908 		    }
4909 		    else
4910 		    {
4911 			if (rex.reg_startpos[no].lnum == rex.lnum
4912 				&& rex.reg_endpos[no].lnum == rex.lnum)
4913 			{
4914 			    /* Compare back-ref within the current line. */
4915 			    len = rex.reg_endpos[no].col
4916 						    - rex.reg_startpos[no].col;
4917 			    if (cstrncmp(rex.line + rex.reg_startpos[no].col,
4918 							  rex.input, &len) != 0)
4919 				status = RA_NOMATCH;
4920 			}
4921 			else
4922 			{
4923 			    /* Messy situation: Need to compare between two
4924 			     * lines. */
4925 			    int r = match_with_backref(
4926 					    rex.reg_startpos[no].lnum,
4927 					    rex.reg_startpos[no].col,
4928 					    rex.reg_endpos[no].lnum,
4929 					    rex.reg_endpos[no].col,
4930 					    &len);
4931 
4932 			    if (r != RA_MATCH)
4933 				status = r;
4934 			}
4935 		    }
4936 		}
4937 
4938 		/* Matched the backref, skip over it. */
4939 		rex.input += len;
4940 	    }
4941 	    break;
4942 
4943 #ifdef FEAT_SYN_HL
4944 	  case ZREF + 1:
4945 	  case ZREF + 2:
4946 	  case ZREF + 3:
4947 	  case ZREF + 4:
4948 	  case ZREF + 5:
4949 	  case ZREF + 6:
4950 	  case ZREF + 7:
4951 	  case ZREF + 8:
4952 	  case ZREF + 9:
4953 	    {
4954 		int	len;
4955 
4956 		cleanup_zsubexpr();
4957 		no = op - ZREF;
4958 		if (re_extmatch_in != NULL
4959 			&& re_extmatch_in->matches[no] != NULL)
4960 		{
4961 		    len = (int)STRLEN(re_extmatch_in->matches[no]);
4962 		    if (cstrncmp(re_extmatch_in->matches[no],
4963 							  rex.input, &len) != 0)
4964 			status = RA_NOMATCH;
4965 		    else
4966 			rex.input += len;
4967 		}
4968 		else
4969 		{
4970 		    /* Backref was not set: Match an empty string. */
4971 		}
4972 	    }
4973 	    break;
4974 #endif
4975 
4976 	  case BRANCH:
4977 	    {
4978 		if (OP(next) != BRANCH) /* No choice. */
4979 		    next = OPERAND(scan);	/* Avoid recursion. */
4980 		else
4981 		{
4982 		    rp = regstack_push(RS_BRANCH, scan);
4983 		    if (rp == NULL)
4984 			status = RA_FAIL;
4985 		    else
4986 			status = RA_BREAK;	/* rest is below */
4987 		}
4988 	    }
4989 	    break;
4990 
4991 	  case BRACE_LIMITS:
4992 	    {
4993 		if (OP(next) == BRACE_SIMPLE)
4994 		{
4995 		    bl_minval = OPERAND_MIN(scan);
4996 		    bl_maxval = OPERAND_MAX(scan);
4997 		}
4998 		else if (OP(next) >= BRACE_COMPLEX
4999 			&& OP(next) < BRACE_COMPLEX + 10)
5000 		{
5001 		    no = OP(next) - BRACE_COMPLEX;
5002 		    brace_min[no] = OPERAND_MIN(scan);
5003 		    brace_max[no] = OPERAND_MAX(scan);
5004 		    brace_count[no] = 0;
5005 		}
5006 		else
5007 		{
5008 		    internal_error("BRACE_LIMITS");
5009 		    status = RA_FAIL;
5010 		}
5011 	    }
5012 	    break;
5013 
5014 	  case BRACE_COMPLEX + 0:
5015 	  case BRACE_COMPLEX + 1:
5016 	  case BRACE_COMPLEX + 2:
5017 	  case BRACE_COMPLEX + 3:
5018 	  case BRACE_COMPLEX + 4:
5019 	  case BRACE_COMPLEX + 5:
5020 	  case BRACE_COMPLEX + 6:
5021 	  case BRACE_COMPLEX + 7:
5022 	  case BRACE_COMPLEX + 8:
5023 	  case BRACE_COMPLEX + 9:
5024 	    {
5025 		no = op - BRACE_COMPLEX;
5026 		++brace_count[no];
5027 
5028 		/* If not matched enough times yet, try one more */
5029 		if (brace_count[no] <= (brace_min[no] <= brace_max[no]
5030 					     ? brace_min[no] : brace_max[no]))
5031 		{
5032 		    rp = regstack_push(RS_BRCPLX_MORE, scan);
5033 		    if (rp == NULL)
5034 			status = RA_FAIL;
5035 		    else
5036 		    {
5037 			rp->rs_no = no;
5038 			reg_save(&rp->rs_un.regsave, &backpos);
5039 			next = OPERAND(scan);
5040 			/* We continue and handle the result when done. */
5041 		    }
5042 		    break;
5043 		}
5044 
5045 		/* If matched enough times, may try matching some more */
5046 		if (brace_min[no] <= brace_max[no])
5047 		{
5048 		    /* Range is the normal way around, use longest match */
5049 		    if (brace_count[no] <= brace_max[no])
5050 		    {
5051 			rp = regstack_push(RS_BRCPLX_LONG, scan);
5052 			if (rp == NULL)
5053 			    status = RA_FAIL;
5054 			else
5055 			{
5056 			    rp->rs_no = no;
5057 			    reg_save(&rp->rs_un.regsave, &backpos);
5058 			    next = OPERAND(scan);
5059 			    /* We continue and handle the result when done. */
5060 			}
5061 		    }
5062 		}
5063 		else
5064 		{
5065 		    /* Range is backwards, use shortest match first */
5066 		    if (brace_count[no] <= brace_min[no])
5067 		    {
5068 			rp = regstack_push(RS_BRCPLX_SHORT, scan);
5069 			if (rp == NULL)
5070 			    status = RA_FAIL;
5071 			else
5072 			{
5073 			    reg_save(&rp->rs_un.regsave, &backpos);
5074 			    /* We continue and handle the result when done. */
5075 			}
5076 		    }
5077 		}
5078 	    }
5079 	    break;
5080 
5081 	  case BRACE_SIMPLE:
5082 	  case STAR:
5083 	  case PLUS:
5084 	    {
5085 		regstar_T	rst;
5086 
5087 		/*
5088 		 * Lookahead to avoid useless match attempts when we know
5089 		 * what character comes next.
5090 		 */
5091 		if (OP(next) == EXACTLY)
5092 		{
5093 		    rst.nextb = *OPERAND(next);
5094 		    if (rex.reg_ic)
5095 		    {
5096 			if (MB_ISUPPER(rst.nextb))
5097 			    rst.nextb_ic = MB_TOLOWER(rst.nextb);
5098 			else
5099 			    rst.nextb_ic = MB_TOUPPER(rst.nextb);
5100 		    }
5101 		    else
5102 			rst.nextb_ic = rst.nextb;
5103 		}
5104 		else
5105 		{
5106 		    rst.nextb = NUL;
5107 		    rst.nextb_ic = NUL;
5108 		}
5109 		if (op != BRACE_SIMPLE)
5110 		{
5111 		    rst.minval = (op == STAR) ? 0 : 1;
5112 		    rst.maxval = MAX_LIMIT;
5113 		}
5114 		else
5115 		{
5116 		    rst.minval = bl_minval;
5117 		    rst.maxval = bl_maxval;
5118 		}
5119 
5120 		/*
5121 		 * When maxval > minval, try matching as much as possible, up
5122 		 * to maxval.  When maxval < minval, try matching at least the
5123 		 * minimal number (since the range is backwards, that's also
5124 		 * maxval!).
5125 		 */
5126 		rst.count = regrepeat(OPERAND(scan), rst.maxval);
5127 		if (got_int)
5128 		{
5129 		    status = RA_FAIL;
5130 		    break;
5131 		}
5132 		if (rst.minval <= rst.maxval
5133 			  ? rst.count >= rst.minval : rst.count >= rst.maxval)
5134 		{
5135 		    /* It could match.  Prepare for trying to match what
5136 		     * follows.  The code is below.  Parameters are stored in
5137 		     * a regstar_T on the regstack. */
5138 		    if ((long)((unsigned)regstack.ga_len >> 10) >= p_mmp)
5139 		    {
5140 			emsg(_(e_maxmempat));
5141 			status = RA_FAIL;
5142 		    }
5143 		    else if (ga_grow(&regstack, sizeof(regstar_T)) == FAIL)
5144 			status = RA_FAIL;
5145 		    else
5146 		    {
5147 			regstack.ga_len += sizeof(regstar_T);
5148 			rp = regstack_push(rst.minval <= rst.maxval
5149 					? RS_STAR_LONG : RS_STAR_SHORT, scan);
5150 			if (rp == NULL)
5151 			    status = RA_FAIL;
5152 			else
5153 			{
5154 			    *(((regstar_T *)rp) - 1) = rst;
5155 			    status = RA_BREAK;	    /* skip the restore bits */
5156 			}
5157 		    }
5158 		}
5159 		else
5160 		    status = RA_NOMATCH;
5161 
5162 	    }
5163 	    break;
5164 
5165 	  case NOMATCH:
5166 	  case MATCH:
5167 	  case SUBPAT:
5168 	    rp = regstack_push(RS_NOMATCH, scan);
5169 	    if (rp == NULL)
5170 		status = RA_FAIL;
5171 	    else
5172 	    {
5173 		rp->rs_no = op;
5174 		reg_save(&rp->rs_un.regsave, &backpos);
5175 		next = OPERAND(scan);
5176 		/* We continue and handle the result when done. */
5177 	    }
5178 	    break;
5179 
5180 	  case BEHIND:
5181 	  case NOBEHIND:
5182 	    /* Need a bit of room to store extra positions. */
5183 	    if ((long)((unsigned)regstack.ga_len >> 10) >= p_mmp)
5184 	    {
5185 		emsg(_(e_maxmempat));
5186 		status = RA_FAIL;
5187 	    }
5188 	    else if (ga_grow(&regstack, sizeof(regbehind_T)) == FAIL)
5189 		status = RA_FAIL;
5190 	    else
5191 	    {
5192 		regstack.ga_len += sizeof(regbehind_T);
5193 		rp = regstack_push(RS_BEHIND1, scan);
5194 		if (rp == NULL)
5195 		    status = RA_FAIL;
5196 		else
5197 		{
5198 		    /* Need to save the subexpr to be able to restore them
5199 		     * when there is a match but we don't use it. */
5200 		    save_subexpr(((regbehind_T *)rp) - 1);
5201 
5202 		    rp->rs_no = op;
5203 		    reg_save(&rp->rs_un.regsave, &backpos);
5204 		    /* First try if what follows matches.  If it does then we
5205 		     * check the behind match by looping. */
5206 		}
5207 	    }
5208 	    break;
5209 
5210 	  case BHPOS:
5211 	    if (REG_MULTI)
5212 	    {
5213 		if (behind_pos.rs_u.pos.col != (colnr_T)(rex.input - rex.line)
5214 			|| behind_pos.rs_u.pos.lnum != rex.lnum)
5215 		    status = RA_NOMATCH;
5216 	    }
5217 	    else if (behind_pos.rs_u.ptr != rex.input)
5218 		status = RA_NOMATCH;
5219 	    break;
5220 
5221 	  case NEWL:
5222 	    if ((c != NUL || !REG_MULTI || rex.lnum > rex.reg_maxline
5223 			     || rex.reg_line_lbr)
5224 					   && (c != '\n' || !rex.reg_line_lbr))
5225 		status = RA_NOMATCH;
5226 	    else if (rex.reg_line_lbr)
5227 		ADVANCE_REGINPUT();
5228 	    else
5229 		reg_nextline();
5230 	    break;
5231 
5232 	  case END:
5233 	    status = RA_MATCH;	/* Success! */
5234 	    break;
5235 
5236 	  default:
5237 	    emsg(_(e_re_corr));
5238 #ifdef DEBUG
5239 	    printf("Illegal op code %d\n", op);
5240 #endif
5241 	    status = RA_FAIL;
5242 	    break;
5243 	  }
5244 	}
5245 
5246 	/* If we can't continue sequentially, break the inner loop. */
5247 	if (status != RA_CONT)
5248 	    break;
5249 
5250 	/* Continue in inner loop, advance to next item. */
5251 	scan = next;
5252 
5253     } /* end of inner loop */
5254 
5255     /*
5256      * If there is something on the regstack execute the code for the state.
5257      * If the state is popped then loop and use the older state.
5258      */
5259     while (regstack.ga_len > 0 && status != RA_FAIL)
5260     {
5261 	rp = (regitem_T *)((char *)regstack.ga_data + regstack.ga_len) - 1;
5262 	switch (rp->rs_state)
5263 	{
5264 	  case RS_NOPEN:
5265 	    /* Result is passed on as-is, simply pop the state. */
5266 	    regstack_pop(&scan);
5267 	    break;
5268 
5269 	  case RS_MOPEN:
5270 	    /* Pop the state.  Restore pointers when there is no match. */
5271 	    if (status == RA_NOMATCH)
5272 		restore_se(&rp->rs_un.sesave, &rex.reg_startpos[rp->rs_no],
5273 						  &rex.reg_startp[rp->rs_no]);
5274 	    regstack_pop(&scan);
5275 	    break;
5276 
5277 #ifdef FEAT_SYN_HL
5278 	  case RS_ZOPEN:
5279 	    /* Pop the state.  Restore pointers when there is no match. */
5280 	    if (status == RA_NOMATCH)
5281 		restore_se(&rp->rs_un.sesave, &reg_startzpos[rp->rs_no],
5282 						 &reg_startzp[rp->rs_no]);
5283 	    regstack_pop(&scan);
5284 	    break;
5285 #endif
5286 
5287 	  case RS_MCLOSE:
5288 	    /* Pop the state.  Restore pointers when there is no match. */
5289 	    if (status == RA_NOMATCH)
5290 		restore_se(&rp->rs_un.sesave, &rex.reg_endpos[rp->rs_no],
5291 						    &rex.reg_endp[rp->rs_no]);
5292 	    regstack_pop(&scan);
5293 	    break;
5294 
5295 #ifdef FEAT_SYN_HL
5296 	  case RS_ZCLOSE:
5297 	    /* Pop the state.  Restore pointers when there is no match. */
5298 	    if (status == RA_NOMATCH)
5299 		restore_se(&rp->rs_un.sesave, &reg_endzpos[rp->rs_no],
5300 						   &reg_endzp[rp->rs_no]);
5301 	    regstack_pop(&scan);
5302 	    break;
5303 #endif
5304 
5305 	  case RS_BRANCH:
5306 	    if (status == RA_MATCH)
5307 		/* this branch matched, use it */
5308 		regstack_pop(&scan);
5309 	    else
5310 	    {
5311 		if (status != RA_BREAK)
5312 		{
5313 		    /* After a non-matching branch: try next one. */
5314 		    reg_restore(&rp->rs_un.regsave, &backpos);
5315 		    scan = rp->rs_scan;
5316 		}
5317 		if (scan == NULL || OP(scan) != BRANCH)
5318 		{
5319 		    /* no more branches, didn't find a match */
5320 		    status = RA_NOMATCH;
5321 		    regstack_pop(&scan);
5322 		}
5323 		else
5324 		{
5325 		    /* Prepare to try a branch. */
5326 		    rp->rs_scan = regnext(scan);
5327 		    reg_save(&rp->rs_un.regsave, &backpos);
5328 		    scan = OPERAND(scan);
5329 		}
5330 	    }
5331 	    break;
5332 
5333 	  case RS_BRCPLX_MORE:
5334 	    /* Pop the state.  Restore pointers when there is no match. */
5335 	    if (status == RA_NOMATCH)
5336 	    {
5337 		reg_restore(&rp->rs_un.regsave, &backpos);
5338 		--brace_count[rp->rs_no];	/* decrement match count */
5339 	    }
5340 	    regstack_pop(&scan);
5341 	    break;
5342 
5343 	  case RS_BRCPLX_LONG:
5344 	    /* Pop the state.  Restore pointers when there is no match. */
5345 	    if (status == RA_NOMATCH)
5346 	    {
5347 		/* There was no match, but we did find enough matches. */
5348 		reg_restore(&rp->rs_un.regsave, &backpos);
5349 		--brace_count[rp->rs_no];
5350 		/* continue with the items after "\{}" */
5351 		status = RA_CONT;
5352 	    }
5353 	    regstack_pop(&scan);
5354 	    if (status == RA_CONT)
5355 		scan = regnext(scan);
5356 	    break;
5357 
5358 	  case RS_BRCPLX_SHORT:
5359 	    /* Pop the state.  Restore pointers when there is no match. */
5360 	    if (status == RA_NOMATCH)
5361 		/* There was no match, try to match one more item. */
5362 		reg_restore(&rp->rs_un.regsave, &backpos);
5363 	    regstack_pop(&scan);
5364 	    if (status == RA_NOMATCH)
5365 	    {
5366 		scan = OPERAND(scan);
5367 		status = RA_CONT;
5368 	    }
5369 	    break;
5370 
5371 	  case RS_NOMATCH:
5372 	    /* Pop the state.  If the operand matches for NOMATCH or
5373 	     * doesn't match for MATCH/SUBPAT, we fail.  Otherwise backup,
5374 	     * except for SUBPAT, and continue with the next item. */
5375 	    if (status == (rp->rs_no == NOMATCH ? RA_MATCH : RA_NOMATCH))
5376 		status = RA_NOMATCH;
5377 	    else
5378 	    {
5379 		status = RA_CONT;
5380 		if (rp->rs_no != SUBPAT)	/* zero-width */
5381 		    reg_restore(&rp->rs_un.regsave, &backpos);
5382 	    }
5383 	    regstack_pop(&scan);
5384 	    if (status == RA_CONT)
5385 		scan = regnext(scan);
5386 	    break;
5387 
5388 	  case RS_BEHIND1:
5389 	    if (status == RA_NOMATCH)
5390 	    {
5391 		regstack_pop(&scan);
5392 		regstack.ga_len -= sizeof(regbehind_T);
5393 	    }
5394 	    else
5395 	    {
5396 		/* The stuff after BEHIND/NOBEHIND matches.  Now try if
5397 		 * the behind part does (not) match before the current
5398 		 * position in the input.  This must be done at every
5399 		 * position in the input and checking if the match ends at
5400 		 * the current position. */
5401 
5402 		/* save the position after the found match for next */
5403 		reg_save(&(((regbehind_T *)rp) - 1)->save_after, &backpos);
5404 
5405 		/* Start looking for a match with operand at the current
5406 		 * position.  Go back one character until we find the
5407 		 * result, hitting the start of the line or the previous
5408 		 * line (for multi-line matching).
5409 		 * Set behind_pos to where the match should end, BHPOS
5410 		 * will match it.  Save the current value. */
5411 		(((regbehind_T *)rp) - 1)->save_behind = behind_pos;
5412 		behind_pos = rp->rs_un.regsave;
5413 
5414 		rp->rs_state = RS_BEHIND2;
5415 
5416 		reg_restore(&rp->rs_un.regsave, &backpos);
5417 		scan = OPERAND(rp->rs_scan) + 4;
5418 	    }
5419 	    break;
5420 
5421 	  case RS_BEHIND2:
5422 	    /*
5423 	     * Looping for BEHIND / NOBEHIND match.
5424 	     */
5425 	    if (status == RA_MATCH && reg_save_equal(&behind_pos))
5426 	    {
5427 		/* found a match that ends where "next" started */
5428 		behind_pos = (((regbehind_T *)rp) - 1)->save_behind;
5429 		if (rp->rs_no == BEHIND)
5430 		    reg_restore(&(((regbehind_T *)rp) - 1)->save_after,
5431 								    &backpos);
5432 		else
5433 		{
5434 		    /* But we didn't want a match.  Need to restore the
5435 		     * subexpr, because what follows matched, so they have
5436 		     * been set. */
5437 		    status = RA_NOMATCH;
5438 		    restore_subexpr(((regbehind_T *)rp) - 1);
5439 		}
5440 		regstack_pop(&scan);
5441 		regstack.ga_len -= sizeof(regbehind_T);
5442 	    }
5443 	    else
5444 	    {
5445 		long limit;
5446 
5447 		/* No match or a match that doesn't end where we want it: Go
5448 		 * back one character.  May go to previous line once. */
5449 		no = OK;
5450 		limit = OPERAND_MIN(rp->rs_scan);
5451 		if (REG_MULTI)
5452 		{
5453 		    if (limit > 0
5454 			    && ((rp->rs_un.regsave.rs_u.pos.lnum
5455 						    < behind_pos.rs_u.pos.lnum
5456 				    ? (colnr_T)STRLEN(rex.line)
5457 				    : behind_pos.rs_u.pos.col)
5458 				- rp->rs_un.regsave.rs_u.pos.col >= limit))
5459 			no = FAIL;
5460 		    else if (rp->rs_un.regsave.rs_u.pos.col == 0)
5461 		    {
5462 			if (rp->rs_un.regsave.rs_u.pos.lnum
5463 					< behind_pos.rs_u.pos.lnum
5464 				|| reg_getline(
5465 					--rp->rs_un.regsave.rs_u.pos.lnum)
5466 								  == NULL)
5467 			    no = FAIL;
5468 			else
5469 			{
5470 			    reg_restore(&rp->rs_un.regsave, &backpos);
5471 			    rp->rs_un.regsave.rs_u.pos.col =
5472 						 (colnr_T)STRLEN(rex.line);
5473 			}
5474 		    }
5475 		    else
5476 		    {
5477 			if (has_mbyte)
5478 			{
5479 			    char_u *line =
5480 				  reg_getline(rp->rs_un.regsave.rs_u.pos.lnum);
5481 
5482 			    rp->rs_un.regsave.rs_u.pos.col -=
5483 				(*mb_head_off)(line, line
5484 				    + rp->rs_un.regsave.rs_u.pos.col - 1) + 1;
5485 			}
5486 			else
5487 			    --rp->rs_un.regsave.rs_u.pos.col;
5488 		    }
5489 		}
5490 		else
5491 		{
5492 		    if (rp->rs_un.regsave.rs_u.ptr == rex.line)
5493 			no = FAIL;
5494 		    else
5495 		    {
5496 			MB_PTR_BACK(rex.line, rp->rs_un.regsave.rs_u.ptr);
5497 			if (limit > 0 && (long)(behind_pos.rs_u.ptr
5498 				     - rp->rs_un.regsave.rs_u.ptr) > limit)
5499 			    no = FAIL;
5500 		    }
5501 		}
5502 		if (no == OK)
5503 		{
5504 		    /* Advanced, prepare for finding match again. */
5505 		    reg_restore(&rp->rs_un.regsave, &backpos);
5506 		    scan = OPERAND(rp->rs_scan) + 4;
5507 		    if (status == RA_MATCH)
5508 		    {
5509 			/* We did match, so subexpr may have been changed,
5510 			 * need to restore them for the next try. */
5511 			status = RA_NOMATCH;
5512 			restore_subexpr(((regbehind_T *)rp) - 1);
5513 		    }
5514 		}
5515 		else
5516 		{
5517 		    /* Can't advance.  For NOBEHIND that's a match. */
5518 		    behind_pos = (((regbehind_T *)rp) - 1)->save_behind;
5519 		    if (rp->rs_no == NOBEHIND)
5520 		    {
5521 			reg_restore(&(((regbehind_T *)rp) - 1)->save_after,
5522 								    &backpos);
5523 			status = RA_MATCH;
5524 		    }
5525 		    else
5526 		    {
5527 			/* We do want a proper match.  Need to restore the
5528 			 * subexpr if we had a match, because they may have
5529 			 * been set. */
5530 			if (status == RA_MATCH)
5531 			{
5532 			    status = RA_NOMATCH;
5533 			    restore_subexpr(((regbehind_T *)rp) - 1);
5534 			}
5535 		    }
5536 		    regstack_pop(&scan);
5537 		    regstack.ga_len -= sizeof(regbehind_T);
5538 		}
5539 	    }
5540 	    break;
5541 
5542 	  case RS_STAR_LONG:
5543 	  case RS_STAR_SHORT:
5544 	    {
5545 		regstar_T	    *rst = ((regstar_T *)rp) - 1;
5546 
5547 		if (status == RA_MATCH)
5548 		{
5549 		    regstack_pop(&scan);
5550 		    regstack.ga_len -= sizeof(regstar_T);
5551 		    break;
5552 		}
5553 
5554 		/* Tried once already, restore input pointers. */
5555 		if (status != RA_BREAK)
5556 		    reg_restore(&rp->rs_un.regsave, &backpos);
5557 
5558 		/* Repeat until we found a position where it could match. */
5559 		for (;;)
5560 		{
5561 		    if (status != RA_BREAK)
5562 		    {
5563 			/* Tried first position already, advance. */
5564 			if (rp->rs_state == RS_STAR_LONG)
5565 			{
5566 			    /* Trying for longest match, but couldn't or
5567 			     * didn't match -- back up one char. */
5568 			    if (--rst->count < rst->minval)
5569 				break;
5570 			    if (rex.input == rex.line)
5571 			    {
5572 				/* backup to last char of previous line */
5573 				--rex.lnum;
5574 				rex.line = reg_getline(rex.lnum);
5575 				/* Just in case regrepeat() didn't count
5576 				 * right. */
5577 				if (rex.line == NULL)
5578 				    break;
5579 				rex.input = rex.line + STRLEN(rex.line);
5580 				fast_breakcheck();
5581 			    }
5582 			    else
5583 				MB_PTR_BACK(rex.line, rex.input);
5584 			}
5585 			else
5586 			{
5587 			    /* Range is backwards, use shortest match first.
5588 			     * Careful: maxval and minval are exchanged!
5589 			     * Couldn't or didn't match: try advancing one
5590 			     * char. */
5591 			    if (rst->count == rst->minval
5592 				  || regrepeat(OPERAND(rp->rs_scan), 1L) == 0)
5593 				break;
5594 			    ++rst->count;
5595 			}
5596 			if (got_int)
5597 			    break;
5598 		    }
5599 		    else
5600 			status = RA_NOMATCH;
5601 
5602 		    /* If it could match, try it. */
5603 		    if (rst->nextb == NUL || *rex.input == rst->nextb
5604 					     || *rex.input == rst->nextb_ic)
5605 		    {
5606 			reg_save(&rp->rs_un.regsave, &backpos);
5607 			scan = regnext(rp->rs_scan);
5608 			status = RA_CONT;
5609 			break;
5610 		    }
5611 		}
5612 		if (status != RA_CONT)
5613 		{
5614 		    /* Failed. */
5615 		    regstack_pop(&scan);
5616 		    regstack.ga_len -= sizeof(regstar_T);
5617 		    status = RA_NOMATCH;
5618 		}
5619 	    }
5620 	    break;
5621 	}
5622 
5623 	/* If we want to continue the inner loop or didn't pop a state
5624 	 * continue matching loop */
5625 	if (status == RA_CONT || rp == (regitem_T *)
5626 			     ((char *)regstack.ga_data + regstack.ga_len) - 1)
5627 	    break;
5628     }
5629 
5630     /* May need to continue with the inner loop, starting at "scan". */
5631     if (status == RA_CONT)
5632 	continue;
5633 
5634     /*
5635      * If the regstack is empty or something failed we are done.
5636      */
5637     if (regstack.ga_len == 0 || status == RA_FAIL)
5638     {
5639 	if (scan == NULL)
5640 	{
5641 	    /*
5642 	     * We get here only if there's trouble -- normally "case END" is
5643 	     * the terminating point.
5644 	     */
5645 	    emsg(_(e_re_corr));
5646 #ifdef DEBUG
5647 	    printf("Premature EOL\n");
5648 #endif
5649 	}
5650 	return (status == RA_MATCH);
5651     }
5652 
5653   } /* End of loop until the regstack is empty. */
5654 
5655   /* NOTREACHED */
5656 }
5657 
5658 /*
5659  * Push an item onto the regstack.
5660  * Returns pointer to new item.  Returns NULL when out of memory.
5661  */
5662     static regitem_T *
5663 regstack_push(regstate_T state, char_u *scan)
5664 {
5665     regitem_T	*rp;
5666 
5667     if ((long)((unsigned)regstack.ga_len >> 10) >= p_mmp)
5668     {
5669 	emsg(_(e_maxmempat));
5670 	return NULL;
5671     }
5672     if (ga_grow(&regstack, sizeof(regitem_T)) == FAIL)
5673 	return NULL;
5674 
5675     rp = (regitem_T *)((char *)regstack.ga_data + regstack.ga_len);
5676     rp->rs_state = state;
5677     rp->rs_scan = scan;
5678 
5679     regstack.ga_len += sizeof(regitem_T);
5680     return rp;
5681 }
5682 
5683 /*
5684  * Pop an item from the regstack.
5685  */
5686     static void
5687 regstack_pop(char_u **scan)
5688 {
5689     regitem_T	*rp;
5690 
5691     rp = (regitem_T *)((char *)regstack.ga_data + regstack.ga_len) - 1;
5692     *scan = rp->rs_scan;
5693 
5694     regstack.ga_len -= sizeof(regitem_T);
5695 }
5696 
5697 /*
5698  * regrepeat - repeatedly match something simple, return how many.
5699  * Advances rex.input (and rex.lnum) to just after the matched chars.
5700  */
5701     static int
5702 regrepeat(
5703     char_u	*p,
5704     long	maxcount)   /* maximum number of matches allowed */
5705 {
5706     long	count = 0;
5707     char_u	*scan;
5708     char_u	*opnd;
5709     int		mask;
5710     int		testval = 0;
5711 
5712     scan = rex.input;	    /* Make local copy of rex.input for speed. */
5713     opnd = OPERAND(p);
5714     switch (OP(p))
5715     {
5716       case ANY:
5717       case ANY + ADD_NL:
5718 	while (count < maxcount)
5719 	{
5720 	    /* Matching anything means we continue until end-of-line (or
5721 	     * end-of-file for ANY + ADD_NL), only limited by maxcount. */
5722 	    while (*scan != NUL && count < maxcount)
5723 	    {
5724 		++count;
5725 		MB_PTR_ADV(scan);
5726 	    }
5727 	    if (!REG_MULTI || !WITH_NL(OP(p)) || rex.lnum > rex.reg_maxline
5728 				      || rex.reg_line_lbr || count == maxcount)
5729 		break;
5730 	    ++count;		/* count the line-break */
5731 	    reg_nextline();
5732 	    scan = rex.input;
5733 	    if (got_int)
5734 		break;
5735 	}
5736 	break;
5737 
5738       case IDENT:
5739       case IDENT + ADD_NL:
5740 	testval = TRUE;
5741 	/* FALLTHROUGH */
5742       case SIDENT:
5743       case SIDENT + ADD_NL:
5744 	while (count < maxcount)
5745 	{
5746 	    if (vim_isIDc(PTR2CHAR(scan)) && (testval || !VIM_ISDIGIT(*scan)))
5747 	    {
5748 		MB_PTR_ADV(scan);
5749 	    }
5750 	    else if (*scan == NUL)
5751 	    {
5752 		if (!REG_MULTI || !WITH_NL(OP(p)) || rex.lnum > rex.reg_maxline
5753 							   || rex.reg_line_lbr)
5754 		    break;
5755 		reg_nextline();
5756 		scan = rex.input;
5757 		if (got_int)
5758 		    break;
5759 	    }
5760 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5761 		++scan;
5762 	    else
5763 		break;
5764 	    ++count;
5765 	}
5766 	break;
5767 
5768       case KWORD:
5769       case KWORD + ADD_NL:
5770 	testval = TRUE;
5771 	/* FALLTHROUGH */
5772       case SKWORD:
5773       case SKWORD + ADD_NL:
5774 	while (count < maxcount)
5775 	{
5776 	    if (vim_iswordp_buf(scan, rex.reg_buf)
5777 					  && (testval || !VIM_ISDIGIT(*scan)))
5778 	    {
5779 		MB_PTR_ADV(scan);
5780 	    }
5781 	    else if (*scan == NUL)
5782 	    {
5783 		if (!REG_MULTI || !WITH_NL(OP(p)) || rex.lnum > rex.reg_maxline
5784 							   || rex.reg_line_lbr)
5785 		    break;
5786 		reg_nextline();
5787 		scan = rex.input;
5788 		if (got_int)
5789 		    break;
5790 	    }
5791 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5792 		++scan;
5793 	    else
5794 		break;
5795 	    ++count;
5796 	}
5797 	break;
5798 
5799       case FNAME:
5800       case FNAME + ADD_NL:
5801 	testval = TRUE;
5802 	/* FALLTHROUGH */
5803       case SFNAME:
5804       case SFNAME + ADD_NL:
5805 	while (count < maxcount)
5806 	{
5807 	    if (vim_isfilec(PTR2CHAR(scan)) && (testval || !VIM_ISDIGIT(*scan)))
5808 	    {
5809 		MB_PTR_ADV(scan);
5810 	    }
5811 	    else if (*scan == NUL)
5812 	    {
5813 		if (!REG_MULTI || !WITH_NL(OP(p)) || rex.lnum > rex.reg_maxline
5814 							   || rex.reg_line_lbr)
5815 		    break;
5816 		reg_nextline();
5817 		scan = rex.input;
5818 		if (got_int)
5819 		    break;
5820 	    }
5821 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5822 		++scan;
5823 	    else
5824 		break;
5825 	    ++count;
5826 	}
5827 	break;
5828 
5829       case PRINT:
5830       case PRINT + ADD_NL:
5831 	testval = TRUE;
5832 	/* FALLTHROUGH */
5833       case SPRINT:
5834       case SPRINT + ADD_NL:
5835 	while (count < maxcount)
5836 	{
5837 	    if (*scan == NUL)
5838 	    {
5839 		if (!REG_MULTI || !WITH_NL(OP(p)) || rex.lnum > rex.reg_maxline
5840 							   || rex.reg_line_lbr)
5841 		    break;
5842 		reg_nextline();
5843 		scan = rex.input;
5844 		if (got_int)
5845 		    break;
5846 	    }
5847 	    else if (vim_isprintc(PTR2CHAR(scan)) == 1
5848 					  && (testval || !VIM_ISDIGIT(*scan)))
5849 	    {
5850 		MB_PTR_ADV(scan);
5851 	    }
5852 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5853 		++scan;
5854 	    else
5855 		break;
5856 	    ++count;
5857 	}
5858 	break;
5859 
5860       case WHITE:
5861       case WHITE + ADD_NL:
5862 	testval = mask = RI_WHITE;
5863 do_class:
5864 	while (count < maxcount)
5865 	{
5866 	    int		l;
5867 
5868 	    if (*scan == NUL)
5869 	    {
5870 		if (!REG_MULTI || !WITH_NL(OP(p)) || rex.lnum > rex.reg_maxline
5871 							   || rex.reg_line_lbr)
5872 		    break;
5873 		reg_nextline();
5874 		scan = rex.input;
5875 		if (got_int)
5876 		    break;
5877 	    }
5878 	    else if (has_mbyte && (l = (*mb_ptr2len)(scan)) > 1)
5879 	    {
5880 		if (testval != 0)
5881 		    break;
5882 		scan += l;
5883 	    }
5884 	    else if ((class_tab[*scan] & mask) == testval)
5885 		++scan;
5886 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5887 		++scan;
5888 	    else
5889 		break;
5890 	    ++count;
5891 	}
5892 	break;
5893 
5894       case NWHITE:
5895       case NWHITE + ADD_NL:
5896 	mask = RI_WHITE;
5897 	goto do_class;
5898       case DIGIT:
5899       case DIGIT + ADD_NL:
5900 	testval = mask = RI_DIGIT;
5901 	goto do_class;
5902       case NDIGIT:
5903       case NDIGIT + ADD_NL:
5904 	mask = RI_DIGIT;
5905 	goto do_class;
5906       case HEX:
5907       case HEX + ADD_NL:
5908 	testval = mask = RI_HEX;
5909 	goto do_class;
5910       case NHEX:
5911       case NHEX + ADD_NL:
5912 	mask = RI_HEX;
5913 	goto do_class;
5914       case OCTAL:
5915       case OCTAL + ADD_NL:
5916 	testval = mask = RI_OCTAL;
5917 	goto do_class;
5918       case NOCTAL:
5919       case NOCTAL + ADD_NL:
5920 	mask = RI_OCTAL;
5921 	goto do_class;
5922       case WORD:
5923       case WORD + ADD_NL:
5924 	testval = mask = RI_WORD;
5925 	goto do_class;
5926       case NWORD:
5927       case NWORD + ADD_NL:
5928 	mask = RI_WORD;
5929 	goto do_class;
5930       case HEAD:
5931       case HEAD + ADD_NL:
5932 	testval = mask = RI_HEAD;
5933 	goto do_class;
5934       case NHEAD:
5935       case NHEAD + ADD_NL:
5936 	mask = RI_HEAD;
5937 	goto do_class;
5938       case ALPHA:
5939       case ALPHA + ADD_NL:
5940 	testval = mask = RI_ALPHA;
5941 	goto do_class;
5942       case NALPHA:
5943       case NALPHA + ADD_NL:
5944 	mask = RI_ALPHA;
5945 	goto do_class;
5946       case LOWER:
5947       case LOWER + ADD_NL:
5948 	testval = mask = RI_LOWER;
5949 	goto do_class;
5950       case NLOWER:
5951       case NLOWER + ADD_NL:
5952 	mask = RI_LOWER;
5953 	goto do_class;
5954       case UPPER:
5955       case UPPER + ADD_NL:
5956 	testval = mask = RI_UPPER;
5957 	goto do_class;
5958       case NUPPER:
5959       case NUPPER + ADD_NL:
5960 	mask = RI_UPPER;
5961 	goto do_class;
5962 
5963       case EXACTLY:
5964 	{
5965 	    int	    cu, cl;
5966 
5967 	    /* This doesn't do a multi-byte character, because a MULTIBYTECODE
5968 	     * would have been used for it.  It does handle single-byte
5969 	     * characters, such as latin1. */
5970 	    if (rex.reg_ic)
5971 	    {
5972 		cu = MB_TOUPPER(*opnd);
5973 		cl = MB_TOLOWER(*opnd);
5974 		while (count < maxcount && (*scan == cu || *scan == cl))
5975 		{
5976 		    count++;
5977 		    scan++;
5978 		}
5979 	    }
5980 	    else
5981 	    {
5982 		cu = *opnd;
5983 		while (count < maxcount && *scan == cu)
5984 		{
5985 		    count++;
5986 		    scan++;
5987 		}
5988 	    }
5989 	    break;
5990 	}
5991 
5992       case MULTIBYTECODE:
5993 	{
5994 	    int		i, len, cf = 0;
5995 
5996 	    /* Safety check (just in case 'encoding' was changed since
5997 	     * compiling the program). */
5998 	    if ((len = (*mb_ptr2len)(opnd)) > 1)
5999 	    {
6000 		if (rex.reg_ic && enc_utf8)
6001 		    cf = utf_fold(utf_ptr2char(opnd));
6002 		while (count < maxcount && (*mb_ptr2len)(scan) >= len)
6003 		{
6004 		    for (i = 0; i < len; ++i)
6005 			if (opnd[i] != scan[i])
6006 			    break;
6007 		    if (i < len && (!rex.reg_ic || !enc_utf8
6008 					|| utf_fold(utf_ptr2char(scan)) != cf))
6009 			break;
6010 		    scan += len;
6011 		    ++count;
6012 		}
6013 	    }
6014 	}
6015 	break;
6016 
6017       case ANYOF:
6018       case ANYOF + ADD_NL:
6019 	testval = TRUE;
6020 	/* FALLTHROUGH */
6021 
6022       case ANYBUT:
6023       case ANYBUT + ADD_NL:
6024 	while (count < maxcount)
6025 	{
6026 	    int len;
6027 
6028 	    if (*scan == NUL)
6029 	    {
6030 		if (!REG_MULTI || !WITH_NL(OP(p)) || rex.lnum > rex.reg_maxline
6031 							   || rex.reg_line_lbr)
6032 		    break;
6033 		reg_nextline();
6034 		scan = rex.input;
6035 		if (got_int)
6036 		    break;
6037 	    }
6038 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
6039 		++scan;
6040 	    else if (has_mbyte && (len = (*mb_ptr2len)(scan)) > 1)
6041 	    {
6042 		if ((cstrchr(opnd, (*mb_ptr2char)(scan)) == NULL) == testval)
6043 		    break;
6044 		scan += len;
6045 	    }
6046 	    else
6047 	    {
6048 		if ((cstrchr(opnd, *scan) == NULL) == testval)
6049 		    break;
6050 		++scan;
6051 	    }
6052 	    ++count;
6053 	}
6054 	break;
6055 
6056       case NEWL:
6057 	while (count < maxcount
6058 		&& ((*scan == NUL && rex.lnum <= rex.reg_maxline
6059 				       && !rex.reg_line_lbr && REG_MULTI)
6060 		    || (*scan == '\n' && rex.reg_line_lbr)))
6061 	{
6062 	    count++;
6063 	    if (rex.reg_line_lbr)
6064 		ADVANCE_REGINPUT();
6065 	    else
6066 		reg_nextline();
6067 	    scan = rex.input;
6068 	    if (got_int)
6069 		break;
6070 	}
6071 	break;
6072 
6073       default:			/* Oh dear.  Called inappropriately. */
6074 	emsg(_(e_re_corr));
6075 #ifdef DEBUG
6076 	printf("Called regrepeat with op code %d\n", OP(p));
6077 #endif
6078 	break;
6079     }
6080 
6081     rex.input = scan;
6082 
6083     return (int)count;
6084 }
6085 
6086 /*
6087  * regnext - dig the "next" pointer out of a node
6088  * Returns NULL when calculating size, when there is no next item and when
6089  * there is an error.
6090  */
6091     static char_u *
6092 regnext(char_u *p)
6093 {
6094     int	    offset;
6095 
6096     if (p == JUST_CALC_SIZE || reg_toolong)
6097 	return NULL;
6098 
6099     offset = NEXT(p);
6100     if (offset == 0)
6101 	return NULL;
6102 
6103     if (OP(p) == BACK)
6104 	return p - offset;
6105     else
6106 	return p + offset;
6107 }
6108 
6109 /*
6110  * Check the regexp program for its magic number.
6111  * Return TRUE if it's wrong.
6112  */
6113     static int
6114 prog_magic_wrong(void)
6115 {
6116     regprog_T	*prog;
6117 
6118     prog = REG_MULTI ? rex.reg_mmatch->regprog : rex.reg_match->regprog;
6119     if (prog->engine == &nfa_regengine)
6120 	/* For NFA matcher we don't check the magic */
6121 	return FALSE;
6122 
6123     if (UCHARAT(((bt_regprog_T *)prog)->program) != REGMAGIC)
6124     {
6125 	emsg(_(e_re_corr));
6126 	return TRUE;
6127     }
6128     return FALSE;
6129 }
6130 
6131 /*
6132  * Cleanup the subexpressions, if this wasn't done yet.
6133  * This construction is used to clear the subexpressions only when they are
6134  * used (to increase speed).
6135  */
6136     static void
6137 cleanup_subexpr(void)
6138 {
6139     if (rex.need_clear_subexpr)
6140     {
6141 	if (REG_MULTI)
6142 	{
6143 	    /* Use 0xff to set lnum to -1 */
6144 	    vim_memset(rex.reg_startpos, 0xff, sizeof(lpos_T) * NSUBEXP);
6145 	    vim_memset(rex.reg_endpos, 0xff, sizeof(lpos_T) * NSUBEXP);
6146 	}
6147 	else
6148 	{
6149 	    vim_memset(rex.reg_startp, 0, sizeof(char_u *) * NSUBEXP);
6150 	    vim_memset(rex.reg_endp, 0, sizeof(char_u *) * NSUBEXP);
6151 	}
6152 	rex.need_clear_subexpr = FALSE;
6153     }
6154 }
6155 
6156 #ifdef FEAT_SYN_HL
6157     static void
6158 cleanup_zsubexpr(void)
6159 {
6160     if (rex.need_clear_zsubexpr)
6161     {
6162 	if (REG_MULTI)
6163 	{
6164 	    /* Use 0xff to set lnum to -1 */
6165 	    vim_memset(reg_startzpos, 0xff, sizeof(lpos_T) * NSUBEXP);
6166 	    vim_memset(reg_endzpos, 0xff, sizeof(lpos_T) * NSUBEXP);
6167 	}
6168 	else
6169 	{
6170 	    vim_memset(reg_startzp, 0, sizeof(char_u *) * NSUBEXP);
6171 	    vim_memset(reg_endzp, 0, sizeof(char_u *) * NSUBEXP);
6172 	}
6173 	rex.need_clear_zsubexpr = FALSE;
6174     }
6175 }
6176 #endif
6177 
6178 /*
6179  * Save the current subexpr to "bp", so that they can be restored
6180  * later by restore_subexpr().
6181  */
6182     static void
6183 save_subexpr(regbehind_T *bp)
6184 {
6185     int i;
6186 
6187     /* When "rex.need_clear_subexpr" is set we don't need to save the values, only
6188      * remember that this flag needs to be set again when restoring. */
6189     bp->save_need_clear_subexpr = rex.need_clear_subexpr;
6190     if (!rex.need_clear_subexpr)
6191     {
6192 	for (i = 0; i < NSUBEXP; ++i)
6193 	{
6194 	    if (REG_MULTI)
6195 	    {
6196 		bp->save_start[i].se_u.pos = rex.reg_startpos[i];
6197 		bp->save_end[i].se_u.pos = rex.reg_endpos[i];
6198 	    }
6199 	    else
6200 	    {
6201 		bp->save_start[i].se_u.ptr = rex.reg_startp[i];
6202 		bp->save_end[i].se_u.ptr = rex.reg_endp[i];
6203 	    }
6204 	}
6205     }
6206 }
6207 
6208 /*
6209  * Restore the subexpr from "bp".
6210  */
6211     static void
6212 restore_subexpr(regbehind_T *bp)
6213 {
6214     int i;
6215 
6216     /* Only need to restore saved values when they are not to be cleared. */
6217     rex.need_clear_subexpr = bp->save_need_clear_subexpr;
6218     if (!rex.need_clear_subexpr)
6219     {
6220 	for (i = 0; i < NSUBEXP; ++i)
6221 	{
6222 	    if (REG_MULTI)
6223 	    {
6224 		rex.reg_startpos[i] = bp->save_start[i].se_u.pos;
6225 		rex.reg_endpos[i] = bp->save_end[i].se_u.pos;
6226 	    }
6227 	    else
6228 	    {
6229 		rex.reg_startp[i] = bp->save_start[i].se_u.ptr;
6230 		rex.reg_endp[i] = bp->save_end[i].se_u.ptr;
6231 	    }
6232 	}
6233     }
6234 }
6235 
6236 /*
6237  * Advance rex.lnum, rex.line and rex.input to the next line.
6238  */
6239     static void
6240 reg_nextline(void)
6241 {
6242     rex.line = reg_getline(++rex.lnum);
6243     rex.input = rex.line;
6244     fast_breakcheck();
6245 }
6246 
6247 /*
6248  * Save the input line and position in a regsave_T.
6249  */
6250     static void
6251 reg_save(regsave_T *save, garray_T *gap)
6252 {
6253     if (REG_MULTI)
6254     {
6255 	save->rs_u.pos.col = (colnr_T)(rex.input - rex.line);
6256 	save->rs_u.pos.lnum = rex.lnum;
6257     }
6258     else
6259 	save->rs_u.ptr = rex.input;
6260     save->rs_len = gap->ga_len;
6261 }
6262 
6263 /*
6264  * Restore the input line and position from a regsave_T.
6265  */
6266     static void
6267 reg_restore(regsave_T *save, garray_T *gap)
6268 {
6269     if (REG_MULTI)
6270     {
6271 	if (rex.lnum != save->rs_u.pos.lnum)
6272 	{
6273 	    /* only call reg_getline() when the line number changed to save
6274 	     * a bit of time */
6275 	    rex.lnum = save->rs_u.pos.lnum;
6276 	    rex.line = reg_getline(rex.lnum);
6277 	}
6278 	rex.input = rex.line + save->rs_u.pos.col;
6279     }
6280     else
6281 	rex.input = save->rs_u.ptr;
6282     gap->ga_len = save->rs_len;
6283 }
6284 
6285 /*
6286  * Return TRUE if current position is equal to saved position.
6287  */
6288     static int
6289 reg_save_equal(regsave_T *save)
6290 {
6291     if (REG_MULTI)
6292 	return rex.lnum == save->rs_u.pos.lnum
6293 				  && rex.input == rex.line + save->rs_u.pos.col;
6294     return rex.input == save->rs_u.ptr;
6295 }
6296 
6297 /*
6298  * Tentatively set the sub-expression start to the current position (after
6299  * calling regmatch() they will have changed).  Need to save the existing
6300  * values for when there is no match.
6301  * Use se_save() to use pointer (save_se_multi()) or position (save_se_one()),
6302  * depending on REG_MULTI.
6303  */
6304     static void
6305 save_se_multi(save_se_T *savep, lpos_T *posp)
6306 {
6307     savep->se_u.pos = *posp;
6308     posp->lnum = rex.lnum;
6309     posp->col = (colnr_T)(rex.input - rex.line);
6310 }
6311 
6312     static void
6313 save_se_one(save_se_T *savep, char_u **pp)
6314 {
6315     savep->se_u.ptr = *pp;
6316     *pp = rex.input;
6317 }
6318 
6319 /*
6320  * Compare a number with the operand of RE_LNUM, RE_COL or RE_VCOL.
6321  */
6322     static int
6323 re_num_cmp(long_u val, char_u *scan)
6324 {
6325     long_u  n = OPERAND_MIN(scan);
6326 
6327     if (OPERAND_CMP(scan) == '>')
6328 	return val > n;
6329     if (OPERAND_CMP(scan) == '<')
6330 	return val < n;
6331     return val == n;
6332 }
6333 
6334 /*
6335  * Check whether a backreference matches.
6336  * Returns RA_FAIL, RA_NOMATCH or RA_MATCH.
6337  * If "bytelen" is not NULL, it is set to the byte length of the match in the
6338  * last line.
6339  */
6340     static int
6341 match_with_backref(
6342     linenr_T start_lnum,
6343     colnr_T  start_col,
6344     linenr_T end_lnum,
6345     colnr_T  end_col,
6346     int	     *bytelen)
6347 {
6348     linenr_T	clnum = start_lnum;
6349     colnr_T	ccol = start_col;
6350     int		len;
6351     char_u	*p;
6352 
6353     if (bytelen != NULL)
6354 	*bytelen = 0;
6355     for (;;)
6356     {
6357 	/* Since getting one line may invalidate the other, need to make copy.
6358 	 * Slow! */
6359 	if (rex.line != reg_tofree)
6360 	{
6361 	    len = (int)STRLEN(rex.line);
6362 	    if (reg_tofree == NULL || len >= (int)reg_tofreelen)
6363 	    {
6364 		len += 50;	/* get some extra */
6365 		vim_free(reg_tofree);
6366 		reg_tofree = alloc(len);
6367 		if (reg_tofree == NULL)
6368 		    return RA_FAIL; /* out of memory!*/
6369 		reg_tofreelen = len;
6370 	    }
6371 	    STRCPY(reg_tofree, rex.line);
6372 	    rex.input = reg_tofree + (rex.input - rex.line);
6373 	    rex.line = reg_tofree;
6374 	}
6375 
6376 	/* Get the line to compare with. */
6377 	p = reg_getline(clnum);
6378 	if (clnum == end_lnum)
6379 	    len = end_col - ccol;
6380 	else
6381 	    len = (int)STRLEN(p + ccol);
6382 
6383 	if (cstrncmp(p + ccol, rex.input, &len) != 0)
6384 	    return RA_NOMATCH;  /* doesn't match */
6385 	if (bytelen != NULL)
6386 	    *bytelen += len;
6387 	if (clnum == end_lnum)
6388 	    break;		/* match and at end! */
6389 	if (rex.lnum >= rex.reg_maxline)
6390 	    return RA_NOMATCH;  /* text too short */
6391 
6392 	/* Advance to next line. */
6393 	reg_nextline();
6394 	if (bytelen != NULL)
6395 	    *bytelen = 0;
6396 	++clnum;
6397 	ccol = 0;
6398 	if (got_int)
6399 	    return RA_FAIL;
6400     }
6401 
6402     /* found a match!  Note that rex.line may now point to a copy of the line,
6403      * that should not matter. */
6404     return RA_MATCH;
6405 }
6406 
6407 #ifdef BT_REGEXP_DUMP
6408 
6409 /*
6410  * regdump - dump a regexp onto stdout in vaguely comprehensible form
6411  */
6412     static void
6413 regdump(char_u *pattern, bt_regprog_T *r)
6414 {
6415     char_u  *s;
6416     int	    op = EXACTLY;	/* Arbitrary non-END op. */
6417     char_u  *next;
6418     char_u  *end = NULL;
6419     FILE    *f;
6420 
6421 #ifdef BT_REGEXP_LOG
6422     f = fopen("bt_regexp_log.log", "a");
6423 #else
6424     f = stdout;
6425 #endif
6426     if (f == NULL)
6427 	return;
6428     fprintf(f, "-------------------------------------\n\r\nregcomp(%s):\r\n", pattern);
6429 
6430     s = r->program + 1;
6431     /*
6432      * Loop until we find the END that isn't before a referred next (an END
6433      * can also appear in a NOMATCH operand).
6434      */
6435     while (op != END || s <= end)
6436     {
6437 	op = OP(s);
6438 	fprintf(f, "%2d%s", (int)(s - r->program), regprop(s)); /* Where, what. */
6439 	next = regnext(s);
6440 	if (next == NULL)	/* Next ptr. */
6441 	    fprintf(f, "(0)");
6442 	else
6443 	    fprintf(f, "(%d)", (int)((s - r->program) + (next - s)));
6444 	if (end < next)
6445 	    end = next;
6446 	if (op == BRACE_LIMITS)
6447 	{
6448 	    /* Two ints */
6449 	    fprintf(f, " minval %ld, maxval %ld", OPERAND_MIN(s), OPERAND_MAX(s));
6450 	    s += 8;
6451 	}
6452 	else if (op == BEHIND || op == NOBEHIND)
6453 	{
6454 	    /* one int */
6455 	    fprintf(f, " count %ld", OPERAND_MIN(s));
6456 	    s += 4;
6457 	}
6458 	else if (op == RE_LNUM || op == RE_COL || op == RE_VCOL)
6459 	{
6460 	    /* one int plus comperator */
6461 	    fprintf(f, " count %ld", OPERAND_MIN(s));
6462 	    s += 5;
6463 	}
6464 	s += 3;
6465 	if (op == ANYOF || op == ANYOF + ADD_NL
6466 		|| op == ANYBUT || op == ANYBUT + ADD_NL
6467 		|| op == EXACTLY)
6468 	{
6469 	    /* Literal string, where present. */
6470 	    fprintf(f, "\nxxxxxxxxx\n");
6471 	    while (*s != NUL)
6472 		fprintf(f, "%c", *s++);
6473 	    fprintf(f, "\nxxxxxxxxx\n");
6474 	    s++;
6475 	}
6476 	fprintf(f, "\r\n");
6477     }
6478 
6479     /* Header fields of interest. */
6480     if (r->regstart != NUL)
6481 	fprintf(f, "start `%s' 0x%x; ", r->regstart < 256
6482 		? (char *)transchar(r->regstart)
6483 		: "multibyte", r->regstart);
6484     if (r->reganch)
6485 	fprintf(f, "anchored; ");
6486     if (r->regmust != NULL)
6487 	fprintf(f, "must have \"%s\"", r->regmust);
6488     fprintf(f, "\r\n");
6489 
6490 #ifdef BT_REGEXP_LOG
6491     fclose(f);
6492 #endif
6493 }
6494 #endif	    /* BT_REGEXP_DUMP */
6495 
6496 #ifdef DEBUG
6497 /*
6498  * regprop - printable representation of opcode
6499  */
6500     static char_u *
6501 regprop(char_u *op)
6502 {
6503     char	    *p;
6504     static char	    buf[50];
6505 
6506     STRCPY(buf, ":");
6507 
6508     switch ((int) OP(op))
6509     {
6510       case BOL:
6511 	p = "BOL";
6512 	break;
6513       case EOL:
6514 	p = "EOL";
6515 	break;
6516       case RE_BOF:
6517 	p = "BOF";
6518 	break;
6519       case RE_EOF:
6520 	p = "EOF";
6521 	break;
6522       case CURSOR:
6523 	p = "CURSOR";
6524 	break;
6525       case RE_VISUAL:
6526 	p = "RE_VISUAL";
6527 	break;
6528       case RE_LNUM:
6529 	p = "RE_LNUM";
6530 	break;
6531       case RE_MARK:
6532 	p = "RE_MARK";
6533 	break;
6534       case RE_COL:
6535 	p = "RE_COL";
6536 	break;
6537       case RE_VCOL:
6538 	p = "RE_VCOL";
6539 	break;
6540       case BOW:
6541 	p = "BOW";
6542 	break;
6543       case EOW:
6544 	p = "EOW";
6545 	break;
6546       case ANY:
6547 	p = "ANY";
6548 	break;
6549       case ANY + ADD_NL:
6550 	p = "ANY+NL";
6551 	break;
6552       case ANYOF:
6553 	p = "ANYOF";
6554 	break;
6555       case ANYOF + ADD_NL:
6556 	p = "ANYOF+NL";
6557 	break;
6558       case ANYBUT:
6559 	p = "ANYBUT";
6560 	break;
6561       case ANYBUT + ADD_NL:
6562 	p = "ANYBUT+NL";
6563 	break;
6564       case IDENT:
6565 	p = "IDENT";
6566 	break;
6567       case IDENT + ADD_NL:
6568 	p = "IDENT+NL";
6569 	break;
6570       case SIDENT:
6571 	p = "SIDENT";
6572 	break;
6573       case SIDENT + ADD_NL:
6574 	p = "SIDENT+NL";
6575 	break;
6576       case KWORD:
6577 	p = "KWORD";
6578 	break;
6579       case KWORD + ADD_NL:
6580 	p = "KWORD+NL";
6581 	break;
6582       case SKWORD:
6583 	p = "SKWORD";
6584 	break;
6585       case SKWORD + ADD_NL:
6586 	p = "SKWORD+NL";
6587 	break;
6588       case FNAME:
6589 	p = "FNAME";
6590 	break;
6591       case FNAME + ADD_NL:
6592 	p = "FNAME+NL";
6593 	break;
6594       case SFNAME:
6595 	p = "SFNAME";
6596 	break;
6597       case SFNAME + ADD_NL:
6598 	p = "SFNAME+NL";
6599 	break;
6600       case PRINT:
6601 	p = "PRINT";
6602 	break;
6603       case PRINT + ADD_NL:
6604 	p = "PRINT+NL";
6605 	break;
6606       case SPRINT:
6607 	p = "SPRINT";
6608 	break;
6609       case SPRINT + ADD_NL:
6610 	p = "SPRINT+NL";
6611 	break;
6612       case WHITE:
6613 	p = "WHITE";
6614 	break;
6615       case WHITE + ADD_NL:
6616 	p = "WHITE+NL";
6617 	break;
6618       case NWHITE:
6619 	p = "NWHITE";
6620 	break;
6621       case NWHITE + ADD_NL:
6622 	p = "NWHITE+NL";
6623 	break;
6624       case DIGIT:
6625 	p = "DIGIT";
6626 	break;
6627       case DIGIT + ADD_NL:
6628 	p = "DIGIT+NL";
6629 	break;
6630       case NDIGIT:
6631 	p = "NDIGIT";
6632 	break;
6633       case NDIGIT + ADD_NL:
6634 	p = "NDIGIT+NL";
6635 	break;
6636       case HEX:
6637 	p = "HEX";
6638 	break;
6639       case HEX + ADD_NL:
6640 	p = "HEX+NL";
6641 	break;
6642       case NHEX:
6643 	p = "NHEX";
6644 	break;
6645       case NHEX + ADD_NL:
6646 	p = "NHEX+NL";
6647 	break;
6648       case OCTAL:
6649 	p = "OCTAL";
6650 	break;
6651       case OCTAL + ADD_NL:
6652 	p = "OCTAL+NL";
6653 	break;
6654       case NOCTAL:
6655 	p = "NOCTAL";
6656 	break;
6657       case NOCTAL + ADD_NL:
6658 	p = "NOCTAL+NL";
6659 	break;
6660       case WORD:
6661 	p = "WORD";
6662 	break;
6663       case WORD + ADD_NL:
6664 	p = "WORD+NL";
6665 	break;
6666       case NWORD:
6667 	p = "NWORD";
6668 	break;
6669       case NWORD + ADD_NL:
6670 	p = "NWORD+NL";
6671 	break;
6672       case HEAD:
6673 	p = "HEAD";
6674 	break;
6675       case HEAD + ADD_NL:
6676 	p = "HEAD+NL";
6677 	break;
6678       case NHEAD:
6679 	p = "NHEAD";
6680 	break;
6681       case NHEAD + ADD_NL:
6682 	p = "NHEAD+NL";
6683 	break;
6684       case ALPHA:
6685 	p = "ALPHA";
6686 	break;
6687       case ALPHA + ADD_NL:
6688 	p = "ALPHA+NL";
6689 	break;
6690       case NALPHA:
6691 	p = "NALPHA";
6692 	break;
6693       case NALPHA + ADD_NL:
6694 	p = "NALPHA+NL";
6695 	break;
6696       case LOWER:
6697 	p = "LOWER";
6698 	break;
6699       case LOWER + ADD_NL:
6700 	p = "LOWER+NL";
6701 	break;
6702       case NLOWER:
6703 	p = "NLOWER";
6704 	break;
6705       case NLOWER + ADD_NL:
6706 	p = "NLOWER+NL";
6707 	break;
6708       case UPPER:
6709 	p = "UPPER";
6710 	break;
6711       case UPPER + ADD_NL:
6712 	p = "UPPER+NL";
6713 	break;
6714       case NUPPER:
6715 	p = "NUPPER";
6716 	break;
6717       case NUPPER + ADD_NL:
6718 	p = "NUPPER+NL";
6719 	break;
6720       case BRANCH:
6721 	p = "BRANCH";
6722 	break;
6723       case EXACTLY:
6724 	p = "EXACTLY";
6725 	break;
6726       case NOTHING:
6727 	p = "NOTHING";
6728 	break;
6729       case BACK:
6730 	p = "BACK";
6731 	break;
6732       case END:
6733 	p = "END";
6734 	break;
6735       case MOPEN + 0:
6736 	p = "MATCH START";
6737 	break;
6738       case MOPEN + 1:
6739       case MOPEN + 2:
6740       case MOPEN + 3:
6741       case MOPEN + 4:
6742       case MOPEN + 5:
6743       case MOPEN + 6:
6744       case MOPEN + 7:
6745       case MOPEN + 8:
6746       case MOPEN + 9:
6747 	sprintf(buf + STRLEN(buf), "MOPEN%d", OP(op) - MOPEN);
6748 	p = NULL;
6749 	break;
6750       case MCLOSE + 0:
6751 	p = "MATCH END";
6752 	break;
6753       case MCLOSE + 1:
6754       case MCLOSE + 2:
6755       case MCLOSE + 3:
6756       case MCLOSE + 4:
6757       case MCLOSE + 5:
6758       case MCLOSE + 6:
6759       case MCLOSE + 7:
6760       case MCLOSE + 8:
6761       case MCLOSE + 9:
6762 	sprintf(buf + STRLEN(buf), "MCLOSE%d", OP(op) - MCLOSE);
6763 	p = NULL;
6764 	break;
6765       case BACKREF + 1:
6766       case BACKREF + 2:
6767       case BACKREF + 3:
6768       case BACKREF + 4:
6769       case BACKREF + 5:
6770       case BACKREF + 6:
6771       case BACKREF + 7:
6772       case BACKREF + 8:
6773       case BACKREF + 9:
6774 	sprintf(buf + STRLEN(buf), "BACKREF%d", OP(op) - BACKREF);
6775 	p = NULL;
6776 	break;
6777       case NOPEN:
6778 	p = "NOPEN";
6779 	break;
6780       case NCLOSE:
6781 	p = "NCLOSE";
6782 	break;
6783 #ifdef FEAT_SYN_HL
6784       case ZOPEN + 1:
6785       case ZOPEN + 2:
6786       case ZOPEN + 3:
6787       case ZOPEN + 4:
6788       case ZOPEN + 5:
6789       case ZOPEN + 6:
6790       case ZOPEN + 7:
6791       case ZOPEN + 8:
6792       case ZOPEN + 9:
6793 	sprintf(buf + STRLEN(buf), "ZOPEN%d", OP(op) - ZOPEN);
6794 	p = NULL;
6795 	break;
6796       case ZCLOSE + 1:
6797       case ZCLOSE + 2:
6798       case ZCLOSE + 3:
6799       case ZCLOSE + 4:
6800       case ZCLOSE + 5:
6801       case ZCLOSE + 6:
6802       case ZCLOSE + 7:
6803       case ZCLOSE + 8:
6804       case ZCLOSE + 9:
6805 	sprintf(buf + STRLEN(buf), "ZCLOSE%d", OP(op) - ZCLOSE);
6806 	p = NULL;
6807 	break;
6808       case ZREF + 1:
6809       case ZREF + 2:
6810       case ZREF + 3:
6811       case ZREF + 4:
6812       case ZREF + 5:
6813       case ZREF + 6:
6814       case ZREF + 7:
6815       case ZREF + 8:
6816       case ZREF + 9:
6817 	sprintf(buf + STRLEN(buf), "ZREF%d", OP(op) - ZREF);
6818 	p = NULL;
6819 	break;
6820 #endif
6821       case STAR:
6822 	p = "STAR";
6823 	break;
6824       case PLUS:
6825 	p = "PLUS";
6826 	break;
6827       case NOMATCH:
6828 	p = "NOMATCH";
6829 	break;
6830       case MATCH:
6831 	p = "MATCH";
6832 	break;
6833       case BEHIND:
6834 	p = "BEHIND";
6835 	break;
6836       case NOBEHIND:
6837 	p = "NOBEHIND";
6838 	break;
6839       case SUBPAT:
6840 	p = "SUBPAT";
6841 	break;
6842       case BRACE_LIMITS:
6843 	p = "BRACE_LIMITS";
6844 	break;
6845       case BRACE_SIMPLE:
6846 	p = "BRACE_SIMPLE";
6847 	break;
6848       case BRACE_COMPLEX + 0:
6849       case BRACE_COMPLEX + 1:
6850       case BRACE_COMPLEX + 2:
6851       case BRACE_COMPLEX + 3:
6852       case BRACE_COMPLEX + 4:
6853       case BRACE_COMPLEX + 5:
6854       case BRACE_COMPLEX + 6:
6855       case BRACE_COMPLEX + 7:
6856       case BRACE_COMPLEX + 8:
6857       case BRACE_COMPLEX + 9:
6858 	sprintf(buf + STRLEN(buf), "BRACE_COMPLEX%d", OP(op) - BRACE_COMPLEX);
6859 	p = NULL;
6860 	break;
6861       case MULTIBYTECODE:
6862 	p = "MULTIBYTECODE";
6863 	break;
6864       case NEWL:
6865 	p = "NEWL";
6866 	break;
6867       default:
6868 	sprintf(buf + STRLEN(buf), "corrupt %d", OP(op));
6869 	p = NULL;
6870 	break;
6871     }
6872     if (p != NULL)
6873 	STRCAT(buf, p);
6874     return (char_u *)buf;
6875 }
6876 #endif	    /* DEBUG */
6877 
6878 /*
6879  * Used in a place where no * or \+ can follow.
6880  */
6881     static int
6882 re_mult_next(char *what)
6883 {
6884     if (re_multi_type(peekchr()) == MULTI_MULT)
6885     {
6886        semsg(_("E888: (NFA regexp) cannot repeat %s"), what);
6887        rc_did_emsg = TRUE;
6888        return FAIL;
6889     }
6890     return OK;
6891 }
6892 
6893 typedef struct
6894 {
6895     int a, b, c;
6896 } decomp_T;
6897 
6898 
6899 /* 0xfb20 - 0xfb4f */
6900 static decomp_T decomp_table[0xfb4f-0xfb20+1] =
6901 {
6902     {0x5e2,0,0},		/* 0xfb20	alt ayin */
6903     {0x5d0,0,0},		/* 0xfb21	alt alef */
6904     {0x5d3,0,0},		/* 0xfb22	alt dalet */
6905     {0x5d4,0,0},		/* 0xfb23	alt he */
6906     {0x5db,0,0},		/* 0xfb24	alt kaf */
6907     {0x5dc,0,0},		/* 0xfb25	alt lamed */
6908     {0x5dd,0,0},		/* 0xfb26	alt mem-sofit */
6909     {0x5e8,0,0},		/* 0xfb27	alt resh */
6910     {0x5ea,0,0},		/* 0xfb28	alt tav */
6911     {'+', 0, 0},		/* 0xfb29	alt plus */
6912     {0x5e9, 0x5c1, 0},		/* 0xfb2a	shin+shin-dot */
6913     {0x5e9, 0x5c2, 0},		/* 0xfb2b	shin+sin-dot */
6914     {0x5e9, 0x5c1, 0x5bc},	/* 0xfb2c	shin+shin-dot+dagesh */
6915     {0x5e9, 0x5c2, 0x5bc},	/* 0xfb2d	shin+sin-dot+dagesh */
6916     {0x5d0, 0x5b7, 0},		/* 0xfb2e	alef+patah */
6917     {0x5d0, 0x5b8, 0},		/* 0xfb2f	alef+qamats */
6918     {0x5d0, 0x5b4, 0},		/* 0xfb30	alef+hiriq */
6919     {0x5d1, 0x5bc, 0},		/* 0xfb31	bet+dagesh */
6920     {0x5d2, 0x5bc, 0},		/* 0xfb32	gimel+dagesh */
6921     {0x5d3, 0x5bc, 0},		/* 0xfb33	dalet+dagesh */
6922     {0x5d4, 0x5bc, 0},		/* 0xfb34	he+dagesh */
6923     {0x5d5, 0x5bc, 0},		/* 0xfb35	vav+dagesh */
6924     {0x5d6, 0x5bc, 0},		/* 0xfb36	zayin+dagesh */
6925     {0xfb37, 0, 0},		/* 0xfb37 -- UNUSED */
6926     {0x5d8, 0x5bc, 0},		/* 0xfb38	tet+dagesh */
6927     {0x5d9, 0x5bc, 0},		/* 0xfb39	yud+dagesh */
6928     {0x5da, 0x5bc, 0},		/* 0xfb3a	kaf sofit+dagesh */
6929     {0x5db, 0x5bc, 0},		/* 0xfb3b	kaf+dagesh */
6930     {0x5dc, 0x5bc, 0},		/* 0xfb3c	lamed+dagesh */
6931     {0xfb3d, 0, 0},		/* 0xfb3d -- UNUSED */
6932     {0x5de, 0x5bc, 0},		/* 0xfb3e	mem+dagesh */
6933     {0xfb3f, 0, 0},		/* 0xfb3f -- UNUSED */
6934     {0x5e0, 0x5bc, 0},		/* 0xfb40	nun+dagesh */
6935     {0x5e1, 0x5bc, 0},		/* 0xfb41	samech+dagesh */
6936     {0xfb42, 0, 0},		/* 0xfb42 -- UNUSED */
6937     {0x5e3, 0x5bc, 0},		/* 0xfb43	pe sofit+dagesh */
6938     {0x5e4, 0x5bc,0},		/* 0xfb44	pe+dagesh */
6939     {0xfb45, 0, 0},		/* 0xfb45 -- UNUSED */
6940     {0x5e6, 0x5bc, 0},		/* 0xfb46	tsadi+dagesh */
6941     {0x5e7, 0x5bc, 0},		/* 0xfb47	qof+dagesh */
6942     {0x5e8, 0x5bc, 0},		/* 0xfb48	resh+dagesh */
6943     {0x5e9, 0x5bc, 0},		/* 0xfb49	shin+dagesh */
6944     {0x5ea, 0x5bc, 0},		/* 0xfb4a	tav+dagesh */
6945     {0x5d5, 0x5b9, 0},		/* 0xfb4b	vav+holam */
6946     {0x5d1, 0x5bf, 0},		/* 0xfb4c	bet+rafe */
6947     {0x5db, 0x5bf, 0},		/* 0xfb4d	kaf+rafe */
6948     {0x5e4, 0x5bf, 0},		/* 0xfb4e	pe+rafe */
6949     {0x5d0, 0x5dc, 0}		/* 0xfb4f	alef-lamed */
6950 };
6951 
6952     static void
6953 mb_decompose(int c, int *c1, int *c2, int *c3)
6954 {
6955     decomp_T d;
6956 
6957     if (c >= 0xfb20 && c <= 0xfb4f)
6958     {
6959 	d = decomp_table[c - 0xfb20];
6960 	*c1 = d.a;
6961 	*c2 = d.b;
6962 	*c3 = d.c;
6963     }
6964     else
6965     {
6966 	*c1 = c;
6967 	*c2 = *c3 = 0;
6968     }
6969 }
6970 
6971 /*
6972  * Compare two strings, ignore case if rex.reg_ic set.
6973  * Return 0 if strings match, non-zero otherwise.
6974  * Correct the length "*n" when composing characters are ignored.
6975  */
6976     static int
6977 cstrncmp(char_u *s1, char_u *s2, int *n)
6978 {
6979     int		result;
6980 
6981     if (!rex.reg_ic)
6982 	result = STRNCMP(s1, s2, *n);
6983     else
6984 	result = MB_STRNICMP(s1, s2, *n);
6985 
6986     /* if it failed and it's utf8 and we want to combineignore: */
6987     if (result != 0 && enc_utf8 && rex.reg_icombine)
6988     {
6989 	char_u	*str1, *str2;
6990 	int	c1, c2, c11, c12;
6991 	int	junk;
6992 
6993 	/* we have to handle the strcmp ourselves, since it is necessary to
6994 	 * deal with the composing characters by ignoring them: */
6995 	str1 = s1;
6996 	str2 = s2;
6997 	c1 = c2 = 0;
6998 	while ((int)(str1 - s1) < *n)
6999 	{
7000 	    c1 = mb_ptr2char_adv(&str1);
7001 	    c2 = mb_ptr2char_adv(&str2);
7002 
7003 	    /* decompose the character if necessary, into 'base' characters
7004 	     * because I don't care about Arabic, I will hard-code the Hebrew
7005 	     * which I *do* care about!  So sue me... */
7006 	    if (c1 != c2 && (!rex.reg_ic || utf_fold(c1) != utf_fold(c2)))
7007 	    {
7008 		/* decomposition necessary? */
7009 		mb_decompose(c1, &c11, &junk, &junk);
7010 		mb_decompose(c2, &c12, &junk, &junk);
7011 		c1 = c11;
7012 		c2 = c12;
7013 		if (c11 != c12
7014 			    && (!rex.reg_ic || utf_fold(c11) != utf_fold(c12)))
7015 		    break;
7016 	    }
7017 	}
7018 	result = c2 - c1;
7019 	if (result == 0)
7020 	    *n = (int)(str2 - s2);
7021     }
7022 
7023     return result;
7024 }
7025 
7026 /*
7027  * cstrchr: This function is used a lot for simple searches, keep it fast!
7028  */
7029     static char_u *
7030 cstrchr(char_u *s, int c)
7031 {
7032     char_u	*p;
7033     int		cc;
7034 
7035     if (!rex.reg_ic || (!enc_utf8 && mb_char2len(c) > 1))
7036 	return vim_strchr(s, c);
7037 
7038     /* tolower() and toupper() can be slow, comparing twice should be a lot
7039      * faster (esp. when using MS Visual C++!).
7040      * For UTF-8 need to use folded case. */
7041     if (enc_utf8 && c > 0x80)
7042 	cc = utf_fold(c);
7043     else
7044 	 if (MB_ISUPPER(c))
7045 	cc = MB_TOLOWER(c);
7046     else if (MB_ISLOWER(c))
7047 	cc = MB_TOUPPER(c);
7048     else
7049 	return vim_strchr(s, c);
7050 
7051     if (has_mbyte)
7052     {
7053 	for (p = s; *p != NUL; p += (*mb_ptr2len)(p))
7054 	{
7055 	    if (enc_utf8 && c > 0x80)
7056 	    {
7057 		if (utf_fold(utf_ptr2char(p)) == cc)
7058 		    return p;
7059 	    }
7060 	    else if (*p == c || *p == cc)
7061 		return p;
7062 	}
7063     }
7064     else
7065 	/* Faster version for when there are no multi-byte characters. */
7066 	for (p = s; *p != NUL; ++p)
7067 	    if (*p == c || *p == cc)
7068 		return p;
7069 
7070     return NULL;
7071 }
7072 
7073 /***************************************************************
7074  *		      regsub stuff			       *
7075  ***************************************************************/
7076 
7077 /*
7078  * We should define ftpr as a pointer to a function returning a pointer to
7079  * a function returning a pointer to a function ...
7080  * This is impossible, so we declare a pointer to a function returning a
7081  * pointer to a function returning void. This should work for all compilers.
7082  */
7083 typedef void (*(*fptr_T)(int *, int))();
7084 
7085 static int vim_regsub_both(char_u *source, typval_T *expr, char_u *dest, int copy, int magic, int backslash);
7086 
7087     static fptr_T
7088 do_upper(int *d, int c)
7089 {
7090     *d = MB_TOUPPER(c);
7091 
7092     return (fptr_T)NULL;
7093 }
7094 
7095     static fptr_T
7096 do_Upper(int *d, int c)
7097 {
7098     *d = MB_TOUPPER(c);
7099 
7100     return (fptr_T)do_Upper;
7101 }
7102 
7103     static fptr_T
7104 do_lower(int *d, int c)
7105 {
7106     *d = MB_TOLOWER(c);
7107 
7108     return (fptr_T)NULL;
7109 }
7110 
7111     static fptr_T
7112 do_Lower(int *d, int c)
7113 {
7114     *d = MB_TOLOWER(c);
7115 
7116     return (fptr_T)do_Lower;
7117 }
7118 
7119 /*
7120  * regtilde(): Replace tildes in the pattern by the old pattern.
7121  *
7122  * Short explanation of the tilde: It stands for the previous replacement
7123  * pattern.  If that previous pattern also contains a ~ we should go back a
7124  * step further...  But we insert the previous pattern into the current one
7125  * and remember that.
7126  * This still does not handle the case where "magic" changes.  So require the
7127  * user to keep his hands off of "magic".
7128  *
7129  * The tildes are parsed once before the first call to vim_regsub().
7130  */
7131     char_u *
7132 regtilde(char_u *source, int magic)
7133 {
7134     char_u	*newsub = source;
7135     char_u	*tmpsub;
7136     char_u	*p;
7137     int		len;
7138     int		prevlen;
7139 
7140     for (p = newsub; *p; ++p)
7141     {
7142 	if ((*p == '~' && magic) || (*p == '\\' && *(p + 1) == '~' && !magic))
7143 	{
7144 	    if (reg_prev_sub != NULL)
7145 	    {
7146 		/* length = len(newsub) - 1 + len(prev_sub) + 1 */
7147 		prevlen = (int)STRLEN(reg_prev_sub);
7148 		tmpsub = alloc((unsigned)(STRLEN(newsub) + prevlen));
7149 		if (tmpsub != NULL)
7150 		{
7151 		    /* copy prefix */
7152 		    len = (int)(p - newsub);	/* not including ~ */
7153 		    mch_memmove(tmpsub, newsub, (size_t)len);
7154 		    /* interpret tilde */
7155 		    mch_memmove(tmpsub + len, reg_prev_sub, (size_t)prevlen);
7156 		    /* copy postfix */
7157 		    if (!magic)
7158 			++p;			/* back off \ */
7159 		    STRCPY(tmpsub + len + prevlen, p + 1);
7160 
7161 		    if (newsub != source)	/* already allocated newsub */
7162 			vim_free(newsub);
7163 		    newsub = tmpsub;
7164 		    p = newsub + len + prevlen;
7165 		}
7166 	    }
7167 	    else if (magic)
7168 		STRMOVE(p, p + 1);	/* remove '~' */
7169 	    else
7170 		STRMOVE(p, p + 2);	/* remove '\~' */
7171 	    --p;
7172 	}
7173 	else
7174 	{
7175 	    if (*p == '\\' && p[1])		/* skip escaped characters */
7176 		++p;
7177 	    if (has_mbyte)
7178 		p += (*mb_ptr2len)(p) - 1;
7179 	}
7180     }
7181 
7182     vim_free(reg_prev_sub);
7183     if (newsub != source)	/* newsub was allocated, just keep it */
7184 	reg_prev_sub = newsub;
7185     else			/* no ~ found, need to save newsub  */
7186 	reg_prev_sub = vim_strsave(newsub);
7187     return newsub;
7188 }
7189 
7190 #ifdef FEAT_EVAL
7191 static int can_f_submatch = FALSE;	/* TRUE when submatch() can be used */
7192 
7193 /* These pointers are used for reg_submatch().  Needed for when the
7194  * substitution string is an expression that contains a call to substitute()
7195  * and submatch(). */
7196 typedef struct {
7197     regmatch_T	*sm_match;
7198     regmmatch_T	*sm_mmatch;
7199     linenr_T	sm_firstlnum;
7200     linenr_T	sm_maxline;
7201     int		sm_line_lbr;
7202 } regsubmatch_T;
7203 
7204 static regsubmatch_T rsm;  /* can only be used when can_f_submatch is TRUE */
7205 #endif
7206 
7207 #if defined(FEAT_MODIFY_FNAME) || defined(FEAT_EVAL) || defined(PROTO)
7208 
7209 /*
7210  * Put the submatches in "argv[0]" which is a list passed into call_func() by
7211  * vim_regsub_both().
7212  */
7213     static int
7214 fill_submatch_list(int argc UNUSED, typval_T *argv, int argcount)
7215 {
7216     listitem_T	*li;
7217     int		i;
7218     char_u	*s;
7219 
7220     if (argcount == 0)
7221 	/* called function doesn't take an argument */
7222 	return 0;
7223 
7224     /* Relies on sl_list to be the first item in staticList10_T. */
7225     init_static_list((staticList10_T *)(argv->vval.v_list));
7226 
7227     /* There are always 10 list items in staticList10_T. */
7228     li = argv->vval.v_list->lv_first;
7229     for (i = 0; i < 10; ++i)
7230     {
7231 	s = rsm.sm_match->startp[i];
7232 	if (s == NULL || rsm.sm_match->endp[i] == NULL)
7233 	    s = NULL;
7234 	else
7235 	    s = vim_strnsave(s, (int)(rsm.sm_match->endp[i] - s));
7236 	li->li_tv.v_type = VAR_STRING;
7237 	li->li_tv.vval.v_string = s;
7238 	li = li->li_next;
7239     }
7240     return 1;
7241 }
7242 
7243     static void
7244 clear_submatch_list(staticList10_T *sl)
7245 {
7246     int i;
7247 
7248     for (i = 0; i < 10; ++i)
7249 	vim_free(sl->sl_items[i].li_tv.vval.v_string);
7250 }
7251 
7252 /*
7253  * vim_regsub() - perform substitutions after a vim_regexec() or
7254  * vim_regexec_multi() match.
7255  *
7256  * If "copy" is TRUE really copy into "dest".
7257  * If "copy" is FALSE nothing is copied, this is just to find out the length
7258  * of the result.
7259  *
7260  * If "backslash" is TRUE, a backslash will be removed later, need to double
7261  * them to keep them, and insert a backslash before a CR to avoid it being
7262  * replaced with a line break later.
7263  *
7264  * Note: The matched text must not change between the call of
7265  * vim_regexec()/vim_regexec_multi() and vim_regsub()!  It would make the back
7266  * references invalid!
7267  *
7268  * Returns the size of the replacement, including terminating NUL.
7269  */
7270     int
7271 vim_regsub(
7272     regmatch_T	*rmp,
7273     char_u	*source,
7274     typval_T	*expr,
7275     char_u	*dest,
7276     int		copy,
7277     int		magic,
7278     int		backslash)
7279 {
7280     int		result;
7281     regexec_T	rex_save;
7282     int		rex_in_use_save = rex_in_use;
7283 
7284     if (rex_in_use)
7285 	/* Being called recursively, save the state. */
7286 	rex_save = rex;
7287     rex_in_use = TRUE;
7288 
7289     rex.reg_match = rmp;
7290     rex.reg_mmatch = NULL;
7291     rex.reg_maxline = 0;
7292     rex.reg_buf = curbuf;
7293     rex.reg_line_lbr = TRUE;
7294     result = vim_regsub_both(source, expr, dest, copy, magic, backslash);
7295 
7296     rex_in_use = rex_in_use_save;
7297     if (rex_in_use)
7298 	rex = rex_save;
7299 
7300     return result;
7301 }
7302 #endif
7303 
7304     int
7305 vim_regsub_multi(
7306     regmmatch_T	*rmp,
7307     linenr_T	lnum,
7308     char_u	*source,
7309     char_u	*dest,
7310     int		copy,
7311     int		magic,
7312     int		backslash)
7313 {
7314     int		result;
7315     regexec_T	rex_save;
7316     int		rex_in_use_save = rex_in_use;
7317 
7318     if (rex_in_use)
7319 	/* Being called recursively, save the state. */
7320 	rex_save = rex;
7321     rex_in_use = TRUE;
7322 
7323     rex.reg_match = NULL;
7324     rex.reg_mmatch = rmp;
7325     rex.reg_buf = curbuf;	/* always works on the current buffer! */
7326     rex.reg_firstlnum = lnum;
7327     rex.reg_maxline = curbuf->b_ml.ml_line_count - lnum;
7328     rex.reg_line_lbr = FALSE;
7329     result = vim_regsub_both(source, NULL, dest, copy, magic, backslash);
7330 
7331     rex_in_use = rex_in_use_save;
7332     if (rex_in_use)
7333 	rex = rex_save;
7334 
7335     return result;
7336 }
7337 
7338     static int
7339 vim_regsub_both(
7340     char_u	*source,
7341     typval_T	*expr,
7342     char_u	*dest,
7343     int		copy,
7344     int		magic,
7345     int		backslash)
7346 {
7347     char_u	*src;
7348     char_u	*dst;
7349     char_u	*s;
7350     int		c;
7351     int		cc;
7352     int		no = -1;
7353     fptr_T	func_all = (fptr_T)NULL;
7354     fptr_T	func_one = (fptr_T)NULL;
7355     linenr_T	clnum = 0;	/* init for GCC */
7356     int		len = 0;	/* init for GCC */
7357 #ifdef FEAT_EVAL
7358     static char_u   *eval_result = NULL;
7359 #endif
7360 
7361     /* Be paranoid... */
7362     if ((source == NULL && expr == NULL) || dest == NULL)
7363     {
7364 	emsg(_(e_null));
7365 	return 0;
7366     }
7367     if (prog_magic_wrong())
7368 	return 0;
7369     src = source;
7370     dst = dest;
7371 
7372     /*
7373      * When the substitute part starts with "\=" evaluate it as an expression.
7374      */
7375     if (expr != NULL || (source[0] == '\\' && source[1] == '='))
7376     {
7377 #ifdef FEAT_EVAL
7378 	/* To make sure that the length doesn't change between checking the
7379 	 * length and copying the string, and to speed up things, the
7380 	 * resulting string is saved from the call with "copy" == FALSE to the
7381 	 * call with "copy" == TRUE. */
7382 	if (copy)
7383 	{
7384 	    if (eval_result != NULL)
7385 	    {
7386 		STRCPY(dest, eval_result);
7387 		dst += STRLEN(eval_result);
7388 		VIM_CLEAR(eval_result);
7389 	    }
7390 	}
7391 	else
7392 	{
7393 	    int		    prev_can_f_submatch = can_f_submatch;
7394 	    regsubmatch_T   rsm_save;
7395 
7396 	    vim_free(eval_result);
7397 
7398 	    /* The expression may contain substitute(), which calls us
7399 	     * recursively.  Make sure submatch() gets the text from the first
7400 	     * level. */
7401 	    if (can_f_submatch)
7402 		rsm_save = rsm;
7403 	    can_f_submatch = TRUE;
7404 	    rsm.sm_match = rex.reg_match;
7405 	    rsm.sm_mmatch = rex.reg_mmatch;
7406 	    rsm.sm_firstlnum = rex.reg_firstlnum;
7407 	    rsm.sm_maxline = rex.reg_maxline;
7408 	    rsm.sm_line_lbr = rex.reg_line_lbr;
7409 
7410 	    if (expr != NULL)
7411 	    {
7412 		typval_T	argv[2];
7413 		int		dummy;
7414 		char_u		buf[NUMBUFLEN];
7415 		typval_T	rettv;
7416 		staticList10_T	matchList;
7417 
7418 		rettv.v_type = VAR_STRING;
7419 		rettv.vval.v_string = NULL;
7420 		argv[0].v_type = VAR_LIST;
7421 		argv[0].vval.v_list = &matchList.sl_list;
7422 		matchList.sl_list.lv_len = 0;
7423 		if (expr->v_type == VAR_FUNC)
7424 		{
7425 		    s = expr->vval.v_string;
7426 		    call_func(s, (int)STRLEN(s), &rettv,
7427 				    1, argv, fill_submatch_list,
7428 					 0L, 0L, &dummy, TRUE, NULL, NULL);
7429 		}
7430 		else if (expr->v_type == VAR_PARTIAL)
7431 		{
7432 		    partial_T   *partial = expr->vval.v_partial;
7433 
7434 		    s = partial_name(partial);
7435 		    call_func(s, (int)STRLEN(s), &rettv,
7436 				    1, argv, fill_submatch_list,
7437 				      0L, 0L, &dummy, TRUE, partial, NULL);
7438 		}
7439 		if (matchList.sl_list.lv_len > 0)
7440 		    /* fill_submatch_list() was called */
7441 		    clear_submatch_list(&matchList);
7442 
7443 		eval_result = tv_get_string_buf_chk(&rettv, buf);
7444 		if (eval_result != NULL)
7445 		    eval_result = vim_strsave(eval_result);
7446 		clear_tv(&rettv);
7447 	    }
7448 	    else
7449 		eval_result = eval_to_string(source + 2, NULL, TRUE);
7450 
7451 	    if (eval_result != NULL)
7452 	    {
7453 		int had_backslash = FALSE;
7454 
7455 		for (s = eval_result; *s != NUL; MB_PTR_ADV(s))
7456 		{
7457 		    /* Change NL to CR, so that it becomes a line break,
7458 		     * unless called from vim_regexec_nl().
7459 		     * Skip over a backslashed character. */
7460 		    if (*s == NL && !rsm.sm_line_lbr)
7461 			*s = CAR;
7462 		    else if (*s == '\\' && s[1] != NUL)
7463 		    {
7464 			++s;
7465 			/* Change NL to CR here too, so that this works:
7466 			 * :s/abc\\\ndef/\="aaa\\\nbbb"/  on text:
7467 			 *   abc\
7468 			 *   def
7469 			 * Not when called from vim_regexec_nl().
7470 			 */
7471 			if (*s == NL && !rsm.sm_line_lbr)
7472 			    *s = CAR;
7473 			had_backslash = TRUE;
7474 		    }
7475 		}
7476 		if (had_backslash && backslash)
7477 		{
7478 		    /* Backslashes will be consumed, need to double them. */
7479 		    s = vim_strsave_escaped(eval_result, (char_u *)"\\");
7480 		    if (s != NULL)
7481 		    {
7482 			vim_free(eval_result);
7483 			eval_result = s;
7484 		    }
7485 		}
7486 
7487 		dst += STRLEN(eval_result);
7488 	    }
7489 
7490 	    can_f_submatch = prev_can_f_submatch;
7491 	    if (can_f_submatch)
7492 		rsm = rsm_save;
7493 	}
7494 #endif
7495     }
7496     else
7497       while ((c = *src++) != NUL)
7498       {
7499 	if (c == '&' && magic)
7500 	    no = 0;
7501 	else if (c == '\\' && *src != NUL)
7502 	{
7503 	    if (*src == '&' && !magic)
7504 	    {
7505 		++src;
7506 		no = 0;
7507 	    }
7508 	    else if ('0' <= *src && *src <= '9')
7509 	    {
7510 		no = *src++ - '0';
7511 	    }
7512 	    else if (vim_strchr((char_u *)"uUlLeE", *src))
7513 	    {
7514 		switch (*src++)
7515 		{
7516 		case 'u':   func_one = (fptr_T)do_upper;
7517 			    continue;
7518 		case 'U':   func_all = (fptr_T)do_Upper;
7519 			    continue;
7520 		case 'l':   func_one = (fptr_T)do_lower;
7521 			    continue;
7522 		case 'L':   func_all = (fptr_T)do_Lower;
7523 			    continue;
7524 		case 'e':
7525 		case 'E':   func_one = func_all = (fptr_T)NULL;
7526 			    continue;
7527 		}
7528 	    }
7529 	}
7530 	if (no < 0)	      /* Ordinary character. */
7531 	{
7532 	    if (c == K_SPECIAL && src[0] != NUL && src[1] != NUL)
7533 	    {
7534 		/* Copy a special key as-is. */
7535 		if (copy)
7536 		{
7537 		    *dst++ = c;
7538 		    *dst++ = *src++;
7539 		    *dst++ = *src++;
7540 		}
7541 		else
7542 		{
7543 		    dst += 3;
7544 		    src += 2;
7545 		}
7546 		continue;
7547 	    }
7548 
7549 	    if (c == '\\' && *src != NUL)
7550 	    {
7551 		/* Check for abbreviations -- webb */
7552 		switch (*src)
7553 		{
7554 		    case 'r':	c = CAR;	++src;	break;
7555 		    case 'n':	c = NL;		++src;	break;
7556 		    case 't':	c = TAB;	++src;	break;
7557 		 /* Oh no!  \e already has meaning in subst pat :-( */
7558 		 /* case 'e':   c = ESC;	++src;	break; */
7559 		    case 'b':	c = Ctrl_H;	++src;	break;
7560 
7561 		    /* If "backslash" is TRUE the backslash will be removed
7562 		     * later.  Used to insert a literal CR. */
7563 		    default:	if (backslash)
7564 				{
7565 				    if (copy)
7566 					*dst = '\\';
7567 				    ++dst;
7568 				}
7569 				c = *src++;
7570 		}
7571 	    }
7572 	    else if (has_mbyte)
7573 		c = mb_ptr2char(src - 1);
7574 
7575 	    /* Write to buffer, if copy is set. */
7576 	    if (func_one != (fptr_T)NULL)
7577 		/* Turbo C complains without the typecast */
7578 		func_one = (fptr_T)(func_one(&cc, c));
7579 	    else if (func_all != (fptr_T)NULL)
7580 		/* Turbo C complains without the typecast */
7581 		func_all = (fptr_T)(func_all(&cc, c));
7582 	    else /* just copy */
7583 		cc = c;
7584 
7585 	    if (has_mbyte)
7586 	    {
7587 		int totlen = mb_ptr2len(src - 1);
7588 
7589 		if (copy)
7590 		    mb_char2bytes(cc, dst);
7591 		dst += mb_char2len(cc) - 1;
7592 		if (enc_utf8)
7593 		{
7594 		    int clen = utf_ptr2len(src - 1);
7595 
7596 		    /* If the character length is shorter than "totlen", there
7597 		     * are composing characters; copy them as-is. */
7598 		    if (clen < totlen)
7599 		    {
7600 			if (copy)
7601 			    mch_memmove(dst + 1, src - 1 + clen,
7602 						     (size_t)(totlen - clen));
7603 			dst += totlen - clen;
7604 		    }
7605 		}
7606 		src += totlen - 1;
7607 	    }
7608 	    else if (copy)
7609 		    *dst = cc;
7610 	    dst++;
7611 	}
7612 	else
7613 	{
7614 	    if (REG_MULTI)
7615 	    {
7616 		clnum = rex.reg_mmatch->startpos[no].lnum;
7617 		if (clnum < 0 || rex.reg_mmatch->endpos[no].lnum < 0)
7618 		    s = NULL;
7619 		else
7620 		{
7621 		    s = reg_getline(clnum) + rex.reg_mmatch->startpos[no].col;
7622 		    if (rex.reg_mmatch->endpos[no].lnum == clnum)
7623 			len = rex.reg_mmatch->endpos[no].col
7624 					    - rex.reg_mmatch->startpos[no].col;
7625 		    else
7626 			len = (int)STRLEN(s);
7627 		}
7628 	    }
7629 	    else
7630 	    {
7631 		s = rex.reg_match->startp[no];
7632 		if (rex.reg_match->endp[no] == NULL)
7633 		    s = NULL;
7634 		else
7635 		    len = (int)(rex.reg_match->endp[no] - s);
7636 	    }
7637 	    if (s != NULL)
7638 	    {
7639 		for (;;)
7640 		{
7641 		    if (len == 0)
7642 		    {
7643 			if (REG_MULTI)
7644 			{
7645 			    if (rex.reg_mmatch->endpos[no].lnum == clnum)
7646 				break;
7647 			    if (copy)
7648 				*dst = CAR;
7649 			    ++dst;
7650 			    s = reg_getline(++clnum);
7651 			    if (rex.reg_mmatch->endpos[no].lnum == clnum)
7652 				len = rex.reg_mmatch->endpos[no].col;
7653 			    else
7654 				len = (int)STRLEN(s);
7655 			}
7656 			else
7657 			    break;
7658 		    }
7659 		    else if (*s == NUL) /* we hit NUL. */
7660 		    {
7661 			if (copy)
7662 			    emsg(_(e_re_damg));
7663 			goto exit;
7664 		    }
7665 		    else
7666 		    {
7667 			if (backslash && (*s == CAR || *s == '\\'))
7668 			{
7669 			    /*
7670 			     * Insert a backslash in front of a CR, otherwise
7671 			     * it will be replaced by a line break.
7672 			     * Number of backslashes will be halved later,
7673 			     * double them here.
7674 			     */
7675 			    if (copy)
7676 			    {
7677 				dst[0] = '\\';
7678 				dst[1] = *s;
7679 			    }
7680 			    dst += 2;
7681 			}
7682 			else
7683 			{
7684 			    if (has_mbyte)
7685 				c = mb_ptr2char(s);
7686 			    else
7687 				c = *s;
7688 
7689 			    if (func_one != (fptr_T)NULL)
7690 				/* Turbo C complains without the typecast */
7691 				func_one = (fptr_T)(func_one(&cc, c));
7692 			    else if (func_all != (fptr_T)NULL)
7693 				/* Turbo C complains without the typecast */
7694 				func_all = (fptr_T)(func_all(&cc, c));
7695 			    else /* just copy */
7696 				cc = c;
7697 
7698 			    if (has_mbyte)
7699 			    {
7700 				int l;
7701 
7702 				/* Copy composing characters separately, one
7703 				 * at a time. */
7704 				if (enc_utf8)
7705 				    l = utf_ptr2len(s) - 1;
7706 				else
7707 				    l = mb_ptr2len(s) - 1;
7708 
7709 				s += l;
7710 				len -= l;
7711 				if (copy)
7712 				    mb_char2bytes(cc, dst);
7713 				dst += mb_char2len(cc) - 1;
7714 			    }
7715 			    else if (copy)
7716 				    *dst = cc;
7717 			    dst++;
7718 			}
7719 
7720 			++s;
7721 			--len;
7722 		    }
7723 		}
7724 	    }
7725 	    no = -1;
7726 	}
7727       }
7728     if (copy)
7729 	*dst = NUL;
7730 
7731 exit:
7732     return (int)((dst - dest) + 1);
7733 }
7734 
7735 #ifdef FEAT_EVAL
7736 /*
7737  * Call reg_getline() with the line numbers from the submatch.  If a
7738  * substitute() was used the reg_maxline and other values have been
7739  * overwritten.
7740  */
7741     static char_u *
7742 reg_getline_submatch(linenr_T lnum)
7743 {
7744     char_u *s;
7745     linenr_T save_first = rex.reg_firstlnum;
7746     linenr_T save_max = rex.reg_maxline;
7747 
7748     rex.reg_firstlnum = rsm.sm_firstlnum;
7749     rex.reg_maxline = rsm.sm_maxline;
7750 
7751     s = reg_getline(lnum);
7752 
7753     rex.reg_firstlnum = save_first;
7754     rex.reg_maxline = save_max;
7755     return s;
7756 }
7757 
7758 /*
7759  * Used for the submatch() function: get the string from the n'th submatch in
7760  * allocated memory.
7761  * Returns NULL when not in a ":s" command and for a non-existing submatch.
7762  */
7763     char_u *
7764 reg_submatch(int no)
7765 {
7766     char_u	*retval = NULL;
7767     char_u	*s;
7768     int		len;
7769     int		round;
7770     linenr_T	lnum;
7771 
7772     if (!can_f_submatch || no < 0)
7773 	return NULL;
7774 
7775     if (rsm.sm_match == NULL)
7776     {
7777 	/*
7778 	 * First round: compute the length and allocate memory.
7779 	 * Second round: copy the text.
7780 	 */
7781 	for (round = 1; round <= 2; ++round)
7782 	{
7783 	    lnum = rsm.sm_mmatch->startpos[no].lnum;
7784 	    if (lnum < 0 || rsm.sm_mmatch->endpos[no].lnum < 0)
7785 		return NULL;
7786 
7787 	    s = reg_getline_submatch(lnum) + rsm.sm_mmatch->startpos[no].col;
7788 	    if (s == NULL)  /* anti-crash check, cannot happen? */
7789 		break;
7790 	    if (rsm.sm_mmatch->endpos[no].lnum == lnum)
7791 	    {
7792 		/* Within one line: take form start to end col. */
7793 		len = rsm.sm_mmatch->endpos[no].col
7794 					  - rsm.sm_mmatch->startpos[no].col;
7795 		if (round == 2)
7796 		    vim_strncpy(retval, s, len);
7797 		++len;
7798 	    }
7799 	    else
7800 	    {
7801 		/* Multiple lines: take start line from start col, middle
7802 		 * lines completely and end line up to end col. */
7803 		len = (int)STRLEN(s);
7804 		if (round == 2)
7805 		{
7806 		    STRCPY(retval, s);
7807 		    retval[len] = '\n';
7808 		}
7809 		++len;
7810 		++lnum;
7811 		while (lnum < rsm.sm_mmatch->endpos[no].lnum)
7812 		{
7813 		    s = reg_getline_submatch(lnum++);
7814 		    if (round == 2)
7815 			STRCPY(retval + len, s);
7816 		    len += (int)STRLEN(s);
7817 		    if (round == 2)
7818 			retval[len] = '\n';
7819 		    ++len;
7820 		}
7821 		if (round == 2)
7822 		    STRNCPY(retval + len, reg_getline_submatch(lnum),
7823 					     rsm.sm_mmatch->endpos[no].col);
7824 		len += rsm.sm_mmatch->endpos[no].col;
7825 		if (round == 2)
7826 		    retval[len] = NUL;
7827 		++len;
7828 	    }
7829 
7830 	    if (retval == NULL)
7831 	    {
7832 		retval = lalloc((long_u)len, TRUE);
7833 		if (retval == NULL)
7834 		    return NULL;
7835 	    }
7836 	}
7837     }
7838     else
7839     {
7840 	s = rsm.sm_match->startp[no];
7841 	if (s == NULL || rsm.sm_match->endp[no] == NULL)
7842 	    retval = NULL;
7843 	else
7844 	    retval = vim_strnsave(s, (int)(rsm.sm_match->endp[no] - s));
7845     }
7846 
7847     return retval;
7848 }
7849 
7850 /*
7851  * Used for the submatch() function with the optional non-zero argument: get
7852  * the list of strings from the n'th submatch in allocated memory with NULs
7853  * represented in NLs.
7854  * Returns a list of allocated strings.  Returns NULL when not in a ":s"
7855  * command, for a non-existing submatch and for any error.
7856  */
7857     list_T *
7858 reg_submatch_list(int no)
7859 {
7860     char_u	*s;
7861     linenr_T	slnum;
7862     linenr_T	elnum;
7863     colnr_T	scol;
7864     colnr_T	ecol;
7865     int		i;
7866     list_T	*list;
7867     int		error = FALSE;
7868 
7869     if (!can_f_submatch || no < 0)
7870 	return NULL;
7871 
7872     if (rsm.sm_match == NULL)
7873     {
7874 	slnum = rsm.sm_mmatch->startpos[no].lnum;
7875 	elnum = rsm.sm_mmatch->endpos[no].lnum;
7876 	if (slnum < 0 || elnum < 0)
7877 	    return NULL;
7878 
7879 	scol = rsm.sm_mmatch->startpos[no].col;
7880 	ecol = rsm.sm_mmatch->endpos[no].col;
7881 
7882 	list = list_alloc();
7883 	if (list == NULL)
7884 	    return NULL;
7885 
7886 	s = reg_getline_submatch(slnum) + scol;
7887 	if (slnum == elnum)
7888 	{
7889 	    if (list_append_string(list, s, ecol - scol) == FAIL)
7890 		error = TRUE;
7891 	}
7892 	else
7893 	{
7894 	    if (list_append_string(list, s, -1) == FAIL)
7895 		error = TRUE;
7896 	    for (i = 1; i < elnum - slnum; i++)
7897 	    {
7898 		s = reg_getline_submatch(slnum + i);
7899 		if (list_append_string(list, s, -1) == FAIL)
7900 		    error = TRUE;
7901 	    }
7902 	    s = reg_getline_submatch(elnum);
7903 	    if (list_append_string(list, s, ecol) == FAIL)
7904 		error = TRUE;
7905 	}
7906     }
7907     else
7908     {
7909 	s = rsm.sm_match->startp[no];
7910 	if (s == NULL || rsm.sm_match->endp[no] == NULL)
7911 	    return NULL;
7912 	list = list_alloc();
7913 	if (list == NULL)
7914 	    return NULL;
7915 	if (list_append_string(list, s,
7916 				 (int)(rsm.sm_match->endp[no] - s)) == FAIL)
7917 	    error = TRUE;
7918     }
7919 
7920     if (error)
7921     {
7922 	list_free(list);
7923 	return NULL;
7924     }
7925     return list;
7926 }
7927 #endif
7928 
7929 static regengine_T bt_regengine =
7930 {
7931     bt_regcomp,
7932     bt_regfree,
7933     bt_regexec_nl,
7934     bt_regexec_multi,
7935     (char_u *)""
7936 };
7937 
7938 #include "regexp_nfa.c"
7939 
7940 static regengine_T nfa_regengine =
7941 {
7942     nfa_regcomp,
7943     nfa_regfree,
7944     nfa_regexec_nl,
7945     nfa_regexec_multi,
7946     (char_u *)""
7947 };
7948 
7949 /* Which regexp engine to use? Needed for vim_regcomp().
7950  * Must match with 'regexpengine'. */
7951 static int regexp_engine = 0;
7952 
7953 #ifdef DEBUG
7954 static char_u regname[][30] = {
7955 		    "AUTOMATIC Regexp Engine",
7956 		    "BACKTRACKING Regexp Engine",
7957 		    "NFA Regexp Engine"
7958 			    };
7959 #endif
7960 
7961 /*
7962  * Compile a regular expression into internal code.
7963  * Returns the program in allocated memory.
7964  * Use vim_regfree() to free the memory.
7965  * Returns NULL for an error.
7966  */
7967     regprog_T *
7968 vim_regcomp(char_u *expr_arg, int re_flags)
7969 {
7970     regprog_T   *prog = NULL;
7971     char_u	*expr = expr_arg;
7972 
7973     regexp_engine = p_re;
7974 
7975     /* Check for prefix "\%#=", that sets the regexp engine */
7976     if (STRNCMP(expr, "\\%#=", 4) == 0)
7977     {
7978 	int newengine = expr[4] - '0';
7979 
7980 	if (newengine == AUTOMATIC_ENGINE
7981 	    || newengine == BACKTRACKING_ENGINE
7982 	    || newengine == NFA_ENGINE)
7983 	{
7984 	    regexp_engine = expr[4] - '0';
7985 	    expr += 5;
7986 #ifdef DEBUG
7987 	    smsg("New regexp mode selected (%d): %s",
7988 					   regexp_engine, regname[newengine]);
7989 #endif
7990 	}
7991 	else
7992 	{
7993 	    emsg(_("E864: \\%#= can only be followed by 0, 1, or 2. The automatic engine will be used "));
7994 	    regexp_engine = AUTOMATIC_ENGINE;
7995 	}
7996     }
7997 #ifdef DEBUG
7998     bt_regengine.expr = expr;
7999     nfa_regengine.expr = expr;
8000 #endif
8001 
8002     /*
8003      * First try the NFA engine, unless backtracking was requested.
8004      */
8005     if (regexp_engine != BACKTRACKING_ENGINE)
8006 	prog = nfa_regengine.regcomp(expr,
8007 		re_flags + (regexp_engine == AUTOMATIC_ENGINE ? RE_AUTO : 0));
8008     else
8009 	prog = bt_regengine.regcomp(expr, re_flags);
8010 
8011     /* Check for error compiling regexp with initial engine. */
8012     if (prog == NULL)
8013     {
8014 #ifdef BT_REGEXP_DEBUG_LOG
8015 	if (regexp_engine != BACKTRACKING_ENGINE)   /* debugging log for NFA */
8016 	{
8017 	    FILE *f;
8018 	    f = fopen(BT_REGEXP_DEBUG_LOG_NAME, "a");
8019 	    if (f)
8020 	    {
8021 		fprintf(f, "Syntax error in \"%s\"\n", expr);
8022 		fclose(f);
8023 	    }
8024 	    else
8025 		semsg("(NFA) Could not open \"%s\" to write !!!",
8026 			BT_REGEXP_DEBUG_LOG_NAME);
8027 	}
8028 #endif
8029 	/*
8030 	 * If the NFA engine failed, try the backtracking engine.
8031 	 * The NFA engine also fails for patterns that it can't handle well
8032 	 * but are still valid patterns, thus a retry should work.
8033 	 */
8034 	if (regexp_engine == AUTOMATIC_ENGINE)
8035 	{
8036 	    regexp_engine = BACKTRACKING_ENGINE;
8037 	    prog = bt_regengine.regcomp(expr, re_flags);
8038 	}
8039     }
8040 
8041     if (prog != NULL)
8042     {
8043 	/* Store the info needed to call regcomp() again when the engine turns
8044 	 * out to be very slow when executing it. */
8045 	prog->re_engine = regexp_engine;
8046 	prog->re_flags  = re_flags;
8047     }
8048 
8049     return prog;
8050 }
8051 
8052 /*
8053  * Free a compiled regexp program, returned by vim_regcomp().
8054  */
8055     void
8056 vim_regfree(regprog_T *prog)
8057 {
8058     if (prog != NULL)
8059 	prog->engine->regfree(prog);
8060 }
8061 
8062 #ifdef FEAT_EVAL
8063     static void
8064 report_re_switch(char_u *pat)
8065 {
8066     if (p_verbose > 0)
8067     {
8068 	verbose_enter();
8069 	msg_puts(_("Switching to backtracking RE engine for pattern: "));
8070 	msg_puts((char *)pat);
8071 	verbose_leave();
8072     }
8073 }
8074 #endif
8075 
8076 #if (defined(FEAT_X11) && (defined(FEAT_TITLE) || defined(FEAT_XCLIPBOARD))) \
8077 	|| defined(PROTO)
8078 /*
8079  * Return whether "prog" is currently being executed.
8080  */
8081     int
8082 regprog_in_use(regprog_T *prog)
8083 {
8084     return prog->re_in_use;
8085 }
8086 #endif
8087 
8088 /*
8089  * Match a regexp against a string.
8090  * "rmp->regprog" is a compiled regexp as returned by vim_regcomp().
8091  * Note: "rmp->regprog" may be freed and changed.
8092  * Uses curbuf for line count and 'iskeyword'.
8093  * When "nl" is TRUE consider a "\n" in "line" to be a line break.
8094  *
8095  * Return TRUE if there is a match, FALSE if not.
8096  */
8097     static int
8098 vim_regexec_string(
8099     regmatch_T	*rmp,
8100     char_u	*line,  /* string to match against */
8101     colnr_T	col,    /* column to start looking for match */
8102     int		nl)
8103 {
8104     int		result;
8105     regexec_T	rex_save;
8106     int		rex_in_use_save = rex_in_use;
8107 
8108     // Cannot use the same prog recursively, it contains state.
8109     if (rmp->regprog->re_in_use)
8110     {
8111 	emsg(_(e_recursive));
8112 	return FALSE;
8113     }
8114     rmp->regprog->re_in_use = TRUE;
8115 
8116     if (rex_in_use)
8117 	// Being called recursively, save the state.
8118 	rex_save = rex;
8119     rex_in_use = TRUE;
8120 
8121     rex.reg_startp = NULL;
8122     rex.reg_endp = NULL;
8123     rex.reg_startpos = NULL;
8124     rex.reg_endpos = NULL;
8125 
8126     result = rmp->regprog->engine->regexec_nl(rmp, line, col, nl);
8127     rmp->regprog->re_in_use = FALSE;
8128 
8129     /* NFA engine aborted because it's very slow. */
8130     if (rmp->regprog->re_engine == AUTOMATIC_ENGINE
8131 					       && result == NFA_TOO_EXPENSIVE)
8132     {
8133 	int    save_p_re = p_re;
8134 	int    re_flags = rmp->regprog->re_flags;
8135 	char_u *pat = vim_strsave(((nfa_regprog_T *)rmp->regprog)->pattern);
8136 
8137 	p_re = BACKTRACKING_ENGINE;
8138 	vim_regfree(rmp->regprog);
8139 	if (pat != NULL)
8140 	{
8141 #ifdef FEAT_EVAL
8142 	    report_re_switch(pat);
8143 #endif
8144 	    rmp->regprog = vim_regcomp(pat, re_flags);
8145 	    if (rmp->regprog != NULL)
8146 	    {
8147 		rmp->regprog->re_in_use = TRUE;
8148 		result = rmp->regprog->engine->regexec_nl(rmp, line, col, nl);
8149 		rmp->regprog->re_in_use = FALSE;
8150 	    }
8151 	    vim_free(pat);
8152 	}
8153 
8154 	p_re = save_p_re;
8155     }
8156 
8157     rex_in_use = rex_in_use_save;
8158     if (rex_in_use)
8159 	rex = rex_save;
8160 
8161     return result > 0;
8162 }
8163 
8164 /*
8165  * Note: "*prog" may be freed and changed.
8166  * Return TRUE if there is a match, FALSE if not.
8167  */
8168     int
8169 vim_regexec_prog(
8170     regprog_T	**prog,
8171     int		ignore_case,
8172     char_u	*line,
8173     colnr_T	col)
8174 {
8175     int		r;
8176     regmatch_T	regmatch;
8177 
8178     regmatch.regprog = *prog;
8179     regmatch.rm_ic = ignore_case;
8180     r = vim_regexec_string(&regmatch, line, col, FALSE);
8181     *prog = regmatch.regprog;
8182     return r;
8183 }
8184 
8185 /*
8186  * Note: "rmp->regprog" may be freed and changed.
8187  * Return TRUE if there is a match, FALSE if not.
8188  */
8189     int
8190 vim_regexec(regmatch_T *rmp, char_u *line, colnr_T col)
8191 {
8192     return vim_regexec_string(rmp, line, col, FALSE);
8193 }
8194 
8195 #if defined(FEAT_MODIFY_FNAME) || defined(FEAT_EVAL) \
8196 	|| defined(FIND_REPLACE_DIALOG) || defined(PROTO)
8197 /*
8198  * Like vim_regexec(), but consider a "\n" in "line" to be a line break.
8199  * Note: "rmp->regprog" may be freed and changed.
8200  * Return TRUE if there is a match, FALSE if not.
8201  */
8202     int
8203 vim_regexec_nl(regmatch_T *rmp, char_u *line, colnr_T col)
8204 {
8205     return vim_regexec_string(rmp, line, col, TRUE);
8206 }
8207 #endif
8208 
8209 /*
8210  * Match a regexp against multiple lines.
8211  * "rmp->regprog" must be a compiled regexp as returned by vim_regcomp().
8212  * Note: "rmp->regprog" may be freed and changed, even set to NULL.
8213  * Uses curbuf for line count and 'iskeyword'.
8214  *
8215  * Return zero if there is no match.  Return number of lines contained in the
8216  * match otherwise.
8217  */
8218     long
8219 vim_regexec_multi(
8220     regmmatch_T *rmp,
8221     win_T       *win,		/* window in which to search or NULL */
8222     buf_T       *buf,		/* buffer in which to search */
8223     linenr_T	lnum,		/* nr of line to start looking for match */
8224     colnr_T	col,		/* column to start looking for match */
8225     proftime_T	*tm,		/* timeout limit or NULL */
8226     int		*timed_out)	/* flag is set when timeout limit reached */
8227 {
8228     int		result;
8229     regexec_T	rex_save;
8230     int		rex_in_use_save = rex_in_use;
8231 
8232     // Cannot use the same prog recursively, it contains state.
8233     if (rmp->regprog->re_in_use)
8234     {
8235 	emsg(_(e_recursive));
8236 	return FALSE;
8237     }
8238     rmp->regprog->re_in_use = TRUE;
8239 
8240     if (rex_in_use)
8241 	/* Being called recursively, save the state. */
8242 	rex_save = rex;
8243     rex_in_use = TRUE;
8244 
8245     result = rmp->regprog->engine->regexec_multi(
8246 				      rmp, win, buf, lnum, col, tm, timed_out);
8247     rmp->regprog->re_in_use = FALSE;
8248 
8249     /* NFA engine aborted because it's very slow. */
8250     if (rmp->regprog->re_engine == AUTOMATIC_ENGINE
8251 					       && result == NFA_TOO_EXPENSIVE)
8252     {
8253 	int    save_p_re = p_re;
8254 	int    re_flags = rmp->regprog->re_flags;
8255 	char_u *pat = vim_strsave(((nfa_regprog_T *)rmp->regprog)->pattern);
8256 
8257 	p_re = BACKTRACKING_ENGINE;
8258 	vim_regfree(rmp->regprog);
8259 	if (pat != NULL)
8260 	{
8261 #ifdef FEAT_EVAL
8262 	    report_re_switch(pat);
8263 #endif
8264 #ifdef FEAT_SYN_HL
8265 	    // checking for \z misuse was already done when compiling for NFA,
8266 	    // allow all here
8267 	    reg_do_extmatch = REX_ALL;
8268 #endif
8269 	    rmp->regprog = vim_regcomp(pat, re_flags);
8270 #ifdef FEAT_SYN_HL
8271 	    reg_do_extmatch = 0;
8272 #endif
8273 
8274 	    if (rmp->regprog != NULL)
8275 	    {
8276 		rmp->regprog->re_in_use = TRUE;
8277 		result = rmp->regprog->engine->regexec_multi(
8278 				      rmp, win, buf, lnum, col, tm, timed_out);
8279 		rmp->regprog->re_in_use = FALSE;
8280 	    }
8281 	    vim_free(pat);
8282 	}
8283 	p_re = save_p_re;
8284     }
8285 
8286     rex_in_use = rex_in_use_save;
8287     if (rex_in_use)
8288 	rex = rex_save;
8289 
8290     return result <= 0 ? 0 : result;
8291 }
8292