xref: /vim-8.2.3635/src/regexp.c (revision e16b00a1)
1 /* vi:set ts=8 sts=4 sw=4 noet:
2  *
3  * Handling of regular expressions: vim_regcomp(), vim_regexec(), vim_regsub()
4  *
5  * NOTICE:
6  *
7  * This is NOT the original regular expression code as written by Henry
8  * Spencer.  This code has been modified specifically for use with the VIM
9  * editor, and should not be used separately from Vim.  If you want a good
10  * regular expression library, get the original code.  The copyright notice
11  * that follows is from the original.
12  *
13  * END NOTICE
14  *
15  *	Copyright (c) 1986 by University of Toronto.
16  *	Written by Henry Spencer.  Not derived from licensed software.
17  *
18  *	Permission is granted to anyone to use this software for any
19  *	purpose on any computer system, and to redistribute it freely,
20  *	subject to the following restrictions:
21  *
22  *	1. The author is not responsible for the consequences of use of
23  *		this software, no matter how awful, even if they arise
24  *		from defects in it.
25  *
26  *	2. The origin of this software must not be misrepresented, either
27  *		by explicit claim or by omission.
28  *
29  *	3. Altered versions must be plainly marked as such, and must not
30  *		be misrepresented as being the original software.
31  *
32  * Beware that some of this code is subtly aware of the way operator
33  * precedence is structured in regular expressions.  Serious changes in
34  * regular-expression syntax might require a total rethink.
35  *
36  * Changes have been made by Tony Andrews, Olaf 'Rhialto' Seibert, Robert
37  * Webb, Ciaran McCreesh and Bram Moolenaar.
38  * Named character class support added by Walter Briscoe (1998 Jul 01)
39  */
40 
41 /* Uncomment the first if you do not want to see debugging logs or files
42  * related to regular expressions, even when compiling with -DDEBUG.
43  * Uncomment the second to get the regexp debugging. */
44 /* #undef DEBUG */
45 /* #define DEBUG */
46 
47 #include "vim.h"
48 
49 #ifdef DEBUG
50 /* show/save debugging data when BT engine is used */
51 # define BT_REGEXP_DUMP
52 /* save the debugging data to a file instead of displaying it */
53 # define BT_REGEXP_LOG
54 # define BT_REGEXP_DEBUG_LOG
55 # define BT_REGEXP_DEBUG_LOG_NAME	"bt_regexp_debug.log"
56 #endif
57 
58 /*
59  * The "internal use only" fields in regexp.h are present to pass info from
60  * compile to execute that permits the execute phase to run lots faster on
61  * simple cases.  They are:
62  *
63  * regstart	char that must begin a match; NUL if none obvious; Can be a
64  *		multi-byte character.
65  * reganch	is the match anchored (at beginning-of-line only)?
66  * regmust	string (pointer into program) that match must include, or NULL
67  * regmlen	length of regmust string
68  * regflags	RF_ values or'ed together
69  *
70  * Regstart and reganch permit very fast decisions on suitable starting points
71  * for a match, cutting down the work a lot.  Regmust permits fast rejection
72  * of lines that cannot possibly match.  The regmust tests are costly enough
73  * that vim_regcomp() supplies a regmust only if the r.e. contains something
74  * potentially expensive (at present, the only such thing detected is * or +
75  * at the start of the r.e., which can involve a lot of backup).  Regmlen is
76  * supplied because the test in vim_regexec() needs it and vim_regcomp() is
77  * computing it anyway.
78  */
79 
80 /*
81  * Structure for regexp "program".  This is essentially a linear encoding
82  * of a nondeterministic finite-state machine (aka syntax charts or
83  * "railroad normal form" in parsing technology).  Each node is an opcode
84  * plus a "next" pointer, possibly plus an operand.  "Next" pointers of
85  * all nodes except BRANCH and BRACES_COMPLEX implement concatenation; a "next"
86  * pointer with a BRANCH on both ends of it is connecting two alternatives.
87  * (Here we have one of the subtle syntax dependencies:	an individual BRANCH
88  * (as opposed to a collection of them) is never concatenated with anything
89  * because of operator precedence).  The "next" pointer of a BRACES_COMPLEX
90  * node points to the node after the stuff to be repeated.
91  * The operand of some types of node is a literal string; for others, it is a
92  * node leading into a sub-FSM.  In particular, the operand of a BRANCH node
93  * is the first node of the branch.
94  * (NB this is *not* a tree structure: the tail of the branch connects to the
95  * thing following the set of BRANCHes.)
96  *
97  * pattern	is coded like:
98  *
99  *			  +-----------------+
100  *			  |		    V
101  * <aa>\|<bb>	BRANCH <aa> BRANCH <bb> --> END
102  *		     |	    ^	 |	    ^
103  *		     +------+	 +----------+
104  *
105  *
106  *		       +------------------+
107  *		       V		  |
108  * <aa>*	BRANCH BRANCH <aa> --> BACK BRANCH --> NOTHING --> END
109  *		     |	    |		    ^			   ^
110  *		     |	    +---------------+			   |
111  *		     +---------------------------------------------+
112  *
113  *
114  *		       +----------------------+
115  *		       V		      |
116  * <aa>\+	BRANCH <aa> --> BRANCH --> BACK  BRANCH --> NOTHING --> END
117  *		     |		     |		 ^			^
118  *		     |		     +-----------+			|
119  *		     +--------------------------------------------------+
120  *
121  *
122  *					+-------------------------+
123  *					V			  |
124  * <aa>\{}	BRANCH BRACE_LIMITS --> BRACE_COMPLEX <aa> --> BACK  END
125  *		     |				    |		     ^
126  *		     |				    +----------------+
127  *		     +-----------------------------------------------+
128  *
129  *
130  * <aa>\@!<bb>	BRANCH NOMATCH <aa> --> END  <bb> --> END
131  *		     |	     |		      ^       ^
132  *		     |	     +----------------+       |
133  *		     +--------------------------------+
134  *
135  *						      +---------+
136  *						      |		V
137  * \z[abc]	BRANCH BRANCH  a  BRANCH  b  BRANCH  c	BRANCH	NOTHING --> END
138  *		     |	    |	       |	  |	^		    ^
139  *		     |	    |	       |	  +-----+		    |
140  *		     |	    |	       +----------------+		    |
141  *		     |	    +---------------------------+		    |
142  *		     +------------------------------------------------------+
143  *
144  * They all start with a BRANCH for "\|" alternatives, even when there is only
145  * one alternative.
146  */
147 
148 /*
149  * The opcodes are:
150  */
151 
152 /* definition	number		   opnd?    meaning */
153 #define END		0	/*	End of program or NOMATCH operand. */
154 #define BOL		1	/*	Match "" at beginning of line. */
155 #define EOL		2	/*	Match "" at end of line. */
156 #define BRANCH		3	/* node Match this alternative, or the
157 				 *	next... */
158 #define BACK		4	/*	Match "", "next" ptr points backward. */
159 #define EXACTLY		5	/* str	Match this string. */
160 #define NOTHING		6	/*	Match empty string. */
161 #define STAR		7	/* node Match this (simple) thing 0 or more
162 				 *	times. */
163 #define PLUS		8	/* node Match this (simple) thing 1 or more
164 				 *	times. */
165 #define MATCH		9	/* node match the operand zero-width */
166 #define NOMATCH		10	/* node check for no match with operand */
167 #define BEHIND		11	/* node look behind for a match with operand */
168 #define NOBEHIND	12	/* node look behind for no match with operand */
169 #define SUBPAT		13	/* node match the operand here */
170 #define BRACE_SIMPLE	14	/* node Match this (simple) thing between m and
171 				 *	n times (\{m,n\}). */
172 #define BOW		15	/*	Match "" after [^a-zA-Z0-9_] */
173 #define EOW		16	/*	Match "" at    [^a-zA-Z0-9_] */
174 #define BRACE_LIMITS	17	/* nr nr  define the min & max for BRACE_SIMPLE
175 				 *	and BRACE_COMPLEX. */
176 #define NEWL		18	/*	Match line-break */
177 #define BHPOS		19	/*	End position for BEHIND or NOBEHIND */
178 
179 
180 /* character classes: 20-48 normal, 50-78 include a line-break */
181 #define ADD_NL		30
182 #define FIRST_NL	ANY + ADD_NL
183 #define ANY		20	/*	Match any one character. */
184 #define ANYOF		21	/* str	Match any character in this string. */
185 #define ANYBUT		22	/* str	Match any character not in this
186 				 *	string. */
187 #define IDENT		23	/*	Match identifier char */
188 #define SIDENT		24	/*	Match identifier char but no digit */
189 #define KWORD		25	/*	Match keyword char */
190 #define SKWORD		26	/*	Match word char but no digit */
191 #define FNAME		27	/*	Match file name char */
192 #define SFNAME		28	/*	Match file name char but no digit */
193 #define PRINT		29	/*	Match printable char */
194 #define SPRINT		30	/*	Match printable char but no digit */
195 #define WHITE		31	/*	Match whitespace char */
196 #define NWHITE		32	/*	Match non-whitespace char */
197 #define DIGIT		33	/*	Match digit char */
198 #define NDIGIT		34	/*	Match non-digit char */
199 #define HEX		35	/*	Match hex char */
200 #define NHEX		36	/*	Match non-hex char */
201 #define OCTAL		37	/*	Match octal char */
202 #define NOCTAL		38	/*	Match non-octal char */
203 #define WORD		39	/*	Match word char */
204 #define NWORD		40	/*	Match non-word char */
205 #define HEAD		41	/*	Match head char */
206 #define NHEAD		42	/*	Match non-head char */
207 #define ALPHA		43	/*	Match alpha char */
208 #define NALPHA		44	/*	Match non-alpha char */
209 #define LOWER		45	/*	Match lowercase char */
210 #define NLOWER		46	/*	Match non-lowercase char */
211 #define UPPER		47	/*	Match uppercase char */
212 #define NUPPER		48	/*	Match non-uppercase char */
213 #define LAST_NL		NUPPER + ADD_NL
214 #define WITH_NL(op)	((op) >= FIRST_NL && (op) <= LAST_NL)
215 
216 #define MOPEN		80  /* -89	 Mark this point in input as start of
217 				 *	 \( subexpr.  MOPEN + 0 marks start of
218 				 *	 match. */
219 #define MCLOSE		90  /* -99	 Analogous to MOPEN.  MCLOSE + 0 marks
220 				 *	 end of match. */
221 #define BACKREF		100 /* -109 node Match same string again \1-\9 */
222 
223 #ifdef FEAT_SYN_HL
224 # define ZOPEN		110 /* -119	 Mark this point in input as start of
225 				 *	 \z( subexpr. */
226 # define ZCLOSE		120 /* -129	 Analogous to ZOPEN. */
227 # define ZREF		130 /* -139 node Match external submatch \z1-\z9 */
228 #endif
229 
230 #define BRACE_COMPLEX	140 /* -149 node Match nodes between m & n times */
231 
232 #define NOPEN		150	/*	Mark this point in input as start of
233 					\%( subexpr. */
234 #define NCLOSE		151	/*	Analogous to NOPEN. */
235 
236 #define MULTIBYTECODE	200	/* mbc	Match one multi-byte character */
237 #define RE_BOF		201	/*	Match "" at beginning of file. */
238 #define RE_EOF		202	/*	Match "" at end of file. */
239 #define CURSOR		203	/*	Match location of cursor. */
240 
241 #define RE_LNUM		204	/* nr cmp  Match line number */
242 #define RE_COL		205	/* nr cmp  Match column number */
243 #define RE_VCOL		206	/* nr cmp  Match virtual column number */
244 
245 #define RE_MARK		207	/* mark cmp  Match mark position */
246 #define RE_VISUAL	208	/*	Match Visual area */
247 #define RE_COMPOSING	209	/* any composing characters */
248 
249 /*
250  * Magic characters have a special meaning, they don't match literally.
251  * Magic characters are negative.  This separates them from literal characters
252  * (possibly multi-byte).  Only ASCII characters can be Magic.
253  */
254 #define Magic(x)	((int)(x) - 256)
255 #define un_Magic(x)	((x) + 256)
256 #define is_Magic(x)	((x) < 0)
257 
258     static int
259 no_Magic(int x)
260 {
261     if (is_Magic(x))
262 	return un_Magic(x);
263     return x;
264 }
265 
266     static int
267 toggle_Magic(int x)
268 {
269     if (is_Magic(x))
270 	return un_Magic(x);
271     return Magic(x);
272 }
273 
274 /*
275  * The first byte of the regexp internal "program" is actually this magic
276  * number; the start node begins in the second byte.  It's used to catch the
277  * most severe mutilation of the program by the caller.
278  */
279 
280 #define REGMAGIC	0234
281 
282 /*
283  * Opcode notes:
284  *
285  * BRANCH	The set of branches constituting a single choice are hooked
286  *		together with their "next" pointers, since precedence prevents
287  *		anything being concatenated to any individual branch.  The
288  *		"next" pointer of the last BRANCH in a choice points to the
289  *		thing following the whole choice.  This is also where the
290  *		final "next" pointer of each individual branch points; each
291  *		branch starts with the operand node of a BRANCH node.
292  *
293  * BACK		Normal "next" pointers all implicitly point forward; BACK
294  *		exists to make loop structures possible.
295  *
296  * STAR,PLUS	'=', and complex '*' and '+', are implemented as circular
297  *		BRANCH structures using BACK.  Simple cases (one character
298  *		per match) are implemented with STAR and PLUS for speed
299  *		and to minimize recursive plunges.
300  *
301  * BRACE_LIMITS	This is always followed by a BRACE_SIMPLE or BRACE_COMPLEX
302  *		node, and defines the min and max limits to be used for that
303  *		node.
304  *
305  * MOPEN,MCLOSE	...are numbered at compile time.
306  * ZOPEN,ZCLOSE	...ditto
307  */
308 
309 /*
310  * A node is one char of opcode followed by two chars of "next" pointer.
311  * "Next" pointers are stored as two 8-bit bytes, high order first.  The
312  * value is a positive offset from the opcode of the node containing it.
313  * An operand, if any, simply follows the node.  (Note that much of the
314  * code generation knows about this implicit relationship.)
315  *
316  * Using two bytes for the "next" pointer is vast overkill for most things,
317  * but allows patterns to get big without disasters.
318  */
319 #define OP(p)		((int)*(p))
320 #define NEXT(p)		(((*((p) + 1) & 0377) << 8) + (*((p) + 2) & 0377))
321 #define OPERAND(p)	((p) + 3)
322 /* Obtain an operand that was stored as four bytes, MSB first. */
323 #define OPERAND_MIN(p)	(((long)(p)[3] << 24) + ((long)(p)[4] << 16) \
324 			+ ((long)(p)[5] << 8) + (long)(p)[6])
325 /* Obtain a second operand stored as four bytes. */
326 #define OPERAND_MAX(p)	OPERAND_MIN((p) + 4)
327 /* Obtain a second single-byte operand stored after a four bytes operand. */
328 #define OPERAND_CMP(p)	(p)[7]
329 
330 /*
331  * Utility definitions.
332  */
333 #define UCHARAT(p)	((int)*(char_u *)(p))
334 
335 /* Used for an error (down from) vim_regcomp(): give the error message, set
336  * rc_did_emsg and return NULL */
337 #define EMSG_RET_NULL(m) return (EMSG(m), rc_did_emsg = TRUE, (void *)NULL)
338 #define IEMSG_RET_NULL(m) return (IEMSG(m), rc_did_emsg = TRUE, (void *)NULL)
339 #define EMSG_RET_FAIL(m) return (EMSG(m), rc_did_emsg = TRUE, FAIL)
340 #define EMSG2_RET_NULL(m, c) return (EMSG2((m), (c) ? "" : "\\"), rc_did_emsg = TRUE, (void *)NULL)
341 #define EMSG2_RET_FAIL(m, c) return (EMSG2((m), (c) ? "" : "\\"), rc_did_emsg = TRUE, FAIL)
342 #define EMSG_ONE_RET_NULL EMSG2_RET_NULL(_("E369: invalid item in %s%%[]"), reg_magic == MAGIC_ALL)
343 
344 
345 #define MAX_LIMIT	(32767L << 16L)
346 
347 static int re_multi_type(int);
348 static int cstrncmp(char_u *s1, char_u *s2, int *n);
349 static char_u *cstrchr(char_u *, int);
350 
351 #ifdef BT_REGEXP_DUMP
352 static void	regdump(char_u *, bt_regprog_T *);
353 #endif
354 #ifdef DEBUG
355 static char_u	*regprop(char_u *);
356 #endif
357 
358 static int re_mult_next(char *what);
359 
360 static char_u e_missingbracket[] = N_("E769: Missing ] after %s[");
361 static char_u e_reverse_range[] = N_("E944: Reverse range in character class");
362 #ifdef FEAT_MBYTE
363 static char_u e_large_class[] = N_("E945: Range too large in character class");
364 #endif
365 static char_u e_unmatchedpp[] = N_("E53: Unmatched %s%%(");
366 static char_u e_unmatchedp[] = N_("E54: Unmatched %s(");
367 static char_u e_unmatchedpar[] = N_("E55: Unmatched %s)");
368 #ifdef FEAT_SYN_HL
369 static char_u e_z_not_allowed[] = N_("E66: \\z( not allowed here");
370 static char_u e_z1_not_allowed[] = N_("E67: \\z1 et al. not allowed here");
371 #endif
372 static char_u e_missing_sb[] = N_("E69: Missing ] after %s%%[");
373 static char_u e_empty_sb[]  = N_("E70: Empty %s%%[]");
374 #define NOT_MULTI	0
375 #define MULTI_ONE	1
376 #define MULTI_MULT	2
377 /*
378  * Return NOT_MULTI if c is not a "multi" operator.
379  * Return MULTI_ONE if c is a single "multi" operator.
380  * Return MULTI_MULT if c is a multi "multi" operator.
381  */
382     static int
383 re_multi_type(int c)
384 {
385     if (c == Magic('@') || c == Magic('=') || c == Magic('?'))
386 	return MULTI_ONE;
387     if (c == Magic('*') || c == Magic('+') || c == Magic('{'))
388 	return MULTI_MULT;
389     return NOT_MULTI;
390 }
391 
392 /*
393  * Flags to be passed up and down.
394  */
395 #define HASWIDTH	0x1	/* Known never to match null string. */
396 #define SIMPLE		0x2	/* Simple enough to be STAR/PLUS operand. */
397 #define SPSTART		0x4	/* Starts with * or +. */
398 #define HASNL		0x8	/* Contains some \n. */
399 #define HASLOOKBH	0x10	/* Contains "\@<=" or "\@<!". */
400 #define WORST		0	/* Worst case. */
401 
402 /*
403  * When regcode is set to this value, code is not emitted and size is computed
404  * instead.
405  */
406 #define JUST_CALC_SIZE	((char_u *) -1)
407 
408 static char_u		*reg_prev_sub = NULL;
409 
410 /*
411  * REGEXP_INRANGE contains all characters which are always special in a []
412  * range after '\'.
413  * REGEXP_ABBR contains all characters which act as abbreviations after '\'.
414  * These are:
415  *  \n	- New line (NL).
416  *  \r	- Carriage Return (CR).
417  *  \t	- Tab (TAB).
418  *  \e	- Escape (ESC).
419  *  \b	- Backspace (Ctrl_H).
420  *  \d  - Character code in decimal, eg \d123
421  *  \o	- Character code in octal, eg \o80
422  *  \x	- Character code in hex, eg \x4a
423  *  \u	- Multibyte character code, eg \u20ac
424  *  \U	- Long multibyte character code, eg \U12345678
425  */
426 static char_u REGEXP_INRANGE[] = "]^-n\\";
427 static char_u REGEXP_ABBR[] = "nrtebdoxuU";
428 
429 static int	backslash_trans(int c);
430 static int	get_char_class(char_u **pp);
431 static int	get_equi_class(char_u **pp);
432 static void	reg_equi_class(int c);
433 static int	get_coll_element(char_u **pp);
434 static char_u	*skip_anyof(char_u *p);
435 static void	init_class_tab(void);
436 
437 /*
438  * Translate '\x' to its control character, except "\n", which is Magic.
439  */
440     static int
441 backslash_trans(int c)
442 {
443     switch (c)
444     {
445 	case 'r':   return CAR;
446 	case 't':   return TAB;
447 	case 'e':   return ESC;
448 	case 'b':   return BS;
449     }
450     return c;
451 }
452 
453 /*
454  * Check for a character class name "[:name:]".  "pp" points to the '['.
455  * Returns one of the CLASS_ items. CLASS_NONE means that no item was
456  * recognized.  Otherwise "pp" is advanced to after the item.
457  */
458     static int
459 get_char_class(char_u **pp)
460 {
461     static const char *(class_names[]) =
462     {
463 	"alnum:]",
464 #define CLASS_ALNUM 0
465 	"alpha:]",
466 #define CLASS_ALPHA 1
467 	"blank:]",
468 #define CLASS_BLANK 2
469 	"cntrl:]",
470 #define CLASS_CNTRL 3
471 	"digit:]",
472 #define CLASS_DIGIT 4
473 	"graph:]",
474 #define CLASS_GRAPH 5
475 	"lower:]",
476 #define CLASS_LOWER 6
477 	"print:]",
478 #define CLASS_PRINT 7
479 	"punct:]",
480 #define CLASS_PUNCT 8
481 	"space:]",
482 #define CLASS_SPACE 9
483 	"upper:]",
484 #define CLASS_UPPER 10
485 	"xdigit:]",
486 #define CLASS_XDIGIT 11
487 	"tab:]",
488 #define CLASS_TAB 12
489 	"return:]",
490 #define CLASS_RETURN 13
491 	"backspace:]",
492 #define CLASS_BACKSPACE 14
493 	"escape:]",
494 #define CLASS_ESCAPE 15
495     };
496 #define CLASS_NONE 99
497     int i;
498 
499     if ((*pp)[1] == ':')
500     {
501 	for (i = 0; i < (int)(sizeof(class_names) / sizeof(*class_names)); ++i)
502 	    if (STRNCMP(*pp + 2, class_names[i], STRLEN(class_names[i])) == 0)
503 	    {
504 		*pp += STRLEN(class_names[i]) + 2;
505 		return i;
506 	    }
507     }
508     return CLASS_NONE;
509 }
510 
511 /*
512  * Specific version of character class functions.
513  * Using a table to keep this fast.
514  */
515 static short	class_tab[256];
516 
517 #define	    RI_DIGIT	0x01
518 #define	    RI_HEX	0x02
519 #define	    RI_OCTAL	0x04
520 #define	    RI_WORD	0x08
521 #define	    RI_HEAD	0x10
522 #define	    RI_ALPHA	0x20
523 #define	    RI_LOWER	0x40
524 #define	    RI_UPPER	0x80
525 #define	    RI_WHITE	0x100
526 
527     static void
528 init_class_tab(void)
529 {
530     int		i;
531     static int	done = FALSE;
532 
533     if (done)
534 	return;
535 
536     for (i = 0; i < 256; ++i)
537     {
538 	if (i >= '0' && i <= '7')
539 	    class_tab[i] = RI_DIGIT + RI_HEX + RI_OCTAL + RI_WORD;
540 	else if (i >= '8' && i <= '9')
541 	    class_tab[i] = RI_DIGIT + RI_HEX + RI_WORD;
542 	else if (i >= 'a' && i <= 'f')
543 	    class_tab[i] = RI_HEX + RI_WORD + RI_HEAD + RI_ALPHA + RI_LOWER;
544 #ifdef EBCDIC
545 	else if ((i >= 'g' && i <= 'i') || (i >= 'j' && i <= 'r')
546 						    || (i >= 's' && i <= 'z'))
547 #else
548 	else if (i >= 'g' && i <= 'z')
549 #endif
550 	    class_tab[i] = RI_WORD + RI_HEAD + RI_ALPHA + RI_LOWER;
551 	else if (i >= 'A' && i <= 'F')
552 	    class_tab[i] = RI_HEX + RI_WORD + RI_HEAD + RI_ALPHA + RI_UPPER;
553 #ifdef EBCDIC
554 	else if ((i >= 'G' && i <= 'I') || ( i >= 'J' && i <= 'R')
555 						    || (i >= 'S' && i <= 'Z'))
556 #else
557 	else if (i >= 'G' && i <= 'Z')
558 #endif
559 	    class_tab[i] = RI_WORD + RI_HEAD + RI_ALPHA + RI_UPPER;
560 	else if (i == '_')
561 	    class_tab[i] = RI_WORD + RI_HEAD;
562 	else
563 	    class_tab[i] = 0;
564     }
565     class_tab[' '] |= RI_WHITE;
566     class_tab['\t'] |= RI_WHITE;
567     done = TRUE;
568 }
569 
570 #ifdef FEAT_MBYTE
571 # define ri_digit(c)	(c < 0x100 && (class_tab[c] & RI_DIGIT))
572 # define ri_hex(c)	(c < 0x100 && (class_tab[c] & RI_HEX))
573 # define ri_octal(c)	(c < 0x100 && (class_tab[c] & RI_OCTAL))
574 # define ri_word(c)	(c < 0x100 && (class_tab[c] & RI_WORD))
575 # define ri_head(c)	(c < 0x100 && (class_tab[c] & RI_HEAD))
576 # define ri_alpha(c)	(c < 0x100 && (class_tab[c] & RI_ALPHA))
577 # define ri_lower(c)	(c < 0x100 && (class_tab[c] & RI_LOWER))
578 # define ri_upper(c)	(c < 0x100 && (class_tab[c] & RI_UPPER))
579 # define ri_white(c)	(c < 0x100 && (class_tab[c] & RI_WHITE))
580 #else
581 # define ri_digit(c)	(class_tab[c] & RI_DIGIT)
582 # define ri_hex(c)	(class_tab[c] & RI_HEX)
583 # define ri_octal(c)	(class_tab[c] & RI_OCTAL)
584 # define ri_word(c)	(class_tab[c] & RI_WORD)
585 # define ri_head(c)	(class_tab[c] & RI_HEAD)
586 # define ri_alpha(c)	(class_tab[c] & RI_ALPHA)
587 # define ri_lower(c)	(class_tab[c] & RI_LOWER)
588 # define ri_upper(c)	(class_tab[c] & RI_UPPER)
589 # define ri_white(c)	(class_tab[c] & RI_WHITE)
590 #endif
591 
592 /* flags for regflags */
593 #define RF_ICASE    1	/* ignore case */
594 #define RF_NOICASE  2	/* don't ignore case */
595 #define RF_HASNL    4	/* can match a NL */
596 #define RF_ICOMBINE 8	/* ignore combining characters */
597 #define RF_LOOKBH   16	/* uses "\@<=" or "\@<!" */
598 
599 /*
600  * Global work variables for vim_regcomp().
601  */
602 
603 static char_u	*regparse;	/* Input-scan pointer. */
604 static int	prevchr_len;	/* byte length of previous char */
605 static int	num_complex_braces; /* Complex \{...} count */
606 static int	regnpar;	/* () count. */
607 #ifdef FEAT_SYN_HL
608 static int	regnzpar;	/* \z() count. */
609 static int	re_has_z;	/* \z item detected */
610 #endif
611 static char_u	*regcode;	/* Code-emit pointer, or JUST_CALC_SIZE */
612 static long	regsize;	/* Code size. */
613 static int	reg_toolong;	/* TRUE when offset out of range */
614 static char_u	had_endbrace[NSUBEXP];	/* flags, TRUE if end of () found */
615 static unsigned	regflags;	/* RF_ flags for prog */
616 static long	brace_min[10];	/* Minimums for complex brace repeats */
617 static long	brace_max[10];	/* Maximums for complex brace repeats */
618 static int	brace_count[10]; /* Current counts for complex brace repeats */
619 #if defined(FEAT_SYN_HL) || defined(PROTO)
620 static int	had_eol;	/* TRUE when EOL found by vim_regcomp() */
621 #endif
622 static int	one_exactly = FALSE;	/* only do one char for EXACTLY */
623 
624 static int	reg_magic;	/* magicness of the pattern: */
625 #define MAGIC_NONE	1	/* "\V" very unmagic */
626 #define MAGIC_OFF	2	/* "\M" or 'magic' off */
627 #define MAGIC_ON	3	/* "\m" or 'magic' */
628 #define MAGIC_ALL	4	/* "\v" very magic */
629 
630 static int	reg_string;	/* matching with a string instead of a buffer
631 				   line */
632 static int	reg_strict;	/* "[abc" is illegal */
633 
634 /*
635  * META contains all characters that may be magic, except '^' and '$'.
636  */
637 
638 #ifdef EBCDIC
639 static char_u META[] = "%&()*+.123456789<=>?@ACDFHIKLMOPSUVWX[_acdfhiklmnopsuvwxz{|~";
640 #else
641 /* META[] is used often enough to justify turning it into a table. */
642 static char_u META_flags[] = {
643     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
644     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
645 /*		   %  &     (  )  *  +	      .    */
646     0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0,
647 /*     1  2  3	4  5  6  7  8  9	<  =  >  ? */
648     0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1,
649 /*  @  A     C	D     F     H  I     K	L  M	 O */
650     1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1,
651 /*  P	     S	   U  V  W  X	  Z  [		 _ */
652     1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1,
653 /*     a     c	d     f     h  i     k	l  m  n  o */
654     0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1,
655 /*  p	     s	   u  v  w  x	  z  {	|     ~    */
656     1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 1
657 };
658 #endif
659 
660 static int	curchr;		/* currently parsed character */
661 /* Previous character.  Note: prevchr is sometimes -1 when we are not at the
662  * start, eg in /[ ^I]^ the pattern was never found even if it existed,
663  * because ^ was taken to be magic -- webb */
664 static int	prevchr;
665 static int	prevprevchr;	/* previous-previous character */
666 static int	nextchr;	/* used for ungetchr() */
667 
668 /* arguments for reg() */
669 #define REG_NOPAREN	0	/* toplevel reg() */
670 #define REG_PAREN	1	/* \(\) */
671 #define REG_ZPAREN	2	/* \z(\) */
672 #define REG_NPAREN	3	/* \%(\) */
673 
674 typedef struct
675 {
676      char_u	*regparse;
677      int	prevchr_len;
678      int	curchr;
679      int	prevchr;
680      int	prevprevchr;
681      int	nextchr;
682      int	at_start;
683      int	prev_at_start;
684      int	regnpar;
685 } parse_state_T;
686 
687 /*
688  * Forward declarations for vim_regcomp()'s friends.
689  */
690 static void	initchr(char_u *);
691 static void	save_parse_state(parse_state_T *ps);
692 static void	restore_parse_state(parse_state_T *ps);
693 static int	getchr(void);
694 static void	skipchr_keepstart(void);
695 static int	peekchr(void);
696 static void	skipchr(void);
697 static void	ungetchr(void);
698 static int	gethexchrs(int maxinputlen);
699 static int	getoctchrs(void);
700 static int	getdecchrs(void);
701 static int	coll_get_char(void);
702 static void	regcomp_start(char_u *expr, int flags);
703 static char_u	*reg(int, int *);
704 static char_u	*regbranch(int *flagp);
705 static char_u	*regconcat(int *flagp);
706 static char_u	*regpiece(int *);
707 static char_u	*regatom(int *);
708 static char_u	*regnode(int);
709 #ifdef FEAT_MBYTE
710 static int	use_multibytecode(int c);
711 #endif
712 static int	prog_magic_wrong(void);
713 static char_u	*regnext(char_u *);
714 static void	regc(int b);
715 #ifdef FEAT_MBYTE
716 static void	regmbc(int c);
717 # define REGMBC(x) regmbc(x);
718 # define CASEMBC(x) case x:
719 #else
720 # define regmbc(c) regc(c)
721 # define REGMBC(x)
722 # define CASEMBC(x)
723 #endif
724 static void	reginsert(int, char_u *);
725 static void	reginsert_nr(int op, long val, char_u *opnd);
726 static void	reginsert_limits(int, long, long, char_u *);
727 static char_u	*re_put_long(char_u *pr, long_u val);
728 static int	read_limits(long *, long *);
729 static void	regtail(char_u *, char_u *);
730 static void	regoptail(char_u *, char_u *);
731 
732 static regengine_T bt_regengine;
733 static regengine_T nfa_regengine;
734 
735 /*
736  * Return TRUE if compiled regular expression "prog" can match a line break.
737  */
738     int
739 re_multiline(regprog_T *prog)
740 {
741     return (prog->regflags & RF_HASNL);
742 }
743 
744 /*
745  * Return TRUE if compiled regular expression "prog" looks before the start
746  * position (pattern contains "\@<=" or "\@<!").
747  */
748     int
749 re_lookbehind(regprog_T *prog)
750 {
751     return (prog->regflags & RF_LOOKBH);
752 }
753 
754 /*
755  * Check for an equivalence class name "[=a=]".  "pp" points to the '['.
756  * Returns a character representing the class. Zero means that no item was
757  * recognized.  Otherwise "pp" is advanced to after the item.
758  */
759     static int
760 get_equi_class(char_u **pp)
761 {
762     int		c;
763     int		l = 1;
764     char_u	*p = *pp;
765 
766     if (p[1] == '=')
767     {
768 #ifdef FEAT_MBYTE
769 	if (has_mbyte)
770 	    l = (*mb_ptr2len)(p + 2);
771 #endif
772 	if (p[l + 2] == '=' && p[l + 3] == ']')
773 	{
774 #ifdef FEAT_MBYTE
775 	    if (has_mbyte)
776 		c = mb_ptr2char(p + 2);
777 	    else
778 #endif
779 		c = p[2];
780 	    *pp += l + 4;
781 	    return c;
782 	}
783     }
784     return 0;
785 }
786 
787 #ifdef EBCDIC
788 /*
789  * Table for equivalence class "c". (IBM-1047)
790  */
791 char *EQUIVAL_CLASS_C[16] = {
792     "A\x62\x63\x64\x65\x66\x67",
793     "C\x68",
794     "E\x71\x72\x73\x74",
795     "I\x75\x76\x77\x78",
796     "N\x69",
797     "O\xEB\xEC\xED\xEE\xEF\x80",
798     "U\xFB\xFC\xFD\xFE",
799     "Y\xBA",
800     "a\x42\x43\x44\x45\x46\x47",
801     "c\x48",
802     "e\x51\x52\x53\x54",
803     "i\x55\x56\x57\x58",
804     "n\x49",
805     "o\xCB\xCC\xCD\xCE\xCF\x70",
806     "u\xDB\xDC\xDD\xDE",
807     "y\x8D\xDF",
808 };
809 #endif
810 
811 /*
812  * Produce the bytes for equivalence class "c".
813  * Currently only handles latin1, latin9 and utf-8.
814  * NOTE: When changing this function, also change nfa_emit_equi_class()
815  */
816     static void
817 reg_equi_class(int c)
818 {
819 #ifdef FEAT_MBYTE
820     if (enc_utf8 || STRCMP(p_enc, "latin1") == 0
821 					 || STRCMP(p_enc, "iso-8859-15") == 0)
822 #endif
823     {
824 #ifdef EBCDIC
825 	int i;
826 
827 	/* This might be slower than switch/case below. */
828 	for (i = 0; i < 16; i++)
829 	{
830 	    if (vim_strchr(EQUIVAL_CLASS_C[i], c) != NULL)
831 	    {
832 		char *p = EQUIVAL_CLASS_C[i];
833 
834 		while (*p != 0)
835 		    regmbc(*p++);
836 		return;
837 	    }
838 	}
839 #else
840 	switch (c)
841 	{
842 	    /* Do not use '\300' style, it results in a negative number. */
843 	    case 'A': case 0xc0: case 0xc1: case 0xc2:
844 	    case 0xc3: case 0xc4: case 0xc5:
845 	    CASEMBC(0x100) CASEMBC(0x102) CASEMBC(0x104) CASEMBC(0x1cd)
846 	    CASEMBC(0x1de) CASEMBC(0x1e0) CASEMBC(0x1ea2)
847 		      regmbc('A'); regmbc(0xc0); regmbc(0xc1);
848 		      regmbc(0xc2); regmbc(0xc3); regmbc(0xc4);
849 		      regmbc(0xc5);
850 		      REGMBC(0x100) REGMBC(0x102) REGMBC(0x104)
851 		      REGMBC(0x1cd) REGMBC(0x1de) REGMBC(0x1e0)
852 		      REGMBC(0x1ea2)
853 		      return;
854 	    case 'B': CASEMBC(0x1e02) CASEMBC(0x1e06)
855 		      regmbc('B'); REGMBC(0x1e02) REGMBC(0x1e06)
856 		      return;
857 	    case 'C': case 0xc7:
858 	    CASEMBC(0x106) CASEMBC(0x108) CASEMBC(0x10a) CASEMBC(0x10c)
859 		      regmbc('C'); regmbc(0xc7);
860 		      REGMBC(0x106) REGMBC(0x108) REGMBC(0x10a)
861 		      REGMBC(0x10c)
862 		      return;
863 	    case 'D': CASEMBC(0x10e) CASEMBC(0x110) CASEMBC(0x1e0a)
864 	    CASEMBC(0x1e0e) CASEMBC(0x1e10)
865 		      regmbc('D'); REGMBC(0x10e) REGMBC(0x110)
866 		      REGMBC(0x1e0a) REGMBC(0x1e0e) REGMBC(0x1e10)
867 		      return;
868 	    case 'E': case 0xc8: case 0xc9: case 0xca: case 0xcb:
869 	    CASEMBC(0x112) CASEMBC(0x114) CASEMBC(0x116) CASEMBC(0x118)
870 	    CASEMBC(0x11a) CASEMBC(0x1eba) CASEMBC(0x1ebc)
871 		      regmbc('E'); regmbc(0xc8); regmbc(0xc9);
872 		      regmbc(0xca); regmbc(0xcb);
873 		      REGMBC(0x112) REGMBC(0x114) REGMBC(0x116)
874 		      REGMBC(0x118) REGMBC(0x11a) REGMBC(0x1eba)
875 		      REGMBC(0x1ebc)
876 		      return;
877 	    case 'F': CASEMBC(0x1e1e)
878 		      regmbc('F'); REGMBC(0x1e1e)
879 		      return;
880 	    case 'G': CASEMBC(0x11c) CASEMBC(0x11e) CASEMBC(0x120)
881 	    CASEMBC(0x122) CASEMBC(0x1e4) CASEMBC(0x1e6) CASEMBC(0x1f4)
882 	    CASEMBC(0x1e20)
883 		      regmbc('G'); REGMBC(0x11c) REGMBC(0x11e)
884 		      REGMBC(0x120) REGMBC(0x122) REGMBC(0x1e4)
885 		      REGMBC(0x1e6) REGMBC(0x1f4) REGMBC(0x1e20)
886 		      return;
887 	    case 'H': CASEMBC(0x124) CASEMBC(0x126) CASEMBC(0x1e22)
888 	    CASEMBC(0x1e26) CASEMBC(0x1e28)
889 		      regmbc('H'); REGMBC(0x124) REGMBC(0x126)
890 		      REGMBC(0x1e22) REGMBC(0x1e26) REGMBC(0x1e28)
891 		      return;
892 	    case 'I': case 0xcc: case 0xcd: case 0xce: case 0xcf:
893 	    CASEMBC(0x128) CASEMBC(0x12a) CASEMBC(0x12c) CASEMBC(0x12e)
894 	    CASEMBC(0x130) CASEMBC(0x1cf) CASEMBC(0x1ec8)
895 		      regmbc('I'); regmbc(0xcc); regmbc(0xcd);
896 		      regmbc(0xce); regmbc(0xcf);
897 		      REGMBC(0x128) REGMBC(0x12a) REGMBC(0x12c)
898 		      REGMBC(0x12e) REGMBC(0x130) REGMBC(0x1cf)
899 		      REGMBC(0x1ec8)
900 		      return;
901 	    case 'J': CASEMBC(0x134)
902 		      regmbc('J'); REGMBC(0x134)
903 		      return;
904 	    case 'K': CASEMBC(0x136) CASEMBC(0x1e8) CASEMBC(0x1e30)
905 	    CASEMBC(0x1e34)
906 		      regmbc('K'); REGMBC(0x136) REGMBC(0x1e8)
907 		      REGMBC(0x1e30) REGMBC(0x1e34)
908 		      return;
909 	    case 'L': CASEMBC(0x139) CASEMBC(0x13b) CASEMBC(0x13d)
910 	    CASEMBC(0x13f) CASEMBC(0x141) CASEMBC(0x1e3a)
911 		      regmbc('L'); REGMBC(0x139) REGMBC(0x13b)
912 		      REGMBC(0x13d) REGMBC(0x13f) REGMBC(0x141)
913 		      REGMBC(0x1e3a)
914 		      return;
915 	    case 'M': CASEMBC(0x1e3e) CASEMBC(0x1e40)
916 		      regmbc('M'); REGMBC(0x1e3e) REGMBC(0x1e40)
917 		      return;
918 	    case 'N': case 0xd1:
919 	    CASEMBC(0x143) CASEMBC(0x145) CASEMBC(0x147) CASEMBC(0x1e44)
920 	    CASEMBC(0x1e48)
921 		      regmbc('N'); regmbc(0xd1);
922 		      REGMBC(0x143) REGMBC(0x145) REGMBC(0x147)
923 		      REGMBC(0x1e44) REGMBC(0x1e48)
924 		      return;
925 	    case 'O': case 0xd2: case 0xd3: case 0xd4: case 0xd5:
926 	    case 0xd6: case 0xd8:
927 	    CASEMBC(0x14c) CASEMBC(0x14e) CASEMBC(0x150) CASEMBC(0x1a0)
928 	    CASEMBC(0x1d1) CASEMBC(0x1ea) CASEMBC(0x1ec) CASEMBC(0x1ece)
929 		      regmbc('O'); regmbc(0xd2); regmbc(0xd3);
930 		      regmbc(0xd4); regmbc(0xd5); regmbc(0xd6);
931 		      regmbc(0xd8);
932 		      REGMBC(0x14c) REGMBC(0x14e) REGMBC(0x150)
933 		      REGMBC(0x1a0) REGMBC(0x1d1) REGMBC(0x1ea)
934 		      REGMBC(0x1ec) REGMBC(0x1ece)
935 		      return;
936 	    case 'P': case 0x1e54: case 0x1e56:
937 		      regmbc('P'); REGMBC(0x1e54) REGMBC(0x1e56)
938 		      return;
939 	    case 'R': CASEMBC(0x154) CASEMBC(0x156) CASEMBC(0x158)
940 	    CASEMBC(0x1e58) CASEMBC(0x1e5e)
941 		      regmbc('R'); REGMBC(0x154) REGMBC(0x156) REGMBC(0x158)
942 		      REGMBC(0x1e58) REGMBC(0x1e5e)
943 		      return;
944 	    case 'S': CASEMBC(0x15a) CASEMBC(0x15c) CASEMBC(0x15e)
945 	    CASEMBC(0x160) CASEMBC(0x1e60)
946 		      regmbc('S'); REGMBC(0x15a) REGMBC(0x15c)
947 		      REGMBC(0x15e) REGMBC(0x160) REGMBC(0x1e60)
948 		      return;
949 	    case 'T': CASEMBC(0x162) CASEMBC(0x164) CASEMBC(0x166)
950 	    CASEMBC(0x1e6a) CASEMBC(0x1e6e)
951 		      regmbc('T'); REGMBC(0x162) REGMBC(0x164)
952 		      REGMBC(0x166) REGMBC(0x1e6a) REGMBC(0x1e6e)
953 		      return;
954 	    case 'U': case 0xd9: case 0xda: case 0xdb: case 0xdc:
955 	    CASEMBC(0x168) CASEMBC(0x16a) CASEMBC(0x16c) CASEMBC(0x16e)
956 	    CASEMBC(0x170) CASEMBC(0x172) CASEMBC(0x1af) CASEMBC(0x1d3)
957 	    CASEMBC(0x1ee6)
958 		      regmbc('U'); regmbc(0xd9); regmbc(0xda);
959 		      regmbc(0xdb); regmbc(0xdc);
960 		      REGMBC(0x168) REGMBC(0x16a) REGMBC(0x16c)
961 		      REGMBC(0x16e) REGMBC(0x170) REGMBC(0x172)
962 		      REGMBC(0x1af) REGMBC(0x1d3) REGMBC(0x1ee6)
963 		      return;
964 	    case 'V': CASEMBC(0x1e7c)
965 		      regmbc('V'); REGMBC(0x1e7c)
966 		      return;
967 	    case 'W': CASEMBC(0x174) CASEMBC(0x1e80) CASEMBC(0x1e82)
968 	    CASEMBC(0x1e84) CASEMBC(0x1e86)
969 		      regmbc('W'); REGMBC(0x174) REGMBC(0x1e80)
970 		      REGMBC(0x1e82) REGMBC(0x1e84) REGMBC(0x1e86)
971 		      return;
972 	    case 'X': CASEMBC(0x1e8a) CASEMBC(0x1e8c)
973 		      regmbc('X'); REGMBC(0x1e8a) REGMBC(0x1e8c)
974 		      return;
975 	    case 'Y': case 0xdd:
976 	    CASEMBC(0x176) CASEMBC(0x178) CASEMBC(0x1e8e) CASEMBC(0x1ef2)
977 	    CASEMBC(0x1ef6) CASEMBC(0x1ef8)
978 		      regmbc('Y'); regmbc(0xdd);
979 		      REGMBC(0x176) REGMBC(0x178) REGMBC(0x1e8e)
980 		      REGMBC(0x1ef2) REGMBC(0x1ef6) REGMBC(0x1ef8)
981 		      return;
982 	    case 'Z': CASEMBC(0x179) CASEMBC(0x17b) CASEMBC(0x17d)
983 	    CASEMBC(0x1b5) CASEMBC(0x1e90) CASEMBC(0x1e94)
984 		      regmbc('Z'); REGMBC(0x179) REGMBC(0x17b)
985 		      REGMBC(0x17d) REGMBC(0x1b5) REGMBC(0x1e90)
986 		      REGMBC(0x1e94)
987 		      return;
988 	    case 'a': case 0xe0: case 0xe1: case 0xe2:
989 	    case 0xe3: case 0xe4: case 0xe5:
990 	    CASEMBC(0x101) CASEMBC(0x103) CASEMBC(0x105) CASEMBC(0x1ce)
991 	    CASEMBC(0x1df) CASEMBC(0x1e1) CASEMBC(0x1ea3)
992 		      regmbc('a'); regmbc(0xe0); regmbc(0xe1);
993 		      regmbc(0xe2); regmbc(0xe3); regmbc(0xe4);
994 		      regmbc(0xe5);
995 		      REGMBC(0x101) REGMBC(0x103) REGMBC(0x105)
996 		      REGMBC(0x1ce) REGMBC(0x1df) REGMBC(0x1e1)
997 		      REGMBC(0x1ea3)
998 		      return;
999 	    case 'b': CASEMBC(0x1e03) CASEMBC(0x1e07)
1000 		      regmbc('b'); REGMBC(0x1e03) REGMBC(0x1e07)
1001 		      return;
1002 	    case 'c': case 0xe7:
1003 	    CASEMBC(0x107) CASEMBC(0x109) CASEMBC(0x10b) CASEMBC(0x10d)
1004 		      regmbc('c'); regmbc(0xe7);
1005 		      REGMBC(0x107) REGMBC(0x109) REGMBC(0x10b)
1006 		      REGMBC(0x10d)
1007 		      return;
1008 	    case 'd': CASEMBC(0x10f) CASEMBC(0x111) CASEMBC(0x1e0b)
1009 	    CASEMBC(0x1e0f) CASEMBC(0x1e11)
1010 		      regmbc('d'); REGMBC(0x10f) REGMBC(0x111)
1011 		      REGMBC(0x1e0b) REGMBC(0x1e0f) REGMBC(0x1e11)
1012 		      return;
1013 	    case 'e': case 0xe8: case 0xe9: case 0xea: case 0xeb:
1014 	    CASEMBC(0x113) CASEMBC(0x115) CASEMBC(0x117) CASEMBC(0x119)
1015 	    CASEMBC(0x11b) CASEMBC(0x1ebb) CASEMBC(0x1ebd)
1016 		      regmbc('e'); regmbc(0xe8); regmbc(0xe9);
1017 		      regmbc(0xea); regmbc(0xeb);
1018 		      REGMBC(0x113) REGMBC(0x115) REGMBC(0x117)
1019 		      REGMBC(0x119) REGMBC(0x11b) REGMBC(0x1ebb)
1020 		      REGMBC(0x1ebd)
1021 		      return;
1022 	    case 'f': CASEMBC(0x1e1f)
1023 		      regmbc('f'); REGMBC(0x1e1f)
1024 		      return;
1025 	    case 'g': CASEMBC(0x11d) CASEMBC(0x11f) CASEMBC(0x121)
1026 	    CASEMBC(0x123) CASEMBC(0x1e5) CASEMBC(0x1e7) CASEMBC(0x1f5)
1027 	    CASEMBC(0x1e21)
1028 		      regmbc('g'); REGMBC(0x11d) REGMBC(0x11f)
1029 		      REGMBC(0x121) REGMBC(0x123) REGMBC(0x1e5)
1030 		      REGMBC(0x1e7) REGMBC(0x1f5) REGMBC(0x1e21)
1031 		      return;
1032 	    case 'h': CASEMBC(0x125) CASEMBC(0x127) CASEMBC(0x1e23)
1033 	    CASEMBC(0x1e27) CASEMBC(0x1e29) CASEMBC(0x1e96)
1034 		      regmbc('h'); REGMBC(0x125) REGMBC(0x127)
1035 		      REGMBC(0x1e23) REGMBC(0x1e27) REGMBC(0x1e29)
1036 		      REGMBC(0x1e96)
1037 		      return;
1038 	    case 'i': case 0xec: case 0xed: case 0xee: case 0xef:
1039 	    CASEMBC(0x129) CASEMBC(0x12b) CASEMBC(0x12d) CASEMBC(0x12f)
1040 	    CASEMBC(0x1d0) CASEMBC(0x1ec9)
1041 		      regmbc('i'); regmbc(0xec); regmbc(0xed);
1042 		      regmbc(0xee); regmbc(0xef);
1043 		      REGMBC(0x129) REGMBC(0x12b) REGMBC(0x12d)
1044 		      REGMBC(0x12f) REGMBC(0x1d0) REGMBC(0x1ec9)
1045 		      return;
1046 	    case 'j': CASEMBC(0x135) CASEMBC(0x1f0)
1047 		      regmbc('j'); REGMBC(0x135) REGMBC(0x1f0)
1048 		      return;
1049 	    case 'k': CASEMBC(0x137) CASEMBC(0x1e9) CASEMBC(0x1e31)
1050 	    CASEMBC(0x1e35)
1051 		      regmbc('k'); REGMBC(0x137) REGMBC(0x1e9)
1052 		      REGMBC(0x1e31) REGMBC(0x1e35)
1053 		      return;
1054 	    case 'l': CASEMBC(0x13a) CASEMBC(0x13c) CASEMBC(0x13e)
1055 	    CASEMBC(0x140) CASEMBC(0x142) CASEMBC(0x1e3b)
1056 		      regmbc('l'); REGMBC(0x13a) REGMBC(0x13c)
1057 		      REGMBC(0x13e) REGMBC(0x140) REGMBC(0x142)
1058 		      REGMBC(0x1e3b)
1059 		      return;
1060 	    case 'm': CASEMBC(0x1e3f) CASEMBC(0x1e41)
1061 		      regmbc('m'); REGMBC(0x1e3f) REGMBC(0x1e41)
1062 		      return;
1063 	    case 'n': case 0xf1:
1064 	    CASEMBC(0x144) CASEMBC(0x146) CASEMBC(0x148) CASEMBC(0x149)
1065 	    CASEMBC(0x1e45) CASEMBC(0x1e49)
1066 		      regmbc('n'); regmbc(0xf1);
1067 		      REGMBC(0x144) REGMBC(0x146) REGMBC(0x148)
1068 		      REGMBC(0x149) REGMBC(0x1e45) REGMBC(0x1e49)
1069 		      return;
1070 	    case 'o': case 0xf2: case 0xf3: case 0xf4: case 0xf5:
1071 	    case 0xf6: case 0xf8:
1072 	    CASEMBC(0x14d) CASEMBC(0x14f) CASEMBC(0x151) CASEMBC(0x1a1)
1073 	    CASEMBC(0x1d2) CASEMBC(0x1eb) CASEMBC(0x1ed) CASEMBC(0x1ecf)
1074 		      regmbc('o'); regmbc(0xf2); regmbc(0xf3);
1075 		      regmbc(0xf4); regmbc(0xf5); regmbc(0xf6);
1076 		      regmbc(0xf8);
1077 		      REGMBC(0x14d) REGMBC(0x14f) REGMBC(0x151)
1078 		      REGMBC(0x1a1) REGMBC(0x1d2) REGMBC(0x1eb)
1079 		      REGMBC(0x1ed) REGMBC(0x1ecf)
1080 		      return;
1081 	    case 'p': CASEMBC(0x1e55) CASEMBC(0x1e57)
1082 		      regmbc('p'); REGMBC(0x1e55) REGMBC(0x1e57)
1083 		      return;
1084 	    case 'r': CASEMBC(0x155) CASEMBC(0x157) CASEMBC(0x159)
1085 	    CASEMBC(0x1e59) CASEMBC(0x1e5f)
1086 		      regmbc('r'); REGMBC(0x155) REGMBC(0x157) REGMBC(0x159)
1087 		      REGMBC(0x1e59) REGMBC(0x1e5f)
1088 		      return;
1089 	    case 's': CASEMBC(0x15b) CASEMBC(0x15d) CASEMBC(0x15f)
1090 	    CASEMBC(0x161) CASEMBC(0x1e61)
1091 		      regmbc('s'); REGMBC(0x15b) REGMBC(0x15d)
1092 		      REGMBC(0x15f) REGMBC(0x161) REGMBC(0x1e61)
1093 		      return;
1094 	    case 't': CASEMBC(0x163) CASEMBC(0x165) CASEMBC(0x167)
1095 	    CASEMBC(0x1e6b) CASEMBC(0x1e6f) CASEMBC(0x1e97)
1096 		      regmbc('t'); REGMBC(0x163) REGMBC(0x165) REGMBC(0x167)
1097 		      REGMBC(0x1e6b) REGMBC(0x1e6f) REGMBC(0x1e97)
1098 		      return;
1099 	    case 'u': case 0xf9: case 0xfa: case 0xfb: case 0xfc:
1100 	    CASEMBC(0x169) CASEMBC(0x16b) CASEMBC(0x16d) CASEMBC(0x16f)
1101 	    CASEMBC(0x171) CASEMBC(0x173) CASEMBC(0x1b0) CASEMBC(0x1d4)
1102 	    CASEMBC(0x1ee7)
1103 		      regmbc('u'); regmbc(0xf9); regmbc(0xfa);
1104 		      regmbc(0xfb); regmbc(0xfc);
1105 		      REGMBC(0x169) REGMBC(0x16b) REGMBC(0x16d)
1106 		      REGMBC(0x16f) REGMBC(0x171) REGMBC(0x173)
1107 		      REGMBC(0x1b0) REGMBC(0x1d4) REGMBC(0x1ee7)
1108 		      return;
1109 	    case 'v': CASEMBC(0x1e7d)
1110 		      regmbc('v'); REGMBC(0x1e7d)
1111 		      return;
1112 	    case 'w': CASEMBC(0x175) CASEMBC(0x1e81) CASEMBC(0x1e83)
1113 	    CASEMBC(0x1e85) CASEMBC(0x1e87) CASEMBC(0x1e98)
1114 		      regmbc('w'); REGMBC(0x175) REGMBC(0x1e81)
1115 		      REGMBC(0x1e83) REGMBC(0x1e85) REGMBC(0x1e87)
1116 		      REGMBC(0x1e98)
1117 		      return;
1118 	    case 'x': CASEMBC(0x1e8b) CASEMBC(0x1e8d)
1119 		      regmbc('x'); REGMBC(0x1e8b) REGMBC(0x1e8d)
1120 		      return;
1121 	    case 'y': case 0xfd: case 0xff:
1122 	    CASEMBC(0x177) CASEMBC(0x1e8f) CASEMBC(0x1e99)
1123 	    CASEMBC(0x1ef3) CASEMBC(0x1ef7) CASEMBC(0x1ef9)
1124 		      regmbc('y'); regmbc(0xfd); regmbc(0xff);
1125 		      REGMBC(0x177) REGMBC(0x1e8f) REGMBC(0x1e99)
1126 		      REGMBC(0x1ef3) REGMBC(0x1ef7) REGMBC(0x1ef9)
1127 		      return;
1128 	    case 'z': CASEMBC(0x17a) CASEMBC(0x17c) CASEMBC(0x17e)
1129 	    CASEMBC(0x1b6) CASEMBC(0x1e91) CASEMBC(0x1e95)
1130 		      regmbc('z'); REGMBC(0x17a) REGMBC(0x17c)
1131 		      REGMBC(0x17e) REGMBC(0x1b6) REGMBC(0x1e91)
1132 		      REGMBC(0x1e95)
1133 		      return;
1134 	}
1135 #endif
1136     }
1137     regmbc(c);
1138 }
1139 
1140 /*
1141  * Check for a collating element "[.a.]".  "pp" points to the '['.
1142  * Returns a character. Zero means that no item was recognized.  Otherwise
1143  * "pp" is advanced to after the item.
1144  * Currently only single characters are recognized!
1145  */
1146     static int
1147 get_coll_element(char_u **pp)
1148 {
1149     int		c;
1150     int		l = 1;
1151     char_u	*p = *pp;
1152 
1153     if (p[0] != NUL && p[1] == '.')
1154     {
1155 #ifdef FEAT_MBYTE
1156 	if (has_mbyte)
1157 	    l = (*mb_ptr2len)(p + 2);
1158 #endif
1159 	if (p[l + 2] == '.' && p[l + 3] == ']')
1160 	{
1161 #ifdef FEAT_MBYTE
1162 	    if (has_mbyte)
1163 		c = mb_ptr2char(p + 2);
1164 	    else
1165 #endif
1166 		c = p[2];
1167 	    *pp += l + 4;
1168 	    return c;
1169 	}
1170     }
1171     return 0;
1172 }
1173 
1174 static void get_cpo_flags(void);
1175 static int reg_cpo_lit; /* 'cpoptions' contains 'l' flag */
1176 static int reg_cpo_bsl; /* 'cpoptions' contains '\' flag */
1177 
1178     static void
1179 get_cpo_flags(void)
1180 {
1181     reg_cpo_lit = vim_strchr(p_cpo, CPO_LITERAL) != NULL;
1182     reg_cpo_bsl = vim_strchr(p_cpo, CPO_BACKSL) != NULL;
1183 }
1184 
1185 /*
1186  * Skip over a "[]" range.
1187  * "p" must point to the character after the '['.
1188  * The returned pointer is on the matching ']', or the terminating NUL.
1189  */
1190     static char_u *
1191 skip_anyof(char_u *p)
1192 {
1193 #ifdef FEAT_MBYTE
1194     int		l;
1195 #endif
1196 
1197     if (*p == '^')	/* Complement of range. */
1198 	++p;
1199     if (*p == ']' || *p == '-')
1200 	++p;
1201     while (*p != NUL && *p != ']')
1202     {
1203 #ifdef FEAT_MBYTE
1204 	if (has_mbyte && (l = (*mb_ptr2len)(p)) > 1)
1205 	    p += l;
1206 	else
1207 #endif
1208 	    if (*p == '-')
1209 	    {
1210 		++p;
1211 		if (*p != ']' && *p != NUL)
1212 		    MB_PTR_ADV(p);
1213 	    }
1214 	else if (*p == '\\'
1215 		&& !reg_cpo_bsl
1216 		&& (vim_strchr(REGEXP_INRANGE, p[1]) != NULL
1217 		    || (!reg_cpo_lit && vim_strchr(REGEXP_ABBR, p[1]) != NULL)))
1218 	    p += 2;
1219 	else if (*p == '[')
1220 	{
1221 	    if (get_char_class(&p) == CLASS_NONE
1222 		    && get_equi_class(&p) == 0
1223 		    && get_coll_element(&p) == 0
1224 		    && *p != NUL)
1225 		++p; /* it is not a class name and not NUL */
1226 	}
1227 	else
1228 	    ++p;
1229     }
1230 
1231     return p;
1232 }
1233 
1234 /*
1235  * Skip past regular expression.
1236  * Stop at end of "startp" or where "dirc" is found ('/', '?', etc).
1237  * Take care of characters with a backslash in front of it.
1238  * Skip strings inside [ and ].
1239  * When "newp" is not NULL and "dirc" is '?', make an allocated copy of the
1240  * expression and change "\?" to "?".  If "*newp" is not NULL the expression
1241  * is changed in-place.
1242  */
1243     char_u *
1244 skip_regexp(
1245     char_u	*startp,
1246     int		dirc,
1247     int		magic,
1248     char_u	**newp)
1249 {
1250     int		mymagic;
1251     char_u	*p = startp;
1252 
1253     if (magic)
1254 	mymagic = MAGIC_ON;
1255     else
1256 	mymagic = MAGIC_OFF;
1257     get_cpo_flags();
1258 
1259     for (; p[0] != NUL; MB_PTR_ADV(p))
1260     {
1261 	if (p[0] == dirc)	/* found end of regexp */
1262 	    break;
1263 	if ((p[0] == '[' && mymagic >= MAGIC_ON)
1264 		|| (p[0] == '\\' && p[1] == '[' && mymagic <= MAGIC_OFF))
1265 	{
1266 	    p = skip_anyof(p + 1);
1267 	    if (p[0] == NUL)
1268 		break;
1269 	}
1270 	else if (p[0] == '\\' && p[1] != NUL)
1271 	{
1272 	    if (dirc == '?' && newp != NULL && p[1] == '?')
1273 	    {
1274 		/* change "\?" to "?", make a copy first. */
1275 		if (*newp == NULL)
1276 		{
1277 		    *newp = vim_strsave(startp);
1278 		    if (*newp != NULL)
1279 			p = *newp + (p - startp);
1280 		}
1281 		if (*newp != NULL)
1282 		    STRMOVE(p, p + 1);
1283 		else
1284 		    ++p;
1285 	    }
1286 	    else
1287 		++p;    /* skip next character */
1288 	    if (*p == 'v')
1289 		mymagic = MAGIC_ALL;
1290 	    else if (*p == 'V')
1291 		mymagic = MAGIC_NONE;
1292 	}
1293     }
1294     return p;
1295 }
1296 
1297 /*
1298  * Return TRUE if the back reference is legal. We must have seen the close
1299  * brace.
1300  * TODO: Should also check that we don't refer to something that is repeated
1301  * (+*=): what instance of the repetition should we match?
1302  */
1303     static int
1304 seen_endbrace(int refnum)
1305 {
1306     if (!had_endbrace[refnum])
1307     {
1308 	char_u *p;
1309 
1310 	/* Trick: check if "@<=" or "@<!" follows, in which case
1311 	 * the \1 can appear before the referenced match. */
1312 	for (p = regparse; *p != NUL; ++p)
1313 	    if (p[0] == '@' && p[1] == '<' && (p[2] == '!' || p[2] == '='))
1314 		break;
1315 	if (*p == NUL)
1316 	{
1317 	    EMSG(_("E65: Illegal back reference"));
1318 	    rc_did_emsg = TRUE;
1319 	    return FALSE;
1320 	}
1321     }
1322     return TRUE;
1323 }
1324 
1325 static regprog_T  *bt_regcomp(char_u *expr, int re_flags);
1326 static void bt_regfree(regprog_T *prog);
1327 
1328 /*
1329  * bt_regcomp() - compile a regular expression into internal code for the
1330  * traditional back track matcher.
1331  * Returns the program in allocated space.  Returns NULL for an error.
1332  *
1333  * We can't allocate space until we know how big the compiled form will be,
1334  * but we can't compile it (and thus know how big it is) until we've got a
1335  * place to put the code.  So we cheat:  we compile it twice, once with code
1336  * generation turned off and size counting turned on, and once "for real".
1337  * This also means that we don't allocate space until we are sure that the
1338  * thing really will compile successfully, and we never have to move the
1339  * code and thus invalidate pointers into it.  (Note that it has to be in
1340  * one piece because vim_free() must be able to free it all.)
1341  *
1342  * Whether upper/lower case is to be ignored is decided when executing the
1343  * program, it does not matter here.
1344  *
1345  * Beware that the optimization-preparation code in here knows about some
1346  * of the structure of the compiled regexp.
1347  * "re_flags": RE_MAGIC and/or RE_STRING.
1348  */
1349     static regprog_T *
1350 bt_regcomp(char_u *expr, int re_flags)
1351 {
1352     bt_regprog_T    *r;
1353     char_u	*scan;
1354     char_u	*longest;
1355     int		len;
1356     int		flags;
1357 
1358     if (expr == NULL)
1359 	EMSG_RET_NULL(_(e_null));
1360 
1361     init_class_tab();
1362 
1363     /*
1364      * First pass: determine size, legality.
1365      */
1366     regcomp_start(expr, re_flags);
1367     regcode = JUST_CALC_SIZE;
1368     regc(REGMAGIC);
1369     if (reg(REG_NOPAREN, &flags) == NULL)
1370 	return NULL;
1371 
1372     /* Allocate space. */
1373     r = (bt_regprog_T *)lalloc(sizeof(bt_regprog_T) + regsize, TRUE);
1374     if (r == NULL)
1375 	return NULL;
1376 
1377     /*
1378      * Second pass: emit code.
1379      */
1380     regcomp_start(expr, re_flags);
1381     regcode = r->program;
1382     regc(REGMAGIC);
1383     if (reg(REG_NOPAREN, &flags) == NULL || reg_toolong)
1384     {
1385 	vim_free(r);
1386 	if (reg_toolong)
1387 	    EMSG_RET_NULL(_("E339: Pattern too long"));
1388 	return NULL;
1389     }
1390 
1391     /* Dig out information for optimizations. */
1392     r->regstart = NUL;		/* Worst-case defaults. */
1393     r->reganch = 0;
1394     r->regmust = NULL;
1395     r->regmlen = 0;
1396     r->regflags = regflags;
1397     if (flags & HASNL)
1398 	r->regflags |= RF_HASNL;
1399     if (flags & HASLOOKBH)
1400 	r->regflags |= RF_LOOKBH;
1401 #ifdef FEAT_SYN_HL
1402     /* Remember whether this pattern has any \z specials in it. */
1403     r->reghasz = re_has_z;
1404 #endif
1405     scan = r->program + 1;	/* First BRANCH. */
1406     if (OP(regnext(scan)) == END)   /* Only one top-level choice. */
1407     {
1408 	scan = OPERAND(scan);
1409 
1410 	/* Starting-point info. */
1411 	if (OP(scan) == BOL || OP(scan) == RE_BOF)
1412 	{
1413 	    r->reganch++;
1414 	    scan = regnext(scan);
1415 	}
1416 
1417 	if (OP(scan) == EXACTLY)
1418 	{
1419 #ifdef FEAT_MBYTE
1420 	    if (has_mbyte)
1421 		r->regstart = (*mb_ptr2char)(OPERAND(scan));
1422 	    else
1423 #endif
1424 		r->regstart = *OPERAND(scan);
1425 	}
1426 	else if ((OP(scan) == BOW
1427 		    || OP(scan) == EOW
1428 		    || OP(scan) == NOTHING
1429 		    || OP(scan) == MOPEN + 0 || OP(scan) == NOPEN
1430 		    || OP(scan) == MCLOSE + 0 || OP(scan) == NCLOSE)
1431 		 && OP(regnext(scan)) == EXACTLY)
1432 	{
1433 #ifdef FEAT_MBYTE
1434 	    if (has_mbyte)
1435 		r->regstart = (*mb_ptr2char)(OPERAND(regnext(scan)));
1436 	    else
1437 #endif
1438 		r->regstart = *OPERAND(regnext(scan));
1439 	}
1440 
1441 	/*
1442 	 * If there's something expensive in the r.e., find the longest
1443 	 * literal string that must appear and make it the regmust.  Resolve
1444 	 * ties in favor of later strings, since the regstart check works
1445 	 * with the beginning of the r.e. and avoiding duplication
1446 	 * strengthens checking.  Not a strong reason, but sufficient in the
1447 	 * absence of others.
1448 	 */
1449 	/*
1450 	 * When the r.e. starts with BOW, it is faster to look for a regmust
1451 	 * first. Used a lot for "#" and "*" commands. (Added by mool).
1452 	 */
1453 	if ((flags & SPSTART || OP(scan) == BOW || OP(scan) == EOW)
1454 							  && !(flags & HASNL))
1455 	{
1456 	    longest = NULL;
1457 	    len = 0;
1458 	    for (; scan != NULL; scan = regnext(scan))
1459 		if (OP(scan) == EXACTLY && STRLEN(OPERAND(scan)) >= (size_t)len)
1460 		{
1461 		    longest = OPERAND(scan);
1462 		    len = (int)STRLEN(OPERAND(scan));
1463 		}
1464 	    r->regmust = longest;
1465 	    r->regmlen = len;
1466 	}
1467     }
1468 #ifdef BT_REGEXP_DUMP
1469     regdump(expr, r);
1470 #endif
1471     r->engine = &bt_regengine;
1472     return (regprog_T *)r;
1473 }
1474 
1475 /*
1476  * Free a compiled regexp program, returned by bt_regcomp().
1477  */
1478     static void
1479 bt_regfree(regprog_T *prog)
1480 {
1481     vim_free(prog);
1482 }
1483 
1484 /*
1485  * Setup to parse the regexp.  Used once to get the length and once to do it.
1486  */
1487     static void
1488 regcomp_start(
1489     char_u	*expr,
1490     int		re_flags)	    /* see vim_regcomp() */
1491 {
1492     initchr(expr);
1493     if (re_flags & RE_MAGIC)
1494 	reg_magic = MAGIC_ON;
1495     else
1496 	reg_magic = MAGIC_OFF;
1497     reg_string = (re_flags & RE_STRING);
1498     reg_strict = (re_flags & RE_STRICT);
1499     get_cpo_flags();
1500 
1501     num_complex_braces = 0;
1502     regnpar = 1;
1503     vim_memset(had_endbrace, 0, sizeof(had_endbrace));
1504 #ifdef FEAT_SYN_HL
1505     regnzpar = 1;
1506     re_has_z = 0;
1507 #endif
1508     regsize = 0L;
1509     reg_toolong = FALSE;
1510     regflags = 0;
1511 #if defined(FEAT_SYN_HL) || defined(PROTO)
1512     had_eol = FALSE;
1513 #endif
1514 }
1515 
1516 #if defined(FEAT_SYN_HL) || defined(PROTO)
1517 /*
1518  * Check if during the previous call to vim_regcomp the EOL item "$" has been
1519  * found.  This is messy, but it works fine.
1520  */
1521     int
1522 vim_regcomp_had_eol(void)
1523 {
1524     return had_eol;
1525 }
1526 #endif
1527 
1528 /* variables for parsing reginput */
1529 static int	at_start;	/* True when on the first character */
1530 static int	prev_at_start;  /* True when on the second character */
1531 
1532 /*
1533  * Parse regular expression, i.e. main body or parenthesized thing.
1534  *
1535  * Caller must absorb opening parenthesis.
1536  *
1537  * Combining parenthesis handling with the base level of regular expression
1538  * is a trifle forced, but the need to tie the tails of the branches to what
1539  * follows makes it hard to avoid.
1540  */
1541     static char_u *
1542 reg(
1543     int		paren,	/* REG_NOPAREN, REG_PAREN, REG_NPAREN or REG_ZPAREN */
1544     int		*flagp)
1545 {
1546     char_u	*ret;
1547     char_u	*br;
1548     char_u	*ender;
1549     int		parno = 0;
1550     int		flags;
1551 
1552     *flagp = HASWIDTH;		/* Tentatively. */
1553 
1554 #ifdef FEAT_SYN_HL
1555     if (paren == REG_ZPAREN)
1556     {
1557 	/* Make a ZOPEN node. */
1558 	if (regnzpar >= NSUBEXP)
1559 	    EMSG_RET_NULL(_("E50: Too many \\z("));
1560 	parno = regnzpar;
1561 	regnzpar++;
1562 	ret = regnode(ZOPEN + parno);
1563     }
1564     else
1565 #endif
1566 	if (paren == REG_PAREN)
1567     {
1568 	/* Make a MOPEN node. */
1569 	if (regnpar >= NSUBEXP)
1570 	    EMSG2_RET_NULL(_("E51: Too many %s("), reg_magic == MAGIC_ALL);
1571 	parno = regnpar;
1572 	++regnpar;
1573 	ret = regnode(MOPEN + parno);
1574     }
1575     else if (paren == REG_NPAREN)
1576     {
1577 	/* Make a NOPEN node. */
1578 	ret = regnode(NOPEN);
1579     }
1580     else
1581 	ret = NULL;
1582 
1583     /* Pick up the branches, linking them together. */
1584     br = regbranch(&flags);
1585     if (br == NULL)
1586 	return NULL;
1587     if (ret != NULL)
1588 	regtail(ret, br);	/* [MZ]OPEN -> first. */
1589     else
1590 	ret = br;
1591     /* If one of the branches can be zero-width, the whole thing can.
1592      * If one of the branches has * at start or matches a line-break, the
1593      * whole thing can. */
1594     if (!(flags & HASWIDTH))
1595 	*flagp &= ~HASWIDTH;
1596     *flagp |= flags & (SPSTART | HASNL | HASLOOKBH);
1597     while (peekchr() == Magic('|'))
1598     {
1599 	skipchr();
1600 	br = regbranch(&flags);
1601 	if (br == NULL || reg_toolong)
1602 	    return NULL;
1603 	regtail(ret, br);	/* BRANCH -> BRANCH. */
1604 	if (!(flags & HASWIDTH))
1605 	    *flagp &= ~HASWIDTH;
1606 	*flagp |= flags & (SPSTART | HASNL | HASLOOKBH);
1607     }
1608 
1609     /* Make a closing node, and hook it on the end. */
1610     ender = regnode(
1611 #ifdef FEAT_SYN_HL
1612 	    paren == REG_ZPAREN ? ZCLOSE + parno :
1613 #endif
1614 	    paren == REG_PAREN ? MCLOSE + parno :
1615 	    paren == REG_NPAREN ? NCLOSE : END);
1616     regtail(ret, ender);
1617 
1618     /* Hook the tails of the branches to the closing node. */
1619     for (br = ret; br != NULL; br = regnext(br))
1620 	regoptail(br, ender);
1621 
1622     /* Check for proper termination. */
1623     if (paren != REG_NOPAREN && getchr() != Magic(')'))
1624     {
1625 #ifdef FEAT_SYN_HL
1626 	if (paren == REG_ZPAREN)
1627 	    EMSG_RET_NULL(_("E52: Unmatched \\z("));
1628 	else
1629 #endif
1630 	    if (paren == REG_NPAREN)
1631 	    EMSG2_RET_NULL(_(e_unmatchedpp), reg_magic == MAGIC_ALL);
1632 	else
1633 	    EMSG2_RET_NULL(_(e_unmatchedp), reg_magic == MAGIC_ALL);
1634     }
1635     else if (paren == REG_NOPAREN && peekchr() != NUL)
1636     {
1637 	if (curchr == Magic(')'))
1638 	    EMSG2_RET_NULL(_(e_unmatchedpar), reg_magic == MAGIC_ALL);
1639 	else
1640 	    EMSG_RET_NULL(_(e_trailing));	/* "Can't happen". */
1641 	/* NOTREACHED */
1642     }
1643     /*
1644      * Here we set the flag allowing back references to this set of
1645      * parentheses.
1646      */
1647     if (paren == REG_PAREN)
1648 	had_endbrace[parno] = TRUE;	/* have seen the close paren */
1649     return ret;
1650 }
1651 
1652 /*
1653  * Parse one alternative of an | operator.
1654  * Implements the & operator.
1655  */
1656     static char_u *
1657 regbranch(int *flagp)
1658 {
1659     char_u	*ret;
1660     char_u	*chain = NULL;
1661     char_u	*latest;
1662     int		flags;
1663 
1664     *flagp = WORST | HASNL;		/* Tentatively. */
1665 
1666     ret = regnode(BRANCH);
1667     for (;;)
1668     {
1669 	latest = regconcat(&flags);
1670 	if (latest == NULL)
1671 	    return NULL;
1672 	/* If one of the branches has width, the whole thing has.  If one of
1673 	 * the branches anchors at start-of-line, the whole thing does.
1674 	 * If one of the branches uses look-behind, the whole thing does. */
1675 	*flagp |= flags & (HASWIDTH | SPSTART | HASLOOKBH);
1676 	/* If one of the branches doesn't match a line-break, the whole thing
1677 	 * doesn't. */
1678 	*flagp &= ~HASNL | (flags & HASNL);
1679 	if (chain != NULL)
1680 	    regtail(chain, latest);
1681 	if (peekchr() != Magic('&'))
1682 	    break;
1683 	skipchr();
1684 	regtail(latest, regnode(END)); /* operand ends */
1685 	if (reg_toolong)
1686 	    break;
1687 	reginsert(MATCH, latest);
1688 	chain = latest;
1689     }
1690 
1691     return ret;
1692 }
1693 
1694 /*
1695  * Parse one alternative of an | or & operator.
1696  * Implements the concatenation operator.
1697  */
1698     static char_u *
1699 regconcat(int *flagp)
1700 {
1701     char_u	*first = NULL;
1702     char_u	*chain = NULL;
1703     char_u	*latest;
1704     int		flags;
1705     int		cont = TRUE;
1706 
1707     *flagp = WORST;		/* Tentatively. */
1708 
1709     while (cont)
1710     {
1711 	switch (peekchr())
1712 	{
1713 	    case NUL:
1714 	    case Magic('|'):
1715 	    case Magic('&'):
1716 	    case Magic(')'):
1717 			    cont = FALSE;
1718 			    break;
1719 	    case Magic('Z'):
1720 #ifdef FEAT_MBYTE
1721 			    regflags |= RF_ICOMBINE;
1722 #endif
1723 			    skipchr_keepstart();
1724 			    break;
1725 	    case Magic('c'):
1726 			    regflags |= RF_ICASE;
1727 			    skipchr_keepstart();
1728 			    break;
1729 	    case Magic('C'):
1730 			    regflags |= RF_NOICASE;
1731 			    skipchr_keepstart();
1732 			    break;
1733 	    case Magic('v'):
1734 			    reg_magic = MAGIC_ALL;
1735 			    skipchr_keepstart();
1736 			    curchr = -1;
1737 			    break;
1738 	    case Magic('m'):
1739 			    reg_magic = MAGIC_ON;
1740 			    skipchr_keepstart();
1741 			    curchr = -1;
1742 			    break;
1743 	    case Magic('M'):
1744 			    reg_magic = MAGIC_OFF;
1745 			    skipchr_keepstart();
1746 			    curchr = -1;
1747 			    break;
1748 	    case Magic('V'):
1749 			    reg_magic = MAGIC_NONE;
1750 			    skipchr_keepstart();
1751 			    curchr = -1;
1752 			    break;
1753 	    default:
1754 			    latest = regpiece(&flags);
1755 			    if (latest == NULL || reg_toolong)
1756 				return NULL;
1757 			    *flagp |= flags & (HASWIDTH | HASNL | HASLOOKBH);
1758 			    if (chain == NULL)	/* First piece. */
1759 				*flagp |= flags & SPSTART;
1760 			    else
1761 				regtail(chain, latest);
1762 			    chain = latest;
1763 			    if (first == NULL)
1764 				first = latest;
1765 			    break;
1766 	}
1767     }
1768     if (first == NULL)		/* Loop ran zero times. */
1769 	first = regnode(NOTHING);
1770     return first;
1771 }
1772 
1773 /*
1774  * Parse something followed by possible [*+=].
1775  *
1776  * Note that the branching code sequences used for = and the general cases
1777  * of * and + are somewhat optimized:  they use the same NOTHING node as
1778  * both the endmarker for their branch list and the body of the last branch.
1779  * It might seem that this node could be dispensed with entirely, but the
1780  * endmarker role is not redundant.
1781  */
1782     static char_u *
1783 regpiece(int *flagp)
1784 {
1785     char_u	    *ret;
1786     int		    op;
1787     char_u	    *next;
1788     int		    flags;
1789     long	    minval;
1790     long	    maxval;
1791 
1792     ret = regatom(&flags);
1793     if (ret == NULL)
1794 	return NULL;
1795 
1796     op = peekchr();
1797     if (re_multi_type(op) == NOT_MULTI)
1798     {
1799 	*flagp = flags;
1800 	return ret;
1801     }
1802     /* default flags */
1803     *flagp = (WORST | SPSTART | (flags & (HASNL | HASLOOKBH)));
1804 
1805     skipchr();
1806     switch (op)
1807     {
1808 	case Magic('*'):
1809 	    if (flags & SIMPLE)
1810 		reginsert(STAR, ret);
1811 	    else
1812 	    {
1813 		/* Emit x* as (x&|), where & means "self". */
1814 		reginsert(BRANCH, ret); /* Either x */
1815 		regoptail(ret, regnode(BACK));	/* and loop */
1816 		regoptail(ret, ret);	/* back */
1817 		regtail(ret, regnode(BRANCH));	/* or */
1818 		regtail(ret, regnode(NOTHING)); /* null. */
1819 	    }
1820 	    break;
1821 
1822 	case Magic('+'):
1823 	    if (flags & SIMPLE)
1824 		reginsert(PLUS, ret);
1825 	    else
1826 	    {
1827 		/* Emit x+ as x(&|), where & means "self". */
1828 		next = regnode(BRANCH); /* Either */
1829 		regtail(ret, next);
1830 		regtail(regnode(BACK), ret);	/* loop back */
1831 		regtail(next, regnode(BRANCH)); /* or */
1832 		regtail(ret, regnode(NOTHING)); /* null. */
1833 	    }
1834 	    *flagp = (WORST | HASWIDTH | (flags & (HASNL | HASLOOKBH)));
1835 	    break;
1836 
1837 	case Magic('@'):
1838 	    {
1839 		int	lop = END;
1840 		int	nr;
1841 
1842 		nr = getdecchrs();
1843 		switch (no_Magic(getchr()))
1844 		{
1845 		    case '=': lop = MATCH; break;		  /* \@= */
1846 		    case '!': lop = NOMATCH; break;		  /* \@! */
1847 		    case '>': lop = SUBPAT; break;		  /* \@> */
1848 		    case '<': switch (no_Magic(getchr()))
1849 			      {
1850 				  case '=': lop = BEHIND; break;   /* \@<= */
1851 				  case '!': lop = NOBEHIND; break; /* \@<! */
1852 			      }
1853 		}
1854 		if (lop == END)
1855 		    EMSG2_RET_NULL(_("E59: invalid character after %s@"),
1856 						      reg_magic == MAGIC_ALL);
1857 		/* Look behind must match with behind_pos. */
1858 		if (lop == BEHIND || lop == NOBEHIND)
1859 		{
1860 		    regtail(ret, regnode(BHPOS));
1861 		    *flagp |= HASLOOKBH;
1862 		}
1863 		regtail(ret, regnode(END)); /* operand ends */
1864 		if (lop == BEHIND || lop == NOBEHIND)
1865 		{
1866 		    if (nr < 0)
1867 			nr = 0; /* no limit is same as zero limit */
1868 		    reginsert_nr(lop, nr, ret);
1869 		}
1870 		else
1871 		    reginsert(lop, ret);
1872 		break;
1873 	    }
1874 
1875 	case Magic('?'):
1876 	case Magic('='):
1877 	    /* Emit x= as (x|) */
1878 	    reginsert(BRANCH, ret);		/* Either x */
1879 	    regtail(ret, regnode(BRANCH));	/* or */
1880 	    next = regnode(NOTHING);		/* null. */
1881 	    regtail(ret, next);
1882 	    regoptail(ret, next);
1883 	    break;
1884 
1885 	case Magic('{'):
1886 	    if (!read_limits(&minval, &maxval))
1887 		return NULL;
1888 	    if (flags & SIMPLE)
1889 	    {
1890 		reginsert(BRACE_SIMPLE, ret);
1891 		reginsert_limits(BRACE_LIMITS, minval, maxval, ret);
1892 	    }
1893 	    else
1894 	    {
1895 		if (num_complex_braces >= 10)
1896 		    EMSG2_RET_NULL(_("E60: Too many complex %s{...}s"),
1897 						      reg_magic == MAGIC_ALL);
1898 		reginsert(BRACE_COMPLEX + num_complex_braces, ret);
1899 		regoptail(ret, regnode(BACK));
1900 		regoptail(ret, ret);
1901 		reginsert_limits(BRACE_LIMITS, minval, maxval, ret);
1902 		++num_complex_braces;
1903 	    }
1904 	    if (minval > 0 && maxval > 0)
1905 		*flagp = (HASWIDTH | (flags & (HASNL | HASLOOKBH)));
1906 	    break;
1907     }
1908     if (re_multi_type(peekchr()) != NOT_MULTI)
1909     {
1910 	/* Can't have a multi follow a multi. */
1911 	if (peekchr() == Magic('*'))
1912 	    sprintf((char *)IObuff, _("E61: Nested %s*"),
1913 					    reg_magic >= MAGIC_ON ? "" : "\\");
1914 	else
1915 	    sprintf((char *)IObuff, _("E62: Nested %s%c"),
1916 		reg_magic == MAGIC_ALL ? "" : "\\", no_Magic(peekchr()));
1917 	EMSG_RET_NULL(IObuff);
1918     }
1919 
1920     return ret;
1921 }
1922 
1923 /* When making changes to classchars also change nfa_classcodes. */
1924 static char_u	*classchars = (char_u *)".iIkKfFpPsSdDxXoOwWhHaAlLuU";
1925 static int	classcodes[] = {
1926     ANY, IDENT, SIDENT, KWORD, SKWORD,
1927     FNAME, SFNAME, PRINT, SPRINT,
1928     WHITE, NWHITE, DIGIT, NDIGIT,
1929     HEX, NHEX, OCTAL, NOCTAL,
1930     WORD, NWORD, HEAD, NHEAD,
1931     ALPHA, NALPHA, LOWER, NLOWER,
1932     UPPER, NUPPER
1933 };
1934 
1935 /*
1936  * Parse the lowest level.
1937  *
1938  * Optimization:  gobbles an entire sequence of ordinary characters so that
1939  * it can turn them into a single node, which is smaller to store and
1940  * faster to run.  Don't do this when one_exactly is set.
1941  */
1942     static char_u *
1943 regatom(int *flagp)
1944 {
1945     char_u	    *ret;
1946     int		    flags;
1947     int		    c;
1948     char_u	    *p;
1949     int		    extra = 0;
1950     int		    save_prev_at_start = prev_at_start;
1951 
1952     *flagp = WORST;		/* Tentatively. */
1953 
1954     c = getchr();
1955     switch (c)
1956     {
1957       case Magic('^'):
1958 	ret = regnode(BOL);
1959 	break;
1960 
1961       case Magic('$'):
1962 	ret = regnode(EOL);
1963 #if defined(FEAT_SYN_HL) || defined(PROTO)
1964 	had_eol = TRUE;
1965 #endif
1966 	break;
1967 
1968       case Magic('<'):
1969 	ret = regnode(BOW);
1970 	break;
1971 
1972       case Magic('>'):
1973 	ret = regnode(EOW);
1974 	break;
1975 
1976       case Magic('_'):
1977 	c = no_Magic(getchr());
1978 	if (c == '^')		/* "\_^" is start-of-line */
1979 	{
1980 	    ret = regnode(BOL);
1981 	    break;
1982 	}
1983 	if (c == '$')		/* "\_$" is end-of-line */
1984 	{
1985 	    ret = regnode(EOL);
1986 #if defined(FEAT_SYN_HL) || defined(PROTO)
1987 	    had_eol = TRUE;
1988 #endif
1989 	    break;
1990 	}
1991 
1992 	extra = ADD_NL;
1993 	*flagp |= HASNL;
1994 
1995 	/* "\_[" is character range plus newline */
1996 	if (c == '[')
1997 	    goto collection;
1998 
1999 	/* "\_x" is character class plus newline */
2000 	/*FALLTHROUGH*/
2001 
2002 	/*
2003 	 * Character classes.
2004 	 */
2005       case Magic('.'):
2006       case Magic('i'):
2007       case Magic('I'):
2008       case Magic('k'):
2009       case Magic('K'):
2010       case Magic('f'):
2011       case Magic('F'):
2012       case Magic('p'):
2013       case Magic('P'):
2014       case Magic('s'):
2015       case Magic('S'):
2016       case Magic('d'):
2017       case Magic('D'):
2018       case Magic('x'):
2019       case Magic('X'):
2020       case Magic('o'):
2021       case Magic('O'):
2022       case Magic('w'):
2023       case Magic('W'):
2024       case Magic('h'):
2025       case Magic('H'):
2026       case Magic('a'):
2027       case Magic('A'):
2028       case Magic('l'):
2029       case Magic('L'):
2030       case Magic('u'):
2031       case Magic('U'):
2032 	p = vim_strchr(classchars, no_Magic(c));
2033 	if (p == NULL)
2034 	    EMSG_RET_NULL(_("E63: invalid use of \\_"));
2035 #ifdef FEAT_MBYTE
2036 	/* When '.' is followed by a composing char ignore the dot, so that
2037 	 * the composing char is matched here. */
2038 	if (enc_utf8 && c == Magic('.') && utf_iscomposing(peekchr()))
2039 	{
2040 	    c = getchr();
2041 	    goto do_multibyte;
2042 	}
2043 #endif
2044 	ret = regnode(classcodes[p - classchars] + extra);
2045 	*flagp |= HASWIDTH | SIMPLE;
2046 	break;
2047 
2048       case Magic('n'):
2049 	if (reg_string)
2050 	{
2051 	    /* In a string "\n" matches a newline character. */
2052 	    ret = regnode(EXACTLY);
2053 	    regc(NL);
2054 	    regc(NUL);
2055 	    *flagp |= HASWIDTH | SIMPLE;
2056 	}
2057 	else
2058 	{
2059 	    /* In buffer text "\n" matches the end of a line. */
2060 	    ret = regnode(NEWL);
2061 	    *flagp |= HASWIDTH | HASNL;
2062 	}
2063 	break;
2064 
2065       case Magic('('):
2066 	if (one_exactly)
2067 	    EMSG_ONE_RET_NULL;
2068 	ret = reg(REG_PAREN, &flags);
2069 	if (ret == NULL)
2070 	    return NULL;
2071 	*flagp |= flags & (HASWIDTH | SPSTART | HASNL | HASLOOKBH);
2072 	break;
2073 
2074       case NUL:
2075       case Magic('|'):
2076       case Magic('&'):
2077       case Magic(')'):
2078 	if (one_exactly)
2079 	    EMSG_ONE_RET_NULL;
2080 	IEMSG_RET_NULL(_(e_internal));	/* Supposed to be caught earlier. */
2081 	/* NOTREACHED */
2082 
2083       case Magic('='):
2084       case Magic('?'):
2085       case Magic('+'):
2086       case Magic('@'):
2087       case Magic('{'):
2088       case Magic('*'):
2089 	c = no_Magic(c);
2090 	sprintf((char *)IObuff, _("E64: %s%c follows nothing"),
2091 		(c == '*' ? reg_magic >= MAGIC_ON : reg_magic == MAGIC_ALL)
2092 		? "" : "\\", c);
2093 	EMSG_RET_NULL(IObuff);
2094 	/* NOTREACHED */
2095 
2096       case Magic('~'):		/* previous substitute pattern */
2097 	    if (reg_prev_sub != NULL)
2098 	    {
2099 		char_u	    *lp;
2100 
2101 		ret = regnode(EXACTLY);
2102 		lp = reg_prev_sub;
2103 		while (*lp != NUL)
2104 		    regc(*lp++);
2105 		regc(NUL);
2106 		if (*reg_prev_sub != NUL)
2107 		{
2108 		    *flagp |= HASWIDTH;
2109 		    if ((lp - reg_prev_sub) == 1)
2110 			*flagp |= SIMPLE;
2111 		}
2112 	    }
2113 	    else
2114 		EMSG_RET_NULL(_(e_nopresub));
2115 	    break;
2116 
2117       case Magic('1'):
2118       case Magic('2'):
2119       case Magic('3'):
2120       case Magic('4'):
2121       case Magic('5'):
2122       case Magic('6'):
2123       case Magic('7'):
2124       case Magic('8'):
2125       case Magic('9'):
2126 	    {
2127 		int		    refnum;
2128 
2129 		refnum = c - Magic('0');
2130 		if (!seen_endbrace(refnum))
2131 		    return NULL;
2132 		ret = regnode(BACKREF + refnum);
2133 	    }
2134 	    break;
2135 
2136       case Magic('z'):
2137 	{
2138 	    c = no_Magic(getchr());
2139 	    switch (c)
2140 	    {
2141 #ifdef FEAT_SYN_HL
2142 		case '(': if (reg_do_extmatch != REX_SET)
2143 			      EMSG_RET_NULL(_(e_z_not_allowed));
2144 			  if (one_exactly)
2145 			      EMSG_ONE_RET_NULL;
2146 			  ret = reg(REG_ZPAREN, &flags);
2147 			  if (ret == NULL)
2148 			      return NULL;
2149 			  *flagp |= flags & (HASWIDTH|SPSTART|HASNL|HASLOOKBH);
2150 			  re_has_z = REX_SET;
2151 			  break;
2152 
2153 		case '1':
2154 		case '2':
2155 		case '3':
2156 		case '4':
2157 		case '5':
2158 		case '6':
2159 		case '7':
2160 		case '8':
2161 		case '9': if (reg_do_extmatch != REX_USE)
2162 			      EMSG_RET_NULL(_(e_z1_not_allowed));
2163 			  ret = regnode(ZREF + c - '0');
2164 			  re_has_z = REX_USE;
2165 			  break;
2166 #endif
2167 
2168 		case 's': ret = regnode(MOPEN + 0);
2169 			  if (re_mult_next("\\zs") == FAIL)
2170 			      return NULL;
2171 			  break;
2172 
2173 		case 'e': ret = regnode(MCLOSE + 0);
2174 			  if (re_mult_next("\\ze") == FAIL)
2175 			      return NULL;
2176 			  break;
2177 
2178 		default:  EMSG_RET_NULL(_("E68: Invalid character after \\z"));
2179 	    }
2180 	}
2181 	break;
2182 
2183       case Magic('%'):
2184 	{
2185 	    c = no_Magic(getchr());
2186 	    switch (c)
2187 	    {
2188 		/* () without a back reference */
2189 		case '(':
2190 		    if (one_exactly)
2191 			EMSG_ONE_RET_NULL;
2192 		    ret = reg(REG_NPAREN, &flags);
2193 		    if (ret == NULL)
2194 			return NULL;
2195 		    *flagp |= flags & (HASWIDTH | SPSTART | HASNL | HASLOOKBH);
2196 		    break;
2197 
2198 		/* Catch \%^ and \%$ regardless of where they appear in the
2199 		 * pattern -- regardless of whether or not it makes sense. */
2200 		case '^':
2201 		    ret = regnode(RE_BOF);
2202 		    break;
2203 
2204 		case '$':
2205 		    ret = regnode(RE_EOF);
2206 		    break;
2207 
2208 		case '#':
2209 		    ret = regnode(CURSOR);
2210 		    break;
2211 
2212 		case 'V':
2213 		    ret = regnode(RE_VISUAL);
2214 		    break;
2215 
2216 		case 'C':
2217 		    ret = regnode(RE_COMPOSING);
2218 		    break;
2219 
2220 		/* \%[abc]: Emit as a list of branches, all ending at the last
2221 		 * branch which matches nothing. */
2222 		case '[':
2223 			  if (one_exactly)	/* doesn't nest */
2224 			      EMSG_ONE_RET_NULL;
2225 			  {
2226 			      char_u	*lastbranch;
2227 			      char_u	*lastnode = NULL;
2228 			      char_u	*br;
2229 
2230 			      ret = NULL;
2231 			      while ((c = getchr()) != ']')
2232 			      {
2233 				  if (c == NUL)
2234 				      EMSG2_RET_NULL(_(e_missing_sb),
2235 						      reg_magic == MAGIC_ALL);
2236 				  br = regnode(BRANCH);
2237 				  if (ret == NULL)
2238 				      ret = br;
2239 				  else
2240 				      regtail(lastnode, br);
2241 
2242 				  ungetchr();
2243 				  one_exactly = TRUE;
2244 				  lastnode = regatom(flagp);
2245 				  one_exactly = FALSE;
2246 				  if (lastnode == NULL)
2247 				      return NULL;
2248 			      }
2249 			      if (ret == NULL)
2250 				  EMSG2_RET_NULL(_(e_empty_sb),
2251 						      reg_magic == MAGIC_ALL);
2252 			      lastbranch = regnode(BRANCH);
2253 			      br = regnode(NOTHING);
2254 			      if (ret != JUST_CALC_SIZE)
2255 			      {
2256 				  regtail(lastnode, br);
2257 				  regtail(lastbranch, br);
2258 				  /* connect all branches to the NOTHING
2259 				   * branch at the end */
2260 				  for (br = ret; br != lastnode; )
2261 				  {
2262 				      if (OP(br) == BRANCH)
2263 				      {
2264 					  regtail(br, lastbranch);
2265 					  br = OPERAND(br);
2266 				      }
2267 				      else
2268 					  br = regnext(br);
2269 				  }
2270 			      }
2271 			      *flagp &= ~(HASWIDTH | SIMPLE);
2272 			      break;
2273 			  }
2274 
2275 		case 'd':   /* %d123 decimal */
2276 		case 'o':   /* %o123 octal */
2277 		case 'x':   /* %xab hex 2 */
2278 		case 'u':   /* %uabcd hex 4 */
2279 		case 'U':   /* %U1234abcd hex 8 */
2280 			  {
2281 			      int i;
2282 
2283 			      switch (c)
2284 			      {
2285 				  case 'd': i = getdecchrs(); break;
2286 				  case 'o': i = getoctchrs(); break;
2287 				  case 'x': i = gethexchrs(2); break;
2288 				  case 'u': i = gethexchrs(4); break;
2289 				  case 'U': i = gethexchrs(8); break;
2290 				  default:  i = -1; break;
2291 			      }
2292 
2293 			      if (i < 0)
2294 				  EMSG2_RET_NULL(
2295 					_("E678: Invalid character after %s%%[dxouU]"),
2296 					reg_magic == MAGIC_ALL);
2297 #ifdef FEAT_MBYTE
2298 			      if (use_multibytecode(i))
2299 				  ret = regnode(MULTIBYTECODE);
2300 			      else
2301 #endif
2302 				  ret = regnode(EXACTLY);
2303 			      if (i == 0)
2304 				  regc(0x0a);
2305 			      else
2306 #ifdef FEAT_MBYTE
2307 				  regmbc(i);
2308 #else
2309 				  regc(i);
2310 #endif
2311 			      regc(NUL);
2312 			      *flagp |= HASWIDTH;
2313 			      break;
2314 			  }
2315 
2316 		default:
2317 			  if (VIM_ISDIGIT(c) || c == '<' || c == '>'
2318 								 || c == '\'')
2319 			  {
2320 			      long_u	n = 0;
2321 			      int	cmp;
2322 
2323 			      cmp = c;
2324 			      if (cmp == '<' || cmp == '>')
2325 				  c = getchr();
2326 			      while (VIM_ISDIGIT(c))
2327 			      {
2328 				  n = n * 10 + (c - '0');
2329 				  c = getchr();
2330 			      }
2331 			      if (c == '\'' && n == 0)
2332 			      {
2333 				  /* "\%'m", "\%<'m" and "\%>'m": Mark */
2334 				  c = getchr();
2335 				  ret = regnode(RE_MARK);
2336 				  if (ret == JUST_CALC_SIZE)
2337 				      regsize += 2;
2338 				  else
2339 				  {
2340 				      *regcode++ = c;
2341 				      *regcode++ = cmp;
2342 				  }
2343 				  break;
2344 			      }
2345 			      else if (c == 'l' || c == 'c' || c == 'v')
2346 			      {
2347 				  if (c == 'l')
2348 				  {
2349 				      ret = regnode(RE_LNUM);
2350 				      if (save_prev_at_start)
2351 					  at_start = TRUE;
2352 				  }
2353 				  else if (c == 'c')
2354 				      ret = regnode(RE_COL);
2355 				  else
2356 				      ret = regnode(RE_VCOL);
2357 				  if (ret == JUST_CALC_SIZE)
2358 				      regsize += 5;
2359 				  else
2360 				  {
2361 				      /* put the number and the optional
2362 				       * comparator after the opcode */
2363 				      regcode = re_put_long(regcode, n);
2364 				      *regcode++ = cmp;
2365 				  }
2366 				  break;
2367 			      }
2368 			  }
2369 
2370 			  EMSG2_RET_NULL(_("E71: Invalid character after %s%%"),
2371 						      reg_magic == MAGIC_ALL);
2372 	    }
2373 	}
2374 	break;
2375 
2376       case Magic('['):
2377 collection:
2378 	{
2379 	    char_u	*lp;
2380 
2381 	    /*
2382 	     * If there is no matching ']', we assume the '[' is a normal
2383 	     * character.  This makes 'incsearch' and ":help [" work.
2384 	     */
2385 	    lp = skip_anyof(regparse);
2386 	    if (*lp == ']')	/* there is a matching ']' */
2387 	    {
2388 		int	startc = -1;	/* > 0 when next '-' is a range */
2389 		int	endc;
2390 
2391 		/*
2392 		 * In a character class, different parsing rules apply.
2393 		 * Not even \ is special anymore, nothing is.
2394 		 */
2395 		if (*regparse == '^')	    /* Complement of range. */
2396 		{
2397 		    ret = regnode(ANYBUT + extra);
2398 		    regparse++;
2399 		}
2400 		else
2401 		    ret = regnode(ANYOF + extra);
2402 
2403 		/* At the start ']' and '-' mean the literal character. */
2404 		if (*regparse == ']' || *regparse == '-')
2405 		{
2406 		    startc = *regparse;
2407 		    regc(*regparse++);
2408 		}
2409 
2410 		while (*regparse != NUL && *regparse != ']')
2411 		{
2412 		    if (*regparse == '-')
2413 		    {
2414 			++regparse;
2415 			/* The '-' is not used for a range at the end and
2416 			 * after or before a '\n'. */
2417 			if (*regparse == ']' || *regparse == NUL
2418 				|| startc == -1
2419 				|| (regparse[0] == '\\' && regparse[1] == 'n'))
2420 			{
2421 			    regc('-');
2422 			    startc = '-';	/* [--x] is a range */
2423 			}
2424 			else
2425 			{
2426 			    /* Also accept "a-[.z.]" */
2427 			    endc = 0;
2428 			    if (*regparse == '[')
2429 				endc = get_coll_element(&regparse);
2430 			    if (endc == 0)
2431 			    {
2432 #ifdef FEAT_MBYTE
2433 				if (has_mbyte)
2434 				    endc = mb_ptr2char_adv(&regparse);
2435 				else
2436 #endif
2437 				    endc = *regparse++;
2438 			    }
2439 
2440 			    /* Handle \o40, \x20 and \u20AC style sequences */
2441 			    if (endc == '\\' && !reg_cpo_lit && !reg_cpo_bsl)
2442 				endc = coll_get_char();
2443 
2444 			    if (startc > endc)
2445 				EMSG_RET_NULL(_(e_reverse_range));
2446 #ifdef FEAT_MBYTE
2447 			    if (has_mbyte && ((*mb_char2len)(startc) > 1
2448 						 || (*mb_char2len)(endc) > 1))
2449 			    {
2450 				/* Limit to a range of 256 chars. */
2451 				if (endc > startc + 256)
2452 				    EMSG_RET_NULL(_(e_large_class));
2453 				while (++startc <= endc)
2454 				    regmbc(startc);
2455 			    }
2456 			    else
2457 #endif
2458 			    {
2459 #ifdef EBCDIC
2460 				int	alpha_only = FALSE;
2461 
2462 				/* for alphabetical range skip the gaps
2463 				 * 'i'-'j', 'r'-'s', 'I'-'J' and 'R'-'S'.  */
2464 				if (isalpha(startc) && isalpha(endc))
2465 				    alpha_only = TRUE;
2466 #endif
2467 				while (++startc <= endc)
2468 #ifdef EBCDIC
2469 				    if (!alpha_only || isalpha(startc))
2470 #endif
2471 					regc(startc);
2472 			    }
2473 			    startc = -1;
2474 			}
2475 		    }
2476 		    /*
2477 		     * Only "\]", "\^", "\]" and "\\" are special in Vi.  Vim
2478 		     * accepts "\t", "\e", etc., but only when the 'l' flag in
2479 		     * 'cpoptions' is not included.
2480 		     * Posix doesn't recognize backslash at all.
2481 		     */
2482 		    else if (*regparse == '\\'
2483 			    && !reg_cpo_bsl
2484 			    && (vim_strchr(REGEXP_INRANGE, regparse[1]) != NULL
2485 				|| (!reg_cpo_lit
2486 				    && vim_strchr(REGEXP_ABBR,
2487 						       regparse[1]) != NULL)))
2488 		    {
2489 			regparse++;
2490 			if (*regparse == 'n')
2491 			{
2492 			    /* '\n' in range: also match NL */
2493 			    if (ret != JUST_CALC_SIZE)
2494 			    {
2495 				/* Using \n inside [^] does not change what
2496 				 * matches. "[^\n]" is the same as ".". */
2497 				if (*ret == ANYOF)
2498 				{
2499 				    *ret = ANYOF + ADD_NL;
2500 				    *flagp |= HASNL;
2501 				}
2502 				/* else: must have had a \n already */
2503 			    }
2504 			    regparse++;
2505 			    startc = -1;
2506 			}
2507 			else if (*regparse == 'd'
2508 				|| *regparse == 'o'
2509 				|| *regparse == 'x'
2510 				|| *regparse == 'u'
2511 				|| *regparse == 'U')
2512 			{
2513 			    startc = coll_get_char();
2514 			    if (startc == 0)
2515 				regc(0x0a);
2516 			    else
2517 #ifdef FEAT_MBYTE
2518 				regmbc(startc);
2519 #else
2520 				regc(startc);
2521 #endif
2522 			}
2523 			else
2524 			{
2525 			    startc = backslash_trans(*regparse++);
2526 			    regc(startc);
2527 			}
2528 		    }
2529 		    else if (*regparse == '[')
2530 		    {
2531 			int c_class;
2532 			int cu;
2533 
2534 			c_class = get_char_class(&regparse);
2535 			startc = -1;
2536 			/* Characters assumed to be 8 bits! */
2537 			switch (c_class)
2538 			{
2539 			    case CLASS_NONE:
2540 				c_class = get_equi_class(&regparse);
2541 				if (c_class != 0)
2542 				{
2543 				    /* produce equivalence class */
2544 				    reg_equi_class(c_class);
2545 				}
2546 				else if ((c_class =
2547 					    get_coll_element(&regparse)) != 0)
2548 				{
2549 				    /* produce a collating element */
2550 				    regmbc(c_class);
2551 				}
2552 				else
2553 				{
2554 				    /* literal '[', allow [[-x] as a range */
2555 				    startc = *regparse++;
2556 				    regc(startc);
2557 				}
2558 				break;
2559 			    case CLASS_ALNUM:
2560 				for (cu = 1; cu < 128; cu++)
2561 				    if (isalnum(cu))
2562 					regmbc(cu);
2563 				break;
2564 			    case CLASS_ALPHA:
2565 				for (cu = 1; cu < 128; cu++)
2566 				    if (isalpha(cu))
2567 					regmbc(cu);
2568 				break;
2569 			    case CLASS_BLANK:
2570 				regc(' ');
2571 				regc('\t');
2572 				break;
2573 			    case CLASS_CNTRL:
2574 				for (cu = 1; cu <= 127; cu++)
2575 				    if (iscntrl(cu))
2576 					regmbc(cu);
2577 				break;
2578 			    case CLASS_DIGIT:
2579 				for (cu = 1; cu <= 127; cu++)
2580 				    if (VIM_ISDIGIT(cu))
2581 					regmbc(cu);
2582 				break;
2583 			    case CLASS_GRAPH:
2584 				for (cu = 1; cu <= 127; cu++)
2585 				    if (isgraph(cu))
2586 					regmbc(cu);
2587 				break;
2588 			    case CLASS_LOWER:
2589 				for (cu = 1; cu <= 255; cu++)
2590 				    if (MB_ISLOWER(cu) && cu != 170
2591 								 && cu != 186)
2592 					regmbc(cu);
2593 				break;
2594 			    case CLASS_PRINT:
2595 				for (cu = 1; cu <= 255; cu++)
2596 				    if (vim_isprintc(cu))
2597 					regmbc(cu);
2598 				break;
2599 			    case CLASS_PUNCT:
2600 				for (cu = 1; cu < 128; cu++)
2601 				    if (ispunct(cu))
2602 					regmbc(cu);
2603 				break;
2604 			    case CLASS_SPACE:
2605 				for (cu = 9; cu <= 13; cu++)
2606 				    regc(cu);
2607 				regc(' ');
2608 				break;
2609 			    case CLASS_UPPER:
2610 				for (cu = 1; cu <= 255; cu++)
2611 				    if (MB_ISUPPER(cu))
2612 					regmbc(cu);
2613 				break;
2614 			    case CLASS_XDIGIT:
2615 				for (cu = 1; cu <= 255; cu++)
2616 				    if (vim_isxdigit(cu))
2617 					regmbc(cu);
2618 				break;
2619 			    case CLASS_TAB:
2620 				regc('\t');
2621 				break;
2622 			    case CLASS_RETURN:
2623 				regc('\r');
2624 				break;
2625 			    case CLASS_BACKSPACE:
2626 				regc('\b');
2627 				break;
2628 			    case CLASS_ESCAPE:
2629 				regc('\033');
2630 				break;
2631 			}
2632 		    }
2633 		    else
2634 		    {
2635 #ifdef FEAT_MBYTE
2636 			if (has_mbyte)
2637 			{
2638 			    int	len;
2639 
2640 			    /* produce a multibyte character, including any
2641 			     * following composing characters */
2642 			    startc = mb_ptr2char(regparse);
2643 			    len = (*mb_ptr2len)(regparse);
2644 			    if (enc_utf8 && utf_char2len(startc) != len)
2645 				startc = -1;	/* composing chars */
2646 			    while (--len >= 0)
2647 				regc(*regparse++);
2648 			}
2649 			else
2650 #endif
2651 			{
2652 			    startc = *regparse++;
2653 			    regc(startc);
2654 			}
2655 		    }
2656 		}
2657 		regc(NUL);
2658 		prevchr_len = 1;	/* last char was the ']' */
2659 		if (*regparse != ']')
2660 		    EMSG_RET_NULL(_(e_toomsbra));	/* Cannot happen? */
2661 		skipchr();	    /* let's be friends with the lexer again */
2662 		*flagp |= HASWIDTH | SIMPLE;
2663 		break;
2664 	    }
2665 	    else if (reg_strict)
2666 		EMSG2_RET_NULL(_(e_missingbracket), reg_magic > MAGIC_OFF);
2667 	}
2668 	/* FALLTHROUGH */
2669 
2670       default:
2671 	{
2672 	    int		len;
2673 
2674 #ifdef FEAT_MBYTE
2675 	    /* A multi-byte character is handled as a separate atom if it's
2676 	     * before a multi and when it's a composing char. */
2677 	    if (use_multibytecode(c))
2678 	    {
2679 do_multibyte:
2680 		ret = regnode(MULTIBYTECODE);
2681 		regmbc(c);
2682 		*flagp |= HASWIDTH | SIMPLE;
2683 		break;
2684 	    }
2685 #endif
2686 
2687 	    ret = regnode(EXACTLY);
2688 
2689 	    /*
2690 	     * Append characters as long as:
2691 	     * - there is no following multi, we then need the character in
2692 	     *   front of it as a single character operand
2693 	     * - not running into a Magic character
2694 	     * - "one_exactly" is not set
2695 	     * But always emit at least one character.  Might be a Multi,
2696 	     * e.g., a "[" without matching "]".
2697 	     */
2698 	    for (len = 0; c != NUL && (len == 0
2699 			|| (re_multi_type(peekchr()) == NOT_MULTI
2700 			    && !one_exactly
2701 			    && !is_Magic(c))); ++len)
2702 	    {
2703 		c = no_Magic(c);
2704 #ifdef FEAT_MBYTE
2705 		if (has_mbyte)
2706 		{
2707 		    regmbc(c);
2708 		    if (enc_utf8)
2709 		    {
2710 			int	l;
2711 
2712 			/* Need to get composing character too. */
2713 			for (;;)
2714 			{
2715 			    l = utf_ptr2len(regparse);
2716 			    if (!UTF_COMPOSINGLIKE(regparse, regparse + l))
2717 				break;
2718 			    regmbc(utf_ptr2char(regparse));
2719 			    skipchr();
2720 			}
2721 		    }
2722 		}
2723 		else
2724 #endif
2725 		    regc(c);
2726 		c = getchr();
2727 	    }
2728 	    ungetchr();
2729 
2730 	    regc(NUL);
2731 	    *flagp |= HASWIDTH;
2732 	    if (len == 1)
2733 		*flagp |= SIMPLE;
2734 	}
2735 	break;
2736     }
2737 
2738     return ret;
2739 }
2740 
2741 #ifdef FEAT_MBYTE
2742 /*
2743  * Return TRUE if MULTIBYTECODE should be used instead of EXACTLY for
2744  * character "c".
2745  */
2746     static int
2747 use_multibytecode(int c)
2748 {
2749     return has_mbyte && (*mb_char2len)(c) > 1
2750 		     && (re_multi_type(peekchr()) != NOT_MULTI
2751 			     || (enc_utf8 && utf_iscomposing(c)));
2752 }
2753 #endif
2754 
2755 /*
2756  * Emit a node.
2757  * Return pointer to generated code.
2758  */
2759     static char_u *
2760 regnode(int op)
2761 {
2762     char_u  *ret;
2763 
2764     ret = regcode;
2765     if (ret == JUST_CALC_SIZE)
2766 	regsize += 3;
2767     else
2768     {
2769 	*regcode++ = op;
2770 	*regcode++ = NUL;		/* Null "next" pointer. */
2771 	*regcode++ = NUL;
2772     }
2773     return ret;
2774 }
2775 
2776 /*
2777  * Emit (if appropriate) a byte of code
2778  */
2779     static void
2780 regc(int b)
2781 {
2782     if (regcode == JUST_CALC_SIZE)
2783 	regsize++;
2784     else
2785 	*regcode++ = b;
2786 }
2787 
2788 #ifdef FEAT_MBYTE
2789 /*
2790  * Emit (if appropriate) a multi-byte character of code
2791  */
2792     static void
2793 regmbc(int c)
2794 {
2795     if (!has_mbyte && c > 0xff)
2796 	return;
2797     if (regcode == JUST_CALC_SIZE)
2798 	regsize += (*mb_char2len)(c);
2799     else
2800 	regcode += (*mb_char2bytes)(c, regcode);
2801 }
2802 #endif
2803 
2804 /*
2805  * Insert an operator in front of already-emitted operand
2806  *
2807  * Means relocating the operand.
2808  */
2809     static void
2810 reginsert(int op, char_u *opnd)
2811 {
2812     char_u	*src;
2813     char_u	*dst;
2814     char_u	*place;
2815 
2816     if (regcode == JUST_CALC_SIZE)
2817     {
2818 	regsize += 3;
2819 	return;
2820     }
2821     src = regcode;
2822     regcode += 3;
2823     dst = regcode;
2824     while (src > opnd)
2825 	*--dst = *--src;
2826 
2827     place = opnd;		/* Op node, where operand used to be. */
2828     *place++ = op;
2829     *place++ = NUL;
2830     *place = NUL;
2831 }
2832 
2833 /*
2834  * Insert an operator in front of already-emitted operand.
2835  * Add a number to the operator.
2836  */
2837     static void
2838 reginsert_nr(int op, long val, char_u *opnd)
2839 {
2840     char_u	*src;
2841     char_u	*dst;
2842     char_u	*place;
2843 
2844     if (regcode == JUST_CALC_SIZE)
2845     {
2846 	regsize += 7;
2847 	return;
2848     }
2849     src = regcode;
2850     regcode += 7;
2851     dst = regcode;
2852     while (src > opnd)
2853 	*--dst = *--src;
2854 
2855     place = opnd;		/* Op node, where operand used to be. */
2856     *place++ = op;
2857     *place++ = NUL;
2858     *place++ = NUL;
2859     place = re_put_long(place, (long_u)val);
2860 }
2861 
2862 /*
2863  * Insert an operator in front of already-emitted operand.
2864  * The operator has the given limit values as operands.  Also set next pointer.
2865  *
2866  * Means relocating the operand.
2867  */
2868     static void
2869 reginsert_limits(
2870     int		op,
2871     long	minval,
2872     long	maxval,
2873     char_u	*opnd)
2874 {
2875     char_u	*src;
2876     char_u	*dst;
2877     char_u	*place;
2878 
2879     if (regcode == JUST_CALC_SIZE)
2880     {
2881 	regsize += 11;
2882 	return;
2883     }
2884     src = regcode;
2885     regcode += 11;
2886     dst = regcode;
2887     while (src > opnd)
2888 	*--dst = *--src;
2889 
2890     place = opnd;		/* Op node, where operand used to be. */
2891     *place++ = op;
2892     *place++ = NUL;
2893     *place++ = NUL;
2894     place = re_put_long(place, (long_u)minval);
2895     place = re_put_long(place, (long_u)maxval);
2896     regtail(opnd, place);
2897 }
2898 
2899 /*
2900  * Write a long as four bytes at "p" and return pointer to the next char.
2901  */
2902     static char_u *
2903 re_put_long(char_u *p, long_u val)
2904 {
2905     *p++ = (char_u) ((val >> 24) & 0377);
2906     *p++ = (char_u) ((val >> 16) & 0377);
2907     *p++ = (char_u) ((val >> 8) & 0377);
2908     *p++ = (char_u) (val & 0377);
2909     return p;
2910 }
2911 
2912 /*
2913  * Set the next-pointer at the end of a node chain.
2914  */
2915     static void
2916 regtail(char_u *p, char_u *val)
2917 {
2918     char_u	*scan;
2919     char_u	*temp;
2920     int		offset;
2921 
2922     if (p == JUST_CALC_SIZE)
2923 	return;
2924 
2925     /* Find last node. */
2926     scan = p;
2927     for (;;)
2928     {
2929 	temp = regnext(scan);
2930 	if (temp == NULL)
2931 	    break;
2932 	scan = temp;
2933     }
2934 
2935     if (OP(scan) == BACK)
2936 	offset = (int)(scan - val);
2937     else
2938 	offset = (int)(val - scan);
2939     /* When the offset uses more than 16 bits it can no longer fit in the two
2940      * bytes available.  Use a global flag to avoid having to check return
2941      * values in too many places. */
2942     if (offset > 0xffff)
2943 	reg_toolong = TRUE;
2944     else
2945     {
2946 	*(scan + 1) = (char_u) (((unsigned)offset >> 8) & 0377);
2947 	*(scan + 2) = (char_u) (offset & 0377);
2948     }
2949 }
2950 
2951 /*
2952  * Like regtail, on item after a BRANCH; nop if none.
2953  */
2954     static void
2955 regoptail(char_u *p, char_u *val)
2956 {
2957     /* When op is neither BRANCH nor BRACE_COMPLEX0-9, it is "operandless" */
2958     if (p == NULL || p == JUST_CALC_SIZE
2959 	    || (OP(p) != BRANCH
2960 		&& (OP(p) < BRACE_COMPLEX || OP(p) > BRACE_COMPLEX + 9)))
2961 	return;
2962     regtail(OPERAND(p), val);
2963 }
2964 
2965 /*
2966  * Functions for getting characters from the regexp input.
2967  */
2968 /*
2969  * Start parsing at "str".
2970  */
2971     static void
2972 initchr(char_u *str)
2973 {
2974     regparse = str;
2975     prevchr_len = 0;
2976     curchr = prevprevchr = prevchr = nextchr = -1;
2977     at_start = TRUE;
2978     prev_at_start = FALSE;
2979 }
2980 
2981 /*
2982  * Save the current parse state, so that it can be restored and parsing
2983  * starts in the same state again.
2984  */
2985     static void
2986 save_parse_state(parse_state_T *ps)
2987 {
2988     ps->regparse = regparse;
2989     ps->prevchr_len = prevchr_len;
2990     ps->curchr = curchr;
2991     ps->prevchr = prevchr;
2992     ps->prevprevchr = prevprevchr;
2993     ps->nextchr = nextchr;
2994     ps->at_start = at_start;
2995     ps->prev_at_start = prev_at_start;
2996     ps->regnpar = regnpar;
2997 }
2998 
2999 /*
3000  * Restore a previously saved parse state.
3001  */
3002     static void
3003 restore_parse_state(parse_state_T *ps)
3004 {
3005     regparse = ps->regparse;
3006     prevchr_len = ps->prevchr_len;
3007     curchr = ps->curchr;
3008     prevchr = ps->prevchr;
3009     prevprevchr = ps->prevprevchr;
3010     nextchr = ps->nextchr;
3011     at_start = ps->at_start;
3012     prev_at_start = ps->prev_at_start;
3013     regnpar = ps->regnpar;
3014 }
3015 
3016 
3017 /*
3018  * Get the next character without advancing.
3019  */
3020     static int
3021 peekchr(void)
3022 {
3023     static int	after_slash = FALSE;
3024 
3025     if (curchr == -1)
3026     {
3027 	switch (curchr = regparse[0])
3028 	{
3029 	case '.':
3030 	case '[':
3031 	case '~':
3032 	    /* magic when 'magic' is on */
3033 	    if (reg_magic >= MAGIC_ON)
3034 		curchr = Magic(curchr);
3035 	    break;
3036 	case '(':
3037 	case ')':
3038 	case '{':
3039 	case '%':
3040 	case '+':
3041 	case '=':
3042 	case '?':
3043 	case '@':
3044 	case '!':
3045 	case '&':
3046 	case '|':
3047 	case '<':
3048 	case '>':
3049 	case '#':	/* future ext. */
3050 	case '"':	/* future ext. */
3051 	case '\'':	/* future ext. */
3052 	case ',':	/* future ext. */
3053 	case '-':	/* future ext. */
3054 	case ':':	/* future ext. */
3055 	case ';':	/* future ext. */
3056 	case '`':	/* future ext. */
3057 	case '/':	/* Can't be used in / command */
3058 	    /* magic only after "\v" */
3059 	    if (reg_magic == MAGIC_ALL)
3060 		curchr = Magic(curchr);
3061 	    break;
3062 	case '*':
3063 	    /* * is not magic as the very first character, eg "?*ptr", when
3064 	     * after '^', eg "/^*ptr" and when after "\(", "\|", "\&".  But
3065 	     * "\(\*" is not magic, thus must be magic if "after_slash" */
3066 	    if (reg_magic >= MAGIC_ON
3067 		    && !at_start
3068 		    && !(prev_at_start && prevchr == Magic('^'))
3069 		    && (after_slash
3070 			|| (prevchr != Magic('(')
3071 			    && prevchr != Magic('&')
3072 			    && prevchr != Magic('|'))))
3073 		curchr = Magic('*');
3074 	    break;
3075 	case '^':
3076 	    /* '^' is only magic as the very first character and if it's after
3077 	     * "\(", "\|", "\&' or "\n" */
3078 	    if (reg_magic >= MAGIC_OFF
3079 		    && (at_start
3080 			|| reg_magic == MAGIC_ALL
3081 			|| prevchr == Magic('(')
3082 			|| prevchr == Magic('|')
3083 			|| prevchr == Magic('&')
3084 			|| prevchr == Magic('n')
3085 			|| (no_Magic(prevchr) == '('
3086 			    && prevprevchr == Magic('%'))))
3087 	    {
3088 		curchr = Magic('^');
3089 		at_start = TRUE;
3090 		prev_at_start = FALSE;
3091 	    }
3092 	    break;
3093 	case '$':
3094 	    /* '$' is only magic as the very last char and if it's in front of
3095 	     * either "\|", "\)", "\&", or "\n" */
3096 	    if (reg_magic >= MAGIC_OFF)
3097 	    {
3098 		char_u *p = regparse + 1;
3099 		int is_magic_all = (reg_magic == MAGIC_ALL);
3100 
3101 		/* ignore \c \C \m \M \v \V and \Z after '$' */
3102 		while (p[0] == '\\' && (p[1] == 'c' || p[1] == 'C'
3103 				|| p[1] == 'm' || p[1] == 'M'
3104 				|| p[1] == 'v' || p[1] == 'V' || p[1] == 'Z'))
3105 		{
3106 		    if (p[1] == 'v')
3107 			is_magic_all = TRUE;
3108 		    else if (p[1] == 'm' || p[1] == 'M' || p[1] == 'V')
3109 			is_magic_all = FALSE;
3110 		    p += 2;
3111 		}
3112 		if (p[0] == NUL
3113 			|| (p[0] == '\\'
3114 			    && (p[1] == '|' || p[1] == '&' || p[1] == ')'
3115 				|| p[1] == 'n'))
3116 			|| (is_magic_all
3117 			       && (p[0] == '|' || p[0] == '&' || p[0] == ')'))
3118 			|| reg_magic == MAGIC_ALL)
3119 		    curchr = Magic('$');
3120 	    }
3121 	    break;
3122 	case '\\':
3123 	    {
3124 		int c = regparse[1];
3125 
3126 		if (c == NUL)
3127 		    curchr = '\\';	/* trailing '\' */
3128 		else if (
3129 #ifdef EBCDIC
3130 			vim_strchr(META, c)
3131 #else
3132 			c <= '~' && META_flags[c]
3133 #endif
3134 			)
3135 		{
3136 		    /*
3137 		     * META contains everything that may be magic sometimes,
3138 		     * except ^ and $ ("\^" and "\$" are only magic after
3139 		     * "\V").  We now fetch the next character and toggle its
3140 		     * magicness.  Therefore, \ is so meta-magic that it is
3141 		     * not in META.
3142 		     */
3143 		    curchr = -1;
3144 		    prev_at_start = at_start;
3145 		    at_start = FALSE;	/* be able to say "/\*ptr" */
3146 		    ++regparse;
3147 		    ++after_slash;
3148 		    peekchr();
3149 		    --regparse;
3150 		    --after_slash;
3151 		    curchr = toggle_Magic(curchr);
3152 		}
3153 		else if (vim_strchr(REGEXP_ABBR, c))
3154 		{
3155 		    /*
3156 		     * Handle abbreviations, like "\t" for TAB -- webb
3157 		     */
3158 		    curchr = backslash_trans(c);
3159 		}
3160 		else if (reg_magic == MAGIC_NONE && (c == '$' || c == '^'))
3161 		    curchr = toggle_Magic(c);
3162 		else
3163 		{
3164 		    /*
3165 		     * Next character can never be (made) magic?
3166 		     * Then backslashing it won't do anything.
3167 		     */
3168 #ifdef FEAT_MBYTE
3169 		    if (has_mbyte)
3170 			curchr = (*mb_ptr2char)(regparse + 1);
3171 		    else
3172 #endif
3173 			curchr = c;
3174 		}
3175 		break;
3176 	    }
3177 
3178 #ifdef FEAT_MBYTE
3179 	default:
3180 	    if (has_mbyte)
3181 		curchr = (*mb_ptr2char)(regparse);
3182 #endif
3183 	}
3184     }
3185 
3186     return curchr;
3187 }
3188 
3189 /*
3190  * Eat one lexed character.  Do this in a way that we can undo it.
3191  */
3192     static void
3193 skipchr(void)
3194 {
3195     /* peekchr() eats a backslash, do the same here */
3196     if (*regparse == '\\')
3197 	prevchr_len = 1;
3198     else
3199 	prevchr_len = 0;
3200     if (regparse[prevchr_len] != NUL)
3201     {
3202 #ifdef FEAT_MBYTE
3203 	if (enc_utf8)
3204 	    /* exclude composing chars that mb_ptr2len does include */
3205 	    prevchr_len += utf_ptr2len(regparse + prevchr_len);
3206 	else if (has_mbyte)
3207 	    prevchr_len += (*mb_ptr2len)(regparse + prevchr_len);
3208 	else
3209 #endif
3210 	    ++prevchr_len;
3211     }
3212     regparse += prevchr_len;
3213     prev_at_start = at_start;
3214     at_start = FALSE;
3215     prevprevchr = prevchr;
3216     prevchr = curchr;
3217     curchr = nextchr;	    /* use previously unget char, or -1 */
3218     nextchr = -1;
3219 }
3220 
3221 /*
3222  * Skip a character while keeping the value of prev_at_start for at_start.
3223  * prevchr and prevprevchr are also kept.
3224  */
3225     static void
3226 skipchr_keepstart(void)
3227 {
3228     int as = prev_at_start;
3229     int pr = prevchr;
3230     int prpr = prevprevchr;
3231 
3232     skipchr();
3233     at_start = as;
3234     prevchr = pr;
3235     prevprevchr = prpr;
3236 }
3237 
3238 /*
3239  * Get the next character from the pattern. We know about magic and such, so
3240  * therefore we need a lexical analyzer.
3241  */
3242     static int
3243 getchr(void)
3244 {
3245     int chr = peekchr();
3246 
3247     skipchr();
3248     return chr;
3249 }
3250 
3251 /*
3252  * put character back.  Works only once!
3253  */
3254     static void
3255 ungetchr(void)
3256 {
3257     nextchr = curchr;
3258     curchr = prevchr;
3259     prevchr = prevprevchr;
3260     at_start = prev_at_start;
3261     prev_at_start = FALSE;
3262 
3263     /* Backup regparse, so that it's at the same position as before the
3264      * getchr(). */
3265     regparse -= prevchr_len;
3266 }
3267 
3268 /*
3269  * Get and return the value of the hex string at the current position.
3270  * Return -1 if there is no valid hex number.
3271  * The position is updated:
3272  *     blahblah\%x20asdf
3273  *	   before-^ ^-after
3274  * The parameter controls the maximum number of input characters. This will be
3275  * 2 when reading a \%x20 sequence and 4 when reading a \%u20AC sequence.
3276  */
3277     static int
3278 gethexchrs(int maxinputlen)
3279 {
3280     int		nr = 0;
3281     int		c;
3282     int		i;
3283 
3284     for (i = 0; i < maxinputlen; ++i)
3285     {
3286 	c = regparse[0];
3287 	if (!vim_isxdigit(c))
3288 	    break;
3289 	nr <<= 4;
3290 	nr |= hex2nr(c);
3291 	++regparse;
3292     }
3293 
3294     if (i == 0)
3295 	return -1;
3296     return nr;
3297 }
3298 
3299 /*
3300  * Get and return the value of the decimal string immediately after the
3301  * current position. Return -1 for invalid.  Consumes all digits.
3302  */
3303     static int
3304 getdecchrs(void)
3305 {
3306     int		nr = 0;
3307     int		c;
3308     int		i;
3309 
3310     for (i = 0; ; ++i)
3311     {
3312 	c = regparse[0];
3313 	if (c < '0' || c > '9')
3314 	    break;
3315 	nr *= 10;
3316 	nr += c - '0';
3317 	++regparse;
3318 	curchr = -1; /* no longer valid */
3319     }
3320 
3321     if (i == 0)
3322 	return -1;
3323     return nr;
3324 }
3325 
3326 /*
3327  * get and return the value of the octal string immediately after the current
3328  * position. Return -1 for invalid, or 0-255 for valid. Smart enough to handle
3329  * numbers > 377 correctly (for example, 400 is treated as 40) and doesn't
3330  * treat 8 or 9 as recognised characters. Position is updated:
3331  *     blahblah\%o210asdf
3332  *	   before-^  ^-after
3333  */
3334     static int
3335 getoctchrs(void)
3336 {
3337     int		nr = 0;
3338     int		c;
3339     int		i;
3340 
3341     for (i = 0; i < 3 && nr < 040; ++i)
3342     {
3343 	c = regparse[0];
3344 	if (c < '0' || c > '7')
3345 	    break;
3346 	nr <<= 3;
3347 	nr |= hex2nr(c);
3348 	++regparse;
3349     }
3350 
3351     if (i == 0)
3352 	return -1;
3353     return nr;
3354 }
3355 
3356 /*
3357  * Get a number after a backslash that is inside [].
3358  * When nothing is recognized return a backslash.
3359  */
3360     static int
3361 coll_get_char(void)
3362 {
3363     int	    nr = -1;
3364 
3365     switch (*regparse++)
3366     {
3367 	case 'd': nr = getdecchrs(); break;
3368 	case 'o': nr = getoctchrs(); break;
3369 	case 'x': nr = gethexchrs(2); break;
3370 	case 'u': nr = gethexchrs(4); break;
3371 	case 'U': nr = gethexchrs(8); break;
3372     }
3373     if (nr < 0)
3374     {
3375 	/* If getting the number fails be backwards compatible: the character
3376 	 * is a backslash. */
3377 	--regparse;
3378 	nr = '\\';
3379     }
3380     return nr;
3381 }
3382 
3383 /*
3384  * read_limits - Read two integers to be taken as a minimum and maximum.
3385  * If the first character is '-', then the range is reversed.
3386  * Should end with 'end'.  If minval is missing, zero is default, if maxval is
3387  * missing, a very big number is the default.
3388  */
3389     static int
3390 read_limits(long *minval, long *maxval)
3391 {
3392     int		reverse = FALSE;
3393     char_u	*first_char;
3394     long	tmp;
3395 
3396     if (*regparse == '-')
3397     {
3398 	/* Starts with '-', so reverse the range later */
3399 	regparse++;
3400 	reverse = TRUE;
3401     }
3402     first_char = regparse;
3403     *minval = getdigits(&regparse);
3404     if (*regparse == ',')	    /* There is a comma */
3405     {
3406 	if (vim_isdigit(*++regparse))
3407 	    *maxval = getdigits(&regparse);
3408 	else
3409 	    *maxval = MAX_LIMIT;
3410     }
3411     else if (VIM_ISDIGIT(*first_char))
3412 	*maxval = *minval;	    /* It was \{n} or \{-n} */
3413     else
3414 	*maxval = MAX_LIMIT;	    /* It was \{} or \{-} */
3415     if (*regparse == '\\')
3416 	regparse++;	/* Allow either \{...} or \{...\} */
3417     if (*regparse != '}')
3418     {
3419 	sprintf((char *)IObuff, _("E554: Syntax error in %s{...}"),
3420 					  reg_magic == MAGIC_ALL ? "" : "\\");
3421 	EMSG_RET_FAIL(IObuff);
3422     }
3423 
3424     /*
3425      * Reverse the range if there was a '-', or make sure it is in the right
3426      * order otherwise.
3427      */
3428     if ((!reverse && *minval > *maxval) || (reverse && *minval < *maxval))
3429     {
3430 	tmp = *minval;
3431 	*minval = *maxval;
3432 	*maxval = tmp;
3433     }
3434     skipchr();		/* let's be friends with the lexer again */
3435     return OK;
3436 }
3437 
3438 /*
3439  * vim_regexec and friends
3440  */
3441 
3442 /*
3443  * Global work variables for vim_regexec().
3444  */
3445 
3446 /* The current match-position is remembered with these variables: */
3447 static linenr_T	reglnum;	/* line number, relative to first line */
3448 static char_u	*regline;	/* start of current line */
3449 static char_u	*reginput;	/* current input, points into "regline" */
3450 
3451 static int	need_clear_subexpr;	/* subexpressions still need to be
3452 					 * cleared */
3453 #ifdef FEAT_SYN_HL
3454 static int	need_clear_zsubexpr = FALSE;	/* extmatch subexpressions
3455 						 * still need to be cleared */
3456 #endif
3457 
3458 /*
3459  * Structure used to save the current input state, when it needs to be
3460  * restored after trying a match.  Used by reg_save() and reg_restore().
3461  * Also stores the length of "backpos".
3462  */
3463 typedef struct
3464 {
3465     union
3466     {
3467 	char_u	*ptr;	/* reginput pointer, for single-line regexp */
3468 	lpos_T	pos;	/* reginput pos, for multi-line regexp */
3469     } rs_u;
3470     int		rs_len;
3471 } regsave_T;
3472 
3473 /* struct to save start/end pointer/position in for \(\) */
3474 typedef struct
3475 {
3476     union
3477     {
3478 	char_u	*ptr;
3479 	lpos_T	pos;
3480     } se_u;
3481 } save_se_T;
3482 
3483 /* used for BEHIND and NOBEHIND matching */
3484 typedef struct regbehind_S
3485 {
3486     regsave_T	save_after;
3487     regsave_T	save_behind;
3488     int		save_need_clear_subexpr;
3489     save_se_T   save_start[NSUBEXP];
3490     save_se_T   save_end[NSUBEXP];
3491 } regbehind_T;
3492 
3493 static char_u	*reg_getline(linenr_T lnum);
3494 static long	bt_regexec_both(char_u *line, colnr_T col, proftime_T *tm, int *timed_out);
3495 static long	regtry(bt_regprog_T *prog, colnr_T col, proftime_T *tm, int *timed_out);
3496 static void	cleanup_subexpr(void);
3497 #ifdef FEAT_SYN_HL
3498 static void	cleanup_zsubexpr(void);
3499 #endif
3500 static void	save_subexpr(regbehind_T *bp);
3501 static void	restore_subexpr(regbehind_T *bp);
3502 static void	reg_nextline(void);
3503 static void	reg_save(regsave_T *save, garray_T *gap);
3504 static void	reg_restore(regsave_T *save, garray_T *gap);
3505 static int	reg_save_equal(regsave_T *save);
3506 static void	save_se_multi(save_se_T *savep, lpos_T *posp);
3507 static void	save_se_one(save_se_T *savep, char_u **pp);
3508 
3509 /* Save the sub-expressions before attempting a match. */
3510 #define save_se(savep, posp, pp) \
3511     REG_MULTI ? save_se_multi((savep), (posp)) : save_se_one((savep), (pp))
3512 
3513 /* After a failed match restore the sub-expressions. */
3514 #define restore_se(savep, posp, pp) { \
3515     if (REG_MULTI) \
3516 	*(posp) = (savep)->se_u.pos; \
3517     else \
3518 	*(pp) = (savep)->se_u.ptr; }
3519 
3520 static int	re_num_cmp(long_u val, char_u *scan);
3521 static int	match_with_backref(linenr_T start_lnum, colnr_T start_col, linenr_T end_lnum, colnr_T end_col, int *bytelen);
3522 static int	regmatch(char_u *prog, proftime_T *tm, int *timed_out);
3523 static int	regrepeat(char_u *p, long maxcount);
3524 
3525 #ifdef DEBUG
3526 int		regnarrate = 0;
3527 #endif
3528 
3529 /*
3530  * Sometimes need to save a copy of a line.  Since alloc()/free() is very
3531  * slow, we keep one allocated piece of memory and only re-allocate it when
3532  * it's too small.  It's freed in bt_regexec_both() when finished.
3533  */
3534 static char_u	*reg_tofree = NULL;
3535 static unsigned	reg_tofreelen;
3536 
3537 /*
3538  * Structure used to store the execution state of the regex engine.
3539  * Which ones are set depends on whether a single-line or multi-line match is
3540  * done:
3541  *			single-line		multi-line
3542  * reg_match		&regmatch_T		NULL
3543  * reg_mmatch		NULL			&regmmatch_T
3544  * reg_startp		reg_match->startp	<invalid>
3545  * reg_endp		reg_match->endp		<invalid>
3546  * reg_startpos		<invalid>		reg_mmatch->startpos
3547  * reg_endpos		<invalid>		reg_mmatch->endpos
3548  * reg_win		NULL			window in which to search
3549  * reg_buf		curbuf			buffer in which to search
3550  * reg_firstlnum	<invalid>		first line in which to search
3551  * reg_maxline		0			last line nr
3552  * reg_line_lbr		FALSE or TRUE		FALSE
3553  */
3554 typedef struct {
3555     regmatch_T		*reg_match;
3556     regmmatch_T		*reg_mmatch;
3557     char_u		**reg_startp;
3558     char_u		**reg_endp;
3559     lpos_T		*reg_startpos;
3560     lpos_T		*reg_endpos;
3561     win_T		*reg_win;
3562     buf_T		*reg_buf;
3563     linenr_T		reg_firstlnum;
3564     linenr_T		reg_maxline;
3565     int			reg_line_lbr;	/* "\n" in string is line break */
3566 
3567     /* Internal copy of 'ignorecase'.  It is set at each call to vim_regexec().
3568      * Normally it gets the value of "rm_ic" or "rmm_ic", but when the pattern
3569      * contains '\c' or '\C' the value is overruled. */
3570     int			reg_ic;
3571 
3572 #ifdef FEAT_MBYTE
3573     /* Similar to rex.reg_ic, but only for 'combining' characters.  Set with \Z
3574      * flag in the regexp.  Defaults to false, always. */
3575     int			reg_icombine;
3576 #endif
3577 
3578     /* Copy of "rmm_maxcol": maximum column to search for a match.  Zero when
3579      * there is no maximum. */
3580     colnr_T		reg_maxcol;
3581 } regexec_T;
3582 
3583 static regexec_T	rex;
3584 static int		rex_in_use = FALSE;
3585 
3586 
3587 /* Values for rs_state in regitem_T. */
3588 typedef enum regstate_E
3589 {
3590     RS_NOPEN = 0	/* NOPEN and NCLOSE */
3591     , RS_MOPEN		/* MOPEN + [0-9] */
3592     , RS_MCLOSE		/* MCLOSE + [0-9] */
3593 #ifdef FEAT_SYN_HL
3594     , RS_ZOPEN		/* ZOPEN + [0-9] */
3595     , RS_ZCLOSE		/* ZCLOSE + [0-9] */
3596 #endif
3597     , RS_BRANCH		/* BRANCH */
3598     , RS_BRCPLX_MORE	/* BRACE_COMPLEX and trying one more match */
3599     , RS_BRCPLX_LONG	/* BRACE_COMPLEX and trying longest match */
3600     , RS_BRCPLX_SHORT	/* BRACE_COMPLEX and trying shortest match */
3601     , RS_NOMATCH	/* NOMATCH */
3602     , RS_BEHIND1	/* BEHIND / NOBEHIND matching rest */
3603     , RS_BEHIND2	/* BEHIND / NOBEHIND matching behind part */
3604     , RS_STAR_LONG	/* STAR/PLUS/BRACE_SIMPLE longest match */
3605     , RS_STAR_SHORT	/* STAR/PLUS/BRACE_SIMPLE shortest match */
3606 } regstate_T;
3607 
3608 /*
3609  * When there are alternatives a regstate_T is put on the regstack to remember
3610  * what we are doing.
3611  * Before it may be another type of item, depending on rs_state, to remember
3612  * more things.
3613  */
3614 typedef struct regitem_S
3615 {
3616     regstate_T	rs_state;	/* what we are doing, one of RS_ above */
3617     char_u	*rs_scan;	/* current node in program */
3618     union
3619     {
3620 	save_se_T  sesave;
3621 	regsave_T  regsave;
3622     } rs_un;			/* room for saving reginput */
3623     short	rs_no;		/* submatch nr or BEHIND/NOBEHIND */
3624 } regitem_T;
3625 
3626 static regitem_T *regstack_push(regstate_T state, char_u *scan);
3627 static void regstack_pop(char_u **scan);
3628 
3629 /* used for STAR, PLUS and BRACE_SIMPLE matching */
3630 typedef struct regstar_S
3631 {
3632     int		nextb;		/* next byte */
3633     int		nextb_ic;	/* next byte reverse case */
3634     long	count;
3635     long	minval;
3636     long	maxval;
3637 } regstar_T;
3638 
3639 /* used to store input position when a BACK was encountered, so that we now if
3640  * we made any progress since the last time. */
3641 typedef struct backpos_S
3642 {
3643     char_u	*bp_scan;	/* "scan" where BACK was encountered */
3644     regsave_T	bp_pos;		/* last input position */
3645 } backpos_T;
3646 
3647 /*
3648  * "regstack" and "backpos" are used by regmatch().  They are kept over calls
3649  * to avoid invoking malloc() and free() often.
3650  * "regstack" is a stack with regitem_T items, sometimes preceded by regstar_T
3651  * or regbehind_T.
3652  * "backpos_T" is a table with backpos_T for BACK
3653  */
3654 static garray_T	regstack = {0, 0, 0, 0, NULL};
3655 static garray_T	backpos = {0, 0, 0, 0, NULL};
3656 
3657 /*
3658  * Both for regstack and backpos tables we use the following strategy of
3659  * allocation (to reduce malloc/free calls):
3660  * - Initial size is fairly small.
3661  * - When needed, the tables are grown bigger (8 times at first, double after
3662  *   that).
3663  * - After executing the match we free the memory only if the array has grown.
3664  *   Thus the memory is kept allocated when it's at the initial size.
3665  * This makes it fast while not keeping a lot of memory allocated.
3666  * A three times speed increase was observed when using many simple patterns.
3667  */
3668 #define REGSTACK_INITIAL	2048
3669 #define BACKPOS_INITIAL		64
3670 
3671 #if defined(EXITFREE) || defined(PROTO)
3672     void
3673 free_regexp_stuff(void)
3674 {
3675     ga_clear(&regstack);
3676     ga_clear(&backpos);
3677     vim_free(reg_tofree);
3678     vim_free(reg_prev_sub);
3679 }
3680 #endif
3681 
3682 /*
3683  * Get pointer to the line "lnum", which is relative to "reg_firstlnum".
3684  */
3685     static char_u *
3686 reg_getline(linenr_T lnum)
3687 {
3688     /* when looking behind for a match/no-match lnum is negative.  But we
3689      * can't go before line 1 */
3690     if (rex.reg_firstlnum + lnum < 1)
3691 	return NULL;
3692     if (lnum > rex.reg_maxline)
3693 	/* Must have matched the "\n" in the last line. */
3694 	return (char_u *)"";
3695     return ml_get_buf(rex.reg_buf, rex.reg_firstlnum + lnum, FALSE);
3696 }
3697 
3698 static regsave_T behind_pos;
3699 
3700 #ifdef FEAT_SYN_HL
3701 static char_u	*reg_startzp[NSUBEXP];	/* Workspace to mark beginning */
3702 static char_u	*reg_endzp[NSUBEXP];	/*   and end of \z(...\) matches */
3703 static lpos_T	reg_startzpos[NSUBEXP];	/* idem, beginning pos */
3704 static lpos_T	reg_endzpos[NSUBEXP];	/* idem, end pos */
3705 #endif
3706 
3707 /* TRUE if using multi-line regexp. */
3708 #define REG_MULTI	(rex.reg_match == NULL)
3709 
3710 /*
3711  * Match a regexp against a string.
3712  * "rmp->regprog" is a compiled regexp as returned by vim_regcomp().
3713  * Uses curbuf for line count and 'iskeyword'.
3714  * if "line_lbr" is TRUE  consider a "\n" in "line" to be a line break.
3715  *
3716  * Returns 0 for failure, number of lines contained in the match otherwise.
3717  */
3718     static int
3719 bt_regexec_nl(
3720     regmatch_T	*rmp,
3721     char_u	*line,	/* string to match against */
3722     colnr_T	col,	/* column to start looking for match */
3723     int		line_lbr)
3724 {
3725     rex.reg_match = rmp;
3726     rex.reg_mmatch = NULL;
3727     rex.reg_maxline = 0;
3728     rex.reg_line_lbr = line_lbr;
3729     rex.reg_buf = curbuf;
3730     rex.reg_win = NULL;
3731     rex.reg_ic = rmp->rm_ic;
3732 #ifdef FEAT_MBYTE
3733     rex.reg_icombine = FALSE;
3734 #endif
3735     rex.reg_maxcol = 0;
3736 
3737     return bt_regexec_both(line, col, NULL, NULL);
3738 }
3739 
3740 /*
3741  * Match a regexp against multiple lines.
3742  * "rmp->regprog" is a compiled regexp as returned by vim_regcomp().
3743  * Uses curbuf for line count and 'iskeyword'.
3744  *
3745  * Return zero if there is no match.  Return number of lines contained in the
3746  * match otherwise.
3747  */
3748     static long
3749 bt_regexec_multi(
3750     regmmatch_T	*rmp,
3751     win_T	*win,		/* window in which to search or NULL */
3752     buf_T	*buf,		/* buffer in which to search */
3753     linenr_T	lnum,		/* nr of line to start looking for match */
3754     colnr_T	col,		/* column to start looking for match */
3755     proftime_T	*tm,		/* timeout limit or NULL */
3756     int		*timed_out)	/* flag set on timeout or NULL */
3757 {
3758     rex.reg_match = NULL;
3759     rex.reg_mmatch = rmp;
3760     rex.reg_buf = buf;
3761     rex.reg_win = win;
3762     rex.reg_firstlnum = lnum;
3763     rex.reg_maxline = rex.reg_buf->b_ml.ml_line_count - lnum;
3764     rex.reg_line_lbr = FALSE;
3765     rex.reg_ic = rmp->rmm_ic;
3766 #ifdef FEAT_MBYTE
3767     rex.reg_icombine = FALSE;
3768 #endif
3769     rex.reg_maxcol = rmp->rmm_maxcol;
3770 
3771     return bt_regexec_both(NULL, col, tm, timed_out);
3772 }
3773 
3774 /*
3775  * Match a regexp against a string ("line" points to the string) or multiple
3776  * lines ("line" is NULL, use reg_getline()).
3777  * Returns 0 for failure, number of lines contained in the match otherwise.
3778  */
3779     static long
3780 bt_regexec_both(
3781     char_u	*line,
3782     colnr_T	col,		/* column to start looking for match */
3783     proftime_T	*tm,		/* timeout limit or NULL */
3784     int		*timed_out)	/* flag set on timeout or NULL */
3785 {
3786     bt_regprog_T    *prog;
3787     char_u	    *s;
3788     long	    retval = 0L;
3789 
3790     /* Create "regstack" and "backpos" if they are not allocated yet.
3791      * We allocate *_INITIAL amount of bytes first and then set the grow size
3792      * to much bigger value to avoid many malloc calls in case of deep regular
3793      * expressions.  */
3794     if (regstack.ga_data == NULL)
3795     {
3796 	/* Use an item size of 1 byte, since we push different things
3797 	 * onto the regstack. */
3798 	ga_init2(&regstack, 1, REGSTACK_INITIAL);
3799 	(void)ga_grow(&regstack, REGSTACK_INITIAL);
3800 	regstack.ga_growsize = REGSTACK_INITIAL * 8;
3801     }
3802 
3803     if (backpos.ga_data == NULL)
3804     {
3805 	ga_init2(&backpos, sizeof(backpos_T), BACKPOS_INITIAL);
3806 	(void)ga_grow(&backpos, BACKPOS_INITIAL);
3807 	backpos.ga_growsize = BACKPOS_INITIAL * 8;
3808     }
3809 
3810     if (REG_MULTI)
3811     {
3812 	prog = (bt_regprog_T *)rex.reg_mmatch->regprog;
3813 	line = reg_getline((linenr_T)0);
3814 	rex.reg_startpos = rex.reg_mmatch->startpos;
3815 	rex.reg_endpos = rex.reg_mmatch->endpos;
3816     }
3817     else
3818     {
3819 	prog = (bt_regprog_T *)rex.reg_match->regprog;
3820 	rex.reg_startp = rex.reg_match->startp;
3821 	rex.reg_endp = rex.reg_match->endp;
3822     }
3823 
3824     /* Be paranoid... */
3825     if (prog == NULL || line == NULL)
3826     {
3827 	EMSG(_(e_null));
3828 	goto theend;
3829     }
3830 
3831     /* Check validity of program. */
3832     if (prog_magic_wrong())
3833 	goto theend;
3834 
3835     /* If the start column is past the maximum column: no need to try. */
3836     if (rex.reg_maxcol > 0 && col >= rex.reg_maxcol)
3837 	goto theend;
3838 
3839     /* If pattern contains "\c" or "\C": overrule value of rex.reg_ic */
3840     if (prog->regflags & RF_ICASE)
3841 	rex.reg_ic = TRUE;
3842     else if (prog->regflags & RF_NOICASE)
3843 	rex.reg_ic = FALSE;
3844 
3845 #ifdef FEAT_MBYTE
3846     /* If pattern contains "\Z" overrule value of rex.reg_icombine */
3847     if (prog->regflags & RF_ICOMBINE)
3848 	rex.reg_icombine = TRUE;
3849 #endif
3850 
3851     /* If there is a "must appear" string, look for it. */
3852     if (prog->regmust != NULL)
3853     {
3854 	int c;
3855 
3856 #ifdef FEAT_MBYTE
3857 	if (has_mbyte)
3858 	    c = (*mb_ptr2char)(prog->regmust);
3859 	else
3860 #endif
3861 	    c = *prog->regmust;
3862 	s = line + col;
3863 
3864 	/*
3865 	 * This is used very often, esp. for ":global".  Use three versions of
3866 	 * the loop to avoid overhead of conditions.
3867 	 */
3868 	if (!rex.reg_ic
3869 #ifdef FEAT_MBYTE
3870 		&& !has_mbyte
3871 #endif
3872 		)
3873 	    while ((s = vim_strbyte(s, c)) != NULL)
3874 	    {
3875 		if (cstrncmp(s, prog->regmust, &prog->regmlen) == 0)
3876 		    break;		/* Found it. */
3877 		++s;
3878 	    }
3879 #ifdef FEAT_MBYTE
3880 	else if (!rex.reg_ic || (!enc_utf8 && mb_char2len(c) > 1))
3881 	    while ((s = vim_strchr(s, c)) != NULL)
3882 	    {
3883 		if (cstrncmp(s, prog->regmust, &prog->regmlen) == 0)
3884 		    break;		/* Found it. */
3885 		MB_PTR_ADV(s);
3886 	    }
3887 #endif
3888 	else
3889 	    while ((s = cstrchr(s, c)) != NULL)
3890 	    {
3891 		if (cstrncmp(s, prog->regmust, &prog->regmlen) == 0)
3892 		    break;		/* Found it. */
3893 		MB_PTR_ADV(s);
3894 	    }
3895 	if (s == NULL)		/* Not present. */
3896 	    goto theend;
3897     }
3898 
3899     regline = line;
3900     reglnum = 0;
3901     reg_toolong = FALSE;
3902 
3903     /* Simplest case: Anchored match need be tried only once. */
3904     if (prog->reganch)
3905     {
3906 	int	c;
3907 
3908 #ifdef FEAT_MBYTE
3909 	if (has_mbyte)
3910 	    c = (*mb_ptr2char)(regline + col);
3911 	else
3912 #endif
3913 	    c = regline[col];
3914 	if (prog->regstart == NUL
3915 		|| prog->regstart == c
3916 		|| (rex.reg_ic && ((
3917 #ifdef FEAT_MBYTE
3918 			(enc_utf8 && utf_fold(prog->regstart) == utf_fold(c)))
3919 			|| (c < 255 && prog->regstart < 255 &&
3920 #endif
3921 			    MB_TOLOWER(prog->regstart) == MB_TOLOWER(c)))))
3922 	    retval = regtry(prog, col, tm, timed_out);
3923 	else
3924 	    retval = 0;
3925     }
3926     else
3927     {
3928 #ifdef FEAT_RELTIME
3929 	int tm_count = 0;
3930 #endif
3931 	/* Messy cases:  unanchored match. */
3932 	while (!got_int)
3933 	{
3934 	    if (prog->regstart != NUL)
3935 	    {
3936 		/* Skip until the char we know it must start with.
3937 		 * Used often, do some work to avoid call overhead. */
3938 		if (!rex.reg_ic
3939 #ifdef FEAT_MBYTE
3940 			    && !has_mbyte
3941 #endif
3942 			    )
3943 		    s = vim_strbyte(regline + col, prog->regstart);
3944 		else
3945 		    s = cstrchr(regline + col, prog->regstart);
3946 		if (s == NULL)
3947 		{
3948 		    retval = 0;
3949 		    break;
3950 		}
3951 		col = (int)(s - regline);
3952 	    }
3953 
3954 	    /* Check for maximum column to try. */
3955 	    if (rex.reg_maxcol > 0 && col >= rex.reg_maxcol)
3956 	    {
3957 		retval = 0;
3958 		break;
3959 	    }
3960 
3961 	    retval = regtry(prog, col, tm, timed_out);
3962 	    if (retval > 0)
3963 		break;
3964 
3965 	    /* if not currently on the first line, get it again */
3966 	    if (reglnum != 0)
3967 	    {
3968 		reglnum = 0;
3969 		regline = reg_getline((linenr_T)0);
3970 	    }
3971 	    if (regline[col] == NUL)
3972 		break;
3973 #ifdef FEAT_MBYTE
3974 	    if (has_mbyte)
3975 		col += (*mb_ptr2len)(regline + col);
3976 	    else
3977 #endif
3978 		++col;
3979 #ifdef FEAT_RELTIME
3980 	    /* Check for timeout once in a twenty times to avoid overhead. */
3981 	    if (tm != NULL && ++tm_count == 20)
3982 	    {
3983 		tm_count = 0;
3984 		if (profile_passed_limit(tm))
3985 		{
3986 		    if (timed_out != NULL)
3987 			*timed_out = TRUE;
3988 		    break;
3989 		}
3990 	    }
3991 #endif
3992 	}
3993     }
3994 
3995 theend:
3996     /* Free "reg_tofree" when it's a bit big.
3997      * Free regstack and backpos if they are bigger than their initial size. */
3998     if (reg_tofreelen > 400)
3999     {
4000 	vim_free(reg_tofree);
4001 	reg_tofree = NULL;
4002     }
4003     if (regstack.ga_maxlen > REGSTACK_INITIAL)
4004 	ga_clear(&regstack);
4005     if (backpos.ga_maxlen > BACKPOS_INITIAL)
4006 	ga_clear(&backpos);
4007 
4008     return retval;
4009 }
4010 
4011 #ifdef FEAT_SYN_HL
4012 static reg_extmatch_T *make_extmatch(void);
4013 
4014 /*
4015  * Create a new extmatch and mark it as referenced once.
4016  */
4017     static reg_extmatch_T *
4018 make_extmatch(void)
4019 {
4020     reg_extmatch_T	*em;
4021 
4022     em = (reg_extmatch_T *)alloc_clear((unsigned)sizeof(reg_extmatch_T));
4023     if (em != NULL)
4024 	em->refcnt = 1;
4025     return em;
4026 }
4027 
4028 /*
4029  * Add a reference to an extmatch.
4030  */
4031     reg_extmatch_T *
4032 ref_extmatch(reg_extmatch_T *em)
4033 {
4034     if (em != NULL)
4035 	em->refcnt++;
4036     return em;
4037 }
4038 
4039 /*
4040  * Remove a reference to an extmatch.  If there are no references left, free
4041  * the info.
4042  */
4043     void
4044 unref_extmatch(reg_extmatch_T *em)
4045 {
4046     int i;
4047 
4048     if (em != NULL && --em->refcnt <= 0)
4049     {
4050 	for (i = 0; i < NSUBEXP; ++i)
4051 	    vim_free(em->matches[i]);
4052 	vim_free(em);
4053     }
4054 }
4055 #endif
4056 
4057 /*
4058  * regtry - try match of "prog" with at regline["col"].
4059  * Returns 0 for failure, number of lines contained in the match otherwise.
4060  */
4061     static long
4062 regtry(
4063     bt_regprog_T	*prog,
4064     colnr_T		col,
4065     proftime_T		*tm,		/* timeout limit or NULL */
4066     int			*timed_out)	/* flag set on timeout or NULL */
4067 {
4068     reginput = regline + col;
4069     need_clear_subexpr = TRUE;
4070 #ifdef FEAT_SYN_HL
4071     /* Clear the external match subpointers if necessary. */
4072     if (prog->reghasz == REX_SET)
4073 	need_clear_zsubexpr = TRUE;
4074 #endif
4075 
4076     if (regmatch(prog->program + 1, tm, timed_out) == 0)
4077 	return 0;
4078 
4079     cleanup_subexpr();
4080     if (REG_MULTI)
4081     {
4082 	if (rex.reg_startpos[0].lnum < 0)
4083 	{
4084 	    rex.reg_startpos[0].lnum = 0;
4085 	    rex.reg_startpos[0].col = col;
4086 	}
4087 	if (rex.reg_endpos[0].lnum < 0)
4088 	{
4089 	    rex.reg_endpos[0].lnum = reglnum;
4090 	    rex.reg_endpos[0].col = (int)(reginput - regline);
4091 	}
4092 	else
4093 	    /* Use line number of "\ze". */
4094 	    reglnum = rex.reg_endpos[0].lnum;
4095     }
4096     else
4097     {
4098 	if (rex.reg_startp[0] == NULL)
4099 	    rex.reg_startp[0] = regline + col;
4100 	if (rex.reg_endp[0] == NULL)
4101 	    rex.reg_endp[0] = reginput;
4102     }
4103 #ifdef FEAT_SYN_HL
4104     /* Package any found \z(...\) matches for export. Default is none. */
4105     unref_extmatch(re_extmatch_out);
4106     re_extmatch_out = NULL;
4107 
4108     if (prog->reghasz == REX_SET)
4109     {
4110 	int		i;
4111 
4112 	cleanup_zsubexpr();
4113 	re_extmatch_out = make_extmatch();
4114 	for (i = 0; i < NSUBEXP; i++)
4115 	{
4116 	    if (REG_MULTI)
4117 	    {
4118 		/* Only accept single line matches. */
4119 		if (reg_startzpos[i].lnum >= 0
4120 			&& reg_endzpos[i].lnum == reg_startzpos[i].lnum
4121 			&& reg_endzpos[i].col >= reg_startzpos[i].col)
4122 		    re_extmatch_out->matches[i] =
4123 			vim_strnsave(reg_getline(reg_startzpos[i].lnum)
4124 						       + reg_startzpos[i].col,
4125 				   reg_endzpos[i].col - reg_startzpos[i].col);
4126 	    }
4127 	    else
4128 	    {
4129 		if (reg_startzp[i] != NULL && reg_endzp[i] != NULL)
4130 		    re_extmatch_out->matches[i] =
4131 			    vim_strnsave(reg_startzp[i],
4132 					(int)(reg_endzp[i] - reg_startzp[i]));
4133 	    }
4134 	}
4135     }
4136 #endif
4137     return 1 + reglnum;
4138 }
4139 
4140 #ifdef FEAT_MBYTE
4141 static int reg_prev_class(void);
4142 
4143 /*
4144  * Get class of previous character.
4145  */
4146     static int
4147 reg_prev_class(void)
4148 {
4149     if (reginput > regline)
4150 	return mb_get_class_buf(reginput - 1
4151 			 - (*mb_head_off)(regline, reginput - 1), rex.reg_buf);
4152     return -1;
4153 }
4154 #endif
4155 
4156 static int reg_match_visual(void);
4157 
4158 /*
4159  * Return TRUE if the current reginput position matches the Visual area.
4160  */
4161     static int
4162 reg_match_visual(void)
4163 {
4164     pos_T	top, bot;
4165     linenr_T    lnum;
4166     colnr_T	col;
4167     win_T	*wp = rex.reg_win == NULL ? curwin : rex.reg_win;
4168     int		mode;
4169     colnr_T	start, end;
4170     colnr_T	start2, end2;
4171     colnr_T	cols;
4172 
4173     /* Check if the buffer is the current buffer. */
4174     if (rex.reg_buf != curbuf || VIsual.lnum == 0)
4175 	return FALSE;
4176 
4177     if (VIsual_active)
4178     {
4179 	if (LT_POS(VIsual, wp->w_cursor))
4180 	{
4181 	    top = VIsual;
4182 	    bot = wp->w_cursor;
4183 	}
4184 	else
4185 	{
4186 	    top = wp->w_cursor;
4187 	    bot = VIsual;
4188 	}
4189 	mode = VIsual_mode;
4190     }
4191     else
4192     {
4193 	if (LT_POS(curbuf->b_visual.vi_start, curbuf->b_visual.vi_end))
4194 	{
4195 	    top = curbuf->b_visual.vi_start;
4196 	    bot = curbuf->b_visual.vi_end;
4197 	}
4198 	else
4199 	{
4200 	    top = curbuf->b_visual.vi_end;
4201 	    bot = curbuf->b_visual.vi_start;
4202 	}
4203 	mode = curbuf->b_visual.vi_mode;
4204     }
4205     lnum = reglnum + rex.reg_firstlnum;
4206     if (lnum < top.lnum || lnum > bot.lnum)
4207 	return FALSE;
4208 
4209     if (mode == 'v')
4210     {
4211 	col = (colnr_T)(reginput - regline);
4212 	if ((lnum == top.lnum && col < top.col)
4213 		|| (lnum == bot.lnum && col >= bot.col + (*p_sel != 'e')))
4214 	    return FALSE;
4215     }
4216     else if (mode == Ctrl_V)
4217     {
4218 	getvvcol(wp, &top, &start, NULL, &end);
4219 	getvvcol(wp, &bot, &start2, NULL, &end2);
4220 	if (start2 < start)
4221 	    start = start2;
4222 	if (end2 > end)
4223 	    end = end2;
4224 	if (top.col == MAXCOL || bot.col == MAXCOL)
4225 	    end = MAXCOL;
4226 	cols = win_linetabsize(wp, regline, (colnr_T)(reginput - regline));
4227 	if (cols < start || cols > end - (*p_sel == 'e'))
4228 	    return FALSE;
4229     }
4230     return TRUE;
4231 }
4232 
4233 #define ADVANCE_REGINPUT() MB_PTR_ADV(reginput)
4234 
4235 /*
4236  * The arguments from BRACE_LIMITS are stored here.  They are actually local
4237  * to regmatch(), but they are here to reduce the amount of stack space used
4238  * (it can be called recursively many times).
4239  */
4240 static long	bl_minval;
4241 static long	bl_maxval;
4242 
4243 /*
4244  * regmatch - main matching routine
4245  *
4246  * Conceptually the strategy is simple: Check to see whether the current node
4247  * matches, push an item onto the regstack and loop to see whether the rest
4248  * matches, and then act accordingly.  In practice we make some effort to
4249  * avoid using the regstack, in particular by going through "ordinary" nodes
4250  * (that don't need to know whether the rest of the match failed) by a nested
4251  * loop.
4252  *
4253  * Returns TRUE when there is a match.  Leaves reginput and reglnum just after
4254  * the last matched character.
4255  * Returns FALSE when there is no match.  Leaves reginput and reglnum in an
4256  * undefined state!
4257  */
4258     static int
4259 regmatch(
4260     char_u	*scan,		    /* Current node. */
4261     proftime_T	*tm UNUSED,	    /* timeout limit or NULL */
4262     int		*timed_out UNUSED)  /* flag set on timeout or NULL */
4263 {
4264   char_u	*next;		/* Next node. */
4265   int		op;
4266   int		c;
4267   regitem_T	*rp;
4268   int		no;
4269   int		status;		/* one of the RA_ values: */
4270 #define RA_FAIL		1	/* something failed, abort */
4271 #define RA_CONT		2	/* continue in inner loop */
4272 #define RA_BREAK	3	/* break inner loop */
4273 #define RA_MATCH	4	/* successful match */
4274 #define RA_NOMATCH	5	/* didn't match */
4275 #ifdef FEAT_RELTIME
4276   int		tm_count = 0;
4277 #endif
4278 
4279   /* Make "regstack" and "backpos" empty.  They are allocated and freed in
4280    * bt_regexec_both() to reduce malloc()/free() calls. */
4281   regstack.ga_len = 0;
4282   backpos.ga_len = 0;
4283 
4284   /*
4285    * Repeat until "regstack" is empty.
4286    */
4287   for (;;)
4288   {
4289     /* Some patterns may take a long time to match, e.g., "\([a-z]\+\)\+Q".
4290      * Allow interrupting them with CTRL-C. */
4291     fast_breakcheck();
4292 
4293 #ifdef DEBUG
4294     if (scan != NULL && regnarrate)
4295     {
4296 	mch_errmsg((char *)regprop(scan));
4297 	mch_errmsg("(\n");
4298     }
4299 #endif
4300 
4301     /*
4302      * Repeat for items that can be matched sequentially, without using the
4303      * regstack.
4304      */
4305     for (;;)
4306     {
4307 	if (got_int || scan == NULL)
4308 	{
4309 	    status = RA_FAIL;
4310 	    break;
4311 	}
4312 #ifdef FEAT_RELTIME
4313 	/* Check for timeout once in a 100 times to avoid overhead. */
4314 	if (tm != NULL && ++tm_count == 100)
4315 	{
4316 	    tm_count = 0;
4317 	    if (profile_passed_limit(tm))
4318 	    {
4319 		if (timed_out != NULL)
4320 		    *timed_out = TRUE;
4321 		status = RA_FAIL;
4322 		break;
4323 	    }
4324 	}
4325 #endif
4326 	status = RA_CONT;
4327 
4328 #ifdef DEBUG
4329 	if (regnarrate)
4330 	{
4331 	    mch_errmsg((char *)regprop(scan));
4332 	    mch_errmsg("...\n");
4333 # ifdef FEAT_SYN_HL
4334 	    if (re_extmatch_in != NULL)
4335 	    {
4336 		int i;
4337 
4338 		mch_errmsg(_("External submatches:\n"));
4339 		for (i = 0; i < NSUBEXP; i++)
4340 		{
4341 		    mch_errmsg("    \"");
4342 		    if (re_extmatch_in->matches[i] != NULL)
4343 			mch_errmsg((char *)re_extmatch_in->matches[i]);
4344 		    mch_errmsg("\"\n");
4345 		}
4346 	    }
4347 # endif
4348 	}
4349 #endif
4350 	next = regnext(scan);
4351 
4352 	op = OP(scan);
4353 	/* Check for character class with NL added. */
4354 	if (!rex.reg_line_lbr && WITH_NL(op) && REG_MULTI
4355 			     && *reginput == NUL && reglnum <= rex.reg_maxline)
4356 	{
4357 	    reg_nextline();
4358 	}
4359 	else if (rex.reg_line_lbr && WITH_NL(op) && *reginput == '\n')
4360 	{
4361 	    ADVANCE_REGINPUT();
4362 	}
4363 	else
4364 	{
4365 	  if (WITH_NL(op))
4366 	      op -= ADD_NL;
4367 #ifdef FEAT_MBYTE
4368 	  if (has_mbyte)
4369 	      c = (*mb_ptr2char)(reginput);
4370 	  else
4371 #endif
4372 	      c = *reginput;
4373 	  switch (op)
4374 	  {
4375 	  case BOL:
4376 	    if (reginput != regline)
4377 		status = RA_NOMATCH;
4378 	    break;
4379 
4380 	  case EOL:
4381 	    if (c != NUL)
4382 		status = RA_NOMATCH;
4383 	    break;
4384 
4385 	  case RE_BOF:
4386 	    /* We're not at the beginning of the file when below the first
4387 	     * line where we started, not at the start of the line or we
4388 	     * didn't start at the first line of the buffer. */
4389 	    if (reglnum != 0 || reginput != regline
4390 				       || (REG_MULTI && rex.reg_firstlnum > 1))
4391 		status = RA_NOMATCH;
4392 	    break;
4393 
4394 	  case RE_EOF:
4395 	    if (reglnum != rex.reg_maxline || c != NUL)
4396 		status = RA_NOMATCH;
4397 	    break;
4398 
4399 	  case CURSOR:
4400 	    /* Check if the buffer is in a window and compare the
4401 	     * rex.reg_win->w_cursor position to the match position. */
4402 	    if (rex.reg_win == NULL
4403 		    || (reglnum + rex.reg_firstlnum
4404 						 != rex.reg_win->w_cursor.lnum)
4405 		    || ((colnr_T)(reginput - regline)
4406 						 != rex.reg_win->w_cursor.col))
4407 		status = RA_NOMATCH;
4408 	    break;
4409 
4410 	  case RE_MARK:
4411 	    /* Compare the mark position to the match position. */
4412 	    {
4413 		int	mark = OPERAND(scan)[0];
4414 		int	cmp = OPERAND(scan)[1];
4415 		pos_T	*pos;
4416 
4417 		pos = getmark_buf(rex.reg_buf, mark, FALSE);
4418 		if (pos == NULL		     /* mark doesn't exist */
4419 			|| pos->lnum <= 0    /* mark isn't set in reg_buf */
4420 			|| (pos->lnum == reglnum + rex.reg_firstlnum
4421 				? (pos->col == (colnr_T)(reginput - regline)
4422 				    ? (cmp == '<' || cmp == '>')
4423 				    : (pos->col < (colnr_T)(reginput - regline)
4424 					? cmp != '>'
4425 					: cmp != '<'))
4426 				: (pos->lnum < reglnum + rex.reg_firstlnum
4427 				    ? cmp != '>'
4428 				    : cmp != '<')))
4429 		    status = RA_NOMATCH;
4430 	    }
4431 	    break;
4432 
4433 	  case RE_VISUAL:
4434 	    if (!reg_match_visual())
4435 		status = RA_NOMATCH;
4436 	    break;
4437 
4438 	  case RE_LNUM:
4439 	    if (!REG_MULTI || !re_num_cmp((long_u)(reglnum + rex.reg_firstlnum),
4440 									scan))
4441 		status = RA_NOMATCH;
4442 	    break;
4443 
4444 	  case RE_COL:
4445 	    if (!re_num_cmp((long_u)(reginput - regline) + 1, scan))
4446 		status = RA_NOMATCH;
4447 	    break;
4448 
4449 	  case RE_VCOL:
4450 	    if (!re_num_cmp((long_u)win_linetabsize(
4451 			    rex.reg_win == NULL ? curwin : rex.reg_win,
4452 			    regline, (colnr_T)(reginput - regline)) + 1, scan))
4453 		status = RA_NOMATCH;
4454 	    break;
4455 
4456 	  case BOW:	/* \<word; reginput points to w */
4457 	    if (c == NUL)	/* Can't match at end of line */
4458 		status = RA_NOMATCH;
4459 #ifdef FEAT_MBYTE
4460 	    else if (has_mbyte)
4461 	    {
4462 		int this_class;
4463 
4464 		/* Get class of current and previous char (if it exists). */
4465 		this_class = mb_get_class_buf(reginput, rex.reg_buf);
4466 		if (this_class <= 1)
4467 		    status = RA_NOMATCH;  /* not on a word at all */
4468 		else if (reg_prev_class() == this_class)
4469 		    status = RA_NOMATCH;  /* previous char is in same word */
4470 	    }
4471 #endif
4472 	    else
4473 	    {
4474 		if (!vim_iswordc_buf(c, rex.reg_buf) || (reginput > regline
4475 				&& vim_iswordc_buf(reginput[-1], rex.reg_buf)))
4476 		    status = RA_NOMATCH;
4477 	    }
4478 	    break;
4479 
4480 	  case EOW:	/* word\>; reginput points after d */
4481 	    if (reginput == regline)    /* Can't match at start of line */
4482 		status = RA_NOMATCH;
4483 #ifdef FEAT_MBYTE
4484 	    else if (has_mbyte)
4485 	    {
4486 		int this_class, prev_class;
4487 
4488 		/* Get class of current and previous char (if it exists). */
4489 		this_class = mb_get_class_buf(reginput, rex.reg_buf);
4490 		prev_class = reg_prev_class();
4491 		if (this_class == prev_class
4492 			|| prev_class == 0 || prev_class == 1)
4493 		    status = RA_NOMATCH;
4494 	    }
4495 #endif
4496 	    else
4497 	    {
4498 		if (!vim_iswordc_buf(reginput[-1], rex.reg_buf)
4499 			|| (reginput[0] != NUL
4500 					   && vim_iswordc_buf(c, rex.reg_buf)))
4501 		    status = RA_NOMATCH;
4502 	    }
4503 	    break; /* Matched with EOW */
4504 
4505 	  case ANY:
4506 	    /* ANY does not match new lines. */
4507 	    if (c == NUL)
4508 		status = RA_NOMATCH;
4509 	    else
4510 		ADVANCE_REGINPUT();
4511 	    break;
4512 
4513 	  case IDENT:
4514 	    if (!vim_isIDc(c))
4515 		status = RA_NOMATCH;
4516 	    else
4517 		ADVANCE_REGINPUT();
4518 	    break;
4519 
4520 	  case SIDENT:
4521 	    if (VIM_ISDIGIT(*reginput) || !vim_isIDc(c))
4522 		status = RA_NOMATCH;
4523 	    else
4524 		ADVANCE_REGINPUT();
4525 	    break;
4526 
4527 	  case KWORD:
4528 	    if (!vim_iswordp_buf(reginput, rex.reg_buf))
4529 		status = RA_NOMATCH;
4530 	    else
4531 		ADVANCE_REGINPUT();
4532 	    break;
4533 
4534 	  case SKWORD:
4535 	    if (VIM_ISDIGIT(*reginput)
4536 				    || !vim_iswordp_buf(reginput, rex.reg_buf))
4537 		status = RA_NOMATCH;
4538 	    else
4539 		ADVANCE_REGINPUT();
4540 	    break;
4541 
4542 	  case FNAME:
4543 	    if (!vim_isfilec(c))
4544 		status = RA_NOMATCH;
4545 	    else
4546 		ADVANCE_REGINPUT();
4547 	    break;
4548 
4549 	  case SFNAME:
4550 	    if (VIM_ISDIGIT(*reginput) || !vim_isfilec(c))
4551 		status = RA_NOMATCH;
4552 	    else
4553 		ADVANCE_REGINPUT();
4554 	    break;
4555 
4556 	  case PRINT:
4557 	    if (!vim_isprintc(PTR2CHAR(reginput)))
4558 		status = RA_NOMATCH;
4559 	    else
4560 		ADVANCE_REGINPUT();
4561 	    break;
4562 
4563 	  case SPRINT:
4564 	    if (VIM_ISDIGIT(*reginput) || !vim_isprintc(PTR2CHAR(reginput)))
4565 		status = RA_NOMATCH;
4566 	    else
4567 		ADVANCE_REGINPUT();
4568 	    break;
4569 
4570 	  case WHITE:
4571 	    if (!VIM_ISWHITE(c))
4572 		status = RA_NOMATCH;
4573 	    else
4574 		ADVANCE_REGINPUT();
4575 	    break;
4576 
4577 	  case NWHITE:
4578 	    if (c == NUL || VIM_ISWHITE(c))
4579 		status = RA_NOMATCH;
4580 	    else
4581 		ADVANCE_REGINPUT();
4582 	    break;
4583 
4584 	  case DIGIT:
4585 	    if (!ri_digit(c))
4586 		status = RA_NOMATCH;
4587 	    else
4588 		ADVANCE_REGINPUT();
4589 	    break;
4590 
4591 	  case NDIGIT:
4592 	    if (c == NUL || ri_digit(c))
4593 		status = RA_NOMATCH;
4594 	    else
4595 		ADVANCE_REGINPUT();
4596 	    break;
4597 
4598 	  case HEX:
4599 	    if (!ri_hex(c))
4600 		status = RA_NOMATCH;
4601 	    else
4602 		ADVANCE_REGINPUT();
4603 	    break;
4604 
4605 	  case NHEX:
4606 	    if (c == NUL || ri_hex(c))
4607 		status = RA_NOMATCH;
4608 	    else
4609 		ADVANCE_REGINPUT();
4610 	    break;
4611 
4612 	  case OCTAL:
4613 	    if (!ri_octal(c))
4614 		status = RA_NOMATCH;
4615 	    else
4616 		ADVANCE_REGINPUT();
4617 	    break;
4618 
4619 	  case NOCTAL:
4620 	    if (c == NUL || ri_octal(c))
4621 		status = RA_NOMATCH;
4622 	    else
4623 		ADVANCE_REGINPUT();
4624 	    break;
4625 
4626 	  case WORD:
4627 	    if (!ri_word(c))
4628 		status = RA_NOMATCH;
4629 	    else
4630 		ADVANCE_REGINPUT();
4631 	    break;
4632 
4633 	  case NWORD:
4634 	    if (c == NUL || ri_word(c))
4635 		status = RA_NOMATCH;
4636 	    else
4637 		ADVANCE_REGINPUT();
4638 	    break;
4639 
4640 	  case HEAD:
4641 	    if (!ri_head(c))
4642 		status = RA_NOMATCH;
4643 	    else
4644 		ADVANCE_REGINPUT();
4645 	    break;
4646 
4647 	  case NHEAD:
4648 	    if (c == NUL || ri_head(c))
4649 		status = RA_NOMATCH;
4650 	    else
4651 		ADVANCE_REGINPUT();
4652 	    break;
4653 
4654 	  case ALPHA:
4655 	    if (!ri_alpha(c))
4656 		status = RA_NOMATCH;
4657 	    else
4658 		ADVANCE_REGINPUT();
4659 	    break;
4660 
4661 	  case NALPHA:
4662 	    if (c == NUL || ri_alpha(c))
4663 		status = RA_NOMATCH;
4664 	    else
4665 		ADVANCE_REGINPUT();
4666 	    break;
4667 
4668 	  case LOWER:
4669 	    if (!ri_lower(c))
4670 		status = RA_NOMATCH;
4671 	    else
4672 		ADVANCE_REGINPUT();
4673 	    break;
4674 
4675 	  case NLOWER:
4676 	    if (c == NUL || ri_lower(c))
4677 		status = RA_NOMATCH;
4678 	    else
4679 		ADVANCE_REGINPUT();
4680 	    break;
4681 
4682 	  case UPPER:
4683 	    if (!ri_upper(c))
4684 		status = RA_NOMATCH;
4685 	    else
4686 		ADVANCE_REGINPUT();
4687 	    break;
4688 
4689 	  case NUPPER:
4690 	    if (c == NUL || ri_upper(c))
4691 		status = RA_NOMATCH;
4692 	    else
4693 		ADVANCE_REGINPUT();
4694 	    break;
4695 
4696 	  case EXACTLY:
4697 	    {
4698 		int	len;
4699 		char_u	*opnd;
4700 
4701 		opnd = OPERAND(scan);
4702 		/* Inline the first byte, for speed. */
4703 		if (*opnd != *reginput
4704 			&& (!rex.reg_ic || (
4705 #ifdef FEAT_MBYTE
4706 			    !enc_utf8 &&
4707 #endif
4708 			    MB_TOLOWER(*opnd) != MB_TOLOWER(*reginput))))
4709 		    status = RA_NOMATCH;
4710 		else if (*opnd == NUL)
4711 		{
4712 		    /* match empty string always works; happens when "~" is
4713 		     * empty. */
4714 		}
4715 		else
4716 		{
4717 		    if (opnd[1] == NUL
4718 #ifdef FEAT_MBYTE
4719 			    && !(enc_utf8 && rex.reg_ic)
4720 #endif
4721 			)
4722 		    {
4723 			len = 1;	/* matched a single byte above */
4724 		    }
4725 		    else
4726 		    {
4727 			/* Need to match first byte again for multi-byte. */
4728 			len = (int)STRLEN(opnd);
4729 			if (cstrncmp(opnd, reginput, &len) != 0)
4730 			    status = RA_NOMATCH;
4731 		    }
4732 #ifdef FEAT_MBYTE
4733 		    /* Check for following composing character, unless %C
4734 		     * follows (skips over all composing chars). */
4735 		    if (status != RA_NOMATCH
4736 			    && enc_utf8
4737 			    && UTF_COMPOSINGLIKE(reginput, reginput + len)
4738 			    && !rex.reg_icombine
4739 			    && OP(next) != RE_COMPOSING)
4740 		    {
4741 			/* raaron: This code makes a composing character get
4742 			 * ignored, which is the correct behavior (sometimes)
4743 			 * for voweled Hebrew texts. */
4744 			status = RA_NOMATCH;
4745 		    }
4746 #endif
4747 		    if (status != RA_NOMATCH)
4748 			reginput += len;
4749 		}
4750 	    }
4751 	    break;
4752 
4753 	  case ANYOF:
4754 	  case ANYBUT:
4755 	    if (c == NUL)
4756 		status = RA_NOMATCH;
4757 	    else if ((cstrchr(OPERAND(scan), c) == NULL) == (op == ANYOF))
4758 		status = RA_NOMATCH;
4759 	    else
4760 		ADVANCE_REGINPUT();
4761 	    break;
4762 
4763 #ifdef FEAT_MBYTE
4764 	  case MULTIBYTECODE:
4765 	    if (has_mbyte)
4766 	    {
4767 		int	i, len;
4768 		char_u	*opnd;
4769 		int	opndc = 0, inpc;
4770 
4771 		opnd = OPERAND(scan);
4772 		/* Safety check (just in case 'encoding' was changed since
4773 		 * compiling the program). */
4774 		if ((len = (*mb_ptr2len)(opnd)) < 2)
4775 		{
4776 		    status = RA_NOMATCH;
4777 		    break;
4778 		}
4779 		if (enc_utf8)
4780 		    opndc = utf_ptr2char(opnd);
4781 		if (enc_utf8 && utf_iscomposing(opndc))
4782 		{
4783 		    /* When only a composing char is given match at any
4784 		     * position where that composing char appears. */
4785 		    status = RA_NOMATCH;
4786 		    for (i = 0; reginput[i] != NUL;
4787 						i += utf_ptr2len(reginput + i))
4788 		    {
4789 			inpc = utf_ptr2char(reginput + i);
4790 			if (!utf_iscomposing(inpc))
4791 			{
4792 			    if (i > 0)
4793 				break;
4794 			}
4795 			else if (opndc == inpc)
4796 			{
4797 			    /* Include all following composing chars. */
4798 			    len = i + utfc_ptr2len(reginput + i);
4799 			    status = RA_MATCH;
4800 			    break;
4801 			}
4802 		    }
4803 		}
4804 		else
4805 		    for (i = 0; i < len; ++i)
4806 			if (opnd[i] != reginput[i])
4807 			{
4808 			    status = RA_NOMATCH;
4809 			    break;
4810 			}
4811 		reginput += len;
4812 	    }
4813 	    else
4814 		status = RA_NOMATCH;
4815 	    break;
4816 #endif
4817 	  case RE_COMPOSING:
4818 #ifdef FEAT_MBYTE
4819 	    if (enc_utf8)
4820 	    {
4821 		/* Skip composing characters. */
4822 		while (utf_iscomposing(utf_ptr2char(reginput)))
4823 		    MB_CPTR_ADV(reginput);
4824 	    }
4825 #endif
4826 	    break;
4827 
4828 	  case NOTHING:
4829 	    break;
4830 
4831 	  case BACK:
4832 	    {
4833 		int		i;
4834 		backpos_T	*bp;
4835 
4836 		/*
4837 		 * When we run into BACK we need to check if we don't keep
4838 		 * looping without matching any input.  The second and later
4839 		 * times a BACK is encountered it fails if the input is still
4840 		 * at the same position as the previous time.
4841 		 * The positions are stored in "backpos" and found by the
4842 		 * current value of "scan", the position in the RE program.
4843 		 */
4844 		bp = (backpos_T *)backpos.ga_data;
4845 		for (i = 0; i < backpos.ga_len; ++i)
4846 		    if (bp[i].bp_scan == scan)
4847 			break;
4848 		if (i == backpos.ga_len)
4849 		{
4850 		    /* First time at this BACK, make room to store the pos. */
4851 		    if (ga_grow(&backpos, 1) == FAIL)
4852 			status = RA_FAIL;
4853 		    else
4854 		    {
4855 			/* get "ga_data" again, it may have changed */
4856 			bp = (backpos_T *)backpos.ga_data;
4857 			bp[i].bp_scan = scan;
4858 			++backpos.ga_len;
4859 		    }
4860 		}
4861 		else if (reg_save_equal(&bp[i].bp_pos))
4862 		    /* Still at same position as last time, fail. */
4863 		    status = RA_NOMATCH;
4864 
4865 		if (status != RA_FAIL && status != RA_NOMATCH)
4866 		    reg_save(&bp[i].bp_pos, &backpos);
4867 	    }
4868 	    break;
4869 
4870 	  case MOPEN + 0:   /* Match start: \zs */
4871 	  case MOPEN + 1:   /* \( */
4872 	  case MOPEN + 2:
4873 	  case MOPEN + 3:
4874 	  case MOPEN + 4:
4875 	  case MOPEN + 5:
4876 	  case MOPEN + 6:
4877 	  case MOPEN + 7:
4878 	  case MOPEN + 8:
4879 	  case MOPEN + 9:
4880 	    {
4881 		no = op - MOPEN;
4882 		cleanup_subexpr();
4883 		rp = regstack_push(RS_MOPEN, scan);
4884 		if (rp == NULL)
4885 		    status = RA_FAIL;
4886 		else
4887 		{
4888 		    rp->rs_no = no;
4889 		    save_se(&rp->rs_un.sesave, &rex.reg_startpos[no],
4890 							  &rex.reg_startp[no]);
4891 		    /* We simply continue and handle the result when done. */
4892 		}
4893 	    }
4894 	    break;
4895 
4896 	  case NOPEN:	    /* \%( */
4897 	  case NCLOSE:	    /* \) after \%( */
4898 		if (regstack_push(RS_NOPEN, scan) == NULL)
4899 		    status = RA_FAIL;
4900 		/* We simply continue and handle the result when done. */
4901 		break;
4902 
4903 #ifdef FEAT_SYN_HL
4904 	  case ZOPEN + 1:
4905 	  case ZOPEN + 2:
4906 	  case ZOPEN + 3:
4907 	  case ZOPEN + 4:
4908 	  case ZOPEN + 5:
4909 	  case ZOPEN + 6:
4910 	  case ZOPEN + 7:
4911 	  case ZOPEN + 8:
4912 	  case ZOPEN + 9:
4913 	    {
4914 		no = op - ZOPEN;
4915 		cleanup_zsubexpr();
4916 		rp = regstack_push(RS_ZOPEN, scan);
4917 		if (rp == NULL)
4918 		    status = RA_FAIL;
4919 		else
4920 		{
4921 		    rp->rs_no = no;
4922 		    save_se(&rp->rs_un.sesave, &reg_startzpos[no],
4923 							     &reg_startzp[no]);
4924 		    /* We simply continue and handle the result when done. */
4925 		}
4926 	    }
4927 	    break;
4928 #endif
4929 
4930 	  case MCLOSE + 0:  /* Match end: \ze */
4931 	  case MCLOSE + 1:  /* \) */
4932 	  case MCLOSE + 2:
4933 	  case MCLOSE + 3:
4934 	  case MCLOSE + 4:
4935 	  case MCLOSE + 5:
4936 	  case MCLOSE + 6:
4937 	  case MCLOSE + 7:
4938 	  case MCLOSE + 8:
4939 	  case MCLOSE + 9:
4940 	    {
4941 		no = op - MCLOSE;
4942 		cleanup_subexpr();
4943 		rp = regstack_push(RS_MCLOSE, scan);
4944 		if (rp == NULL)
4945 		    status = RA_FAIL;
4946 		else
4947 		{
4948 		    rp->rs_no = no;
4949 		    save_se(&rp->rs_un.sesave, &rex.reg_endpos[no],
4950 							    &rex.reg_endp[no]);
4951 		    /* We simply continue and handle the result when done. */
4952 		}
4953 	    }
4954 	    break;
4955 
4956 #ifdef FEAT_SYN_HL
4957 	  case ZCLOSE + 1:  /* \) after \z( */
4958 	  case ZCLOSE + 2:
4959 	  case ZCLOSE + 3:
4960 	  case ZCLOSE + 4:
4961 	  case ZCLOSE + 5:
4962 	  case ZCLOSE + 6:
4963 	  case ZCLOSE + 7:
4964 	  case ZCLOSE + 8:
4965 	  case ZCLOSE + 9:
4966 	    {
4967 		no = op - ZCLOSE;
4968 		cleanup_zsubexpr();
4969 		rp = regstack_push(RS_ZCLOSE, scan);
4970 		if (rp == NULL)
4971 		    status = RA_FAIL;
4972 		else
4973 		{
4974 		    rp->rs_no = no;
4975 		    save_se(&rp->rs_un.sesave, &reg_endzpos[no],
4976 							      &reg_endzp[no]);
4977 		    /* We simply continue and handle the result when done. */
4978 		}
4979 	    }
4980 	    break;
4981 #endif
4982 
4983 	  case BACKREF + 1:
4984 	  case BACKREF + 2:
4985 	  case BACKREF + 3:
4986 	  case BACKREF + 4:
4987 	  case BACKREF + 5:
4988 	  case BACKREF + 6:
4989 	  case BACKREF + 7:
4990 	  case BACKREF + 8:
4991 	  case BACKREF + 9:
4992 	    {
4993 		int		len;
4994 
4995 		no = op - BACKREF;
4996 		cleanup_subexpr();
4997 		if (!REG_MULTI)		/* Single-line regexp */
4998 		{
4999 		    if (rex.reg_startp[no] == NULL || rex.reg_endp[no] == NULL)
5000 		    {
5001 			/* Backref was not set: Match an empty string. */
5002 			len = 0;
5003 		    }
5004 		    else
5005 		    {
5006 			/* Compare current input with back-ref in the same
5007 			 * line. */
5008 			len = (int)(rex.reg_endp[no] - rex.reg_startp[no]);
5009 			if (cstrncmp(rex.reg_startp[no], reginput, &len) != 0)
5010 			    status = RA_NOMATCH;
5011 		    }
5012 		}
5013 		else				/* Multi-line regexp */
5014 		{
5015 		    if (rex.reg_startpos[no].lnum < 0
5016 						|| rex.reg_endpos[no].lnum < 0)
5017 		    {
5018 			/* Backref was not set: Match an empty string. */
5019 			len = 0;
5020 		    }
5021 		    else
5022 		    {
5023 			if (rex.reg_startpos[no].lnum == reglnum
5024 				&& rex.reg_endpos[no].lnum == reglnum)
5025 			{
5026 			    /* Compare back-ref within the current line. */
5027 			    len = rex.reg_endpos[no].col
5028 						    - rex.reg_startpos[no].col;
5029 			    if (cstrncmp(regline + rex.reg_startpos[no].col,
5030 							  reginput, &len) != 0)
5031 				status = RA_NOMATCH;
5032 			}
5033 			else
5034 			{
5035 			    /* Messy situation: Need to compare between two
5036 			     * lines. */
5037 			    int r = match_with_backref(
5038 					    rex.reg_startpos[no].lnum,
5039 					    rex.reg_startpos[no].col,
5040 					    rex.reg_endpos[no].lnum,
5041 					    rex.reg_endpos[no].col,
5042 					    &len);
5043 
5044 			    if (r != RA_MATCH)
5045 				status = r;
5046 			}
5047 		    }
5048 		}
5049 
5050 		/* Matched the backref, skip over it. */
5051 		reginput += len;
5052 	    }
5053 	    break;
5054 
5055 #ifdef FEAT_SYN_HL
5056 	  case ZREF + 1:
5057 	  case ZREF + 2:
5058 	  case ZREF + 3:
5059 	  case ZREF + 4:
5060 	  case ZREF + 5:
5061 	  case ZREF + 6:
5062 	  case ZREF + 7:
5063 	  case ZREF + 8:
5064 	  case ZREF + 9:
5065 	    {
5066 		int	len;
5067 
5068 		cleanup_zsubexpr();
5069 		no = op - ZREF;
5070 		if (re_extmatch_in != NULL
5071 			&& re_extmatch_in->matches[no] != NULL)
5072 		{
5073 		    len = (int)STRLEN(re_extmatch_in->matches[no]);
5074 		    if (cstrncmp(re_extmatch_in->matches[no],
5075 							  reginput, &len) != 0)
5076 			status = RA_NOMATCH;
5077 		    else
5078 			reginput += len;
5079 		}
5080 		else
5081 		{
5082 		    /* Backref was not set: Match an empty string. */
5083 		}
5084 	    }
5085 	    break;
5086 #endif
5087 
5088 	  case BRANCH:
5089 	    {
5090 		if (OP(next) != BRANCH) /* No choice. */
5091 		    next = OPERAND(scan);	/* Avoid recursion. */
5092 		else
5093 		{
5094 		    rp = regstack_push(RS_BRANCH, scan);
5095 		    if (rp == NULL)
5096 			status = RA_FAIL;
5097 		    else
5098 			status = RA_BREAK;	/* rest is below */
5099 		}
5100 	    }
5101 	    break;
5102 
5103 	  case BRACE_LIMITS:
5104 	    {
5105 		if (OP(next) == BRACE_SIMPLE)
5106 		{
5107 		    bl_minval = OPERAND_MIN(scan);
5108 		    bl_maxval = OPERAND_MAX(scan);
5109 		}
5110 		else if (OP(next) >= BRACE_COMPLEX
5111 			&& OP(next) < BRACE_COMPLEX + 10)
5112 		{
5113 		    no = OP(next) - BRACE_COMPLEX;
5114 		    brace_min[no] = OPERAND_MIN(scan);
5115 		    brace_max[no] = OPERAND_MAX(scan);
5116 		    brace_count[no] = 0;
5117 		}
5118 		else
5119 		{
5120 		    internal_error("BRACE_LIMITS");
5121 		    status = RA_FAIL;
5122 		}
5123 	    }
5124 	    break;
5125 
5126 	  case BRACE_COMPLEX + 0:
5127 	  case BRACE_COMPLEX + 1:
5128 	  case BRACE_COMPLEX + 2:
5129 	  case BRACE_COMPLEX + 3:
5130 	  case BRACE_COMPLEX + 4:
5131 	  case BRACE_COMPLEX + 5:
5132 	  case BRACE_COMPLEX + 6:
5133 	  case BRACE_COMPLEX + 7:
5134 	  case BRACE_COMPLEX + 8:
5135 	  case BRACE_COMPLEX + 9:
5136 	    {
5137 		no = op - BRACE_COMPLEX;
5138 		++brace_count[no];
5139 
5140 		/* If not matched enough times yet, try one more */
5141 		if (brace_count[no] <= (brace_min[no] <= brace_max[no]
5142 					     ? brace_min[no] : brace_max[no]))
5143 		{
5144 		    rp = regstack_push(RS_BRCPLX_MORE, scan);
5145 		    if (rp == NULL)
5146 			status = RA_FAIL;
5147 		    else
5148 		    {
5149 			rp->rs_no = no;
5150 			reg_save(&rp->rs_un.regsave, &backpos);
5151 			next = OPERAND(scan);
5152 			/* We continue and handle the result when done. */
5153 		    }
5154 		    break;
5155 		}
5156 
5157 		/* If matched enough times, may try matching some more */
5158 		if (brace_min[no] <= brace_max[no])
5159 		{
5160 		    /* Range is the normal way around, use longest match */
5161 		    if (brace_count[no] <= brace_max[no])
5162 		    {
5163 			rp = regstack_push(RS_BRCPLX_LONG, scan);
5164 			if (rp == NULL)
5165 			    status = RA_FAIL;
5166 			else
5167 			{
5168 			    rp->rs_no = no;
5169 			    reg_save(&rp->rs_un.regsave, &backpos);
5170 			    next = OPERAND(scan);
5171 			    /* We continue and handle the result when done. */
5172 			}
5173 		    }
5174 		}
5175 		else
5176 		{
5177 		    /* Range is backwards, use shortest match first */
5178 		    if (brace_count[no] <= brace_min[no])
5179 		    {
5180 			rp = regstack_push(RS_BRCPLX_SHORT, scan);
5181 			if (rp == NULL)
5182 			    status = RA_FAIL;
5183 			else
5184 			{
5185 			    reg_save(&rp->rs_un.regsave, &backpos);
5186 			    /* We continue and handle the result when done. */
5187 			}
5188 		    }
5189 		}
5190 	    }
5191 	    break;
5192 
5193 	  case BRACE_SIMPLE:
5194 	  case STAR:
5195 	  case PLUS:
5196 	    {
5197 		regstar_T	rst;
5198 
5199 		/*
5200 		 * Lookahead to avoid useless match attempts when we know
5201 		 * what character comes next.
5202 		 */
5203 		if (OP(next) == EXACTLY)
5204 		{
5205 		    rst.nextb = *OPERAND(next);
5206 		    if (rex.reg_ic)
5207 		    {
5208 			if (MB_ISUPPER(rst.nextb))
5209 			    rst.nextb_ic = MB_TOLOWER(rst.nextb);
5210 			else
5211 			    rst.nextb_ic = MB_TOUPPER(rst.nextb);
5212 		    }
5213 		    else
5214 			rst.nextb_ic = rst.nextb;
5215 		}
5216 		else
5217 		{
5218 		    rst.nextb = NUL;
5219 		    rst.nextb_ic = NUL;
5220 		}
5221 		if (op != BRACE_SIMPLE)
5222 		{
5223 		    rst.minval = (op == STAR) ? 0 : 1;
5224 		    rst.maxval = MAX_LIMIT;
5225 		}
5226 		else
5227 		{
5228 		    rst.minval = bl_minval;
5229 		    rst.maxval = bl_maxval;
5230 		}
5231 
5232 		/*
5233 		 * When maxval > minval, try matching as much as possible, up
5234 		 * to maxval.  When maxval < minval, try matching at least the
5235 		 * minimal number (since the range is backwards, that's also
5236 		 * maxval!).
5237 		 */
5238 		rst.count = regrepeat(OPERAND(scan), rst.maxval);
5239 		if (got_int)
5240 		{
5241 		    status = RA_FAIL;
5242 		    break;
5243 		}
5244 		if (rst.minval <= rst.maxval
5245 			  ? rst.count >= rst.minval : rst.count >= rst.maxval)
5246 		{
5247 		    /* It could match.  Prepare for trying to match what
5248 		     * follows.  The code is below.  Parameters are stored in
5249 		     * a regstar_T on the regstack. */
5250 		    if ((long)((unsigned)regstack.ga_len >> 10) >= p_mmp)
5251 		    {
5252 			EMSG(_(e_maxmempat));
5253 			status = RA_FAIL;
5254 		    }
5255 		    else if (ga_grow(&regstack, sizeof(regstar_T)) == FAIL)
5256 			status = RA_FAIL;
5257 		    else
5258 		    {
5259 			regstack.ga_len += sizeof(regstar_T);
5260 			rp = regstack_push(rst.minval <= rst.maxval
5261 					? RS_STAR_LONG : RS_STAR_SHORT, scan);
5262 			if (rp == NULL)
5263 			    status = RA_FAIL;
5264 			else
5265 			{
5266 			    *(((regstar_T *)rp) - 1) = rst;
5267 			    status = RA_BREAK;	    /* skip the restore bits */
5268 			}
5269 		    }
5270 		}
5271 		else
5272 		    status = RA_NOMATCH;
5273 
5274 	    }
5275 	    break;
5276 
5277 	  case NOMATCH:
5278 	  case MATCH:
5279 	  case SUBPAT:
5280 	    rp = regstack_push(RS_NOMATCH, scan);
5281 	    if (rp == NULL)
5282 		status = RA_FAIL;
5283 	    else
5284 	    {
5285 		rp->rs_no = op;
5286 		reg_save(&rp->rs_un.regsave, &backpos);
5287 		next = OPERAND(scan);
5288 		/* We continue and handle the result when done. */
5289 	    }
5290 	    break;
5291 
5292 	  case BEHIND:
5293 	  case NOBEHIND:
5294 	    /* Need a bit of room to store extra positions. */
5295 	    if ((long)((unsigned)regstack.ga_len >> 10) >= p_mmp)
5296 	    {
5297 		EMSG(_(e_maxmempat));
5298 		status = RA_FAIL;
5299 	    }
5300 	    else if (ga_grow(&regstack, sizeof(regbehind_T)) == FAIL)
5301 		status = RA_FAIL;
5302 	    else
5303 	    {
5304 		regstack.ga_len += sizeof(regbehind_T);
5305 		rp = regstack_push(RS_BEHIND1, scan);
5306 		if (rp == NULL)
5307 		    status = RA_FAIL;
5308 		else
5309 		{
5310 		    /* Need to save the subexpr to be able to restore them
5311 		     * when there is a match but we don't use it. */
5312 		    save_subexpr(((regbehind_T *)rp) - 1);
5313 
5314 		    rp->rs_no = op;
5315 		    reg_save(&rp->rs_un.regsave, &backpos);
5316 		    /* First try if what follows matches.  If it does then we
5317 		     * check the behind match by looping. */
5318 		}
5319 	    }
5320 	    break;
5321 
5322 	  case BHPOS:
5323 	    if (REG_MULTI)
5324 	    {
5325 		if (behind_pos.rs_u.pos.col != (colnr_T)(reginput - regline)
5326 			|| behind_pos.rs_u.pos.lnum != reglnum)
5327 		    status = RA_NOMATCH;
5328 	    }
5329 	    else if (behind_pos.rs_u.ptr != reginput)
5330 		status = RA_NOMATCH;
5331 	    break;
5332 
5333 	  case NEWL:
5334 	    if ((c != NUL || !REG_MULTI || reglnum > rex.reg_maxline
5335 			     || rex.reg_line_lbr)
5336 					   && (c != '\n' || !rex.reg_line_lbr))
5337 		status = RA_NOMATCH;
5338 	    else if (rex.reg_line_lbr)
5339 		ADVANCE_REGINPUT();
5340 	    else
5341 		reg_nextline();
5342 	    break;
5343 
5344 	  case END:
5345 	    status = RA_MATCH;	/* Success! */
5346 	    break;
5347 
5348 	  default:
5349 	    EMSG(_(e_re_corr));
5350 #ifdef DEBUG
5351 	    printf("Illegal op code %d\n", op);
5352 #endif
5353 	    status = RA_FAIL;
5354 	    break;
5355 	  }
5356 	}
5357 
5358 	/* If we can't continue sequentially, break the inner loop. */
5359 	if (status != RA_CONT)
5360 	    break;
5361 
5362 	/* Continue in inner loop, advance to next item. */
5363 	scan = next;
5364 
5365     } /* end of inner loop */
5366 
5367     /*
5368      * If there is something on the regstack execute the code for the state.
5369      * If the state is popped then loop and use the older state.
5370      */
5371     while (regstack.ga_len > 0 && status != RA_FAIL)
5372     {
5373 	rp = (regitem_T *)((char *)regstack.ga_data + regstack.ga_len) - 1;
5374 	switch (rp->rs_state)
5375 	{
5376 	  case RS_NOPEN:
5377 	    /* Result is passed on as-is, simply pop the state. */
5378 	    regstack_pop(&scan);
5379 	    break;
5380 
5381 	  case RS_MOPEN:
5382 	    /* Pop the state.  Restore pointers when there is no match. */
5383 	    if (status == RA_NOMATCH)
5384 		restore_se(&rp->rs_un.sesave, &rex.reg_startpos[rp->rs_no],
5385 						  &rex.reg_startp[rp->rs_no]);
5386 	    regstack_pop(&scan);
5387 	    break;
5388 
5389 #ifdef FEAT_SYN_HL
5390 	  case RS_ZOPEN:
5391 	    /* Pop the state.  Restore pointers when there is no match. */
5392 	    if (status == RA_NOMATCH)
5393 		restore_se(&rp->rs_un.sesave, &reg_startzpos[rp->rs_no],
5394 						 &reg_startzp[rp->rs_no]);
5395 	    regstack_pop(&scan);
5396 	    break;
5397 #endif
5398 
5399 	  case RS_MCLOSE:
5400 	    /* Pop the state.  Restore pointers when there is no match. */
5401 	    if (status == RA_NOMATCH)
5402 		restore_se(&rp->rs_un.sesave, &rex.reg_endpos[rp->rs_no],
5403 						    &rex.reg_endp[rp->rs_no]);
5404 	    regstack_pop(&scan);
5405 	    break;
5406 
5407 #ifdef FEAT_SYN_HL
5408 	  case RS_ZCLOSE:
5409 	    /* Pop the state.  Restore pointers when there is no match. */
5410 	    if (status == RA_NOMATCH)
5411 		restore_se(&rp->rs_un.sesave, &reg_endzpos[rp->rs_no],
5412 						   &reg_endzp[rp->rs_no]);
5413 	    regstack_pop(&scan);
5414 	    break;
5415 #endif
5416 
5417 	  case RS_BRANCH:
5418 	    if (status == RA_MATCH)
5419 		/* this branch matched, use it */
5420 		regstack_pop(&scan);
5421 	    else
5422 	    {
5423 		if (status != RA_BREAK)
5424 		{
5425 		    /* After a non-matching branch: try next one. */
5426 		    reg_restore(&rp->rs_un.regsave, &backpos);
5427 		    scan = rp->rs_scan;
5428 		}
5429 		if (scan == NULL || OP(scan) != BRANCH)
5430 		{
5431 		    /* no more branches, didn't find a match */
5432 		    status = RA_NOMATCH;
5433 		    regstack_pop(&scan);
5434 		}
5435 		else
5436 		{
5437 		    /* Prepare to try a branch. */
5438 		    rp->rs_scan = regnext(scan);
5439 		    reg_save(&rp->rs_un.regsave, &backpos);
5440 		    scan = OPERAND(scan);
5441 		}
5442 	    }
5443 	    break;
5444 
5445 	  case RS_BRCPLX_MORE:
5446 	    /* Pop the state.  Restore pointers when there is no match. */
5447 	    if (status == RA_NOMATCH)
5448 	    {
5449 		reg_restore(&rp->rs_un.regsave, &backpos);
5450 		--brace_count[rp->rs_no];	/* decrement match count */
5451 	    }
5452 	    regstack_pop(&scan);
5453 	    break;
5454 
5455 	  case RS_BRCPLX_LONG:
5456 	    /* Pop the state.  Restore pointers when there is no match. */
5457 	    if (status == RA_NOMATCH)
5458 	    {
5459 		/* There was no match, but we did find enough matches. */
5460 		reg_restore(&rp->rs_un.regsave, &backpos);
5461 		--brace_count[rp->rs_no];
5462 		/* continue with the items after "\{}" */
5463 		status = RA_CONT;
5464 	    }
5465 	    regstack_pop(&scan);
5466 	    if (status == RA_CONT)
5467 		scan = regnext(scan);
5468 	    break;
5469 
5470 	  case RS_BRCPLX_SHORT:
5471 	    /* Pop the state.  Restore pointers when there is no match. */
5472 	    if (status == RA_NOMATCH)
5473 		/* There was no match, try to match one more item. */
5474 		reg_restore(&rp->rs_un.regsave, &backpos);
5475 	    regstack_pop(&scan);
5476 	    if (status == RA_NOMATCH)
5477 	    {
5478 		scan = OPERAND(scan);
5479 		status = RA_CONT;
5480 	    }
5481 	    break;
5482 
5483 	  case RS_NOMATCH:
5484 	    /* Pop the state.  If the operand matches for NOMATCH or
5485 	     * doesn't match for MATCH/SUBPAT, we fail.  Otherwise backup,
5486 	     * except for SUBPAT, and continue with the next item. */
5487 	    if (status == (rp->rs_no == NOMATCH ? RA_MATCH : RA_NOMATCH))
5488 		status = RA_NOMATCH;
5489 	    else
5490 	    {
5491 		status = RA_CONT;
5492 		if (rp->rs_no != SUBPAT)	/* zero-width */
5493 		    reg_restore(&rp->rs_un.regsave, &backpos);
5494 	    }
5495 	    regstack_pop(&scan);
5496 	    if (status == RA_CONT)
5497 		scan = regnext(scan);
5498 	    break;
5499 
5500 	  case RS_BEHIND1:
5501 	    if (status == RA_NOMATCH)
5502 	    {
5503 		regstack_pop(&scan);
5504 		regstack.ga_len -= sizeof(regbehind_T);
5505 	    }
5506 	    else
5507 	    {
5508 		/* The stuff after BEHIND/NOBEHIND matches.  Now try if
5509 		 * the behind part does (not) match before the current
5510 		 * position in the input.  This must be done at every
5511 		 * position in the input and checking if the match ends at
5512 		 * the current position. */
5513 
5514 		/* save the position after the found match for next */
5515 		reg_save(&(((regbehind_T *)rp) - 1)->save_after, &backpos);
5516 
5517 		/* Start looking for a match with operand at the current
5518 		 * position.  Go back one character until we find the
5519 		 * result, hitting the start of the line or the previous
5520 		 * line (for multi-line matching).
5521 		 * Set behind_pos to where the match should end, BHPOS
5522 		 * will match it.  Save the current value. */
5523 		(((regbehind_T *)rp) - 1)->save_behind = behind_pos;
5524 		behind_pos = rp->rs_un.regsave;
5525 
5526 		rp->rs_state = RS_BEHIND2;
5527 
5528 		reg_restore(&rp->rs_un.regsave, &backpos);
5529 		scan = OPERAND(rp->rs_scan) + 4;
5530 	    }
5531 	    break;
5532 
5533 	  case RS_BEHIND2:
5534 	    /*
5535 	     * Looping for BEHIND / NOBEHIND match.
5536 	     */
5537 	    if (status == RA_MATCH && reg_save_equal(&behind_pos))
5538 	    {
5539 		/* found a match that ends where "next" started */
5540 		behind_pos = (((regbehind_T *)rp) - 1)->save_behind;
5541 		if (rp->rs_no == BEHIND)
5542 		    reg_restore(&(((regbehind_T *)rp) - 1)->save_after,
5543 								    &backpos);
5544 		else
5545 		{
5546 		    /* But we didn't want a match.  Need to restore the
5547 		     * subexpr, because what follows matched, so they have
5548 		     * been set. */
5549 		    status = RA_NOMATCH;
5550 		    restore_subexpr(((regbehind_T *)rp) - 1);
5551 		}
5552 		regstack_pop(&scan);
5553 		regstack.ga_len -= sizeof(regbehind_T);
5554 	    }
5555 	    else
5556 	    {
5557 		long limit;
5558 
5559 		/* No match or a match that doesn't end where we want it: Go
5560 		 * back one character.  May go to previous line once. */
5561 		no = OK;
5562 		limit = OPERAND_MIN(rp->rs_scan);
5563 		if (REG_MULTI)
5564 		{
5565 		    if (limit > 0
5566 			    && ((rp->rs_un.regsave.rs_u.pos.lnum
5567 						    < behind_pos.rs_u.pos.lnum
5568 				    ? (colnr_T)STRLEN(regline)
5569 				    : behind_pos.rs_u.pos.col)
5570 				- rp->rs_un.regsave.rs_u.pos.col >= limit))
5571 			no = FAIL;
5572 		    else if (rp->rs_un.regsave.rs_u.pos.col == 0)
5573 		    {
5574 			if (rp->rs_un.regsave.rs_u.pos.lnum
5575 					< behind_pos.rs_u.pos.lnum
5576 				|| reg_getline(
5577 					--rp->rs_un.regsave.rs_u.pos.lnum)
5578 								  == NULL)
5579 			    no = FAIL;
5580 			else
5581 			{
5582 			    reg_restore(&rp->rs_un.regsave, &backpos);
5583 			    rp->rs_un.regsave.rs_u.pos.col =
5584 						 (colnr_T)STRLEN(regline);
5585 			}
5586 		    }
5587 		    else
5588 		    {
5589 #ifdef FEAT_MBYTE
5590 			if (has_mbyte)
5591 			    rp->rs_un.regsave.rs_u.pos.col -=
5592 				(*mb_head_off)(regline, regline
5593 				    + rp->rs_un.regsave.rs_u.pos.col - 1) + 1;
5594 			else
5595 #endif
5596 			    --rp->rs_un.regsave.rs_u.pos.col;
5597 		    }
5598 		}
5599 		else
5600 		{
5601 		    if (rp->rs_un.regsave.rs_u.ptr == regline)
5602 			no = FAIL;
5603 		    else
5604 		    {
5605 			MB_PTR_BACK(regline, rp->rs_un.regsave.rs_u.ptr);
5606 			if (limit > 0 && (long)(behind_pos.rs_u.ptr
5607 				     - rp->rs_un.regsave.rs_u.ptr) > limit)
5608 			    no = FAIL;
5609 		    }
5610 		}
5611 		if (no == OK)
5612 		{
5613 		    /* Advanced, prepare for finding match again. */
5614 		    reg_restore(&rp->rs_un.regsave, &backpos);
5615 		    scan = OPERAND(rp->rs_scan) + 4;
5616 		    if (status == RA_MATCH)
5617 		    {
5618 			/* We did match, so subexpr may have been changed,
5619 			 * need to restore them for the next try. */
5620 			status = RA_NOMATCH;
5621 			restore_subexpr(((regbehind_T *)rp) - 1);
5622 		    }
5623 		}
5624 		else
5625 		{
5626 		    /* Can't advance.  For NOBEHIND that's a match. */
5627 		    behind_pos = (((regbehind_T *)rp) - 1)->save_behind;
5628 		    if (rp->rs_no == NOBEHIND)
5629 		    {
5630 			reg_restore(&(((regbehind_T *)rp) - 1)->save_after,
5631 								    &backpos);
5632 			status = RA_MATCH;
5633 		    }
5634 		    else
5635 		    {
5636 			/* We do want a proper match.  Need to restore the
5637 			 * subexpr if we had a match, because they may have
5638 			 * been set. */
5639 			if (status == RA_MATCH)
5640 			{
5641 			    status = RA_NOMATCH;
5642 			    restore_subexpr(((regbehind_T *)rp) - 1);
5643 			}
5644 		    }
5645 		    regstack_pop(&scan);
5646 		    regstack.ga_len -= sizeof(regbehind_T);
5647 		}
5648 	    }
5649 	    break;
5650 
5651 	  case RS_STAR_LONG:
5652 	  case RS_STAR_SHORT:
5653 	    {
5654 		regstar_T	    *rst = ((regstar_T *)rp) - 1;
5655 
5656 		if (status == RA_MATCH)
5657 		{
5658 		    regstack_pop(&scan);
5659 		    regstack.ga_len -= sizeof(regstar_T);
5660 		    break;
5661 		}
5662 
5663 		/* Tried once already, restore input pointers. */
5664 		if (status != RA_BREAK)
5665 		    reg_restore(&rp->rs_un.regsave, &backpos);
5666 
5667 		/* Repeat until we found a position where it could match. */
5668 		for (;;)
5669 		{
5670 		    if (status != RA_BREAK)
5671 		    {
5672 			/* Tried first position already, advance. */
5673 			if (rp->rs_state == RS_STAR_LONG)
5674 			{
5675 			    /* Trying for longest match, but couldn't or
5676 			     * didn't match -- back up one char. */
5677 			    if (--rst->count < rst->minval)
5678 				break;
5679 			    if (reginput == regline)
5680 			    {
5681 				/* backup to last char of previous line */
5682 				--reglnum;
5683 				regline = reg_getline(reglnum);
5684 				/* Just in case regrepeat() didn't count
5685 				 * right. */
5686 				if (regline == NULL)
5687 				    break;
5688 				reginput = regline + STRLEN(regline);
5689 				fast_breakcheck();
5690 			    }
5691 			    else
5692 				MB_PTR_BACK(regline, reginput);
5693 			}
5694 			else
5695 			{
5696 			    /* Range is backwards, use shortest match first.
5697 			     * Careful: maxval and minval are exchanged!
5698 			     * Couldn't or didn't match: try advancing one
5699 			     * char. */
5700 			    if (rst->count == rst->minval
5701 				  || regrepeat(OPERAND(rp->rs_scan), 1L) == 0)
5702 				break;
5703 			    ++rst->count;
5704 			}
5705 			if (got_int)
5706 			    break;
5707 		    }
5708 		    else
5709 			status = RA_NOMATCH;
5710 
5711 		    /* If it could match, try it. */
5712 		    if (rst->nextb == NUL || *reginput == rst->nextb
5713 					     || *reginput == rst->nextb_ic)
5714 		    {
5715 			reg_save(&rp->rs_un.regsave, &backpos);
5716 			scan = regnext(rp->rs_scan);
5717 			status = RA_CONT;
5718 			break;
5719 		    }
5720 		}
5721 		if (status != RA_CONT)
5722 		{
5723 		    /* Failed. */
5724 		    regstack_pop(&scan);
5725 		    regstack.ga_len -= sizeof(regstar_T);
5726 		    status = RA_NOMATCH;
5727 		}
5728 	    }
5729 	    break;
5730 	}
5731 
5732 	/* If we want to continue the inner loop or didn't pop a state
5733 	 * continue matching loop */
5734 	if (status == RA_CONT || rp == (regitem_T *)
5735 			     ((char *)regstack.ga_data + regstack.ga_len) - 1)
5736 	    break;
5737     }
5738 
5739     /* May need to continue with the inner loop, starting at "scan". */
5740     if (status == RA_CONT)
5741 	continue;
5742 
5743     /*
5744      * If the regstack is empty or something failed we are done.
5745      */
5746     if (regstack.ga_len == 0 || status == RA_FAIL)
5747     {
5748 	if (scan == NULL)
5749 	{
5750 	    /*
5751 	     * We get here only if there's trouble -- normally "case END" is
5752 	     * the terminating point.
5753 	     */
5754 	    EMSG(_(e_re_corr));
5755 #ifdef DEBUG
5756 	    printf("Premature EOL\n");
5757 #endif
5758 	}
5759 	return (status == RA_MATCH);
5760     }
5761 
5762   } /* End of loop until the regstack is empty. */
5763 
5764   /* NOTREACHED */
5765 }
5766 
5767 /*
5768  * Push an item onto the regstack.
5769  * Returns pointer to new item.  Returns NULL when out of memory.
5770  */
5771     static regitem_T *
5772 regstack_push(regstate_T state, char_u *scan)
5773 {
5774     regitem_T	*rp;
5775 
5776     if ((long)((unsigned)regstack.ga_len >> 10) >= p_mmp)
5777     {
5778 	EMSG(_(e_maxmempat));
5779 	return NULL;
5780     }
5781     if (ga_grow(&regstack, sizeof(regitem_T)) == FAIL)
5782 	return NULL;
5783 
5784     rp = (regitem_T *)((char *)regstack.ga_data + regstack.ga_len);
5785     rp->rs_state = state;
5786     rp->rs_scan = scan;
5787 
5788     regstack.ga_len += sizeof(regitem_T);
5789     return rp;
5790 }
5791 
5792 /*
5793  * Pop an item from the regstack.
5794  */
5795     static void
5796 regstack_pop(char_u **scan)
5797 {
5798     regitem_T	*rp;
5799 
5800     rp = (regitem_T *)((char *)regstack.ga_data + regstack.ga_len) - 1;
5801     *scan = rp->rs_scan;
5802 
5803     regstack.ga_len -= sizeof(regitem_T);
5804 }
5805 
5806 /*
5807  * regrepeat - repeatedly match something simple, return how many.
5808  * Advances reginput (and reglnum) to just after the matched chars.
5809  */
5810     static int
5811 regrepeat(
5812     char_u	*p,
5813     long	maxcount)   /* maximum number of matches allowed */
5814 {
5815     long	count = 0;
5816     char_u	*scan;
5817     char_u	*opnd;
5818     int		mask;
5819     int		testval = 0;
5820 
5821     scan = reginput;	    /* Make local copy of reginput for speed. */
5822     opnd = OPERAND(p);
5823     switch (OP(p))
5824     {
5825       case ANY:
5826       case ANY + ADD_NL:
5827 	while (count < maxcount)
5828 	{
5829 	    /* Matching anything means we continue until end-of-line (or
5830 	     * end-of-file for ANY + ADD_NL), only limited by maxcount. */
5831 	    while (*scan != NUL && count < maxcount)
5832 	    {
5833 		++count;
5834 		MB_PTR_ADV(scan);
5835 	    }
5836 	    if (!REG_MULTI || !WITH_NL(OP(p)) || reglnum > rex.reg_maxline
5837 				      || rex.reg_line_lbr || count == maxcount)
5838 		break;
5839 	    ++count;		/* count the line-break */
5840 	    reg_nextline();
5841 	    scan = reginput;
5842 	    if (got_int)
5843 		break;
5844 	}
5845 	break;
5846 
5847       case IDENT:
5848       case IDENT + ADD_NL:
5849 	testval = TRUE;
5850 	/*FALLTHROUGH*/
5851       case SIDENT:
5852       case SIDENT + ADD_NL:
5853 	while (count < maxcount)
5854 	{
5855 	    if (vim_isIDc(PTR2CHAR(scan)) && (testval || !VIM_ISDIGIT(*scan)))
5856 	    {
5857 		MB_PTR_ADV(scan);
5858 	    }
5859 	    else if (*scan == NUL)
5860 	    {
5861 		if (!REG_MULTI || !WITH_NL(OP(p)) || reglnum > rex.reg_maxline
5862 							   || rex.reg_line_lbr)
5863 		    break;
5864 		reg_nextline();
5865 		scan = reginput;
5866 		if (got_int)
5867 		    break;
5868 	    }
5869 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5870 		++scan;
5871 	    else
5872 		break;
5873 	    ++count;
5874 	}
5875 	break;
5876 
5877       case KWORD:
5878       case KWORD + ADD_NL:
5879 	testval = TRUE;
5880 	/*FALLTHROUGH*/
5881       case SKWORD:
5882       case SKWORD + ADD_NL:
5883 	while (count < maxcount)
5884 	{
5885 	    if (vim_iswordp_buf(scan, rex.reg_buf)
5886 					  && (testval || !VIM_ISDIGIT(*scan)))
5887 	    {
5888 		MB_PTR_ADV(scan);
5889 	    }
5890 	    else if (*scan == NUL)
5891 	    {
5892 		if (!REG_MULTI || !WITH_NL(OP(p)) || reglnum > rex.reg_maxline
5893 							   || rex.reg_line_lbr)
5894 		    break;
5895 		reg_nextline();
5896 		scan = reginput;
5897 		if (got_int)
5898 		    break;
5899 	    }
5900 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5901 		++scan;
5902 	    else
5903 		break;
5904 	    ++count;
5905 	}
5906 	break;
5907 
5908       case FNAME:
5909       case FNAME + ADD_NL:
5910 	testval = TRUE;
5911 	/*FALLTHROUGH*/
5912       case SFNAME:
5913       case SFNAME + ADD_NL:
5914 	while (count < maxcount)
5915 	{
5916 	    if (vim_isfilec(PTR2CHAR(scan)) && (testval || !VIM_ISDIGIT(*scan)))
5917 	    {
5918 		MB_PTR_ADV(scan);
5919 	    }
5920 	    else if (*scan == NUL)
5921 	    {
5922 		if (!REG_MULTI || !WITH_NL(OP(p)) || reglnum > rex.reg_maxline
5923 							   || rex.reg_line_lbr)
5924 		    break;
5925 		reg_nextline();
5926 		scan = reginput;
5927 		if (got_int)
5928 		    break;
5929 	    }
5930 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5931 		++scan;
5932 	    else
5933 		break;
5934 	    ++count;
5935 	}
5936 	break;
5937 
5938       case PRINT:
5939       case PRINT + ADD_NL:
5940 	testval = TRUE;
5941 	/*FALLTHROUGH*/
5942       case SPRINT:
5943       case SPRINT + ADD_NL:
5944 	while (count < maxcount)
5945 	{
5946 	    if (*scan == NUL)
5947 	    {
5948 		if (!REG_MULTI || !WITH_NL(OP(p)) || reglnum > rex.reg_maxline
5949 							   || rex.reg_line_lbr)
5950 		    break;
5951 		reg_nextline();
5952 		scan = reginput;
5953 		if (got_int)
5954 		    break;
5955 	    }
5956 	    else if (vim_isprintc(PTR2CHAR(scan)) == 1
5957 					  && (testval || !VIM_ISDIGIT(*scan)))
5958 	    {
5959 		MB_PTR_ADV(scan);
5960 	    }
5961 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5962 		++scan;
5963 	    else
5964 		break;
5965 	    ++count;
5966 	}
5967 	break;
5968 
5969       case WHITE:
5970       case WHITE + ADD_NL:
5971 	testval = mask = RI_WHITE;
5972 do_class:
5973 	while (count < maxcount)
5974 	{
5975 #ifdef FEAT_MBYTE
5976 	    int		l;
5977 #endif
5978 	    if (*scan == NUL)
5979 	    {
5980 		if (!REG_MULTI || !WITH_NL(OP(p)) || reglnum > rex.reg_maxline
5981 							   || rex.reg_line_lbr)
5982 		    break;
5983 		reg_nextline();
5984 		scan = reginput;
5985 		if (got_int)
5986 		    break;
5987 	    }
5988 #ifdef FEAT_MBYTE
5989 	    else if (has_mbyte && (l = (*mb_ptr2len)(scan)) > 1)
5990 	    {
5991 		if (testval != 0)
5992 		    break;
5993 		scan += l;
5994 	    }
5995 #endif
5996 	    else if ((class_tab[*scan] & mask) == testval)
5997 		++scan;
5998 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
5999 		++scan;
6000 	    else
6001 		break;
6002 	    ++count;
6003 	}
6004 	break;
6005 
6006       case NWHITE:
6007       case NWHITE + ADD_NL:
6008 	mask = RI_WHITE;
6009 	goto do_class;
6010       case DIGIT:
6011       case DIGIT + ADD_NL:
6012 	testval = mask = RI_DIGIT;
6013 	goto do_class;
6014       case NDIGIT:
6015       case NDIGIT + ADD_NL:
6016 	mask = RI_DIGIT;
6017 	goto do_class;
6018       case HEX:
6019       case HEX + ADD_NL:
6020 	testval = mask = RI_HEX;
6021 	goto do_class;
6022       case NHEX:
6023       case NHEX + ADD_NL:
6024 	mask = RI_HEX;
6025 	goto do_class;
6026       case OCTAL:
6027       case OCTAL + ADD_NL:
6028 	testval = mask = RI_OCTAL;
6029 	goto do_class;
6030       case NOCTAL:
6031       case NOCTAL + ADD_NL:
6032 	mask = RI_OCTAL;
6033 	goto do_class;
6034       case WORD:
6035       case WORD + ADD_NL:
6036 	testval = mask = RI_WORD;
6037 	goto do_class;
6038       case NWORD:
6039       case NWORD + ADD_NL:
6040 	mask = RI_WORD;
6041 	goto do_class;
6042       case HEAD:
6043       case HEAD + ADD_NL:
6044 	testval = mask = RI_HEAD;
6045 	goto do_class;
6046       case NHEAD:
6047       case NHEAD + ADD_NL:
6048 	mask = RI_HEAD;
6049 	goto do_class;
6050       case ALPHA:
6051       case ALPHA + ADD_NL:
6052 	testval = mask = RI_ALPHA;
6053 	goto do_class;
6054       case NALPHA:
6055       case NALPHA + ADD_NL:
6056 	mask = RI_ALPHA;
6057 	goto do_class;
6058       case LOWER:
6059       case LOWER + ADD_NL:
6060 	testval = mask = RI_LOWER;
6061 	goto do_class;
6062       case NLOWER:
6063       case NLOWER + ADD_NL:
6064 	mask = RI_LOWER;
6065 	goto do_class;
6066       case UPPER:
6067       case UPPER + ADD_NL:
6068 	testval = mask = RI_UPPER;
6069 	goto do_class;
6070       case NUPPER:
6071       case NUPPER + ADD_NL:
6072 	mask = RI_UPPER;
6073 	goto do_class;
6074 
6075       case EXACTLY:
6076 	{
6077 	    int	    cu, cl;
6078 
6079 	    /* This doesn't do a multi-byte character, because a MULTIBYTECODE
6080 	     * would have been used for it.  It does handle single-byte
6081 	     * characters, such as latin1. */
6082 	    if (rex.reg_ic)
6083 	    {
6084 		cu = MB_TOUPPER(*opnd);
6085 		cl = MB_TOLOWER(*opnd);
6086 		while (count < maxcount && (*scan == cu || *scan == cl))
6087 		{
6088 		    count++;
6089 		    scan++;
6090 		}
6091 	    }
6092 	    else
6093 	    {
6094 		cu = *opnd;
6095 		while (count < maxcount && *scan == cu)
6096 		{
6097 		    count++;
6098 		    scan++;
6099 		}
6100 	    }
6101 	    break;
6102 	}
6103 
6104 #ifdef FEAT_MBYTE
6105       case MULTIBYTECODE:
6106 	{
6107 	    int		i, len, cf = 0;
6108 
6109 	    /* Safety check (just in case 'encoding' was changed since
6110 	     * compiling the program). */
6111 	    if ((len = (*mb_ptr2len)(opnd)) > 1)
6112 	    {
6113 		if (rex.reg_ic && enc_utf8)
6114 		    cf = utf_fold(utf_ptr2char(opnd));
6115 		while (count < maxcount && (*mb_ptr2len)(scan) >= len)
6116 		{
6117 		    for (i = 0; i < len; ++i)
6118 			if (opnd[i] != scan[i])
6119 			    break;
6120 		    if (i < len && (!rex.reg_ic || !enc_utf8
6121 					|| utf_fold(utf_ptr2char(scan)) != cf))
6122 			break;
6123 		    scan += len;
6124 		    ++count;
6125 		}
6126 	    }
6127 	}
6128 	break;
6129 #endif
6130 
6131       case ANYOF:
6132       case ANYOF + ADD_NL:
6133 	testval = TRUE;
6134 	/*FALLTHROUGH*/
6135 
6136       case ANYBUT:
6137       case ANYBUT + ADD_NL:
6138 	while (count < maxcount)
6139 	{
6140 #ifdef FEAT_MBYTE
6141 	    int len;
6142 #endif
6143 	    if (*scan == NUL)
6144 	    {
6145 		if (!REG_MULTI || !WITH_NL(OP(p)) || reglnum > rex.reg_maxline
6146 							   || rex.reg_line_lbr)
6147 		    break;
6148 		reg_nextline();
6149 		scan = reginput;
6150 		if (got_int)
6151 		    break;
6152 	    }
6153 	    else if (rex.reg_line_lbr && *scan == '\n' && WITH_NL(OP(p)))
6154 		++scan;
6155 #ifdef FEAT_MBYTE
6156 	    else if (has_mbyte && (len = (*mb_ptr2len)(scan)) > 1)
6157 	    {
6158 		if ((cstrchr(opnd, (*mb_ptr2char)(scan)) == NULL) == testval)
6159 		    break;
6160 		scan += len;
6161 	    }
6162 #endif
6163 	    else
6164 	    {
6165 		if ((cstrchr(opnd, *scan) == NULL) == testval)
6166 		    break;
6167 		++scan;
6168 	    }
6169 	    ++count;
6170 	}
6171 	break;
6172 
6173       case NEWL:
6174 	while (count < maxcount
6175 		&& ((*scan == NUL && reglnum <= rex.reg_maxline
6176 				       && !rex.reg_line_lbr && REG_MULTI)
6177 		    || (*scan == '\n' && rex.reg_line_lbr)))
6178 	{
6179 	    count++;
6180 	    if (rex.reg_line_lbr)
6181 		ADVANCE_REGINPUT();
6182 	    else
6183 		reg_nextline();
6184 	    scan = reginput;
6185 	    if (got_int)
6186 		break;
6187 	}
6188 	break;
6189 
6190       default:			/* Oh dear.  Called inappropriately. */
6191 	EMSG(_(e_re_corr));
6192 #ifdef DEBUG
6193 	printf("Called regrepeat with op code %d\n", OP(p));
6194 #endif
6195 	break;
6196     }
6197 
6198     reginput = scan;
6199 
6200     return (int)count;
6201 }
6202 
6203 /*
6204  * regnext - dig the "next" pointer out of a node
6205  * Returns NULL when calculating size, when there is no next item and when
6206  * there is an error.
6207  */
6208     static char_u *
6209 regnext(char_u *p)
6210 {
6211     int	    offset;
6212 
6213     if (p == JUST_CALC_SIZE || reg_toolong)
6214 	return NULL;
6215 
6216     offset = NEXT(p);
6217     if (offset == 0)
6218 	return NULL;
6219 
6220     if (OP(p) == BACK)
6221 	return p - offset;
6222     else
6223 	return p + offset;
6224 }
6225 
6226 /*
6227  * Check the regexp program for its magic number.
6228  * Return TRUE if it's wrong.
6229  */
6230     static int
6231 prog_magic_wrong(void)
6232 {
6233     regprog_T	*prog;
6234 
6235     prog = REG_MULTI ? rex.reg_mmatch->regprog : rex.reg_match->regprog;
6236     if (prog->engine == &nfa_regengine)
6237 	/* For NFA matcher we don't check the magic */
6238 	return FALSE;
6239 
6240     if (UCHARAT(((bt_regprog_T *)prog)->program) != REGMAGIC)
6241     {
6242 	EMSG(_(e_re_corr));
6243 	return TRUE;
6244     }
6245     return FALSE;
6246 }
6247 
6248 /*
6249  * Cleanup the subexpressions, if this wasn't done yet.
6250  * This construction is used to clear the subexpressions only when they are
6251  * used (to increase speed).
6252  */
6253     static void
6254 cleanup_subexpr(void)
6255 {
6256     if (need_clear_subexpr)
6257     {
6258 	if (REG_MULTI)
6259 	{
6260 	    /* Use 0xff to set lnum to -1 */
6261 	    vim_memset(rex.reg_startpos, 0xff, sizeof(lpos_T) * NSUBEXP);
6262 	    vim_memset(rex.reg_endpos, 0xff, sizeof(lpos_T) * NSUBEXP);
6263 	}
6264 	else
6265 	{
6266 	    vim_memset(rex.reg_startp, 0, sizeof(char_u *) * NSUBEXP);
6267 	    vim_memset(rex.reg_endp, 0, sizeof(char_u *) * NSUBEXP);
6268 	}
6269 	need_clear_subexpr = FALSE;
6270     }
6271 }
6272 
6273 #ifdef FEAT_SYN_HL
6274     static void
6275 cleanup_zsubexpr(void)
6276 {
6277     if (need_clear_zsubexpr)
6278     {
6279 	if (REG_MULTI)
6280 	{
6281 	    /* Use 0xff to set lnum to -1 */
6282 	    vim_memset(reg_startzpos, 0xff, sizeof(lpos_T) * NSUBEXP);
6283 	    vim_memset(reg_endzpos, 0xff, sizeof(lpos_T) * NSUBEXP);
6284 	}
6285 	else
6286 	{
6287 	    vim_memset(reg_startzp, 0, sizeof(char_u *) * NSUBEXP);
6288 	    vim_memset(reg_endzp, 0, sizeof(char_u *) * NSUBEXP);
6289 	}
6290 	need_clear_zsubexpr = FALSE;
6291     }
6292 }
6293 #endif
6294 
6295 /*
6296  * Save the current subexpr to "bp", so that they can be restored
6297  * later by restore_subexpr().
6298  */
6299     static void
6300 save_subexpr(regbehind_T *bp)
6301 {
6302     int i;
6303 
6304     /* When "need_clear_subexpr" is set we don't need to save the values, only
6305      * remember that this flag needs to be set again when restoring. */
6306     bp->save_need_clear_subexpr = need_clear_subexpr;
6307     if (!need_clear_subexpr)
6308     {
6309 	for (i = 0; i < NSUBEXP; ++i)
6310 	{
6311 	    if (REG_MULTI)
6312 	    {
6313 		bp->save_start[i].se_u.pos = rex.reg_startpos[i];
6314 		bp->save_end[i].se_u.pos = rex.reg_endpos[i];
6315 	    }
6316 	    else
6317 	    {
6318 		bp->save_start[i].se_u.ptr = rex.reg_startp[i];
6319 		bp->save_end[i].se_u.ptr = rex.reg_endp[i];
6320 	    }
6321 	}
6322     }
6323 }
6324 
6325 /*
6326  * Restore the subexpr from "bp".
6327  */
6328     static void
6329 restore_subexpr(regbehind_T *bp)
6330 {
6331     int i;
6332 
6333     /* Only need to restore saved values when they are not to be cleared. */
6334     need_clear_subexpr = bp->save_need_clear_subexpr;
6335     if (!need_clear_subexpr)
6336     {
6337 	for (i = 0; i < NSUBEXP; ++i)
6338 	{
6339 	    if (REG_MULTI)
6340 	    {
6341 		rex.reg_startpos[i] = bp->save_start[i].se_u.pos;
6342 		rex.reg_endpos[i] = bp->save_end[i].se_u.pos;
6343 	    }
6344 	    else
6345 	    {
6346 		rex.reg_startp[i] = bp->save_start[i].se_u.ptr;
6347 		rex.reg_endp[i] = bp->save_end[i].se_u.ptr;
6348 	    }
6349 	}
6350     }
6351 }
6352 
6353 /*
6354  * Advance reglnum, regline and reginput to the next line.
6355  */
6356     static void
6357 reg_nextline(void)
6358 {
6359     regline = reg_getline(++reglnum);
6360     reginput = regline;
6361     fast_breakcheck();
6362 }
6363 
6364 /*
6365  * Save the input line and position in a regsave_T.
6366  */
6367     static void
6368 reg_save(regsave_T *save, garray_T *gap)
6369 {
6370     if (REG_MULTI)
6371     {
6372 	save->rs_u.pos.col = (colnr_T)(reginput - regline);
6373 	save->rs_u.pos.lnum = reglnum;
6374     }
6375     else
6376 	save->rs_u.ptr = reginput;
6377     save->rs_len = gap->ga_len;
6378 }
6379 
6380 /*
6381  * Restore the input line and position from a regsave_T.
6382  */
6383     static void
6384 reg_restore(regsave_T *save, garray_T *gap)
6385 {
6386     if (REG_MULTI)
6387     {
6388 	if (reglnum != save->rs_u.pos.lnum)
6389 	{
6390 	    /* only call reg_getline() when the line number changed to save
6391 	     * a bit of time */
6392 	    reglnum = save->rs_u.pos.lnum;
6393 	    regline = reg_getline(reglnum);
6394 	}
6395 	reginput = regline + save->rs_u.pos.col;
6396     }
6397     else
6398 	reginput = save->rs_u.ptr;
6399     gap->ga_len = save->rs_len;
6400 }
6401 
6402 /*
6403  * Return TRUE if current position is equal to saved position.
6404  */
6405     static int
6406 reg_save_equal(regsave_T *save)
6407 {
6408     if (REG_MULTI)
6409 	return reglnum == save->rs_u.pos.lnum
6410 				  && reginput == regline + save->rs_u.pos.col;
6411     return reginput == save->rs_u.ptr;
6412 }
6413 
6414 /*
6415  * Tentatively set the sub-expression start to the current position (after
6416  * calling regmatch() they will have changed).  Need to save the existing
6417  * values for when there is no match.
6418  * Use se_save() to use pointer (save_se_multi()) or position (save_se_one()),
6419  * depending on REG_MULTI.
6420  */
6421     static void
6422 save_se_multi(save_se_T *savep, lpos_T *posp)
6423 {
6424     savep->se_u.pos = *posp;
6425     posp->lnum = reglnum;
6426     posp->col = (colnr_T)(reginput - regline);
6427 }
6428 
6429     static void
6430 save_se_one(save_se_T *savep, char_u **pp)
6431 {
6432     savep->se_u.ptr = *pp;
6433     *pp = reginput;
6434 }
6435 
6436 /*
6437  * Compare a number with the operand of RE_LNUM, RE_COL or RE_VCOL.
6438  */
6439     static int
6440 re_num_cmp(long_u val, char_u *scan)
6441 {
6442     long_u  n = OPERAND_MIN(scan);
6443 
6444     if (OPERAND_CMP(scan) == '>')
6445 	return val > n;
6446     if (OPERAND_CMP(scan) == '<')
6447 	return val < n;
6448     return val == n;
6449 }
6450 
6451 /*
6452  * Check whether a backreference matches.
6453  * Returns RA_FAIL, RA_NOMATCH or RA_MATCH.
6454  * If "bytelen" is not NULL, it is set to the byte length of the match in the
6455  * last line.
6456  */
6457     static int
6458 match_with_backref(
6459     linenr_T start_lnum,
6460     colnr_T  start_col,
6461     linenr_T end_lnum,
6462     colnr_T  end_col,
6463     int	     *bytelen)
6464 {
6465     linenr_T	clnum = start_lnum;
6466     colnr_T	ccol = start_col;
6467     int		len;
6468     char_u	*p;
6469 
6470     if (bytelen != NULL)
6471 	*bytelen = 0;
6472     for (;;)
6473     {
6474 	/* Since getting one line may invalidate the other, need to make copy.
6475 	 * Slow! */
6476 	if (regline != reg_tofree)
6477 	{
6478 	    len = (int)STRLEN(regline);
6479 	    if (reg_tofree == NULL || len >= (int)reg_tofreelen)
6480 	    {
6481 		len += 50;	/* get some extra */
6482 		vim_free(reg_tofree);
6483 		reg_tofree = alloc(len);
6484 		if (reg_tofree == NULL)
6485 		    return RA_FAIL; /* out of memory!*/
6486 		reg_tofreelen = len;
6487 	    }
6488 	    STRCPY(reg_tofree, regline);
6489 	    reginput = reg_tofree + (reginput - regline);
6490 	    regline = reg_tofree;
6491 	}
6492 
6493 	/* Get the line to compare with. */
6494 	p = reg_getline(clnum);
6495 	if (clnum == end_lnum)
6496 	    len = end_col - ccol;
6497 	else
6498 	    len = (int)STRLEN(p + ccol);
6499 
6500 	if (cstrncmp(p + ccol, reginput, &len) != 0)
6501 	    return RA_NOMATCH;  /* doesn't match */
6502 	if (bytelen != NULL)
6503 	    *bytelen += len;
6504 	if (clnum == end_lnum)
6505 	    break;		/* match and at end! */
6506 	if (reglnum >= rex.reg_maxline)
6507 	    return RA_NOMATCH;  /* text too short */
6508 
6509 	/* Advance to next line. */
6510 	reg_nextline();
6511 	if (bytelen != NULL)
6512 	    *bytelen = 0;
6513 	++clnum;
6514 	ccol = 0;
6515 	if (got_int)
6516 	    return RA_FAIL;
6517     }
6518 
6519     /* found a match!  Note that regline may now point to a copy of the line,
6520      * that should not matter. */
6521     return RA_MATCH;
6522 }
6523 
6524 #ifdef BT_REGEXP_DUMP
6525 
6526 /*
6527  * regdump - dump a regexp onto stdout in vaguely comprehensible form
6528  */
6529     static void
6530 regdump(char_u *pattern, bt_regprog_T *r)
6531 {
6532     char_u  *s;
6533     int	    op = EXACTLY;	/* Arbitrary non-END op. */
6534     char_u  *next;
6535     char_u  *end = NULL;
6536     FILE    *f;
6537 
6538 #ifdef BT_REGEXP_LOG
6539     f = fopen("bt_regexp_log.log", "a");
6540 #else
6541     f = stdout;
6542 #endif
6543     if (f == NULL)
6544 	return;
6545     fprintf(f, "-------------------------------------\n\r\nregcomp(%s):\r\n", pattern);
6546 
6547     s = r->program + 1;
6548     /*
6549      * Loop until we find the END that isn't before a referred next (an END
6550      * can also appear in a NOMATCH operand).
6551      */
6552     while (op != END || s <= end)
6553     {
6554 	op = OP(s);
6555 	fprintf(f, "%2d%s", (int)(s - r->program), regprop(s)); /* Where, what. */
6556 	next = regnext(s);
6557 	if (next == NULL)	/* Next ptr. */
6558 	    fprintf(f, "(0)");
6559 	else
6560 	    fprintf(f, "(%d)", (int)((s - r->program) + (next - s)));
6561 	if (end < next)
6562 	    end = next;
6563 	if (op == BRACE_LIMITS)
6564 	{
6565 	    /* Two ints */
6566 	    fprintf(f, " minval %ld, maxval %ld", OPERAND_MIN(s), OPERAND_MAX(s));
6567 	    s += 8;
6568 	}
6569 	else if (op == BEHIND || op == NOBEHIND)
6570 	{
6571 	    /* one int */
6572 	    fprintf(f, " count %ld", OPERAND_MIN(s));
6573 	    s += 4;
6574 	}
6575 	else if (op == RE_LNUM || op == RE_COL || op == RE_VCOL)
6576 	{
6577 	    /* one int plus comperator */
6578 	    fprintf(f, " count %ld", OPERAND_MIN(s));
6579 	    s += 5;
6580 	}
6581 	s += 3;
6582 	if (op == ANYOF || op == ANYOF + ADD_NL
6583 		|| op == ANYBUT || op == ANYBUT + ADD_NL
6584 		|| op == EXACTLY)
6585 	{
6586 	    /* Literal string, where present. */
6587 	    fprintf(f, "\nxxxxxxxxx\n");
6588 	    while (*s != NUL)
6589 		fprintf(f, "%c", *s++);
6590 	    fprintf(f, "\nxxxxxxxxx\n");
6591 	    s++;
6592 	}
6593 	fprintf(f, "\r\n");
6594     }
6595 
6596     /* Header fields of interest. */
6597     if (r->regstart != NUL)
6598 	fprintf(f, "start `%s' 0x%x; ", r->regstart < 256
6599 		? (char *)transchar(r->regstart)
6600 		: "multibyte", r->regstart);
6601     if (r->reganch)
6602 	fprintf(f, "anchored; ");
6603     if (r->regmust != NULL)
6604 	fprintf(f, "must have \"%s\"", r->regmust);
6605     fprintf(f, "\r\n");
6606 
6607 #ifdef BT_REGEXP_LOG
6608     fclose(f);
6609 #endif
6610 }
6611 #endif	    /* BT_REGEXP_DUMP */
6612 
6613 #ifdef DEBUG
6614 /*
6615  * regprop - printable representation of opcode
6616  */
6617     static char_u *
6618 regprop(char_u *op)
6619 {
6620     char	    *p;
6621     static char	    buf[50];
6622 
6623     STRCPY(buf, ":");
6624 
6625     switch ((int) OP(op))
6626     {
6627       case BOL:
6628 	p = "BOL";
6629 	break;
6630       case EOL:
6631 	p = "EOL";
6632 	break;
6633       case RE_BOF:
6634 	p = "BOF";
6635 	break;
6636       case RE_EOF:
6637 	p = "EOF";
6638 	break;
6639       case CURSOR:
6640 	p = "CURSOR";
6641 	break;
6642       case RE_VISUAL:
6643 	p = "RE_VISUAL";
6644 	break;
6645       case RE_LNUM:
6646 	p = "RE_LNUM";
6647 	break;
6648       case RE_MARK:
6649 	p = "RE_MARK";
6650 	break;
6651       case RE_COL:
6652 	p = "RE_COL";
6653 	break;
6654       case RE_VCOL:
6655 	p = "RE_VCOL";
6656 	break;
6657       case BOW:
6658 	p = "BOW";
6659 	break;
6660       case EOW:
6661 	p = "EOW";
6662 	break;
6663       case ANY:
6664 	p = "ANY";
6665 	break;
6666       case ANY + ADD_NL:
6667 	p = "ANY+NL";
6668 	break;
6669       case ANYOF:
6670 	p = "ANYOF";
6671 	break;
6672       case ANYOF + ADD_NL:
6673 	p = "ANYOF+NL";
6674 	break;
6675       case ANYBUT:
6676 	p = "ANYBUT";
6677 	break;
6678       case ANYBUT + ADD_NL:
6679 	p = "ANYBUT+NL";
6680 	break;
6681       case IDENT:
6682 	p = "IDENT";
6683 	break;
6684       case IDENT + ADD_NL:
6685 	p = "IDENT+NL";
6686 	break;
6687       case SIDENT:
6688 	p = "SIDENT";
6689 	break;
6690       case SIDENT + ADD_NL:
6691 	p = "SIDENT+NL";
6692 	break;
6693       case KWORD:
6694 	p = "KWORD";
6695 	break;
6696       case KWORD + ADD_NL:
6697 	p = "KWORD+NL";
6698 	break;
6699       case SKWORD:
6700 	p = "SKWORD";
6701 	break;
6702       case SKWORD + ADD_NL:
6703 	p = "SKWORD+NL";
6704 	break;
6705       case FNAME:
6706 	p = "FNAME";
6707 	break;
6708       case FNAME + ADD_NL:
6709 	p = "FNAME+NL";
6710 	break;
6711       case SFNAME:
6712 	p = "SFNAME";
6713 	break;
6714       case SFNAME + ADD_NL:
6715 	p = "SFNAME+NL";
6716 	break;
6717       case PRINT:
6718 	p = "PRINT";
6719 	break;
6720       case PRINT + ADD_NL:
6721 	p = "PRINT+NL";
6722 	break;
6723       case SPRINT:
6724 	p = "SPRINT";
6725 	break;
6726       case SPRINT + ADD_NL:
6727 	p = "SPRINT+NL";
6728 	break;
6729       case WHITE:
6730 	p = "WHITE";
6731 	break;
6732       case WHITE + ADD_NL:
6733 	p = "WHITE+NL";
6734 	break;
6735       case NWHITE:
6736 	p = "NWHITE";
6737 	break;
6738       case NWHITE + ADD_NL:
6739 	p = "NWHITE+NL";
6740 	break;
6741       case DIGIT:
6742 	p = "DIGIT";
6743 	break;
6744       case DIGIT + ADD_NL:
6745 	p = "DIGIT+NL";
6746 	break;
6747       case NDIGIT:
6748 	p = "NDIGIT";
6749 	break;
6750       case NDIGIT + ADD_NL:
6751 	p = "NDIGIT+NL";
6752 	break;
6753       case HEX:
6754 	p = "HEX";
6755 	break;
6756       case HEX + ADD_NL:
6757 	p = "HEX+NL";
6758 	break;
6759       case NHEX:
6760 	p = "NHEX";
6761 	break;
6762       case NHEX + ADD_NL:
6763 	p = "NHEX+NL";
6764 	break;
6765       case OCTAL:
6766 	p = "OCTAL";
6767 	break;
6768       case OCTAL + ADD_NL:
6769 	p = "OCTAL+NL";
6770 	break;
6771       case NOCTAL:
6772 	p = "NOCTAL";
6773 	break;
6774       case NOCTAL + ADD_NL:
6775 	p = "NOCTAL+NL";
6776 	break;
6777       case WORD:
6778 	p = "WORD";
6779 	break;
6780       case WORD + ADD_NL:
6781 	p = "WORD+NL";
6782 	break;
6783       case NWORD:
6784 	p = "NWORD";
6785 	break;
6786       case NWORD + ADD_NL:
6787 	p = "NWORD+NL";
6788 	break;
6789       case HEAD:
6790 	p = "HEAD";
6791 	break;
6792       case HEAD + ADD_NL:
6793 	p = "HEAD+NL";
6794 	break;
6795       case NHEAD:
6796 	p = "NHEAD";
6797 	break;
6798       case NHEAD + ADD_NL:
6799 	p = "NHEAD+NL";
6800 	break;
6801       case ALPHA:
6802 	p = "ALPHA";
6803 	break;
6804       case ALPHA + ADD_NL:
6805 	p = "ALPHA+NL";
6806 	break;
6807       case NALPHA:
6808 	p = "NALPHA";
6809 	break;
6810       case NALPHA + ADD_NL:
6811 	p = "NALPHA+NL";
6812 	break;
6813       case LOWER:
6814 	p = "LOWER";
6815 	break;
6816       case LOWER + ADD_NL:
6817 	p = "LOWER+NL";
6818 	break;
6819       case NLOWER:
6820 	p = "NLOWER";
6821 	break;
6822       case NLOWER + ADD_NL:
6823 	p = "NLOWER+NL";
6824 	break;
6825       case UPPER:
6826 	p = "UPPER";
6827 	break;
6828       case UPPER + ADD_NL:
6829 	p = "UPPER+NL";
6830 	break;
6831       case NUPPER:
6832 	p = "NUPPER";
6833 	break;
6834       case NUPPER + ADD_NL:
6835 	p = "NUPPER+NL";
6836 	break;
6837       case BRANCH:
6838 	p = "BRANCH";
6839 	break;
6840       case EXACTLY:
6841 	p = "EXACTLY";
6842 	break;
6843       case NOTHING:
6844 	p = "NOTHING";
6845 	break;
6846       case BACK:
6847 	p = "BACK";
6848 	break;
6849       case END:
6850 	p = "END";
6851 	break;
6852       case MOPEN + 0:
6853 	p = "MATCH START";
6854 	break;
6855       case MOPEN + 1:
6856       case MOPEN + 2:
6857       case MOPEN + 3:
6858       case MOPEN + 4:
6859       case MOPEN + 5:
6860       case MOPEN + 6:
6861       case MOPEN + 7:
6862       case MOPEN + 8:
6863       case MOPEN + 9:
6864 	sprintf(buf + STRLEN(buf), "MOPEN%d", OP(op) - MOPEN);
6865 	p = NULL;
6866 	break;
6867       case MCLOSE + 0:
6868 	p = "MATCH END";
6869 	break;
6870       case MCLOSE + 1:
6871       case MCLOSE + 2:
6872       case MCLOSE + 3:
6873       case MCLOSE + 4:
6874       case MCLOSE + 5:
6875       case MCLOSE + 6:
6876       case MCLOSE + 7:
6877       case MCLOSE + 8:
6878       case MCLOSE + 9:
6879 	sprintf(buf + STRLEN(buf), "MCLOSE%d", OP(op) - MCLOSE);
6880 	p = NULL;
6881 	break;
6882       case BACKREF + 1:
6883       case BACKREF + 2:
6884       case BACKREF + 3:
6885       case BACKREF + 4:
6886       case BACKREF + 5:
6887       case BACKREF + 6:
6888       case BACKREF + 7:
6889       case BACKREF + 8:
6890       case BACKREF + 9:
6891 	sprintf(buf + STRLEN(buf), "BACKREF%d", OP(op) - BACKREF);
6892 	p = NULL;
6893 	break;
6894       case NOPEN:
6895 	p = "NOPEN";
6896 	break;
6897       case NCLOSE:
6898 	p = "NCLOSE";
6899 	break;
6900 #ifdef FEAT_SYN_HL
6901       case ZOPEN + 1:
6902       case ZOPEN + 2:
6903       case ZOPEN + 3:
6904       case ZOPEN + 4:
6905       case ZOPEN + 5:
6906       case ZOPEN + 6:
6907       case ZOPEN + 7:
6908       case ZOPEN + 8:
6909       case ZOPEN + 9:
6910 	sprintf(buf + STRLEN(buf), "ZOPEN%d", OP(op) - ZOPEN);
6911 	p = NULL;
6912 	break;
6913       case ZCLOSE + 1:
6914       case ZCLOSE + 2:
6915       case ZCLOSE + 3:
6916       case ZCLOSE + 4:
6917       case ZCLOSE + 5:
6918       case ZCLOSE + 6:
6919       case ZCLOSE + 7:
6920       case ZCLOSE + 8:
6921       case ZCLOSE + 9:
6922 	sprintf(buf + STRLEN(buf), "ZCLOSE%d", OP(op) - ZCLOSE);
6923 	p = NULL;
6924 	break;
6925       case ZREF + 1:
6926       case ZREF + 2:
6927       case ZREF + 3:
6928       case ZREF + 4:
6929       case ZREF + 5:
6930       case ZREF + 6:
6931       case ZREF + 7:
6932       case ZREF + 8:
6933       case ZREF + 9:
6934 	sprintf(buf + STRLEN(buf), "ZREF%d", OP(op) - ZREF);
6935 	p = NULL;
6936 	break;
6937 #endif
6938       case STAR:
6939 	p = "STAR";
6940 	break;
6941       case PLUS:
6942 	p = "PLUS";
6943 	break;
6944       case NOMATCH:
6945 	p = "NOMATCH";
6946 	break;
6947       case MATCH:
6948 	p = "MATCH";
6949 	break;
6950       case BEHIND:
6951 	p = "BEHIND";
6952 	break;
6953       case NOBEHIND:
6954 	p = "NOBEHIND";
6955 	break;
6956       case SUBPAT:
6957 	p = "SUBPAT";
6958 	break;
6959       case BRACE_LIMITS:
6960 	p = "BRACE_LIMITS";
6961 	break;
6962       case BRACE_SIMPLE:
6963 	p = "BRACE_SIMPLE";
6964 	break;
6965       case BRACE_COMPLEX + 0:
6966       case BRACE_COMPLEX + 1:
6967       case BRACE_COMPLEX + 2:
6968       case BRACE_COMPLEX + 3:
6969       case BRACE_COMPLEX + 4:
6970       case BRACE_COMPLEX + 5:
6971       case BRACE_COMPLEX + 6:
6972       case BRACE_COMPLEX + 7:
6973       case BRACE_COMPLEX + 8:
6974       case BRACE_COMPLEX + 9:
6975 	sprintf(buf + STRLEN(buf), "BRACE_COMPLEX%d", OP(op) - BRACE_COMPLEX);
6976 	p = NULL;
6977 	break;
6978 #ifdef FEAT_MBYTE
6979       case MULTIBYTECODE:
6980 	p = "MULTIBYTECODE";
6981 	break;
6982 #endif
6983       case NEWL:
6984 	p = "NEWL";
6985 	break;
6986       default:
6987 	sprintf(buf + STRLEN(buf), "corrupt %d", OP(op));
6988 	p = NULL;
6989 	break;
6990     }
6991     if (p != NULL)
6992 	STRCAT(buf, p);
6993     return (char_u *)buf;
6994 }
6995 #endif	    /* DEBUG */
6996 
6997 /*
6998  * Used in a place where no * or \+ can follow.
6999  */
7000     static int
7001 re_mult_next(char *what)
7002 {
7003     if (re_multi_type(peekchr()) == MULTI_MULT)
7004 	EMSG2_RET_FAIL(_("E888: (NFA regexp) cannot repeat %s"), what);
7005     return OK;
7006 }
7007 
7008 #ifdef FEAT_MBYTE
7009 static void mb_decompose(int c, int *c1, int *c2, int *c3);
7010 
7011 typedef struct
7012 {
7013     int a, b, c;
7014 } decomp_T;
7015 
7016 
7017 /* 0xfb20 - 0xfb4f */
7018 static decomp_T decomp_table[0xfb4f-0xfb20+1] =
7019 {
7020     {0x5e2,0,0},		/* 0xfb20	alt ayin */
7021     {0x5d0,0,0},		/* 0xfb21	alt alef */
7022     {0x5d3,0,0},		/* 0xfb22	alt dalet */
7023     {0x5d4,0,0},		/* 0xfb23	alt he */
7024     {0x5db,0,0},		/* 0xfb24	alt kaf */
7025     {0x5dc,0,0},		/* 0xfb25	alt lamed */
7026     {0x5dd,0,0},		/* 0xfb26	alt mem-sofit */
7027     {0x5e8,0,0},		/* 0xfb27	alt resh */
7028     {0x5ea,0,0},		/* 0xfb28	alt tav */
7029     {'+', 0, 0},		/* 0xfb29	alt plus */
7030     {0x5e9, 0x5c1, 0},		/* 0xfb2a	shin+shin-dot */
7031     {0x5e9, 0x5c2, 0},		/* 0xfb2b	shin+sin-dot */
7032     {0x5e9, 0x5c1, 0x5bc},	/* 0xfb2c	shin+shin-dot+dagesh */
7033     {0x5e9, 0x5c2, 0x5bc},	/* 0xfb2d	shin+sin-dot+dagesh */
7034     {0x5d0, 0x5b7, 0},		/* 0xfb2e	alef+patah */
7035     {0x5d0, 0x5b8, 0},		/* 0xfb2f	alef+qamats */
7036     {0x5d0, 0x5b4, 0},		/* 0xfb30	alef+hiriq */
7037     {0x5d1, 0x5bc, 0},		/* 0xfb31	bet+dagesh */
7038     {0x5d2, 0x5bc, 0},		/* 0xfb32	gimel+dagesh */
7039     {0x5d3, 0x5bc, 0},		/* 0xfb33	dalet+dagesh */
7040     {0x5d4, 0x5bc, 0},		/* 0xfb34	he+dagesh */
7041     {0x5d5, 0x5bc, 0},		/* 0xfb35	vav+dagesh */
7042     {0x5d6, 0x5bc, 0},		/* 0xfb36	zayin+dagesh */
7043     {0xfb37, 0, 0},		/* 0xfb37 -- UNUSED */
7044     {0x5d8, 0x5bc, 0},		/* 0xfb38	tet+dagesh */
7045     {0x5d9, 0x5bc, 0},		/* 0xfb39	yud+dagesh */
7046     {0x5da, 0x5bc, 0},		/* 0xfb3a	kaf sofit+dagesh */
7047     {0x5db, 0x5bc, 0},		/* 0xfb3b	kaf+dagesh */
7048     {0x5dc, 0x5bc, 0},		/* 0xfb3c	lamed+dagesh */
7049     {0xfb3d, 0, 0},		/* 0xfb3d -- UNUSED */
7050     {0x5de, 0x5bc, 0},		/* 0xfb3e	mem+dagesh */
7051     {0xfb3f, 0, 0},		/* 0xfb3f -- UNUSED */
7052     {0x5e0, 0x5bc, 0},		/* 0xfb40	nun+dagesh */
7053     {0x5e1, 0x5bc, 0},		/* 0xfb41	samech+dagesh */
7054     {0xfb42, 0, 0},		/* 0xfb42 -- UNUSED */
7055     {0x5e3, 0x5bc, 0},		/* 0xfb43	pe sofit+dagesh */
7056     {0x5e4, 0x5bc,0},		/* 0xfb44	pe+dagesh */
7057     {0xfb45, 0, 0},		/* 0xfb45 -- UNUSED */
7058     {0x5e6, 0x5bc, 0},		/* 0xfb46	tsadi+dagesh */
7059     {0x5e7, 0x5bc, 0},		/* 0xfb47	qof+dagesh */
7060     {0x5e8, 0x5bc, 0},		/* 0xfb48	resh+dagesh */
7061     {0x5e9, 0x5bc, 0},		/* 0xfb49	shin+dagesh */
7062     {0x5ea, 0x5bc, 0},		/* 0xfb4a	tav+dagesh */
7063     {0x5d5, 0x5b9, 0},		/* 0xfb4b	vav+holam */
7064     {0x5d1, 0x5bf, 0},		/* 0xfb4c	bet+rafe */
7065     {0x5db, 0x5bf, 0},		/* 0xfb4d	kaf+rafe */
7066     {0x5e4, 0x5bf, 0},		/* 0xfb4e	pe+rafe */
7067     {0x5d0, 0x5dc, 0}		/* 0xfb4f	alef-lamed */
7068 };
7069 
7070     static void
7071 mb_decompose(int c, int *c1, int *c2, int *c3)
7072 {
7073     decomp_T d;
7074 
7075     if (c >= 0xfb20 && c <= 0xfb4f)
7076     {
7077 	d = decomp_table[c - 0xfb20];
7078 	*c1 = d.a;
7079 	*c2 = d.b;
7080 	*c3 = d.c;
7081     }
7082     else
7083     {
7084 	*c1 = c;
7085 	*c2 = *c3 = 0;
7086     }
7087 }
7088 #endif
7089 
7090 /*
7091  * Compare two strings, ignore case if rex.reg_ic set.
7092  * Return 0 if strings match, non-zero otherwise.
7093  * Correct the length "*n" when composing characters are ignored.
7094  */
7095     static int
7096 cstrncmp(char_u *s1, char_u *s2, int *n)
7097 {
7098     int		result;
7099 
7100     if (!rex.reg_ic)
7101 	result = STRNCMP(s1, s2, *n);
7102     else
7103 	result = MB_STRNICMP(s1, s2, *n);
7104 
7105 #ifdef FEAT_MBYTE
7106     /* if it failed and it's utf8 and we want to combineignore: */
7107     if (result != 0 && enc_utf8 && rex.reg_icombine)
7108     {
7109 	char_u	*str1, *str2;
7110 	int	c1, c2, c11, c12;
7111 	int	junk;
7112 
7113 	/* we have to handle the strcmp ourselves, since it is necessary to
7114 	 * deal with the composing characters by ignoring them: */
7115 	str1 = s1;
7116 	str2 = s2;
7117 	c1 = c2 = 0;
7118 	while ((int)(str1 - s1) < *n)
7119 	{
7120 	    c1 = mb_ptr2char_adv(&str1);
7121 	    c2 = mb_ptr2char_adv(&str2);
7122 
7123 	    /* decompose the character if necessary, into 'base' characters
7124 	     * because I don't care about Arabic, I will hard-code the Hebrew
7125 	     * which I *do* care about!  So sue me... */
7126 	    if (c1 != c2 && (!rex.reg_ic || utf_fold(c1) != utf_fold(c2)))
7127 	    {
7128 		/* decomposition necessary? */
7129 		mb_decompose(c1, &c11, &junk, &junk);
7130 		mb_decompose(c2, &c12, &junk, &junk);
7131 		c1 = c11;
7132 		c2 = c12;
7133 		if (c11 != c12
7134 			    && (!rex.reg_ic || utf_fold(c11) != utf_fold(c12)))
7135 		    break;
7136 	    }
7137 	}
7138 	result = c2 - c1;
7139 	if (result == 0)
7140 	    *n = (int)(str2 - s2);
7141     }
7142 #endif
7143 
7144     return result;
7145 }
7146 
7147 /*
7148  * cstrchr: This function is used a lot for simple searches, keep it fast!
7149  */
7150     static char_u *
7151 cstrchr(char_u *s, int c)
7152 {
7153     char_u	*p;
7154     int		cc;
7155 
7156     if (!rex.reg_ic
7157 #ifdef FEAT_MBYTE
7158 	    || (!enc_utf8 && mb_char2len(c) > 1)
7159 #endif
7160 	    )
7161 	return vim_strchr(s, c);
7162 
7163     /* tolower() and toupper() can be slow, comparing twice should be a lot
7164      * faster (esp. when using MS Visual C++!).
7165      * For UTF-8 need to use folded case. */
7166 #ifdef FEAT_MBYTE
7167     if (enc_utf8 && c > 0x80)
7168 	cc = utf_fold(c);
7169     else
7170 #endif
7171 	 if (MB_ISUPPER(c))
7172 	cc = MB_TOLOWER(c);
7173     else if (MB_ISLOWER(c))
7174 	cc = MB_TOUPPER(c);
7175     else
7176 	return vim_strchr(s, c);
7177 
7178 #ifdef FEAT_MBYTE
7179     if (has_mbyte)
7180     {
7181 	for (p = s; *p != NUL; p += (*mb_ptr2len)(p))
7182 	{
7183 	    if (enc_utf8 && c > 0x80)
7184 	    {
7185 		if (utf_fold(utf_ptr2char(p)) == cc)
7186 		    return p;
7187 	    }
7188 	    else if (*p == c || *p == cc)
7189 		return p;
7190 	}
7191     }
7192     else
7193 #endif
7194 	/* Faster version for when there are no multi-byte characters. */
7195 	for (p = s; *p != NUL; ++p)
7196 	    if (*p == c || *p == cc)
7197 		return p;
7198 
7199     return NULL;
7200 }
7201 
7202 /***************************************************************
7203  *		      regsub stuff			       *
7204  ***************************************************************/
7205 
7206 /*
7207  * We should define ftpr as a pointer to a function returning a pointer to
7208  * a function returning a pointer to a function ...
7209  * This is impossible, so we declare a pointer to a function returning a
7210  * pointer to a function returning void. This should work for all compilers.
7211  */
7212 typedef void (*(*fptr_T)(int *, int))();
7213 
7214 static fptr_T do_upper(int *, int);
7215 static fptr_T do_Upper(int *, int);
7216 static fptr_T do_lower(int *, int);
7217 static fptr_T do_Lower(int *, int);
7218 
7219 static int vim_regsub_both(char_u *source, typval_T *expr, char_u *dest, int copy, int magic, int backslash);
7220 
7221     static fptr_T
7222 do_upper(int *d, int c)
7223 {
7224     *d = MB_TOUPPER(c);
7225 
7226     return (fptr_T)NULL;
7227 }
7228 
7229     static fptr_T
7230 do_Upper(int *d, int c)
7231 {
7232     *d = MB_TOUPPER(c);
7233 
7234     return (fptr_T)do_Upper;
7235 }
7236 
7237     static fptr_T
7238 do_lower(int *d, int c)
7239 {
7240     *d = MB_TOLOWER(c);
7241 
7242     return (fptr_T)NULL;
7243 }
7244 
7245     static fptr_T
7246 do_Lower(int *d, int c)
7247 {
7248     *d = MB_TOLOWER(c);
7249 
7250     return (fptr_T)do_Lower;
7251 }
7252 
7253 /*
7254  * regtilde(): Replace tildes in the pattern by the old pattern.
7255  *
7256  * Short explanation of the tilde: It stands for the previous replacement
7257  * pattern.  If that previous pattern also contains a ~ we should go back a
7258  * step further...  But we insert the previous pattern into the current one
7259  * and remember that.
7260  * This still does not handle the case where "magic" changes.  So require the
7261  * user to keep his hands off of "magic".
7262  *
7263  * The tildes are parsed once before the first call to vim_regsub().
7264  */
7265     char_u *
7266 regtilde(char_u *source, int magic)
7267 {
7268     char_u	*newsub = source;
7269     char_u	*tmpsub;
7270     char_u	*p;
7271     int		len;
7272     int		prevlen;
7273 
7274     for (p = newsub; *p; ++p)
7275     {
7276 	if ((*p == '~' && magic) || (*p == '\\' && *(p + 1) == '~' && !magic))
7277 	{
7278 	    if (reg_prev_sub != NULL)
7279 	    {
7280 		/* length = len(newsub) - 1 + len(prev_sub) + 1 */
7281 		prevlen = (int)STRLEN(reg_prev_sub);
7282 		tmpsub = alloc((unsigned)(STRLEN(newsub) + prevlen));
7283 		if (tmpsub != NULL)
7284 		{
7285 		    /* copy prefix */
7286 		    len = (int)(p - newsub);	/* not including ~ */
7287 		    mch_memmove(tmpsub, newsub, (size_t)len);
7288 		    /* interpret tilde */
7289 		    mch_memmove(tmpsub + len, reg_prev_sub, (size_t)prevlen);
7290 		    /* copy postfix */
7291 		    if (!magic)
7292 			++p;			/* back off \ */
7293 		    STRCPY(tmpsub + len + prevlen, p + 1);
7294 
7295 		    if (newsub != source)	/* already allocated newsub */
7296 			vim_free(newsub);
7297 		    newsub = tmpsub;
7298 		    p = newsub + len + prevlen;
7299 		}
7300 	    }
7301 	    else if (magic)
7302 		STRMOVE(p, p + 1);	/* remove '~' */
7303 	    else
7304 		STRMOVE(p, p + 2);	/* remove '\~' */
7305 	    --p;
7306 	}
7307 	else
7308 	{
7309 	    if (*p == '\\' && p[1])		/* skip escaped characters */
7310 		++p;
7311 #ifdef FEAT_MBYTE
7312 	    if (has_mbyte)
7313 		p += (*mb_ptr2len)(p) - 1;
7314 #endif
7315 	}
7316     }
7317 
7318     vim_free(reg_prev_sub);
7319     if (newsub != source)	/* newsub was allocated, just keep it */
7320 	reg_prev_sub = newsub;
7321     else			/* no ~ found, need to save newsub  */
7322 	reg_prev_sub = vim_strsave(newsub);
7323     return newsub;
7324 }
7325 
7326 #ifdef FEAT_EVAL
7327 static int can_f_submatch = FALSE;	/* TRUE when submatch() can be used */
7328 
7329 /* These pointers are used for reg_submatch().  Needed for when the
7330  * substitution string is an expression that contains a call to substitute()
7331  * and submatch(). */
7332 typedef struct {
7333     regmatch_T	*sm_match;
7334     regmmatch_T	*sm_mmatch;
7335     linenr_T	sm_firstlnum;
7336     linenr_T	sm_maxline;
7337     int		sm_line_lbr;
7338 } regsubmatch_T;
7339 
7340 static regsubmatch_T rsm;  /* can only be used when can_f_submatch is TRUE */
7341 #endif
7342 
7343 #if defined(FEAT_MODIFY_FNAME) || defined(FEAT_EVAL) || defined(PROTO)
7344 
7345 /*
7346  * Put the submatches in "argv[0]" which is a list passed into call_func() by
7347  * vim_regsub_both().
7348  */
7349     static int
7350 fill_submatch_list(int argc UNUSED, typval_T *argv, int argcount)
7351 {
7352     listitem_T	*li;
7353     int		i;
7354     char_u	*s;
7355 
7356     if (argcount == 0)
7357 	/* called function doesn't take an argument */
7358 	return 0;
7359 
7360     /* Relies on sl_list to be the first item in staticList10_T. */
7361     init_static_list((staticList10_T *)(argv->vval.v_list));
7362 
7363     /* There are always 10 list items in staticList10_T. */
7364     li = argv->vval.v_list->lv_first;
7365     for (i = 0; i < 10; ++i)
7366     {
7367 	s = rsm.sm_match->startp[i];
7368 	if (s == NULL || rsm.sm_match->endp[i] == NULL)
7369 	    s = NULL;
7370 	else
7371 	    s = vim_strnsave(s, (int)(rsm.sm_match->endp[i] - s));
7372 	li->li_tv.v_type = VAR_STRING;
7373 	li->li_tv.vval.v_string = s;
7374 	li = li->li_next;
7375     }
7376     return 1;
7377 }
7378 
7379     static void
7380 clear_submatch_list(staticList10_T *sl)
7381 {
7382     int i;
7383 
7384     for (i = 0; i < 10; ++i)
7385 	vim_free(sl->sl_items[i].li_tv.vval.v_string);
7386 }
7387 
7388 /*
7389  * vim_regsub() - perform substitutions after a vim_regexec() or
7390  * vim_regexec_multi() match.
7391  *
7392  * If "copy" is TRUE really copy into "dest".
7393  * If "copy" is FALSE nothing is copied, this is just to find out the length
7394  * of the result.
7395  *
7396  * If "backslash" is TRUE, a backslash will be removed later, need to double
7397  * them to keep them, and insert a backslash before a CR to avoid it being
7398  * replaced with a line break later.
7399  *
7400  * Note: The matched text must not change between the call of
7401  * vim_regexec()/vim_regexec_multi() and vim_regsub()!  It would make the back
7402  * references invalid!
7403  *
7404  * Returns the size of the replacement, including terminating NUL.
7405  */
7406     int
7407 vim_regsub(
7408     regmatch_T	*rmp,
7409     char_u	*source,
7410     typval_T	*expr,
7411     char_u	*dest,
7412     int		copy,
7413     int		magic,
7414     int		backslash)
7415 {
7416     int		result;
7417     regexec_T	rex_save;
7418     int		rex_in_use_save = rex_in_use;
7419 
7420     if (rex_in_use)
7421 	/* Being called recursively, save the state. */
7422 	rex_save = rex;
7423     rex_in_use = TRUE;
7424 
7425     rex.reg_match = rmp;
7426     rex.reg_mmatch = NULL;
7427     rex.reg_maxline = 0;
7428     rex.reg_buf = curbuf;
7429     rex.reg_line_lbr = TRUE;
7430     result = vim_regsub_both(source, expr, dest, copy, magic, backslash);
7431 
7432     rex_in_use = rex_in_use_save;
7433     if (rex_in_use)
7434 	rex = rex_save;
7435 
7436     return result;
7437 }
7438 #endif
7439 
7440     int
7441 vim_regsub_multi(
7442     regmmatch_T	*rmp,
7443     linenr_T	lnum,
7444     char_u	*source,
7445     char_u	*dest,
7446     int		copy,
7447     int		magic,
7448     int		backslash)
7449 {
7450     int		result;
7451     regexec_T	rex_save;
7452     int		rex_in_use_save = rex_in_use;
7453 
7454     if (rex_in_use)
7455 	/* Being called recursively, save the state. */
7456 	rex_save = rex;
7457     rex_in_use = TRUE;
7458 
7459     rex.reg_match = NULL;
7460     rex.reg_mmatch = rmp;
7461     rex.reg_buf = curbuf;	/* always works on the current buffer! */
7462     rex.reg_firstlnum = lnum;
7463     rex.reg_maxline = curbuf->b_ml.ml_line_count - lnum;
7464     rex.reg_line_lbr = FALSE;
7465     result = vim_regsub_both(source, NULL, dest, copy, magic, backslash);
7466 
7467     rex_in_use = rex_in_use_save;
7468     if (rex_in_use)
7469 	rex = rex_save;
7470 
7471     return result;
7472 }
7473 
7474     static int
7475 vim_regsub_both(
7476     char_u	*source,
7477     typval_T	*expr,
7478     char_u	*dest,
7479     int		copy,
7480     int		magic,
7481     int		backslash)
7482 {
7483     char_u	*src;
7484     char_u	*dst;
7485     char_u	*s;
7486     int		c;
7487     int		cc;
7488     int		no = -1;
7489     fptr_T	func_all = (fptr_T)NULL;
7490     fptr_T	func_one = (fptr_T)NULL;
7491     linenr_T	clnum = 0;	/* init for GCC */
7492     int		len = 0;	/* init for GCC */
7493 #ifdef FEAT_EVAL
7494     static char_u   *eval_result = NULL;
7495 #endif
7496 
7497     /* Be paranoid... */
7498     if ((source == NULL && expr == NULL) || dest == NULL)
7499     {
7500 	EMSG(_(e_null));
7501 	return 0;
7502     }
7503     if (prog_magic_wrong())
7504 	return 0;
7505     src = source;
7506     dst = dest;
7507 
7508     /*
7509      * When the substitute part starts with "\=" evaluate it as an expression.
7510      */
7511     if (expr != NULL || (source[0] == '\\' && source[1] == '='))
7512     {
7513 #ifdef FEAT_EVAL
7514 	/* To make sure that the length doesn't change between checking the
7515 	 * length and copying the string, and to speed up things, the
7516 	 * resulting string is saved from the call with "copy" == FALSE to the
7517 	 * call with "copy" == TRUE. */
7518 	if (copy)
7519 	{
7520 	    if (eval_result != NULL)
7521 	    {
7522 		STRCPY(dest, eval_result);
7523 		dst += STRLEN(eval_result);
7524 		vim_free(eval_result);
7525 		eval_result = NULL;
7526 	    }
7527 	}
7528 	else
7529 	{
7530 	    int		    prev_can_f_submatch = can_f_submatch;
7531 	    regsubmatch_T   rsm_save;
7532 
7533 	    vim_free(eval_result);
7534 
7535 	    /* The expression may contain substitute(), which calls us
7536 	     * recursively.  Make sure submatch() gets the text from the first
7537 	     * level. */
7538 	    if (can_f_submatch)
7539 		rsm_save = rsm;
7540 	    can_f_submatch = TRUE;
7541 	    rsm.sm_match = rex.reg_match;
7542 	    rsm.sm_mmatch = rex.reg_mmatch;
7543 	    rsm.sm_firstlnum = rex.reg_firstlnum;
7544 	    rsm.sm_maxline = rex.reg_maxline;
7545 	    rsm.sm_line_lbr = rex.reg_line_lbr;
7546 
7547 	    if (expr != NULL)
7548 	    {
7549 		typval_T	argv[2];
7550 		int		dummy;
7551 		char_u		buf[NUMBUFLEN];
7552 		typval_T	rettv;
7553 		staticList10_T	matchList;
7554 
7555 		rettv.v_type = VAR_STRING;
7556 		rettv.vval.v_string = NULL;
7557 		argv[0].v_type = VAR_LIST;
7558 		argv[0].vval.v_list = &matchList.sl_list;
7559 		matchList.sl_list.lv_len = 0;
7560 		if (expr->v_type == VAR_FUNC)
7561 		{
7562 		    s = expr->vval.v_string;
7563 		    call_func(s, (int)STRLEN(s), &rettv,
7564 				    1, argv, fill_submatch_list,
7565 					 0L, 0L, &dummy, TRUE, NULL, NULL);
7566 		}
7567 		else if (expr->v_type == VAR_PARTIAL)
7568 		{
7569 		    partial_T   *partial = expr->vval.v_partial;
7570 
7571 		    s = partial_name(partial);
7572 		    call_func(s, (int)STRLEN(s), &rettv,
7573 				    1, argv, fill_submatch_list,
7574 				      0L, 0L, &dummy, TRUE, partial, NULL);
7575 		}
7576 		if (matchList.sl_list.lv_len > 0)
7577 		    /* fill_submatch_list() was called */
7578 		    clear_submatch_list(&matchList);
7579 
7580 		eval_result = get_tv_string_buf_chk(&rettv, buf);
7581 		if (eval_result != NULL)
7582 		    eval_result = vim_strsave(eval_result);
7583 		clear_tv(&rettv);
7584 	    }
7585 	    else
7586 		eval_result = eval_to_string(source + 2, NULL, TRUE);
7587 
7588 	    if (eval_result != NULL)
7589 	    {
7590 		int had_backslash = FALSE;
7591 
7592 		for (s = eval_result; *s != NUL; MB_PTR_ADV(s))
7593 		{
7594 		    /* Change NL to CR, so that it becomes a line break,
7595 		     * unless called from vim_regexec_nl().
7596 		     * Skip over a backslashed character. */
7597 		    if (*s == NL && !rsm.sm_line_lbr)
7598 			*s = CAR;
7599 		    else if (*s == '\\' && s[1] != NUL)
7600 		    {
7601 			++s;
7602 			/* Change NL to CR here too, so that this works:
7603 			 * :s/abc\\\ndef/\="aaa\\\nbbb"/  on text:
7604 			 *   abc\
7605 			 *   def
7606 			 * Not when called from vim_regexec_nl().
7607 			 */
7608 			if (*s == NL && !rsm.sm_line_lbr)
7609 			    *s = CAR;
7610 			had_backslash = TRUE;
7611 		    }
7612 		}
7613 		if (had_backslash && backslash)
7614 		{
7615 		    /* Backslashes will be consumed, need to double them. */
7616 		    s = vim_strsave_escaped(eval_result, (char_u *)"\\");
7617 		    if (s != NULL)
7618 		    {
7619 			vim_free(eval_result);
7620 			eval_result = s;
7621 		    }
7622 		}
7623 
7624 		dst += STRLEN(eval_result);
7625 	    }
7626 
7627 	    can_f_submatch = prev_can_f_submatch;
7628 	    if (can_f_submatch)
7629 		rsm = rsm_save;
7630 	}
7631 #endif
7632     }
7633     else
7634       while ((c = *src++) != NUL)
7635       {
7636 	if (c == '&' && magic)
7637 	    no = 0;
7638 	else if (c == '\\' && *src != NUL)
7639 	{
7640 	    if (*src == '&' && !magic)
7641 	    {
7642 		++src;
7643 		no = 0;
7644 	    }
7645 	    else if ('0' <= *src && *src <= '9')
7646 	    {
7647 		no = *src++ - '0';
7648 	    }
7649 	    else if (vim_strchr((char_u *)"uUlLeE", *src))
7650 	    {
7651 		switch (*src++)
7652 		{
7653 		case 'u':   func_one = (fptr_T)do_upper;
7654 			    continue;
7655 		case 'U':   func_all = (fptr_T)do_Upper;
7656 			    continue;
7657 		case 'l':   func_one = (fptr_T)do_lower;
7658 			    continue;
7659 		case 'L':   func_all = (fptr_T)do_Lower;
7660 			    continue;
7661 		case 'e':
7662 		case 'E':   func_one = func_all = (fptr_T)NULL;
7663 			    continue;
7664 		}
7665 	    }
7666 	}
7667 	if (no < 0)	      /* Ordinary character. */
7668 	{
7669 	    if (c == K_SPECIAL && src[0] != NUL && src[1] != NUL)
7670 	    {
7671 		/* Copy a special key as-is. */
7672 		if (copy)
7673 		{
7674 		    *dst++ = c;
7675 		    *dst++ = *src++;
7676 		    *dst++ = *src++;
7677 		}
7678 		else
7679 		{
7680 		    dst += 3;
7681 		    src += 2;
7682 		}
7683 		continue;
7684 	    }
7685 
7686 	    if (c == '\\' && *src != NUL)
7687 	    {
7688 		/* Check for abbreviations -- webb */
7689 		switch (*src)
7690 		{
7691 		    case 'r':	c = CAR;	++src;	break;
7692 		    case 'n':	c = NL;		++src;	break;
7693 		    case 't':	c = TAB;	++src;	break;
7694 		 /* Oh no!  \e already has meaning in subst pat :-( */
7695 		 /* case 'e':   c = ESC;	++src;	break; */
7696 		    case 'b':	c = Ctrl_H;	++src;	break;
7697 
7698 		    /* If "backslash" is TRUE the backslash will be removed
7699 		     * later.  Used to insert a literal CR. */
7700 		    default:	if (backslash)
7701 				{
7702 				    if (copy)
7703 					*dst = '\\';
7704 				    ++dst;
7705 				}
7706 				c = *src++;
7707 		}
7708 	    }
7709 #ifdef FEAT_MBYTE
7710 	    else if (has_mbyte)
7711 		c = mb_ptr2char(src - 1);
7712 #endif
7713 
7714 	    /* Write to buffer, if copy is set. */
7715 	    if (func_one != (fptr_T)NULL)
7716 		/* Turbo C complains without the typecast */
7717 		func_one = (fptr_T)(func_one(&cc, c));
7718 	    else if (func_all != (fptr_T)NULL)
7719 		/* Turbo C complains without the typecast */
7720 		func_all = (fptr_T)(func_all(&cc, c));
7721 	    else /* just copy */
7722 		cc = c;
7723 
7724 #ifdef FEAT_MBYTE
7725 	    if (has_mbyte)
7726 	    {
7727 		int totlen = mb_ptr2len(src - 1);
7728 
7729 		if (copy)
7730 		    mb_char2bytes(cc, dst);
7731 		dst += mb_char2len(cc) - 1;
7732 		if (enc_utf8)
7733 		{
7734 		    int clen = utf_ptr2len(src - 1);
7735 
7736 		    /* If the character length is shorter than "totlen", there
7737 		     * are composing characters; copy them as-is. */
7738 		    if (clen < totlen)
7739 		    {
7740 			if (copy)
7741 			    mch_memmove(dst + 1, src - 1 + clen,
7742 						     (size_t)(totlen - clen));
7743 			dst += totlen - clen;
7744 		    }
7745 		}
7746 		src += totlen - 1;
7747 	    }
7748 	    else
7749 #endif
7750 		if (copy)
7751 		    *dst = cc;
7752 	    dst++;
7753 	}
7754 	else
7755 	{
7756 	    if (REG_MULTI)
7757 	    {
7758 		clnum = rex.reg_mmatch->startpos[no].lnum;
7759 		if (clnum < 0 || rex.reg_mmatch->endpos[no].lnum < 0)
7760 		    s = NULL;
7761 		else
7762 		{
7763 		    s = reg_getline(clnum) + rex.reg_mmatch->startpos[no].col;
7764 		    if (rex.reg_mmatch->endpos[no].lnum == clnum)
7765 			len = rex.reg_mmatch->endpos[no].col
7766 					    - rex.reg_mmatch->startpos[no].col;
7767 		    else
7768 			len = (int)STRLEN(s);
7769 		}
7770 	    }
7771 	    else
7772 	    {
7773 		s = rex.reg_match->startp[no];
7774 		if (rex.reg_match->endp[no] == NULL)
7775 		    s = NULL;
7776 		else
7777 		    len = (int)(rex.reg_match->endp[no] - s);
7778 	    }
7779 	    if (s != NULL)
7780 	    {
7781 		for (;;)
7782 		{
7783 		    if (len == 0)
7784 		    {
7785 			if (REG_MULTI)
7786 			{
7787 			    if (rex.reg_mmatch->endpos[no].lnum == clnum)
7788 				break;
7789 			    if (copy)
7790 				*dst = CAR;
7791 			    ++dst;
7792 			    s = reg_getline(++clnum);
7793 			    if (rex.reg_mmatch->endpos[no].lnum == clnum)
7794 				len = rex.reg_mmatch->endpos[no].col;
7795 			    else
7796 				len = (int)STRLEN(s);
7797 			}
7798 			else
7799 			    break;
7800 		    }
7801 		    else if (*s == NUL) /* we hit NUL. */
7802 		    {
7803 			if (copy)
7804 			    EMSG(_(e_re_damg));
7805 			goto exit;
7806 		    }
7807 		    else
7808 		    {
7809 			if (backslash && (*s == CAR || *s == '\\'))
7810 			{
7811 			    /*
7812 			     * Insert a backslash in front of a CR, otherwise
7813 			     * it will be replaced by a line break.
7814 			     * Number of backslashes will be halved later,
7815 			     * double them here.
7816 			     */
7817 			    if (copy)
7818 			    {
7819 				dst[0] = '\\';
7820 				dst[1] = *s;
7821 			    }
7822 			    dst += 2;
7823 			}
7824 			else
7825 			{
7826 #ifdef FEAT_MBYTE
7827 			    if (has_mbyte)
7828 				c = mb_ptr2char(s);
7829 			    else
7830 #endif
7831 				c = *s;
7832 
7833 			    if (func_one != (fptr_T)NULL)
7834 				/* Turbo C complains without the typecast */
7835 				func_one = (fptr_T)(func_one(&cc, c));
7836 			    else if (func_all != (fptr_T)NULL)
7837 				/* Turbo C complains without the typecast */
7838 				func_all = (fptr_T)(func_all(&cc, c));
7839 			    else /* just copy */
7840 				cc = c;
7841 
7842 #ifdef FEAT_MBYTE
7843 			    if (has_mbyte)
7844 			    {
7845 				int l;
7846 
7847 				/* Copy composing characters separately, one
7848 				 * at a time. */
7849 				if (enc_utf8)
7850 				    l = utf_ptr2len(s) - 1;
7851 				else
7852 				    l = mb_ptr2len(s) - 1;
7853 
7854 				s += l;
7855 				len -= l;
7856 				if (copy)
7857 				    mb_char2bytes(cc, dst);
7858 				dst += mb_char2len(cc) - 1;
7859 			    }
7860 			    else
7861 #endif
7862 				if (copy)
7863 				    *dst = cc;
7864 			    dst++;
7865 			}
7866 
7867 			++s;
7868 			--len;
7869 		    }
7870 		}
7871 	    }
7872 	    no = -1;
7873 	}
7874       }
7875     if (copy)
7876 	*dst = NUL;
7877 
7878 exit:
7879     return (int)((dst - dest) + 1);
7880 }
7881 
7882 #ifdef FEAT_EVAL
7883 static char_u *reg_getline_submatch(linenr_T lnum);
7884 
7885 /*
7886  * Call reg_getline() with the line numbers from the submatch.  If a
7887  * substitute() was used the reg_maxline and other values have been
7888  * overwritten.
7889  */
7890     static char_u *
7891 reg_getline_submatch(linenr_T lnum)
7892 {
7893     char_u *s;
7894     linenr_T save_first = rex.reg_firstlnum;
7895     linenr_T save_max = rex.reg_maxline;
7896 
7897     rex.reg_firstlnum = rsm.sm_firstlnum;
7898     rex.reg_maxline = rsm.sm_maxline;
7899 
7900     s = reg_getline(lnum);
7901 
7902     rex.reg_firstlnum = save_first;
7903     rex.reg_maxline = save_max;
7904     return s;
7905 }
7906 
7907 /*
7908  * Used for the submatch() function: get the string from the n'th submatch in
7909  * allocated memory.
7910  * Returns NULL when not in a ":s" command and for a non-existing submatch.
7911  */
7912     char_u *
7913 reg_submatch(int no)
7914 {
7915     char_u	*retval = NULL;
7916     char_u	*s;
7917     int		len;
7918     int		round;
7919     linenr_T	lnum;
7920 
7921     if (!can_f_submatch || no < 0)
7922 	return NULL;
7923 
7924     if (rsm.sm_match == NULL)
7925     {
7926 	/*
7927 	 * First round: compute the length and allocate memory.
7928 	 * Second round: copy the text.
7929 	 */
7930 	for (round = 1; round <= 2; ++round)
7931 	{
7932 	    lnum = rsm.sm_mmatch->startpos[no].lnum;
7933 	    if (lnum < 0 || rsm.sm_mmatch->endpos[no].lnum < 0)
7934 		return NULL;
7935 
7936 	    s = reg_getline_submatch(lnum) + rsm.sm_mmatch->startpos[no].col;
7937 	    if (s == NULL)  /* anti-crash check, cannot happen? */
7938 		break;
7939 	    if (rsm.sm_mmatch->endpos[no].lnum == lnum)
7940 	    {
7941 		/* Within one line: take form start to end col. */
7942 		len = rsm.sm_mmatch->endpos[no].col
7943 					  - rsm.sm_mmatch->startpos[no].col;
7944 		if (round == 2)
7945 		    vim_strncpy(retval, s, len);
7946 		++len;
7947 	    }
7948 	    else
7949 	    {
7950 		/* Multiple lines: take start line from start col, middle
7951 		 * lines completely and end line up to end col. */
7952 		len = (int)STRLEN(s);
7953 		if (round == 2)
7954 		{
7955 		    STRCPY(retval, s);
7956 		    retval[len] = '\n';
7957 		}
7958 		++len;
7959 		++lnum;
7960 		while (lnum < rsm.sm_mmatch->endpos[no].lnum)
7961 		{
7962 		    s = reg_getline_submatch(lnum++);
7963 		    if (round == 2)
7964 			STRCPY(retval + len, s);
7965 		    len += (int)STRLEN(s);
7966 		    if (round == 2)
7967 			retval[len] = '\n';
7968 		    ++len;
7969 		}
7970 		if (round == 2)
7971 		    STRNCPY(retval + len, reg_getline_submatch(lnum),
7972 					     rsm.sm_mmatch->endpos[no].col);
7973 		len += rsm.sm_mmatch->endpos[no].col;
7974 		if (round == 2)
7975 		    retval[len] = NUL;
7976 		++len;
7977 	    }
7978 
7979 	    if (retval == NULL)
7980 	    {
7981 		retval = lalloc((long_u)len, TRUE);
7982 		if (retval == NULL)
7983 		    return NULL;
7984 	    }
7985 	}
7986     }
7987     else
7988     {
7989 	s = rsm.sm_match->startp[no];
7990 	if (s == NULL || rsm.sm_match->endp[no] == NULL)
7991 	    retval = NULL;
7992 	else
7993 	    retval = vim_strnsave(s, (int)(rsm.sm_match->endp[no] - s));
7994     }
7995 
7996     return retval;
7997 }
7998 
7999 /*
8000  * Used for the submatch() function with the optional non-zero argument: get
8001  * the list of strings from the n'th submatch in allocated memory with NULs
8002  * represented in NLs.
8003  * Returns a list of allocated strings.  Returns NULL when not in a ":s"
8004  * command, for a non-existing submatch and for any error.
8005  */
8006     list_T *
8007 reg_submatch_list(int no)
8008 {
8009     char_u	*s;
8010     linenr_T	slnum;
8011     linenr_T	elnum;
8012     colnr_T	scol;
8013     colnr_T	ecol;
8014     int		i;
8015     list_T	*list;
8016     int		error = FALSE;
8017 
8018     if (!can_f_submatch || no < 0)
8019 	return NULL;
8020 
8021     if (rsm.sm_match == NULL)
8022     {
8023 	slnum = rsm.sm_mmatch->startpos[no].lnum;
8024 	elnum = rsm.sm_mmatch->endpos[no].lnum;
8025 	if (slnum < 0 || elnum < 0)
8026 	    return NULL;
8027 
8028 	scol = rsm.sm_mmatch->startpos[no].col;
8029 	ecol = rsm.sm_mmatch->endpos[no].col;
8030 
8031 	list = list_alloc();
8032 	if (list == NULL)
8033 	    return NULL;
8034 
8035 	s = reg_getline_submatch(slnum) + scol;
8036 	if (slnum == elnum)
8037 	{
8038 	    if (list_append_string(list, s, ecol - scol) == FAIL)
8039 		error = TRUE;
8040 	}
8041 	else
8042 	{
8043 	    if (list_append_string(list, s, -1) == FAIL)
8044 		error = TRUE;
8045 	    for (i = 1; i < elnum - slnum; i++)
8046 	    {
8047 		s = reg_getline_submatch(slnum + i);
8048 		if (list_append_string(list, s, -1) == FAIL)
8049 		    error = TRUE;
8050 	    }
8051 	    s = reg_getline_submatch(elnum);
8052 	    if (list_append_string(list, s, ecol) == FAIL)
8053 		error = TRUE;
8054 	}
8055     }
8056     else
8057     {
8058 	s = rsm.sm_match->startp[no];
8059 	if (s == NULL || rsm.sm_match->endp[no] == NULL)
8060 	    return NULL;
8061 	list = list_alloc();
8062 	if (list == NULL)
8063 	    return NULL;
8064 	if (list_append_string(list, s,
8065 				 (int)(rsm.sm_match->endp[no] - s)) == FAIL)
8066 	    error = TRUE;
8067     }
8068 
8069     if (error)
8070     {
8071 	list_free(list);
8072 	return NULL;
8073     }
8074     return list;
8075 }
8076 #endif
8077 
8078 static regengine_T bt_regengine =
8079 {
8080     bt_regcomp,
8081     bt_regfree,
8082     bt_regexec_nl,
8083     bt_regexec_multi,
8084     (char_u *)""
8085 };
8086 
8087 #include "regexp_nfa.c"
8088 
8089 static regengine_T nfa_regengine =
8090 {
8091     nfa_regcomp,
8092     nfa_regfree,
8093     nfa_regexec_nl,
8094     nfa_regexec_multi,
8095     (char_u *)""
8096 };
8097 
8098 /* Which regexp engine to use? Needed for vim_regcomp().
8099  * Must match with 'regexpengine'. */
8100 static int regexp_engine = 0;
8101 
8102 #ifdef DEBUG
8103 static char_u regname[][30] = {
8104 		    "AUTOMATIC Regexp Engine",
8105 		    "BACKTRACKING Regexp Engine",
8106 		    "NFA Regexp Engine"
8107 			    };
8108 #endif
8109 
8110 /*
8111  * Compile a regular expression into internal code.
8112  * Returns the program in allocated memory.
8113  * Use vim_regfree() to free the memory.
8114  * Returns NULL for an error.
8115  */
8116     regprog_T *
8117 vim_regcomp(char_u *expr_arg, int re_flags)
8118 {
8119     regprog_T   *prog = NULL;
8120     char_u	*expr = expr_arg;
8121 
8122     regexp_engine = p_re;
8123 
8124     /* Check for prefix "\%#=", that sets the regexp engine */
8125     if (STRNCMP(expr, "\\%#=", 4) == 0)
8126     {
8127 	int newengine = expr[4] - '0';
8128 
8129 	if (newengine == AUTOMATIC_ENGINE
8130 	    || newengine == BACKTRACKING_ENGINE
8131 	    || newengine == NFA_ENGINE)
8132 	{
8133 	    regexp_engine = expr[4] - '0';
8134 	    expr += 5;
8135 #ifdef DEBUG
8136 	    smsg((char_u *)"New regexp mode selected (%d): %s",
8137 					   regexp_engine, regname[newengine]);
8138 #endif
8139 	}
8140 	else
8141 	{
8142 	    EMSG(_("E864: \\%#= can only be followed by 0, 1, or 2. The automatic engine will be used "));
8143 	    regexp_engine = AUTOMATIC_ENGINE;
8144 	}
8145     }
8146     bt_regengine.expr = expr;
8147     nfa_regengine.expr = expr;
8148 
8149     /*
8150      * First try the NFA engine, unless backtracking was requested.
8151      */
8152     if (regexp_engine != BACKTRACKING_ENGINE)
8153         prog = nfa_regengine.regcomp(expr,
8154 		re_flags + (regexp_engine == AUTOMATIC_ENGINE ? RE_AUTO : 0));
8155     else
8156 	prog = bt_regengine.regcomp(expr, re_flags);
8157 
8158     /* Check for error compiling regexp with initial engine. */
8159     if (prog == NULL)
8160     {
8161 #ifdef BT_REGEXP_DEBUG_LOG
8162 	if (regexp_engine != BACKTRACKING_ENGINE)   /* debugging log for NFA */
8163 	{
8164 	    FILE *f;
8165 	    f = fopen(BT_REGEXP_DEBUG_LOG_NAME, "a");
8166 	    if (f)
8167 	    {
8168 		fprintf(f, "Syntax error in \"%s\"\n", expr);
8169 		fclose(f);
8170 	    }
8171 	    else
8172 		EMSG2("(NFA) Could not open \"%s\" to write !!!",
8173                         BT_REGEXP_DEBUG_LOG_NAME);
8174 	}
8175 #endif
8176 	/*
8177 	 * If the NFA engine failed, try the backtracking engine.
8178 	 * The NFA engine also fails for patterns that it can't handle well
8179 	 * but are still valid patterns, thus a retry should work.
8180 	 */
8181 	if (regexp_engine == AUTOMATIC_ENGINE)
8182 	{
8183 	    regexp_engine = BACKTRACKING_ENGINE;
8184 	    prog = bt_regengine.regcomp(expr, re_flags);
8185 	}
8186     }
8187 
8188     if (prog != NULL)
8189     {
8190 	/* Store the info needed to call regcomp() again when the engine turns
8191 	 * out to be very slow when executing it. */
8192 	prog->re_engine = regexp_engine;
8193 	prog->re_flags  = re_flags;
8194     }
8195 
8196     return prog;
8197 }
8198 
8199 /*
8200  * Free a compiled regexp program, returned by vim_regcomp().
8201  */
8202     void
8203 vim_regfree(regprog_T *prog)
8204 {
8205     if (prog != NULL)
8206 	prog->engine->regfree(prog);
8207 }
8208 
8209 #ifdef FEAT_EVAL
8210 static void report_re_switch(char_u *pat);
8211 
8212     static void
8213 report_re_switch(char_u *pat)
8214 {
8215     if (p_verbose > 0)
8216     {
8217 	verbose_enter();
8218 	MSG_PUTS(_("Switching to backtracking RE engine for pattern: "));
8219 	MSG_PUTS(pat);
8220 	verbose_leave();
8221     }
8222 }
8223 #endif
8224 
8225 /*
8226  * Match a regexp against a string.
8227  * "rmp->regprog" is a compiled regexp as returned by vim_regcomp().
8228  * Note: "rmp->regprog" may be freed and changed.
8229  * Uses curbuf for line count and 'iskeyword'.
8230  * When "nl" is TRUE consider a "\n" in "line" to be a line break.
8231  *
8232  * Return TRUE if there is a match, FALSE if not.
8233  */
8234     static int
8235 vim_regexec_string(
8236     regmatch_T	*rmp,
8237     char_u	*line,  /* string to match against */
8238     colnr_T	col,    /* column to start looking for match */
8239     int		nl)
8240 {
8241     int		result;
8242     regexec_T	rex_save;
8243     int		rex_in_use_save = rex_in_use;
8244 
8245     if (rex_in_use)
8246 	/* Being called recursively, save the state. */
8247 	rex_save = rex;
8248     rex_in_use = TRUE;
8249     rex.reg_startp = NULL;
8250     rex.reg_endp = NULL;
8251     rex.reg_startpos = NULL;
8252     rex.reg_endpos = NULL;
8253 
8254     result = rmp->regprog->engine->regexec_nl(rmp, line, col, nl);
8255 
8256     /* NFA engine aborted because it's very slow. */
8257     if (rmp->regprog->re_engine == AUTOMATIC_ENGINE
8258 					       && result == NFA_TOO_EXPENSIVE)
8259     {
8260 	int    save_p_re = p_re;
8261 	int    re_flags = rmp->regprog->re_flags;
8262 	char_u *pat = vim_strsave(((nfa_regprog_T *)rmp->regprog)->pattern);
8263 
8264 	p_re = BACKTRACKING_ENGINE;
8265 	vim_regfree(rmp->regprog);
8266 	if (pat != NULL)
8267 	{
8268 #ifdef FEAT_EVAL
8269 	    report_re_switch(pat);
8270 #endif
8271 	    rmp->regprog = vim_regcomp(pat, re_flags);
8272 	    if (rmp->regprog != NULL)
8273 		result = rmp->regprog->engine->regexec_nl(rmp, line, col, nl);
8274 	    vim_free(pat);
8275 	}
8276 
8277 	p_re = save_p_re;
8278     }
8279 
8280     rex_in_use = rex_in_use_save;
8281     if (rex_in_use)
8282 	rex = rex_save;
8283 
8284     return result > 0;
8285 }
8286 
8287 /*
8288  * Note: "*prog" may be freed and changed.
8289  * Return TRUE if there is a match, FALSE if not.
8290  */
8291     int
8292 vim_regexec_prog(
8293     regprog_T	**prog,
8294     int		ignore_case,
8295     char_u	*line,
8296     colnr_T	col)
8297 {
8298     int		r;
8299     regmatch_T	regmatch;
8300 
8301     regmatch.regprog = *prog;
8302     regmatch.rm_ic = ignore_case;
8303     r = vim_regexec_string(&regmatch, line, col, FALSE);
8304     *prog = regmatch.regprog;
8305     return r;
8306 }
8307 
8308 /*
8309  * Note: "rmp->regprog" may be freed and changed.
8310  * Return TRUE if there is a match, FALSE if not.
8311  */
8312     int
8313 vim_regexec(regmatch_T *rmp, char_u *line, colnr_T col)
8314 {
8315     return vim_regexec_string(rmp, line, col, FALSE);
8316 }
8317 
8318 #if defined(FEAT_MODIFY_FNAME) || defined(FEAT_EVAL) \
8319 	|| defined(FIND_REPLACE_DIALOG) || defined(PROTO)
8320 /*
8321  * Like vim_regexec(), but consider a "\n" in "line" to be a line break.
8322  * Note: "rmp->regprog" may be freed and changed.
8323  * Return TRUE if there is a match, FALSE if not.
8324  */
8325     int
8326 vim_regexec_nl(regmatch_T *rmp, char_u *line, colnr_T col)
8327 {
8328     return vim_regexec_string(rmp, line, col, TRUE);
8329 }
8330 #endif
8331 
8332 /*
8333  * Match a regexp against multiple lines.
8334  * "rmp->regprog" is a compiled regexp as returned by vim_regcomp().
8335  * Note: "rmp->regprog" may be freed and changed.
8336  * Uses curbuf for line count and 'iskeyword'.
8337  *
8338  * Return zero if there is no match.  Return number of lines contained in the
8339  * match otherwise.
8340  */
8341     long
8342 vim_regexec_multi(
8343     regmmatch_T *rmp,
8344     win_T       *win,           /* window in which to search or NULL */
8345     buf_T       *buf,           /* buffer in which to search */
8346     linenr_T    lnum,           /* nr of line to start looking for match */
8347     colnr_T     col,            /* column to start looking for match */
8348     proftime_T	*tm,		/* timeout limit or NULL */
8349     int		*timed_out)	/* flag is set when timeout limit reached */
8350 {
8351     int		result;
8352     regexec_T	rex_save;
8353     int		rex_in_use_save = rex_in_use;
8354 
8355     if (rex_in_use)
8356 	/* Being called recursively, save the state. */
8357 	rex_save = rex;
8358     rex_in_use = TRUE;
8359 
8360     result = rmp->regprog->engine->regexec_multi(
8361 				      rmp, win, buf, lnum, col, tm, timed_out);
8362 
8363     /* NFA engine aborted because it's very slow. */
8364     if (rmp->regprog->re_engine == AUTOMATIC_ENGINE
8365 					       && result == NFA_TOO_EXPENSIVE)
8366     {
8367 	int    save_p_re = p_re;
8368 	int    re_flags = rmp->regprog->re_flags;
8369 	char_u *pat = vim_strsave(((nfa_regprog_T *)rmp->regprog)->pattern);
8370 
8371 	p_re = BACKTRACKING_ENGINE;
8372 	vim_regfree(rmp->regprog);
8373 	if (pat != NULL)
8374 	{
8375 #ifdef FEAT_EVAL
8376 	    report_re_switch(pat);
8377 #endif
8378 	    rmp->regprog = vim_regcomp(pat, re_flags);
8379 	    if (rmp->regprog != NULL)
8380 		result = rmp->regprog->engine->regexec_multi(
8381 				      rmp, win, buf, lnum, col, tm, timed_out);
8382 	    vim_free(pat);
8383 	}
8384 	p_re = save_p_re;
8385     }
8386 
8387     rex_in_use = rex_in_use_save;
8388     if (rex_in_use)
8389 	rex = rex_save;
8390 
8391     return result <= 0 ? 0 : result;
8392 }
8393