xref: /vim-8.2.3635/src/regexp.c (revision ed37d9b3)
1 /* vi:set ts=8 sts=4 sw=4 noet:
2  *
3  * Handling of regular expressions: vim_regcomp(), vim_regexec(), vim_regsub()
4  */
5 
6 // By default: do not create debugging logs or files related to regular
7 // expressions, even when compiling with -DDEBUG.
8 // Uncomment the second line to get the regexp debugging.
9 #undef DEBUG
10 // #define DEBUG
11 
12 #include "vim.h"
13 
14 #ifdef DEBUG
15 // show/save debugging data when BT engine is used
16 # define BT_REGEXP_DUMP
17 // save the debugging data to a file instead of displaying it
18 # define BT_REGEXP_LOG
19 # define BT_REGEXP_DEBUG_LOG
20 # define BT_REGEXP_DEBUG_LOG_NAME	"bt_regexp_debug.log"
21 #endif
22 
23 /*
24  * Magic characters have a special meaning, they don't match literally.
25  * Magic characters are negative.  This separates them from literal characters
26  * (possibly multi-byte).  Only ASCII characters can be Magic.
27  */
28 #define Magic(x)	((int)(x) - 256)
29 #define un_Magic(x)	((x) + 256)
30 #define is_Magic(x)	((x) < 0)
31 
32     static int
33 no_Magic(int x)
34 {
35     if (is_Magic(x))
36 	return un_Magic(x);
37     return x;
38 }
39 
40     static int
41 toggle_Magic(int x)
42 {
43     if (is_Magic(x))
44 	return un_Magic(x);
45     return Magic(x);
46 }
47 
48 /*
49  * The first byte of the BT regexp internal "program" is actually this magic
50  * number; the start node begins in the second byte.  It's used to catch the
51  * most severe mutilation of the program by the caller.
52  */
53 
54 #define REGMAGIC	0234
55 
56 /*
57  * Utility definitions.
58  */
59 #define UCHARAT(p)	((int)*(char_u *)(p))
60 
61 // Used for an error (down from) vim_regcomp(): give the error message, set
62 // rc_did_emsg and return NULL
63 #define EMSG_RET_NULL(m) return (emsg((m)), rc_did_emsg = TRUE, (void *)NULL)
64 #define IEMSG_RET_NULL(m) return (iemsg((m)), rc_did_emsg = TRUE, (void *)NULL)
65 #define EMSG_RET_FAIL(m) return (emsg((m)), rc_did_emsg = TRUE, FAIL)
66 #define EMSG2_RET_NULL(m, c) return (semsg((const char *)(m), (c) ? "" : "\\"), rc_did_emsg = TRUE, (void *)NULL)
67 #define EMSG3_RET_NULL(m, c, a) return (semsg((const char *)(m), (c) ? "" : "\\", (a)), rc_did_emsg = TRUE, (void *)NULL)
68 #define EMSG2_RET_FAIL(m, c) return (semsg((const char *)(m), (c) ? "" : "\\"), rc_did_emsg = TRUE, FAIL)
69 #define EMSG_ONE_RET_NULL EMSG2_RET_NULL(_("E369: invalid item in %s%%[]"), reg_magic == MAGIC_ALL)
70 
71 
72 #define MAX_LIMIT	(32767L << 16L)
73 
74 static char_u e_missingbracket[] = N_("E769: Missing ] after %s[");
75 static char_u e_reverse_range[] = N_("E944: Reverse range in character class");
76 static char_u e_large_class[] = N_("E945: Range too large in character class");
77 static char_u e_unmatchedpp[] = N_("E53: Unmatched %s%%(");
78 static char_u e_unmatchedp[] = N_("E54: Unmatched %s(");
79 static char_u e_unmatchedpar[] = N_("E55: Unmatched %s)");
80 #ifdef FEAT_SYN_HL
81 static char_u e_z_not_allowed[] = N_("E66: \\z( not allowed here");
82 static char_u e_z1_not_allowed[] = N_("E67: \\z1 - \\z9 not allowed here");
83 #endif
84 static char_u e_missing_sb[] = N_("E69: Missing ] after %s%%[");
85 static char_u e_empty_sb[]  = N_("E70: Empty %s%%[]");
86 static char_u e_recursive[]  = N_("E956: Cannot use pattern recursively");
87 
88 #define NOT_MULTI	0
89 #define MULTI_ONE	1
90 #define MULTI_MULT	2
91 
92 // return values for regmatch()
93 #define RA_FAIL		1	// something failed, abort
94 #define RA_CONT		2	// continue in inner loop
95 #define RA_BREAK	3	// break inner loop
96 #define RA_MATCH	4	// successful match
97 #define RA_NOMATCH	5	// didn't match
98 
99 /*
100  * Return NOT_MULTI if c is not a "multi" operator.
101  * Return MULTI_ONE if c is a single "multi" operator.
102  * Return MULTI_MULT if c is a multi "multi" operator.
103  */
104     static int
105 re_multi_type(int c)
106 {
107     if (c == Magic('@') || c == Magic('=') || c == Magic('?'))
108 	return MULTI_ONE;
109     if (c == Magic('*') || c == Magic('+') || c == Magic('{'))
110 	return MULTI_MULT;
111     return NOT_MULTI;
112 }
113 
114 static char_u		*reg_prev_sub = NULL;
115 
116 /*
117  * REGEXP_INRANGE contains all characters which are always special in a []
118  * range after '\'.
119  * REGEXP_ABBR contains all characters which act as abbreviations after '\'.
120  * These are:
121  *  \n	- New line (NL).
122  *  \r	- Carriage Return (CR).
123  *  \t	- Tab (TAB).
124  *  \e	- Escape (ESC).
125  *  \b	- Backspace (Ctrl_H).
126  *  \d  - Character code in decimal, eg \d123
127  *  \o	- Character code in octal, eg \o80
128  *  \x	- Character code in hex, eg \x4a
129  *  \u	- Multibyte character code, eg \u20ac
130  *  \U	- Long multibyte character code, eg \U12345678
131  */
132 static char_u REGEXP_INRANGE[] = "]^-n\\";
133 static char_u REGEXP_ABBR[] = "nrtebdoxuU";
134 
135 /*
136  * Translate '\x' to its control character, except "\n", which is Magic.
137  */
138     static int
139 backslash_trans(int c)
140 {
141     switch (c)
142     {
143 	case 'r':   return CAR;
144 	case 't':   return TAB;
145 	case 'e':   return ESC;
146 	case 'b':   return BS;
147     }
148     return c;
149 }
150 
151 /*
152  * Check for a character class name "[:name:]".  "pp" points to the '['.
153  * Returns one of the CLASS_ items. CLASS_NONE means that no item was
154  * recognized.  Otherwise "pp" is advanced to after the item.
155  */
156     static int
157 get_char_class(char_u **pp)
158 {
159     static const char *(class_names[]) =
160     {
161 	"alnum:]",
162 #define CLASS_ALNUM 0
163 	"alpha:]",
164 #define CLASS_ALPHA 1
165 	"blank:]",
166 #define CLASS_BLANK 2
167 	"cntrl:]",
168 #define CLASS_CNTRL 3
169 	"digit:]",
170 #define CLASS_DIGIT 4
171 	"graph:]",
172 #define CLASS_GRAPH 5
173 	"lower:]",
174 #define CLASS_LOWER 6
175 	"print:]",
176 #define CLASS_PRINT 7
177 	"punct:]",
178 #define CLASS_PUNCT 8
179 	"space:]",
180 #define CLASS_SPACE 9
181 	"upper:]",
182 #define CLASS_UPPER 10
183 	"xdigit:]",
184 #define CLASS_XDIGIT 11
185 	"tab:]",
186 #define CLASS_TAB 12
187 	"return:]",
188 #define CLASS_RETURN 13
189 	"backspace:]",
190 #define CLASS_BACKSPACE 14
191 	"escape:]",
192 #define CLASS_ESCAPE 15
193 	"ident:]",
194 #define CLASS_IDENT 16
195 	"keyword:]",
196 #define CLASS_KEYWORD 17
197 	"fname:]",
198 #define CLASS_FNAME 18
199     };
200 #define CLASS_NONE 99
201     int i;
202 
203     if ((*pp)[1] == ':')
204     {
205 	for (i = 0; i < (int)(sizeof(class_names) / sizeof(*class_names)); ++i)
206 	    if (STRNCMP(*pp + 2, class_names[i], STRLEN(class_names[i])) == 0)
207 	    {
208 		*pp += STRLEN(class_names[i]) + 2;
209 		return i;
210 	    }
211     }
212     return CLASS_NONE;
213 }
214 
215 /*
216  * Specific version of character class functions.
217  * Using a table to keep this fast.
218  */
219 static short	class_tab[256];
220 
221 #define	    RI_DIGIT	0x01
222 #define	    RI_HEX	0x02
223 #define	    RI_OCTAL	0x04
224 #define	    RI_WORD	0x08
225 #define	    RI_HEAD	0x10
226 #define	    RI_ALPHA	0x20
227 #define	    RI_LOWER	0x40
228 #define	    RI_UPPER	0x80
229 #define	    RI_WHITE	0x100
230 
231     static void
232 init_class_tab(void)
233 {
234     int		i;
235     static int	done = FALSE;
236 
237     if (done)
238 	return;
239 
240     for (i = 0; i < 256; ++i)
241     {
242 	if (i >= '0' && i <= '7')
243 	    class_tab[i] = RI_DIGIT + RI_HEX + RI_OCTAL + RI_WORD;
244 	else if (i >= '8' && i <= '9')
245 	    class_tab[i] = RI_DIGIT + RI_HEX + RI_WORD;
246 	else if (i >= 'a' && i <= 'f')
247 	    class_tab[i] = RI_HEX + RI_WORD + RI_HEAD + RI_ALPHA + RI_LOWER;
248 #ifdef EBCDIC
249 	else if ((i >= 'g' && i <= 'i') || (i >= 'j' && i <= 'r')
250 						    || (i >= 's' && i <= 'z'))
251 #else
252 	else if (i >= 'g' && i <= 'z')
253 #endif
254 	    class_tab[i] = RI_WORD + RI_HEAD + RI_ALPHA + RI_LOWER;
255 	else if (i >= 'A' && i <= 'F')
256 	    class_tab[i] = RI_HEX + RI_WORD + RI_HEAD + RI_ALPHA + RI_UPPER;
257 #ifdef EBCDIC
258 	else if ((i >= 'G' && i <= 'I') || ( i >= 'J' && i <= 'R')
259 						    || (i >= 'S' && i <= 'Z'))
260 #else
261 	else if (i >= 'G' && i <= 'Z')
262 #endif
263 	    class_tab[i] = RI_WORD + RI_HEAD + RI_ALPHA + RI_UPPER;
264 	else if (i == '_')
265 	    class_tab[i] = RI_WORD + RI_HEAD;
266 	else
267 	    class_tab[i] = 0;
268     }
269     class_tab[' '] |= RI_WHITE;
270     class_tab['\t'] |= RI_WHITE;
271     done = TRUE;
272 }
273 
274 #define ri_digit(c)	(c < 0x100 && (class_tab[c] & RI_DIGIT))
275 #define ri_hex(c)	(c < 0x100 && (class_tab[c] & RI_HEX))
276 #define ri_octal(c)	(c < 0x100 && (class_tab[c] & RI_OCTAL))
277 #define ri_word(c)	(c < 0x100 && (class_tab[c] & RI_WORD))
278 #define ri_head(c)	(c < 0x100 && (class_tab[c] & RI_HEAD))
279 #define ri_alpha(c)	(c < 0x100 && (class_tab[c] & RI_ALPHA))
280 #define ri_lower(c)	(c < 0x100 && (class_tab[c] & RI_LOWER))
281 #define ri_upper(c)	(c < 0x100 && (class_tab[c] & RI_UPPER))
282 #define ri_white(c)	(c < 0x100 && (class_tab[c] & RI_WHITE))
283 
284 // flags for regflags
285 #define RF_ICASE    1	// ignore case
286 #define RF_NOICASE  2	// don't ignore case
287 #define RF_HASNL    4	// can match a NL
288 #define RF_ICOMBINE 8	// ignore combining characters
289 #define RF_LOOKBH   16	// uses "\@<=" or "\@<!"
290 
291 /*
292  * Global work variables for vim_regcomp().
293  */
294 
295 static char_u	*regparse;	// Input-scan pointer.
296 static int	regnpar;	// () count.
297 #ifdef FEAT_SYN_HL
298 static int	regnzpar;	// \z() count.
299 static int	re_has_z;	// \z item detected
300 #endif
301 static unsigned	regflags;	// RF_ flags for prog
302 #if defined(FEAT_SYN_HL) || defined(PROTO)
303 static int	had_eol;	// TRUE when EOL found by vim_regcomp()
304 #endif
305 
306 static int	reg_magic;	// magicness of the pattern:
307 #define MAGIC_NONE	1	// "\V" very unmagic
308 #define MAGIC_OFF	2	// "\M" or 'magic' off
309 #define MAGIC_ON	3	// "\m" or 'magic'
310 #define MAGIC_ALL	4	// "\v" very magic
311 
312 static int	reg_string;	// matching with a string instead of a buffer
313 				// line
314 static int	reg_strict;	// "[abc" is illegal
315 
316 /*
317  * META contains all characters that may be magic, except '^' and '$'.
318  */
319 
320 #ifdef EBCDIC
321 static char_u META[] = "%&()*+.123456789<=>?@ACDFHIKLMOPSUVWX[_acdfhiklmnopsuvwxz{|~";
322 #else
323 // META[] is used often enough to justify turning it into a table.
324 static char_u META_flags[] = {
325     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
326     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
327 //		   %  &     (  )  *  +	      .
328     0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0,
329 //     1  2  3	4  5  6  7  8  9	<  =  >  ?
330     0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1,
331 //  @  A     C	D     F     H  I     K	L  M	 O
332     1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1,
333 //  P	     S	   U  V  W  X	  Z  [		 _
334     1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1,
335 //     a     c	d     f     h  i     k	l  m  n  o
336     0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1,
337 //  p	     s	   u  v  w  x	  z  {	|     ~
338     1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 1
339 };
340 #endif
341 
342 static int	curchr;		// currently parsed character
343 // Previous character.  Note: prevchr is sometimes -1 when we are not at the
344 // start, eg in /[ ^I]^ the pattern was never found even if it existed,
345 // because ^ was taken to be magic -- webb
346 static int	prevchr;
347 static int	prevprevchr;	// previous-previous character
348 static int	nextchr;	// used for ungetchr()
349 
350 // arguments for reg()
351 #define REG_NOPAREN	0	// toplevel reg()
352 #define REG_PAREN	1	// \(\)
353 #define REG_ZPAREN	2	// \z(\)
354 #define REG_NPAREN	3	// \%(\)
355 
356 typedef struct
357 {
358      char_u	*regparse;
359      int	prevchr_len;
360      int	curchr;
361      int	prevchr;
362      int	prevprevchr;
363      int	nextchr;
364      int	at_start;
365      int	prev_at_start;
366      int	regnpar;
367 } parse_state_T;
368 
369 static void	initchr(char_u *);
370 static int	getchr(void);
371 static void	skipchr_keepstart(void);
372 static int	peekchr(void);
373 static void	skipchr(void);
374 static void	ungetchr(void);
375 static long	gethexchrs(int maxinputlen);
376 static long	getoctchrs(void);
377 static long	getdecchrs(void);
378 static int	coll_get_char(void);
379 static int	prog_magic_wrong(void);
380 static int	cstrncmp(char_u *s1, char_u *s2, int *n);
381 static char_u	*cstrchr(char_u *, int);
382 static int	re_mult_next(char *what);
383 static int	reg_iswordc(int);
384 
385 static regengine_T bt_regengine;
386 static regengine_T nfa_regengine;
387 
388 /*
389  * Return TRUE if compiled regular expression "prog" can match a line break.
390  */
391     int
392 re_multiline(regprog_T *prog)
393 {
394     return (prog->regflags & RF_HASNL);
395 }
396 
397 /*
398  * Check for an equivalence class name "[=a=]".  "pp" points to the '['.
399  * Returns a character representing the class. Zero means that no item was
400  * recognized.  Otherwise "pp" is advanced to after the item.
401  */
402     static int
403 get_equi_class(char_u **pp)
404 {
405     int		c;
406     int		l = 1;
407     char_u	*p = *pp;
408 
409     if (p[1] == '=' && p[2] != NUL)
410     {
411 	if (has_mbyte)
412 	    l = (*mb_ptr2len)(p + 2);
413 	if (p[l + 2] == '=' && p[l + 3] == ']')
414 	{
415 	    if (has_mbyte)
416 		c = mb_ptr2char(p + 2);
417 	    else
418 		c = p[2];
419 	    *pp += l + 4;
420 	    return c;
421 	}
422     }
423     return 0;
424 }
425 
426 #ifdef EBCDIC
427 /*
428  * Table for equivalence class "c". (IBM-1047)
429  */
430 static char *EQUIVAL_CLASS_C[16] = {
431     "A\x62\x63\x64\x65\x66\x67",
432     "C\x68",
433     "E\x71\x72\x73\x74",
434     "I\x75\x76\x77\x78",
435     "N\x69",
436     "O\xEB\xEC\xED\xEE\xEF\x80",
437     "U\xFB\xFC\xFD\xFE",
438     "Y\xBA",
439     "a\x42\x43\x44\x45\x46\x47",
440     "c\x48",
441     "e\x51\x52\x53\x54",
442     "i\x55\x56\x57\x58",
443     "n\x49",
444     "o\xCB\xCC\xCD\xCE\xCF\x70",
445     "u\xDB\xDC\xDD\xDE",
446     "y\x8D\xDF",
447 };
448 #endif
449 
450 /*
451  * Check for a collating element "[.a.]".  "pp" points to the '['.
452  * Returns a character. Zero means that no item was recognized.  Otherwise
453  * "pp" is advanced to after the item.
454  * Currently only single characters are recognized!
455  */
456     static int
457 get_coll_element(char_u **pp)
458 {
459     int		c;
460     int		l = 1;
461     char_u	*p = *pp;
462 
463     if (p[0] != NUL && p[1] == '.' && p[2] != NUL)
464     {
465 	if (has_mbyte)
466 	    l = (*mb_ptr2len)(p + 2);
467 	if (p[l + 2] == '.' && p[l + 3] == ']')
468 	{
469 	    if (has_mbyte)
470 		c = mb_ptr2char(p + 2);
471 	    else
472 		c = p[2];
473 	    *pp += l + 4;
474 	    return c;
475 	}
476     }
477     return 0;
478 }
479 
480 static int reg_cpo_lit; // 'cpoptions' contains 'l' flag
481 static int reg_cpo_bsl; // 'cpoptions' contains '\' flag
482 
483     static void
484 get_cpo_flags(void)
485 {
486     reg_cpo_lit = vim_strchr(p_cpo, CPO_LITERAL) != NULL;
487     reg_cpo_bsl = vim_strchr(p_cpo, CPO_BACKSL) != NULL;
488 }
489 
490 /*
491  * Skip over a "[]" range.
492  * "p" must point to the character after the '['.
493  * The returned pointer is on the matching ']', or the terminating NUL.
494  */
495     static char_u *
496 skip_anyof(char_u *p)
497 {
498     int		l;
499 
500     if (*p == '^')	// Complement of range.
501 	++p;
502     if (*p == ']' || *p == '-')
503 	++p;
504     while (*p != NUL && *p != ']')
505     {
506 	if (has_mbyte && (l = (*mb_ptr2len)(p)) > 1)
507 	    p += l;
508 	else
509 	    if (*p == '-')
510 	    {
511 		++p;
512 		if (*p != ']' && *p != NUL)
513 		    MB_PTR_ADV(p);
514 	    }
515 	else if (*p == '\\'
516 		&& !reg_cpo_bsl
517 		&& (vim_strchr(REGEXP_INRANGE, p[1]) != NULL
518 		    || (!reg_cpo_lit && vim_strchr(REGEXP_ABBR, p[1]) != NULL)))
519 	    p += 2;
520 	else if (*p == '[')
521 	{
522 	    if (get_char_class(&p) == CLASS_NONE
523 		    && get_equi_class(&p) == 0
524 		    && get_coll_element(&p) == 0
525 		    && *p != NUL)
526 		++p; // it is not a class name and not NUL
527 	}
528 	else
529 	    ++p;
530     }
531 
532     return p;
533 }
534 
535 /*
536  * Skip past regular expression.
537  * Stop at end of "startp" or where "delim" is found ('/', '?', etc).
538  * Take care of characters with a backslash in front of it.
539  * Skip strings inside [ and ].
540  */
541     char_u *
542 skip_regexp(
543     char_u	*startp,
544     int		delim,
545     int		magic)
546 {
547     return skip_regexp_ex(startp, delim, magic, NULL, NULL);
548 }
549 
550 /*
551  * Call skip_regexp() and when the delimiter does not match give an error and
552  * return NULL.
553  */
554     char_u *
555 skip_regexp_err(
556     char_u	*startp,
557     int		delim,
558     int		magic)
559 {
560     char_u *p = skip_regexp(startp, delim, magic);
561 
562     if (*p != delim)
563     {
564 	semsg(_("E654: missing delimiter after search pattern: %s"), startp);
565 	return NULL;
566     }
567     return p;
568 }
569 
570 /*
571  * skip_regexp() with extra arguments:
572  * When "newp" is not NULL and "dirc" is '?', make an allocated copy of the
573  * expression and change "\?" to "?".  If "*newp" is not NULL the expression
574  * is changed in-place.
575  * If a "\?" is changed to "?" then "dropped" is incremented, unless NULL.
576  */
577     char_u *
578 skip_regexp_ex(
579     char_u	*startp,
580     int		dirc,
581     int		magic,
582     char_u	**newp,
583     int		*dropped)
584 {
585     int		mymagic;
586     char_u	*p = startp;
587 
588     if (magic)
589 	mymagic = MAGIC_ON;
590     else
591 	mymagic = MAGIC_OFF;
592     get_cpo_flags();
593 
594     for (; p[0] != NUL; MB_PTR_ADV(p))
595     {
596 	if (p[0] == dirc)	// found end of regexp
597 	    break;
598 	if ((p[0] == '[' && mymagic >= MAGIC_ON)
599 		|| (p[0] == '\\' && p[1] == '[' && mymagic <= MAGIC_OFF))
600 	{
601 	    p = skip_anyof(p + 1);
602 	    if (p[0] == NUL)
603 		break;
604 	}
605 	else if (p[0] == '\\' && p[1] != NUL)
606 	{
607 	    if (dirc == '?' && newp != NULL && p[1] == '?')
608 	    {
609 		// change "\?" to "?", make a copy first.
610 		if (*newp == NULL)
611 		{
612 		    *newp = vim_strsave(startp);
613 		    if (*newp != NULL)
614 			p = *newp + (p - startp);
615 		}
616 		if (dropped != NULL)
617 		    ++*dropped;
618 		if (*newp != NULL)
619 		    STRMOVE(p, p + 1);
620 		else
621 		    ++p;
622 	    }
623 	    else
624 		++p;    // skip next character
625 	    if (*p == 'v')
626 		mymagic = MAGIC_ALL;
627 	    else if (*p == 'V')
628 		mymagic = MAGIC_NONE;
629 	}
630     }
631     return p;
632 }
633 
634 /*
635  * Functions for getting characters from the regexp input.
636  */
637 static int	prevchr_len;	// byte length of previous char
638 static int	at_start;	// True when on the first character
639 static int	prev_at_start;  // True when on the second character
640 
641 /*
642  * Start parsing at "str".
643  */
644     static void
645 initchr(char_u *str)
646 {
647     regparse = str;
648     prevchr_len = 0;
649     curchr = prevprevchr = prevchr = nextchr = -1;
650     at_start = TRUE;
651     prev_at_start = FALSE;
652 }
653 
654 /*
655  * Save the current parse state, so that it can be restored and parsing
656  * starts in the same state again.
657  */
658     static void
659 save_parse_state(parse_state_T *ps)
660 {
661     ps->regparse = regparse;
662     ps->prevchr_len = prevchr_len;
663     ps->curchr = curchr;
664     ps->prevchr = prevchr;
665     ps->prevprevchr = prevprevchr;
666     ps->nextchr = nextchr;
667     ps->at_start = at_start;
668     ps->prev_at_start = prev_at_start;
669     ps->regnpar = regnpar;
670 }
671 
672 /*
673  * Restore a previously saved parse state.
674  */
675     static void
676 restore_parse_state(parse_state_T *ps)
677 {
678     regparse = ps->regparse;
679     prevchr_len = ps->prevchr_len;
680     curchr = ps->curchr;
681     prevchr = ps->prevchr;
682     prevprevchr = ps->prevprevchr;
683     nextchr = ps->nextchr;
684     at_start = ps->at_start;
685     prev_at_start = ps->prev_at_start;
686     regnpar = ps->regnpar;
687 }
688 
689 
690 /*
691  * Get the next character without advancing.
692  */
693     static int
694 peekchr(void)
695 {
696     static int	after_slash = FALSE;
697 
698     if (curchr == -1)
699     {
700 	switch (curchr = regparse[0])
701 	{
702 	case '.':
703 	case '[':
704 	case '~':
705 	    // magic when 'magic' is on
706 	    if (reg_magic >= MAGIC_ON)
707 		curchr = Magic(curchr);
708 	    break;
709 	case '(':
710 	case ')':
711 	case '{':
712 	case '%':
713 	case '+':
714 	case '=':
715 	case '?':
716 	case '@':
717 	case '!':
718 	case '&':
719 	case '|':
720 	case '<':
721 	case '>':
722 	case '#':	// future ext.
723 	case '"':	// future ext.
724 	case '\'':	// future ext.
725 	case ',':	// future ext.
726 	case '-':	// future ext.
727 	case ':':	// future ext.
728 	case ';':	// future ext.
729 	case '`':	// future ext.
730 	case '/':	// Can't be used in / command
731 	    // magic only after "\v"
732 	    if (reg_magic == MAGIC_ALL)
733 		curchr = Magic(curchr);
734 	    break;
735 	case '*':
736 	    // * is not magic as the very first character, eg "?*ptr", when
737 	    // after '^', eg "/^*ptr" and when after "\(", "\|", "\&".  But
738 	    // "\(\*" is not magic, thus must be magic if "after_slash"
739 	    if (reg_magic >= MAGIC_ON
740 		    && !at_start
741 		    && !(prev_at_start && prevchr == Magic('^'))
742 		    && (after_slash
743 			|| (prevchr != Magic('(')
744 			    && prevchr != Magic('&')
745 			    && prevchr != Magic('|'))))
746 		curchr = Magic('*');
747 	    break;
748 	case '^':
749 	    // '^' is only magic as the very first character and if it's after
750 	    // "\(", "\|", "\&' or "\n"
751 	    if (reg_magic >= MAGIC_OFF
752 		    && (at_start
753 			|| reg_magic == MAGIC_ALL
754 			|| prevchr == Magic('(')
755 			|| prevchr == Magic('|')
756 			|| prevchr == Magic('&')
757 			|| prevchr == Magic('n')
758 			|| (no_Magic(prevchr) == '('
759 			    && prevprevchr == Magic('%'))))
760 	    {
761 		curchr = Magic('^');
762 		at_start = TRUE;
763 		prev_at_start = FALSE;
764 	    }
765 	    break;
766 	case '$':
767 	    // '$' is only magic as the very last char and if it's in front of
768 	    // either "\|", "\)", "\&", or "\n"
769 	    if (reg_magic >= MAGIC_OFF)
770 	    {
771 		char_u *p = regparse + 1;
772 		int is_magic_all = (reg_magic == MAGIC_ALL);
773 
774 		// ignore \c \C \m \M \v \V and \Z after '$'
775 		while (p[0] == '\\' && (p[1] == 'c' || p[1] == 'C'
776 				|| p[1] == 'm' || p[1] == 'M'
777 				|| p[1] == 'v' || p[1] == 'V' || p[1] == 'Z'))
778 		{
779 		    if (p[1] == 'v')
780 			is_magic_all = TRUE;
781 		    else if (p[1] == 'm' || p[1] == 'M' || p[1] == 'V')
782 			is_magic_all = FALSE;
783 		    p += 2;
784 		}
785 		if (p[0] == NUL
786 			|| (p[0] == '\\'
787 			    && (p[1] == '|' || p[1] == '&' || p[1] == ')'
788 				|| p[1] == 'n'))
789 			|| (is_magic_all
790 			       && (p[0] == '|' || p[0] == '&' || p[0] == ')'))
791 			|| reg_magic == MAGIC_ALL)
792 		    curchr = Magic('$');
793 	    }
794 	    break;
795 	case '\\':
796 	    {
797 		int c = regparse[1];
798 
799 		if (c == NUL)
800 		    curchr = '\\';	// trailing '\'
801 		else if (
802 #ifdef EBCDIC
803 			vim_strchr(META, c)
804 #else
805 			c <= '~' && META_flags[c]
806 #endif
807 			)
808 		{
809 		    /*
810 		     * META contains everything that may be magic sometimes,
811 		     * except ^ and $ ("\^" and "\$" are only magic after
812 		     * "\V").  We now fetch the next character and toggle its
813 		     * magicness.  Therefore, \ is so meta-magic that it is
814 		     * not in META.
815 		     */
816 		    curchr = -1;
817 		    prev_at_start = at_start;
818 		    at_start = FALSE;	// be able to say "/\*ptr"
819 		    ++regparse;
820 		    ++after_slash;
821 		    peekchr();
822 		    --regparse;
823 		    --after_slash;
824 		    curchr = toggle_Magic(curchr);
825 		}
826 		else if (vim_strchr(REGEXP_ABBR, c))
827 		{
828 		    /*
829 		     * Handle abbreviations, like "\t" for TAB -- webb
830 		     */
831 		    curchr = backslash_trans(c);
832 		}
833 		else if (reg_magic == MAGIC_NONE && (c == '$' || c == '^'))
834 		    curchr = toggle_Magic(c);
835 		else
836 		{
837 		    /*
838 		     * Next character can never be (made) magic?
839 		     * Then backslashing it won't do anything.
840 		     */
841 		    if (has_mbyte)
842 			curchr = (*mb_ptr2char)(regparse + 1);
843 		    else
844 			curchr = c;
845 		}
846 		break;
847 	    }
848 
849 	default:
850 	    if (has_mbyte)
851 		curchr = (*mb_ptr2char)(regparse);
852 	}
853     }
854 
855     return curchr;
856 }
857 
858 /*
859  * Eat one lexed character.  Do this in a way that we can undo it.
860  */
861     static void
862 skipchr(void)
863 {
864     // peekchr() eats a backslash, do the same here
865     if (*regparse == '\\')
866 	prevchr_len = 1;
867     else
868 	prevchr_len = 0;
869     if (regparse[prevchr_len] != NUL)
870     {
871 	if (enc_utf8)
872 	    // exclude composing chars that mb_ptr2len does include
873 	    prevchr_len += utf_ptr2len(regparse + prevchr_len);
874 	else if (has_mbyte)
875 	    prevchr_len += (*mb_ptr2len)(regparse + prevchr_len);
876 	else
877 	    ++prevchr_len;
878     }
879     regparse += prevchr_len;
880     prev_at_start = at_start;
881     at_start = FALSE;
882     prevprevchr = prevchr;
883     prevchr = curchr;
884     curchr = nextchr;	    // use previously unget char, or -1
885     nextchr = -1;
886 }
887 
888 /*
889  * Skip a character while keeping the value of prev_at_start for at_start.
890  * prevchr and prevprevchr are also kept.
891  */
892     static void
893 skipchr_keepstart(void)
894 {
895     int as = prev_at_start;
896     int pr = prevchr;
897     int prpr = prevprevchr;
898 
899     skipchr();
900     at_start = as;
901     prevchr = pr;
902     prevprevchr = prpr;
903 }
904 
905 /*
906  * Get the next character from the pattern. We know about magic and such, so
907  * therefore we need a lexical analyzer.
908  */
909     static int
910 getchr(void)
911 {
912     int chr = peekchr();
913 
914     skipchr();
915     return chr;
916 }
917 
918 /*
919  * put character back.  Works only once!
920  */
921     static void
922 ungetchr(void)
923 {
924     nextchr = curchr;
925     curchr = prevchr;
926     prevchr = prevprevchr;
927     at_start = prev_at_start;
928     prev_at_start = FALSE;
929 
930     // Backup regparse, so that it's at the same position as before the
931     // getchr().
932     regparse -= prevchr_len;
933 }
934 
935 /*
936  * Get and return the value of the hex string at the current position.
937  * Return -1 if there is no valid hex number.
938  * The position is updated:
939  *     blahblah\%x20asdf
940  *	   before-^ ^-after
941  * The parameter controls the maximum number of input characters. This will be
942  * 2 when reading a \%x20 sequence and 4 when reading a \%u20AC sequence.
943  */
944     static long
945 gethexchrs(int maxinputlen)
946 {
947     long_u	nr = 0;
948     int		c;
949     int		i;
950 
951     for (i = 0; i < maxinputlen; ++i)
952     {
953 	c = regparse[0];
954 	if (!vim_isxdigit(c))
955 	    break;
956 	nr <<= 4;
957 	nr |= hex2nr(c);
958 	++regparse;
959     }
960 
961     if (i == 0)
962 	return -1;
963     return (long)nr;
964 }
965 
966 /*
967  * Get and return the value of the decimal string immediately after the
968  * current position. Return -1 for invalid.  Consumes all digits.
969  */
970     static long
971 getdecchrs(void)
972 {
973     long_u	nr = 0;
974     int		c;
975     int		i;
976 
977     for (i = 0; ; ++i)
978     {
979 	c = regparse[0];
980 	if (c < '0' || c > '9')
981 	    break;
982 	nr *= 10;
983 	nr += c - '0';
984 	++regparse;
985 	curchr = -1; // no longer valid
986     }
987 
988     if (i == 0)
989 	return -1;
990     return (long)nr;
991 }
992 
993 /*
994  * get and return the value of the octal string immediately after the current
995  * position. Return -1 for invalid, or 0-255 for valid. Smart enough to handle
996  * numbers > 377 correctly (for example, 400 is treated as 40) and doesn't
997  * treat 8 or 9 as recognised characters. Position is updated:
998  *     blahblah\%o210asdf
999  *	   before-^  ^-after
1000  */
1001     static long
1002 getoctchrs(void)
1003 {
1004     long_u	nr = 0;
1005     int		c;
1006     int		i;
1007 
1008     for (i = 0; i < 3 && nr < 040; ++i)
1009     {
1010 	c = regparse[0];
1011 	if (c < '0' || c > '7')
1012 	    break;
1013 	nr <<= 3;
1014 	nr |= hex2nr(c);
1015 	++regparse;
1016     }
1017 
1018     if (i == 0)
1019 	return -1;
1020     return (long)nr;
1021 }
1022 
1023 /*
1024  * read_limits - Read two integers to be taken as a minimum and maximum.
1025  * If the first character is '-', then the range is reversed.
1026  * Should end with 'end'.  If minval is missing, zero is default, if maxval is
1027  * missing, a very big number is the default.
1028  */
1029     static int
1030 read_limits(long *minval, long *maxval)
1031 {
1032     int		reverse = FALSE;
1033     char_u	*first_char;
1034     long	tmp;
1035 
1036     if (*regparse == '-')
1037     {
1038 	// Starts with '-', so reverse the range later
1039 	regparse++;
1040 	reverse = TRUE;
1041     }
1042     first_char = regparse;
1043     *minval = getdigits(&regparse);
1044     if (*regparse == ',')	    // There is a comma
1045     {
1046 	if (vim_isdigit(*++regparse))
1047 	    *maxval = getdigits(&regparse);
1048 	else
1049 	    *maxval = MAX_LIMIT;
1050     }
1051     else if (VIM_ISDIGIT(*first_char))
1052 	*maxval = *minval;	    // It was \{n} or \{-n}
1053     else
1054 	*maxval = MAX_LIMIT;	    // It was \{} or \{-}
1055     if (*regparse == '\\')
1056 	regparse++;	// Allow either \{...} or \{...\}
1057     if (*regparse != '}')
1058 	EMSG2_RET_FAIL(_("E554: Syntax error in %s{...}"),
1059 						       reg_magic == MAGIC_ALL);
1060 
1061     /*
1062      * Reverse the range if there was a '-', or make sure it is in the right
1063      * order otherwise.
1064      */
1065     if ((!reverse && *minval > *maxval) || (reverse && *minval < *maxval))
1066     {
1067 	tmp = *minval;
1068 	*minval = *maxval;
1069 	*maxval = tmp;
1070     }
1071     skipchr();		// let's be friends with the lexer again
1072     return OK;
1073 }
1074 
1075 /*
1076  * vim_regexec and friends
1077  */
1078 
1079 /*
1080  * Global work variables for vim_regexec().
1081  */
1082 
1083 static void	cleanup_subexpr(void);
1084 #ifdef FEAT_SYN_HL
1085 static void	cleanup_zsubexpr(void);
1086 #endif
1087 static void	reg_nextline(void);
1088 static int	match_with_backref(linenr_T start_lnum, colnr_T start_col, linenr_T end_lnum, colnr_T end_col, int *bytelen);
1089 
1090 /*
1091  * Sometimes need to save a copy of a line.  Since alloc()/free() is very
1092  * slow, we keep one allocated piece of memory and only re-allocate it when
1093  * it's too small.  It's freed in bt_regexec_both() when finished.
1094  */
1095 static char_u	*reg_tofree = NULL;
1096 static unsigned	reg_tofreelen;
1097 
1098 /*
1099  * Structure used to store the execution state of the regex engine.
1100  * Which ones are set depends on whether a single-line or multi-line match is
1101  * done:
1102  *			single-line		multi-line
1103  * reg_match		&regmatch_T		NULL
1104  * reg_mmatch		NULL			&regmmatch_T
1105  * reg_startp		reg_match->startp	<invalid>
1106  * reg_endp		reg_match->endp		<invalid>
1107  * reg_startpos		<invalid>		reg_mmatch->startpos
1108  * reg_endpos		<invalid>		reg_mmatch->endpos
1109  * reg_win		NULL			window in which to search
1110  * reg_buf		curbuf			buffer in which to search
1111  * reg_firstlnum	<invalid>		first line in which to search
1112  * reg_maxline		0			last line nr
1113  * reg_line_lbr		FALSE or TRUE		FALSE
1114  */
1115 typedef struct {
1116     regmatch_T		*reg_match;
1117     regmmatch_T		*reg_mmatch;
1118     char_u		**reg_startp;
1119     char_u		**reg_endp;
1120     lpos_T		*reg_startpos;
1121     lpos_T		*reg_endpos;
1122     win_T		*reg_win;
1123     buf_T		*reg_buf;
1124     linenr_T		reg_firstlnum;
1125     linenr_T		reg_maxline;
1126     int			reg_line_lbr;	// "\n" in string is line break
1127 
1128     // The current match-position is stord in these variables:
1129     linenr_T	lnum;		// line number, relative to first line
1130     char_u	*line;		// start of current line
1131     char_u	*input;		// current input, points into "regline"
1132 
1133     int	need_clear_subexpr;	// subexpressions still need to be cleared
1134 #ifdef FEAT_SYN_HL
1135     int	need_clear_zsubexpr;	// extmatch subexpressions still need to be
1136 				// cleared
1137 #endif
1138 
1139     // Internal copy of 'ignorecase'.  It is set at each call to vim_regexec().
1140     // Normally it gets the value of "rm_ic" or "rmm_ic", but when the pattern
1141     // contains '\c' or '\C' the value is overruled.
1142     int			reg_ic;
1143 
1144     // Similar to "reg_ic", but only for 'combining' characters.  Set with \Z
1145     // flag in the regexp.  Defaults to false, always.
1146     int			reg_icombine;
1147 
1148     // Copy of "rmm_maxcol": maximum column to search for a match.  Zero when
1149     // there is no maximum.
1150     colnr_T		reg_maxcol;
1151 
1152     // State for the NFA engine regexec.
1153     int nfa_has_zend;	    // NFA regexp \ze operator encountered.
1154     int nfa_has_backref;    // NFA regexp \1 .. \9 encountered.
1155     int nfa_nsubexpr;	    // Number of sub expressions actually being used
1156 			    // during execution. 1 if only the whole match
1157 			    // (subexpr 0) is used.
1158     // listid is global, so that it increases on recursive calls to
1159     // nfa_regmatch(), which means we don't have to clear the lastlist field of
1160     // all the states.
1161     int nfa_listid;
1162     int nfa_alt_listid;
1163 
1164 #ifdef FEAT_SYN_HL
1165     int nfa_has_zsubexpr;   // NFA regexp has \z( ), set zsubexpr.
1166 #endif
1167 } regexec_T;
1168 
1169 static regexec_T	rex;
1170 static int		rex_in_use = FALSE;
1171 
1172 /*
1173  * Return TRUE if character 'c' is included in 'iskeyword' option for
1174  * "reg_buf" buffer.
1175  */
1176     static int
1177 reg_iswordc(int c)
1178 {
1179     return vim_iswordc_buf(c, rex.reg_buf);
1180 }
1181 
1182 /*
1183  * Get pointer to the line "lnum", which is relative to "reg_firstlnum".
1184  */
1185     static char_u *
1186 reg_getline(linenr_T lnum)
1187 {
1188     // when looking behind for a match/no-match lnum is negative.  But we
1189     // can't go before line 1
1190     if (rex.reg_firstlnum + lnum < 1)
1191 	return NULL;
1192     if (lnum > rex.reg_maxline)
1193 	// Must have matched the "\n" in the last line.
1194 	return (char_u *)"";
1195     return ml_get_buf(rex.reg_buf, rex.reg_firstlnum + lnum, FALSE);
1196 }
1197 
1198 #ifdef FEAT_SYN_HL
1199 static char_u	*reg_startzp[NSUBEXP];	// Workspace to mark beginning
1200 static char_u	*reg_endzp[NSUBEXP];	//   and end of \z(...\) matches
1201 static lpos_T	reg_startzpos[NSUBEXP];	// idem, beginning pos
1202 static lpos_T	reg_endzpos[NSUBEXP];	// idem, end pos
1203 #endif
1204 
1205 // TRUE if using multi-line regexp.
1206 #define REG_MULTI	(rex.reg_match == NULL)
1207 
1208 #ifdef FEAT_SYN_HL
1209 /*
1210  * Create a new extmatch and mark it as referenced once.
1211  */
1212     static reg_extmatch_T *
1213 make_extmatch(void)
1214 {
1215     reg_extmatch_T	*em;
1216 
1217     em = ALLOC_CLEAR_ONE(reg_extmatch_T);
1218     if (em != NULL)
1219 	em->refcnt = 1;
1220     return em;
1221 }
1222 
1223 /*
1224  * Add a reference to an extmatch.
1225  */
1226     reg_extmatch_T *
1227 ref_extmatch(reg_extmatch_T *em)
1228 {
1229     if (em != NULL)
1230 	em->refcnt++;
1231     return em;
1232 }
1233 
1234 /*
1235  * Remove a reference to an extmatch.  If there are no references left, free
1236  * the info.
1237  */
1238     void
1239 unref_extmatch(reg_extmatch_T *em)
1240 {
1241     int i;
1242 
1243     if (em != NULL && --em->refcnt <= 0)
1244     {
1245 	for (i = 0; i < NSUBEXP; ++i)
1246 	    vim_free(em->matches[i]);
1247 	vim_free(em);
1248     }
1249 }
1250 #endif
1251 
1252 /*
1253  * Get class of previous character.
1254  */
1255     static int
1256 reg_prev_class(void)
1257 {
1258     if (rex.input > rex.line)
1259 	return mb_get_class_buf(rex.input - 1
1260 		       - (*mb_head_off)(rex.line, rex.input - 1), rex.reg_buf);
1261     return -1;
1262 }
1263 
1264 /*
1265  * Return TRUE if the current rex.input position matches the Visual area.
1266  */
1267     static int
1268 reg_match_visual(void)
1269 {
1270     pos_T	top, bot;
1271     linenr_T    lnum;
1272     colnr_T	col;
1273     win_T	*wp = rex.reg_win == NULL ? curwin : rex.reg_win;
1274     int		mode;
1275     colnr_T	start, end;
1276     colnr_T	start2, end2;
1277     colnr_T	cols;
1278 
1279     // Check if the buffer is the current buffer.
1280     if (rex.reg_buf != curbuf || VIsual.lnum == 0)
1281 	return FALSE;
1282 
1283     if (VIsual_active)
1284     {
1285 	if (LT_POS(VIsual, wp->w_cursor))
1286 	{
1287 	    top = VIsual;
1288 	    bot = wp->w_cursor;
1289 	}
1290 	else
1291 	{
1292 	    top = wp->w_cursor;
1293 	    bot = VIsual;
1294 	}
1295 	mode = VIsual_mode;
1296     }
1297     else
1298     {
1299 	if (LT_POS(curbuf->b_visual.vi_start, curbuf->b_visual.vi_end))
1300 	{
1301 	    top = curbuf->b_visual.vi_start;
1302 	    bot = curbuf->b_visual.vi_end;
1303 	}
1304 	else
1305 	{
1306 	    top = curbuf->b_visual.vi_end;
1307 	    bot = curbuf->b_visual.vi_start;
1308 	}
1309 	mode = curbuf->b_visual.vi_mode;
1310     }
1311     lnum = rex.lnum + rex.reg_firstlnum;
1312     if (lnum < top.lnum || lnum > bot.lnum)
1313 	return FALSE;
1314 
1315     if (mode == 'v')
1316     {
1317 	col = (colnr_T)(rex.input - rex.line);
1318 	if ((lnum == top.lnum && col < top.col)
1319 		|| (lnum == bot.lnum && col >= bot.col + (*p_sel != 'e')))
1320 	    return FALSE;
1321     }
1322     else if (mode == Ctrl_V)
1323     {
1324 	getvvcol(wp, &top, &start, NULL, &end);
1325 	getvvcol(wp, &bot, &start2, NULL, &end2);
1326 	if (start2 < start)
1327 	    start = start2;
1328 	if (end2 > end)
1329 	    end = end2;
1330 	if (top.col == MAXCOL || bot.col == MAXCOL)
1331 	    end = MAXCOL;
1332 	cols = win_linetabsize(wp, rex.line, (colnr_T)(rex.input - rex.line));
1333 	if (cols < start || cols > end - (*p_sel == 'e'))
1334 	    return FALSE;
1335     }
1336     return TRUE;
1337 }
1338 
1339 /*
1340  * Check the regexp program for its magic number.
1341  * Return TRUE if it's wrong.
1342  */
1343     static int
1344 prog_magic_wrong(void)
1345 {
1346     regprog_T	*prog;
1347 
1348     prog = REG_MULTI ? rex.reg_mmatch->regprog : rex.reg_match->regprog;
1349     if (prog->engine == &nfa_regengine)
1350 	// For NFA matcher we don't check the magic
1351 	return FALSE;
1352 
1353     if (UCHARAT(((bt_regprog_T *)prog)->program) != REGMAGIC)
1354     {
1355 	emsg(_(e_re_corr));
1356 	return TRUE;
1357     }
1358     return FALSE;
1359 }
1360 
1361 /*
1362  * Cleanup the subexpressions, if this wasn't done yet.
1363  * This construction is used to clear the subexpressions only when they are
1364  * used (to increase speed).
1365  */
1366     static void
1367 cleanup_subexpr(void)
1368 {
1369     if (rex.need_clear_subexpr)
1370     {
1371 	if (REG_MULTI)
1372 	{
1373 	    // Use 0xff to set lnum to -1
1374 	    vim_memset(rex.reg_startpos, 0xff, sizeof(lpos_T) * NSUBEXP);
1375 	    vim_memset(rex.reg_endpos, 0xff, sizeof(lpos_T) * NSUBEXP);
1376 	}
1377 	else
1378 	{
1379 	    vim_memset(rex.reg_startp, 0, sizeof(char_u *) * NSUBEXP);
1380 	    vim_memset(rex.reg_endp, 0, sizeof(char_u *) * NSUBEXP);
1381 	}
1382 	rex.need_clear_subexpr = FALSE;
1383     }
1384 }
1385 
1386 #ifdef FEAT_SYN_HL
1387     static void
1388 cleanup_zsubexpr(void)
1389 {
1390     if (rex.need_clear_zsubexpr)
1391     {
1392 	if (REG_MULTI)
1393 	{
1394 	    // Use 0xff to set lnum to -1
1395 	    vim_memset(reg_startzpos, 0xff, sizeof(lpos_T) * NSUBEXP);
1396 	    vim_memset(reg_endzpos, 0xff, sizeof(lpos_T) * NSUBEXP);
1397 	}
1398 	else
1399 	{
1400 	    vim_memset(reg_startzp, 0, sizeof(char_u *) * NSUBEXP);
1401 	    vim_memset(reg_endzp, 0, sizeof(char_u *) * NSUBEXP);
1402 	}
1403 	rex.need_clear_zsubexpr = FALSE;
1404     }
1405 }
1406 #endif
1407 
1408 /*
1409  * Advance rex.lnum, rex.line and rex.input to the next line.
1410  */
1411     static void
1412 reg_nextline(void)
1413 {
1414     rex.line = reg_getline(++rex.lnum);
1415     rex.input = rex.line;
1416     fast_breakcheck();
1417 }
1418 
1419 /*
1420  * Check whether a backreference matches.
1421  * Returns RA_FAIL, RA_NOMATCH or RA_MATCH.
1422  * If "bytelen" is not NULL, it is set to the byte length of the match in the
1423  * last line.
1424  */
1425     static int
1426 match_with_backref(
1427     linenr_T start_lnum,
1428     colnr_T  start_col,
1429     linenr_T end_lnum,
1430     colnr_T  end_col,
1431     int	     *bytelen)
1432 {
1433     linenr_T	clnum = start_lnum;
1434     colnr_T	ccol = start_col;
1435     int		len;
1436     char_u	*p;
1437 
1438     if (bytelen != NULL)
1439 	*bytelen = 0;
1440     for (;;)
1441     {
1442 	// Since getting one line may invalidate the other, need to make copy.
1443 	// Slow!
1444 	if (rex.line != reg_tofree)
1445 	{
1446 	    len = (int)STRLEN(rex.line);
1447 	    if (reg_tofree == NULL || len >= (int)reg_tofreelen)
1448 	    {
1449 		len += 50;	// get some extra
1450 		vim_free(reg_tofree);
1451 		reg_tofree = alloc(len);
1452 		if (reg_tofree == NULL)
1453 		    return RA_FAIL; // out of memory!
1454 		reg_tofreelen = len;
1455 	    }
1456 	    STRCPY(reg_tofree, rex.line);
1457 	    rex.input = reg_tofree + (rex.input - rex.line);
1458 	    rex.line = reg_tofree;
1459 	}
1460 
1461 	// Get the line to compare with.
1462 	p = reg_getline(clnum);
1463 	if (clnum == end_lnum)
1464 	    len = end_col - ccol;
1465 	else
1466 	    len = (int)STRLEN(p + ccol);
1467 
1468 	if (cstrncmp(p + ccol, rex.input, &len) != 0)
1469 	    return RA_NOMATCH;  // doesn't match
1470 	if (bytelen != NULL)
1471 	    *bytelen += len;
1472 	if (clnum == end_lnum)
1473 	    break;		// match and at end!
1474 	if (rex.lnum >= rex.reg_maxline)
1475 	    return RA_NOMATCH;  // text too short
1476 
1477 	// Advance to next line.
1478 	reg_nextline();
1479 	if (bytelen != NULL)
1480 	    *bytelen = 0;
1481 	++clnum;
1482 	ccol = 0;
1483 	if (got_int)
1484 	    return RA_FAIL;
1485     }
1486 
1487     // found a match!  Note that rex.line may now point to a copy of the line,
1488     // that should not matter.
1489     return RA_MATCH;
1490 }
1491 
1492 /*
1493  * Used in a place where no * or \+ can follow.
1494  */
1495     static int
1496 re_mult_next(char *what)
1497 {
1498     if (re_multi_type(peekchr()) == MULTI_MULT)
1499     {
1500        semsg(_("E888: (NFA regexp) cannot repeat %s"), what);
1501        rc_did_emsg = TRUE;
1502        return FAIL;
1503     }
1504     return OK;
1505 }
1506 
1507 typedef struct
1508 {
1509     int a, b, c;
1510 } decomp_T;
1511 
1512 
1513 // 0xfb20 - 0xfb4f
1514 static decomp_T decomp_table[0xfb4f-0xfb20+1] =
1515 {
1516     {0x5e2,0,0},		// 0xfb20	alt ayin
1517     {0x5d0,0,0},		// 0xfb21	alt alef
1518     {0x5d3,0,0},		// 0xfb22	alt dalet
1519     {0x5d4,0,0},		// 0xfb23	alt he
1520     {0x5db,0,0},		// 0xfb24	alt kaf
1521     {0x5dc,0,0},		// 0xfb25	alt lamed
1522     {0x5dd,0,0},		// 0xfb26	alt mem-sofit
1523     {0x5e8,0,0},		// 0xfb27	alt resh
1524     {0x5ea,0,0},		// 0xfb28	alt tav
1525     {'+', 0, 0},		// 0xfb29	alt plus
1526     {0x5e9, 0x5c1, 0},		// 0xfb2a	shin+shin-dot
1527     {0x5e9, 0x5c2, 0},		// 0xfb2b	shin+sin-dot
1528     {0x5e9, 0x5c1, 0x5bc},	// 0xfb2c	shin+shin-dot+dagesh
1529     {0x5e9, 0x5c2, 0x5bc},	// 0xfb2d	shin+sin-dot+dagesh
1530     {0x5d0, 0x5b7, 0},		// 0xfb2e	alef+patah
1531     {0x5d0, 0x5b8, 0},		// 0xfb2f	alef+qamats
1532     {0x5d0, 0x5b4, 0},		// 0xfb30	alef+hiriq
1533     {0x5d1, 0x5bc, 0},		// 0xfb31	bet+dagesh
1534     {0x5d2, 0x5bc, 0},		// 0xfb32	gimel+dagesh
1535     {0x5d3, 0x5bc, 0},		// 0xfb33	dalet+dagesh
1536     {0x5d4, 0x5bc, 0},		// 0xfb34	he+dagesh
1537     {0x5d5, 0x5bc, 0},		// 0xfb35	vav+dagesh
1538     {0x5d6, 0x5bc, 0},		// 0xfb36	zayin+dagesh
1539     {0xfb37, 0, 0},		// 0xfb37 -- UNUSED
1540     {0x5d8, 0x5bc, 0},		// 0xfb38	tet+dagesh
1541     {0x5d9, 0x5bc, 0},		// 0xfb39	yud+dagesh
1542     {0x5da, 0x5bc, 0},		// 0xfb3a	kaf sofit+dagesh
1543     {0x5db, 0x5bc, 0},		// 0xfb3b	kaf+dagesh
1544     {0x5dc, 0x5bc, 0},		// 0xfb3c	lamed+dagesh
1545     {0xfb3d, 0, 0},		// 0xfb3d -- UNUSED
1546     {0x5de, 0x5bc, 0},		// 0xfb3e	mem+dagesh
1547     {0xfb3f, 0, 0},		// 0xfb3f -- UNUSED
1548     {0x5e0, 0x5bc, 0},		// 0xfb40	nun+dagesh
1549     {0x5e1, 0x5bc, 0},		// 0xfb41	samech+dagesh
1550     {0xfb42, 0, 0},		// 0xfb42 -- UNUSED
1551     {0x5e3, 0x5bc, 0},		// 0xfb43	pe sofit+dagesh
1552     {0x5e4, 0x5bc,0},		// 0xfb44	pe+dagesh
1553     {0xfb45, 0, 0},		// 0xfb45 -- UNUSED
1554     {0x5e6, 0x5bc, 0},		// 0xfb46	tsadi+dagesh
1555     {0x5e7, 0x5bc, 0},		// 0xfb47	qof+dagesh
1556     {0x5e8, 0x5bc, 0},		// 0xfb48	resh+dagesh
1557     {0x5e9, 0x5bc, 0},		// 0xfb49	shin+dagesh
1558     {0x5ea, 0x5bc, 0},		// 0xfb4a	tav+dagesh
1559     {0x5d5, 0x5b9, 0},		// 0xfb4b	vav+holam
1560     {0x5d1, 0x5bf, 0},		// 0xfb4c	bet+rafe
1561     {0x5db, 0x5bf, 0},		// 0xfb4d	kaf+rafe
1562     {0x5e4, 0x5bf, 0},		// 0xfb4e	pe+rafe
1563     {0x5d0, 0x5dc, 0}		// 0xfb4f	alef-lamed
1564 };
1565 
1566     static void
1567 mb_decompose(int c, int *c1, int *c2, int *c3)
1568 {
1569     decomp_T d;
1570 
1571     if (c >= 0xfb20 && c <= 0xfb4f)
1572     {
1573 	d = decomp_table[c - 0xfb20];
1574 	*c1 = d.a;
1575 	*c2 = d.b;
1576 	*c3 = d.c;
1577     }
1578     else
1579     {
1580 	*c1 = c;
1581 	*c2 = *c3 = 0;
1582     }
1583 }
1584 
1585 /*
1586  * Compare two strings, ignore case if rex.reg_ic set.
1587  * Return 0 if strings match, non-zero otherwise.
1588  * Correct the length "*n" when composing characters are ignored.
1589  */
1590     static int
1591 cstrncmp(char_u *s1, char_u *s2, int *n)
1592 {
1593     int		result;
1594 
1595     if (!rex.reg_ic)
1596 	result = STRNCMP(s1, s2, *n);
1597     else
1598 	result = MB_STRNICMP(s1, s2, *n);
1599 
1600     // if it failed and it's utf8 and we want to combineignore:
1601     if (result != 0 && enc_utf8 && rex.reg_icombine)
1602     {
1603 	char_u	*str1, *str2;
1604 	int	c1, c2, c11, c12;
1605 	int	junk;
1606 
1607 	// we have to handle the strcmp ourselves, since it is necessary to
1608 	// deal with the composing characters by ignoring them:
1609 	str1 = s1;
1610 	str2 = s2;
1611 	c1 = c2 = 0;
1612 	while ((int)(str1 - s1) < *n)
1613 	{
1614 	    c1 = mb_ptr2char_adv(&str1);
1615 	    c2 = mb_ptr2char_adv(&str2);
1616 
1617 	    // Decompose the character if necessary, into 'base' characters.
1618 	    // Currently hard-coded for Hebrew, Arabic to be done...
1619 	    if (c1 != c2 && (!rex.reg_ic || utf_fold(c1) != utf_fold(c2)))
1620 	    {
1621 		// decomposition necessary?
1622 		mb_decompose(c1, &c11, &junk, &junk);
1623 		mb_decompose(c2, &c12, &junk, &junk);
1624 		c1 = c11;
1625 		c2 = c12;
1626 		if (c11 != c12
1627 			    && (!rex.reg_ic || utf_fold(c11) != utf_fold(c12)))
1628 		    break;
1629 	    }
1630 	}
1631 	result = c2 - c1;
1632 	if (result == 0)
1633 	    *n = (int)(str2 - s2);
1634     }
1635 
1636     return result;
1637 }
1638 
1639 /*
1640  * cstrchr: This function is used a lot for simple searches, keep it fast!
1641  */
1642     static char_u *
1643 cstrchr(char_u *s, int c)
1644 {
1645     char_u	*p;
1646     int		cc;
1647 
1648     if (!rex.reg_ic || (!enc_utf8 && mb_char2len(c) > 1))
1649 	return vim_strchr(s, c);
1650 
1651     // tolower() and toupper() can be slow, comparing twice should be a lot
1652     // faster (esp. when using MS Visual C++!).
1653     // For UTF-8 need to use folded case.
1654     if (enc_utf8 && c > 0x80)
1655 	cc = utf_fold(c);
1656     else
1657 	 if (MB_ISUPPER(c))
1658 	cc = MB_TOLOWER(c);
1659     else if (MB_ISLOWER(c))
1660 	cc = MB_TOUPPER(c);
1661     else
1662 	return vim_strchr(s, c);
1663 
1664     if (has_mbyte)
1665     {
1666 	for (p = s; *p != NUL; p += (*mb_ptr2len)(p))
1667 	{
1668 	    if (enc_utf8 && c > 0x80)
1669 	    {
1670 		if (utf_fold(utf_ptr2char(p)) == cc)
1671 		    return p;
1672 	    }
1673 	    else if (*p == c || *p == cc)
1674 		return p;
1675 	}
1676     }
1677     else
1678 	// Faster version for when there are no multi-byte characters.
1679 	for (p = s; *p != NUL; ++p)
1680 	    if (*p == c || *p == cc)
1681 		return p;
1682 
1683     return NULL;
1684 }
1685 
1686 ////////////////////////////////////////////////////////////////
1687 //		      regsub stuff			      //
1688 ////////////////////////////////////////////////////////////////
1689 
1690 /*
1691  * We should define ftpr as a pointer to a function returning a pointer to
1692  * a function returning a pointer to a function ...
1693  * This is impossible, so we declare a pointer to a function returning a
1694  * pointer to a function returning void. This should work for all compilers.
1695  */
1696 typedef void (*(*fptr_T)(int *, int))();
1697 
1698 static int vim_regsub_both(char_u *source, typval_T *expr, char_u *dest, int copy, int magic, int backslash);
1699 
1700     static fptr_T
1701 do_upper(int *d, int c)
1702 {
1703     *d = MB_TOUPPER(c);
1704 
1705     return (fptr_T)NULL;
1706 }
1707 
1708     static fptr_T
1709 do_Upper(int *d, int c)
1710 {
1711     *d = MB_TOUPPER(c);
1712 
1713     return (fptr_T)do_Upper;
1714 }
1715 
1716     static fptr_T
1717 do_lower(int *d, int c)
1718 {
1719     *d = MB_TOLOWER(c);
1720 
1721     return (fptr_T)NULL;
1722 }
1723 
1724     static fptr_T
1725 do_Lower(int *d, int c)
1726 {
1727     *d = MB_TOLOWER(c);
1728 
1729     return (fptr_T)do_Lower;
1730 }
1731 
1732 /*
1733  * regtilde(): Replace tildes in the pattern by the old pattern.
1734  *
1735  * Short explanation of the tilde: It stands for the previous replacement
1736  * pattern.  If that previous pattern also contains a ~ we should go back a
1737  * step further...  But we insert the previous pattern into the current one
1738  * and remember that.
1739  * This still does not handle the case where "magic" changes.  So require the
1740  * user to keep his hands off of "magic".
1741  *
1742  * The tildes are parsed once before the first call to vim_regsub().
1743  */
1744     char_u *
1745 regtilde(char_u *source, int magic)
1746 {
1747     char_u	*newsub = source;
1748     char_u	*tmpsub;
1749     char_u	*p;
1750     int		len;
1751     int		prevlen;
1752 
1753     for (p = newsub; *p; ++p)
1754     {
1755 	if ((*p == '~' && magic) || (*p == '\\' && *(p + 1) == '~' && !magic))
1756 	{
1757 	    if (reg_prev_sub != NULL)
1758 	    {
1759 		// length = len(newsub) - 1 + len(prev_sub) + 1
1760 		prevlen = (int)STRLEN(reg_prev_sub);
1761 		tmpsub = alloc(STRLEN(newsub) + prevlen);
1762 		if (tmpsub != NULL)
1763 		{
1764 		    // copy prefix
1765 		    len = (int)(p - newsub);	// not including ~
1766 		    mch_memmove(tmpsub, newsub, (size_t)len);
1767 		    // interpret tilde
1768 		    mch_memmove(tmpsub + len, reg_prev_sub, (size_t)prevlen);
1769 		    // copy postfix
1770 		    if (!magic)
1771 			++p;			// back off backslash
1772 		    STRCPY(tmpsub + len + prevlen, p + 1);
1773 
1774 		    if (newsub != source)	// already allocated newsub
1775 			vim_free(newsub);
1776 		    newsub = tmpsub;
1777 		    p = newsub + len + prevlen;
1778 		}
1779 	    }
1780 	    else if (magic)
1781 		STRMOVE(p, p + 1);	// remove '~'
1782 	    else
1783 		STRMOVE(p, p + 2);	// remove '\~'
1784 	    --p;
1785 	}
1786 	else
1787 	{
1788 	    if (*p == '\\' && p[1])		// skip escaped characters
1789 		++p;
1790 	    if (has_mbyte)
1791 		p += (*mb_ptr2len)(p) - 1;
1792 	}
1793     }
1794 
1795     vim_free(reg_prev_sub);
1796     if (newsub != source)	// newsub was allocated, just keep it
1797 	reg_prev_sub = newsub;
1798     else			// no ~ found, need to save newsub
1799 	reg_prev_sub = vim_strsave(newsub);
1800     return newsub;
1801 }
1802 
1803 #ifdef FEAT_EVAL
1804 static int can_f_submatch = FALSE;	// TRUE when submatch() can be used
1805 
1806 // These pointers are used for reg_submatch().  Needed for when the
1807 // substitution string is an expression that contains a call to substitute()
1808 // and submatch().
1809 typedef struct {
1810     regmatch_T	*sm_match;
1811     regmmatch_T	*sm_mmatch;
1812     linenr_T	sm_firstlnum;
1813     linenr_T	sm_maxline;
1814     int		sm_line_lbr;
1815 } regsubmatch_T;
1816 
1817 static regsubmatch_T rsm;  // can only be used when can_f_submatch is TRUE
1818 #endif
1819 
1820 #ifdef FEAT_EVAL
1821 
1822 /*
1823  * Put the submatches in "argv[argskip]" which is a list passed into
1824  * call_func() by vim_regsub_both().
1825  */
1826     static int
1827 fill_submatch_list(int argc UNUSED, typval_T *argv, int argskip, int argcount)
1828 {
1829     listitem_T	*li;
1830     int		i;
1831     char_u	*s;
1832     typval_T	*listarg = argv + argskip;
1833 
1834     if (argcount == argskip)
1835 	// called function doesn't take a submatches argument
1836 	return argskip;
1837 
1838     // Relies on sl_list to be the first item in staticList10_T.
1839     init_static_list((staticList10_T *)(listarg->vval.v_list));
1840 
1841     // There are always 10 list items in staticList10_T.
1842     li = listarg->vval.v_list->lv_first;
1843     for (i = 0; i < 10; ++i)
1844     {
1845 	s = rsm.sm_match->startp[i];
1846 	if (s == NULL || rsm.sm_match->endp[i] == NULL)
1847 	    s = NULL;
1848 	else
1849 	    s = vim_strnsave(s, (int)(rsm.sm_match->endp[i] - s));
1850 	li->li_tv.v_type = VAR_STRING;
1851 	li->li_tv.vval.v_string = s;
1852 	li = li->li_next;
1853     }
1854     return argskip + 1;
1855 }
1856 
1857     static void
1858 clear_submatch_list(staticList10_T *sl)
1859 {
1860     int i;
1861 
1862     for (i = 0; i < 10; ++i)
1863 	vim_free(sl->sl_items[i].li_tv.vval.v_string);
1864 }
1865 #endif
1866 
1867 /*
1868  * vim_regsub() - perform substitutions after a vim_regexec() or
1869  * vim_regexec_multi() match.
1870  *
1871  * If "copy" is TRUE really copy into "dest".
1872  * If "copy" is FALSE nothing is copied, this is just to find out the length
1873  * of the result.
1874  *
1875  * If "backslash" is TRUE, a backslash will be removed later, need to double
1876  * them to keep them, and insert a backslash before a CR to avoid it being
1877  * replaced with a line break later.
1878  *
1879  * Note: The matched text must not change between the call of
1880  * vim_regexec()/vim_regexec_multi() and vim_regsub()!  It would make the back
1881  * references invalid!
1882  *
1883  * Returns the size of the replacement, including terminating NUL.
1884  */
1885     int
1886 vim_regsub(
1887     regmatch_T	*rmp,
1888     char_u	*source,
1889     typval_T	*expr,
1890     char_u	*dest,
1891     int		copy,
1892     int		magic,
1893     int		backslash)
1894 {
1895     int		result;
1896     regexec_T	rex_save;
1897     int		rex_in_use_save = rex_in_use;
1898 
1899     if (rex_in_use)
1900 	// Being called recursively, save the state.
1901 	rex_save = rex;
1902     rex_in_use = TRUE;
1903 
1904     rex.reg_match = rmp;
1905     rex.reg_mmatch = NULL;
1906     rex.reg_maxline = 0;
1907     rex.reg_buf = curbuf;
1908     rex.reg_line_lbr = TRUE;
1909     result = vim_regsub_both(source, expr, dest, copy, magic, backslash);
1910 
1911     rex_in_use = rex_in_use_save;
1912     if (rex_in_use)
1913 	rex = rex_save;
1914 
1915     return result;
1916 }
1917 
1918     int
1919 vim_regsub_multi(
1920     regmmatch_T	*rmp,
1921     linenr_T	lnum,
1922     char_u	*source,
1923     char_u	*dest,
1924     int		copy,
1925     int		magic,
1926     int		backslash)
1927 {
1928     int		result;
1929     regexec_T	rex_save;
1930     int		rex_in_use_save = rex_in_use;
1931 
1932     if (rex_in_use)
1933 	// Being called recursively, save the state.
1934 	rex_save = rex;
1935     rex_in_use = TRUE;
1936 
1937     rex.reg_match = NULL;
1938     rex.reg_mmatch = rmp;
1939     rex.reg_buf = curbuf;	// always works on the current buffer!
1940     rex.reg_firstlnum = lnum;
1941     rex.reg_maxline = curbuf->b_ml.ml_line_count - lnum;
1942     rex.reg_line_lbr = FALSE;
1943     result = vim_regsub_both(source, NULL, dest, copy, magic, backslash);
1944 
1945     rex_in_use = rex_in_use_save;
1946     if (rex_in_use)
1947 	rex = rex_save;
1948 
1949     return result;
1950 }
1951 
1952     static int
1953 vim_regsub_both(
1954     char_u	*source,
1955     typval_T	*expr,
1956     char_u	*dest,
1957     int		copy,
1958     int		magic,
1959     int		backslash)
1960 {
1961     char_u	*src;
1962     char_u	*dst;
1963     char_u	*s;
1964     int		c;
1965     int		cc;
1966     int		no = -1;
1967     fptr_T	func_all = (fptr_T)NULL;
1968     fptr_T	func_one = (fptr_T)NULL;
1969     linenr_T	clnum = 0;	// init for GCC
1970     int		len = 0;	// init for GCC
1971 #ifdef FEAT_EVAL
1972     static char_u   *eval_result = NULL;
1973 #endif
1974 
1975     // Be paranoid...
1976     if ((source == NULL && expr == NULL) || dest == NULL)
1977     {
1978 	emsg(_(e_null));
1979 	return 0;
1980     }
1981     if (prog_magic_wrong())
1982 	return 0;
1983     src = source;
1984     dst = dest;
1985 
1986     /*
1987      * When the substitute part starts with "\=" evaluate it as an expression.
1988      */
1989     if (expr != NULL || (source[0] == '\\' && source[1] == '='))
1990     {
1991 #ifdef FEAT_EVAL
1992 	// To make sure that the length doesn't change between checking the
1993 	// length and copying the string, and to speed up things, the
1994 	// resulting string is saved from the call with "copy" == FALSE to the
1995 	// call with "copy" == TRUE.
1996 	if (copy)
1997 	{
1998 	    if (eval_result != NULL)
1999 	    {
2000 		STRCPY(dest, eval_result);
2001 		dst += STRLEN(eval_result);
2002 		VIM_CLEAR(eval_result);
2003 	    }
2004 	}
2005 	else
2006 	{
2007 	    int		    prev_can_f_submatch = can_f_submatch;
2008 	    regsubmatch_T   rsm_save;
2009 
2010 	    vim_free(eval_result);
2011 
2012 	    // The expression may contain substitute(), which calls us
2013 	    // recursively.  Make sure submatch() gets the text from the first
2014 	    // level.
2015 	    if (can_f_submatch)
2016 		rsm_save = rsm;
2017 	    can_f_submatch = TRUE;
2018 	    rsm.sm_match = rex.reg_match;
2019 	    rsm.sm_mmatch = rex.reg_mmatch;
2020 	    rsm.sm_firstlnum = rex.reg_firstlnum;
2021 	    rsm.sm_maxline = rex.reg_maxline;
2022 	    rsm.sm_line_lbr = rex.reg_line_lbr;
2023 
2024 	    if (expr != NULL)
2025 	    {
2026 		typval_T	argv[2];
2027 		char_u		buf[NUMBUFLEN];
2028 		typval_T	rettv;
2029 		staticList10_T	matchList;
2030 		funcexe_T	funcexe;
2031 
2032 		rettv.v_type = VAR_STRING;
2033 		rettv.vval.v_string = NULL;
2034 		argv[0].v_type = VAR_LIST;
2035 		argv[0].vval.v_list = &matchList.sl_list;
2036 		matchList.sl_list.lv_len = 0;
2037 		CLEAR_FIELD(funcexe);
2038 		funcexe.argv_func = fill_submatch_list;
2039 		funcexe.evaluate = TRUE;
2040 		if (expr->v_type == VAR_FUNC)
2041 		{
2042 		    s = expr->vval.v_string;
2043 		    call_func(s, -1, &rettv, 1, argv, &funcexe);
2044 		}
2045 		else if (expr->v_type == VAR_PARTIAL)
2046 		{
2047 		    partial_T   *partial = expr->vval.v_partial;
2048 
2049 		    s = partial_name(partial);
2050 		    funcexe.partial = partial;
2051 		    call_func(s, -1, &rettv, 1, argv, &funcexe);
2052 		}
2053 		if (matchList.sl_list.lv_len > 0)
2054 		    // fill_submatch_list() was called
2055 		    clear_submatch_list(&matchList);
2056 
2057 		if (rettv.v_type == VAR_UNKNOWN)
2058 		    // something failed, no need to report another error
2059 		    eval_result = NULL;
2060 		else
2061 		{
2062 		    eval_result = tv_get_string_buf_chk(&rettv, buf);
2063 		    if (eval_result != NULL)
2064 			eval_result = vim_strsave(eval_result);
2065 		}
2066 		clear_tv(&rettv);
2067 	    }
2068 	    else
2069 		eval_result = eval_to_string(source + 2, NULL, TRUE);
2070 
2071 	    if (eval_result != NULL)
2072 	    {
2073 		int had_backslash = FALSE;
2074 
2075 		for (s = eval_result; *s != NUL; MB_PTR_ADV(s))
2076 		{
2077 		    // Change NL to CR, so that it becomes a line break,
2078 		    // unless called from vim_regexec_nl().
2079 		    // Skip over a backslashed character.
2080 		    if (*s == NL && !rsm.sm_line_lbr)
2081 			*s = CAR;
2082 		    else if (*s == '\\' && s[1] != NUL)
2083 		    {
2084 			++s;
2085 			/* Change NL to CR here too, so that this works:
2086 			 * :s/abc\\\ndef/\="aaa\\\nbbb"/  on text:
2087 			 *   abc\
2088 			 *   def
2089 			 * Not when called from vim_regexec_nl().
2090 			 */
2091 			if (*s == NL && !rsm.sm_line_lbr)
2092 			    *s = CAR;
2093 			had_backslash = TRUE;
2094 		    }
2095 		}
2096 		if (had_backslash && backslash)
2097 		{
2098 		    // Backslashes will be consumed, need to double them.
2099 		    s = vim_strsave_escaped(eval_result, (char_u *)"\\");
2100 		    if (s != NULL)
2101 		    {
2102 			vim_free(eval_result);
2103 			eval_result = s;
2104 		    }
2105 		}
2106 
2107 		dst += STRLEN(eval_result);
2108 	    }
2109 
2110 	    can_f_submatch = prev_can_f_submatch;
2111 	    if (can_f_submatch)
2112 		rsm = rsm_save;
2113 	}
2114 #endif
2115     }
2116     else
2117       while ((c = *src++) != NUL)
2118       {
2119 	if (c == '&' && magic)
2120 	    no = 0;
2121 	else if (c == '\\' && *src != NUL)
2122 	{
2123 	    if (*src == '&' && !magic)
2124 	    {
2125 		++src;
2126 		no = 0;
2127 	    }
2128 	    else if ('0' <= *src && *src <= '9')
2129 	    {
2130 		no = *src++ - '0';
2131 	    }
2132 	    else if (vim_strchr((char_u *)"uUlLeE", *src))
2133 	    {
2134 		switch (*src++)
2135 		{
2136 		case 'u':   func_one = (fptr_T)do_upper;
2137 			    continue;
2138 		case 'U':   func_all = (fptr_T)do_Upper;
2139 			    continue;
2140 		case 'l':   func_one = (fptr_T)do_lower;
2141 			    continue;
2142 		case 'L':   func_all = (fptr_T)do_Lower;
2143 			    continue;
2144 		case 'e':
2145 		case 'E':   func_one = func_all = (fptr_T)NULL;
2146 			    continue;
2147 		}
2148 	    }
2149 	}
2150 	if (no < 0)	      // Ordinary character.
2151 	{
2152 	    if (c == K_SPECIAL && src[0] != NUL && src[1] != NUL)
2153 	    {
2154 		// Copy a special key as-is.
2155 		if (copy)
2156 		{
2157 		    *dst++ = c;
2158 		    *dst++ = *src++;
2159 		    *dst++ = *src++;
2160 		}
2161 		else
2162 		{
2163 		    dst += 3;
2164 		    src += 2;
2165 		}
2166 		continue;
2167 	    }
2168 
2169 	    if (c == '\\' && *src != NUL)
2170 	    {
2171 		// Check for abbreviations -- webb
2172 		switch (*src)
2173 		{
2174 		    case 'r':	c = CAR;	++src;	break;
2175 		    case 'n':	c = NL;		++src;	break;
2176 		    case 't':	c = TAB;	++src;	break;
2177 		 // Oh no!  \e already has meaning in subst pat :-(
2178 		 // case 'e':   c = ESC;	++src;	break;
2179 		    case 'b':	c = Ctrl_H;	++src;	break;
2180 
2181 		    // If "backslash" is TRUE the backslash will be removed
2182 		    // later.  Used to insert a literal CR.
2183 		    default:	if (backslash)
2184 				{
2185 				    if (copy)
2186 					*dst = '\\';
2187 				    ++dst;
2188 				}
2189 				c = *src++;
2190 		}
2191 	    }
2192 	    else if (has_mbyte)
2193 		c = mb_ptr2char(src - 1);
2194 
2195 	    // Write to buffer, if copy is set.
2196 	    if (func_one != (fptr_T)NULL)
2197 		// Turbo C complains without the typecast
2198 		func_one = (fptr_T)(func_one(&cc, c));
2199 	    else if (func_all != (fptr_T)NULL)
2200 		// Turbo C complains without the typecast
2201 		func_all = (fptr_T)(func_all(&cc, c));
2202 	    else // just copy
2203 		cc = c;
2204 
2205 	    if (has_mbyte)
2206 	    {
2207 		int totlen = mb_ptr2len(src - 1);
2208 
2209 		if (copy)
2210 		    mb_char2bytes(cc, dst);
2211 		dst += mb_char2len(cc) - 1;
2212 		if (enc_utf8)
2213 		{
2214 		    int clen = utf_ptr2len(src - 1);
2215 
2216 		    // If the character length is shorter than "totlen", there
2217 		    // are composing characters; copy them as-is.
2218 		    if (clen < totlen)
2219 		    {
2220 			if (copy)
2221 			    mch_memmove(dst + 1, src - 1 + clen,
2222 						     (size_t)(totlen - clen));
2223 			dst += totlen - clen;
2224 		    }
2225 		}
2226 		src += totlen - 1;
2227 	    }
2228 	    else if (copy)
2229 		    *dst = cc;
2230 	    dst++;
2231 	}
2232 	else
2233 	{
2234 	    if (REG_MULTI)
2235 	    {
2236 		clnum = rex.reg_mmatch->startpos[no].lnum;
2237 		if (clnum < 0 || rex.reg_mmatch->endpos[no].lnum < 0)
2238 		    s = NULL;
2239 		else
2240 		{
2241 		    s = reg_getline(clnum) + rex.reg_mmatch->startpos[no].col;
2242 		    if (rex.reg_mmatch->endpos[no].lnum == clnum)
2243 			len = rex.reg_mmatch->endpos[no].col
2244 					    - rex.reg_mmatch->startpos[no].col;
2245 		    else
2246 			len = (int)STRLEN(s);
2247 		}
2248 	    }
2249 	    else
2250 	    {
2251 		s = rex.reg_match->startp[no];
2252 		if (rex.reg_match->endp[no] == NULL)
2253 		    s = NULL;
2254 		else
2255 		    len = (int)(rex.reg_match->endp[no] - s);
2256 	    }
2257 	    if (s != NULL)
2258 	    {
2259 		for (;;)
2260 		{
2261 		    if (len == 0)
2262 		    {
2263 			if (REG_MULTI)
2264 			{
2265 			    if (rex.reg_mmatch->endpos[no].lnum == clnum)
2266 				break;
2267 			    if (copy)
2268 				*dst = CAR;
2269 			    ++dst;
2270 			    s = reg_getline(++clnum);
2271 			    if (rex.reg_mmatch->endpos[no].lnum == clnum)
2272 				len = rex.reg_mmatch->endpos[no].col;
2273 			    else
2274 				len = (int)STRLEN(s);
2275 			}
2276 			else
2277 			    break;
2278 		    }
2279 		    else if (*s == NUL) // we hit NUL.
2280 		    {
2281 			if (copy)
2282 			    emsg(_(e_re_damg));
2283 			goto exit;
2284 		    }
2285 		    else
2286 		    {
2287 			if (backslash && (*s == CAR || *s == '\\'))
2288 			{
2289 			    /*
2290 			     * Insert a backslash in front of a CR, otherwise
2291 			     * it will be replaced by a line break.
2292 			     * Number of backslashes will be halved later,
2293 			     * double them here.
2294 			     */
2295 			    if (copy)
2296 			    {
2297 				dst[0] = '\\';
2298 				dst[1] = *s;
2299 			    }
2300 			    dst += 2;
2301 			}
2302 			else
2303 			{
2304 			    if (has_mbyte)
2305 				c = mb_ptr2char(s);
2306 			    else
2307 				c = *s;
2308 
2309 			    if (func_one != (fptr_T)NULL)
2310 				// Turbo C complains without the typecast
2311 				func_one = (fptr_T)(func_one(&cc, c));
2312 			    else if (func_all != (fptr_T)NULL)
2313 				// Turbo C complains without the typecast
2314 				func_all = (fptr_T)(func_all(&cc, c));
2315 			    else // just copy
2316 				cc = c;
2317 
2318 			    if (has_mbyte)
2319 			    {
2320 				int l;
2321 
2322 				// Copy composing characters separately, one
2323 				// at a time.
2324 				if (enc_utf8)
2325 				    l = utf_ptr2len(s) - 1;
2326 				else
2327 				    l = mb_ptr2len(s) - 1;
2328 
2329 				s += l;
2330 				len -= l;
2331 				if (copy)
2332 				    mb_char2bytes(cc, dst);
2333 				dst += mb_char2len(cc) - 1;
2334 			    }
2335 			    else if (copy)
2336 				    *dst = cc;
2337 			    dst++;
2338 			}
2339 
2340 			++s;
2341 			--len;
2342 		    }
2343 		}
2344 	    }
2345 	    no = -1;
2346 	}
2347       }
2348     if (copy)
2349 	*dst = NUL;
2350 
2351 exit:
2352     return (int)((dst - dest) + 1);
2353 }
2354 
2355 #ifdef FEAT_EVAL
2356 /*
2357  * Call reg_getline() with the line numbers from the submatch.  If a
2358  * substitute() was used the reg_maxline and other values have been
2359  * overwritten.
2360  */
2361     static char_u *
2362 reg_getline_submatch(linenr_T lnum)
2363 {
2364     char_u *s;
2365     linenr_T save_first = rex.reg_firstlnum;
2366     linenr_T save_max = rex.reg_maxline;
2367 
2368     rex.reg_firstlnum = rsm.sm_firstlnum;
2369     rex.reg_maxline = rsm.sm_maxline;
2370 
2371     s = reg_getline(lnum);
2372 
2373     rex.reg_firstlnum = save_first;
2374     rex.reg_maxline = save_max;
2375     return s;
2376 }
2377 
2378 /*
2379  * Used for the submatch() function: get the string from the n'th submatch in
2380  * allocated memory.
2381  * Returns NULL when not in a ":s" command and for a non-existing submatch.
2382  */
2383     char_u *
2384 reg_submatch(int no)
2385 {
2386     char_u	*retval = NULL;
2387     char_u	*s;
2388     int		len;
2389     int		round;
2390     linenr_T	lnum;
2391 
2392     if (!can_f_submatch || no < 0)
2393 	return NULL;
2394 
2395     if (rsm.sm_match == NULL)
2396     {
2397 	/*
2398 	 * First round: compute the length and allocate memory.
2399 	 * Second round: copy the text.
2400 	 */
2401 	for (round = 1; round <= 2; ++round)
2402 	{
2403 	    lnum = rsm.sm_mmatch->startpos[no].lnum;
2404 	    if (lnum < 0 || rsm.sm_mmatch->endpos[no].lnum < 0)
2405 		return NULL;
2406 
2407 	    s = reg_getline_submatch(lnum);
2408 	    if (s == NULL)  // anti-crash check, cannot happen?
2409 		break;
2410 	    s += rsm.sm_mmatch->startpos[no].col;
2411 	    if (rsm.sm_mmatch->endpos[no].lnum == lnum)
2412 	    {
2413 		// Within one line: take form start to end col.
2414 		len = rsm.sm_mmatch->endpos[no].col
2415 					  - rsm.sm_mmatch->startpos[no].col;
2416 		if (round == 2)
2417 		    vim_strncpy(retval, s, len);
2418 		++len;
2419 	    }
2420 	    else
2421 	    {
2422 		// Multiple lines: take start line from start col, middle
2423 		// lines completely and end line up to end col.
2424 		len = (int)STRLEN(s);
2425 		if (round == 2)
2426 		{
2427 		    STRCPY(retval, s);
2428 		    retval[len] = '\n';
2429 		}
2430 		++len;
2431 		++lnum;
2432 		while (lnum < rsm.sm_mmatch->endpos[no].lnum)
2433 		{
2434 		    s = reg_getline_submatch(lnum++);
2435 		    if (round == 2)
2436 			STRCPY(retval + len, s);
2437 		    len += (int)STRLEN(s);
2438 		    if (round == 2)
2439 			retval[len] = '\n';
2440 		    ++len;
2441 		}
2442 		if (round == 2)
2443 		    STRNCPY(retval + len, reg_getline_submatch(lnum),
2444 					     rsm.sm_mmatch->endpos[no].col);
2445 		len += rsm.sm_mmatch->endpos[no].col;
2446 		if (round == 2)
2447 		    retval[len] = NUL;
2448 		++len;
2449 	    }
2450 
2451 	    if (retval == NULL)
2452 	    {
2453 		retval = alloc(len);
2454 		if (retval == NULL)
2455 		    return NULL;
2456 	    }
2457 	}
2458     }
2459     else
2460     {
2461 	s = rsm.sm_match->startp[no];
2462 	if (s == NULL || rsm.sm_match->endp[no] == NULL)
2463 	    retval = NULL;
2464 	else
2465 	    retval = vim_strnsave(s, (int)(rsm.sm_match->endp[no] - s));
2466     }
2467 
2468     return retval;
2469 }
2470 
2471 /*
2472  * Used for the submatch() function with the optional non-zero argument: get
2473  * the list of strings from the n'th submatch in allocated memory with NULs
2474  * represented in NLs.
2475  * Returns a list of allocated strings.  Returns NULL when not in a ":s"
2476  * command, for a non-existing submatch and for any error.
2477  */
2478     list_T *
2479 reg_submatch_list(int no)
2480 {
2481     char_u	*s;
2482     linenr_T	slnum;
2483     linenr_T	elnum;
2484     colnr_T	scol;
2485     colnr_T	ecol;
2486     int		i;
2487     list_T	*list;
2488     int		error = FALSE;
2489 
2490     if (!can_f_submatch || no < 0)
2491 	return NULL;
2492 
2493     if (rsm.sm_match == NULL)
2494     {
2495 	slnum = rsm.sm_mmatch->startpos[no].lnum;
2496 	elnum = rsm.sm_mmatch->endpos[no].lnum;
2497 	if (slnum < 0 || elnum < 0)
2498 	    return NULL;
2499 
2500 	scol = rsm.sm_mmatch->startpos[no].col;
2501 	ecol = rsm.sm_mmatch->endpos[no].col;
2502 
2503 	list = list_alloc();
2504 	if (list == NULL)
2505 	    return NULL;
2506 
2507 	s = reg_getline_submatch(slnum) + scol;
2508 	if (slnum == elnum)
2509 	{
2510 	    if (list_append_string(list, s, ecol - scol) == FAIL)
2511 		error = TRUE;
2512 	}
2513 	else
2514 	{
2515 	    if (list_append_string(list, s, -1) == FAIL)
2516 		error = TRUE;
2517 	    for (i = 1; i < elnum - slnum; i++)
2518 	    {
2519 		s = reg_getline_submatch(slnum + i);
2520 		if (list_append_string(list, s, -1) == FAIL)
2521 		    error = TRUE;
2522 	    }
2523 	    s = reg_getline_submatch(elnum);
2524 	    if (list_append_string(list, s, ecol) == FAIL)
2525 		error = TRUE;
2526 	}
2527     }
2528     else
2529     {
2530 	s = rsm.sm_match->startp[no];
2531 	if (s == NULL || rsm.sm_match->endp[no] == NULL)
2532 	    return NULL;
2533 	list = list_alloc();
2534 	if (list == NULL)
2535 	    return NULL;
2536 	if (list_append_string(list, s,
2537 				 (int)(rsm.sm_match->endp[no] - s)) == FAIL)
2538 	    error = TRUE;
2539     }
2540 
2541     if (error)
2542     {
2543 	list_free(list);
2544 	return NULL;
2545     }
2546     return list;
2547 }
2548 #endif
2549 
2550 /*
2551  * Initialize the values used for matching against multiple lines
2552  */
2553     static void
2554 init_regexec_multi(
2555 	regmmatch_T	*rmp,
2556 	win_T		*win,	// window in which to search or NULL
2557 	buf_T		*buf,	// buffer in which to search
2558 	linenr_T	lnum)	// nr of line to start looking for match
2559 {
2560     rex.reg_match = NULL;
2561     rex.reg_mmatch = rmp;
2562     rex.reg_buf = buf;
2563     rex.reg_win = win;
2564     rex.reg_firstlnum = lnum;
2565     rex.reg_maxline = rex.reg_buf->b_ml.ml_line_count - lnum;
2566     rex.reg_line_lbr = FALSE;
2567     rex.reg_ic = rmp->rmm_ic;
2568     rex.reg_icombine = FALSE;
2569     rex.reg_maxcol = rmp->rmm_maxcol;
2570 }
2571 
2572 #include "regexp_bt.c"
2573 
2574 static regengine_T bt_regengine =
2575 {
2576     bt_regcomp,
2577     bt_regfree,
2578     bt_regexec_nl,
2579     bt_regexec_multi,
2580     (char_u *)""
2581 };
2582 
2583 #include "regexp_nfa.c"
2584 
2585 static regengine_T nfa_regengine =
2586 {
2587     nfa_regcomp,
2588     nfa_regfree,
2589     nfa_regexec_nl,
2590     nfa_regexec_multi,
2591     (char_u *)""
2592 };
2593 
2594 // Which regexp engine to use? Needed for vim_regcomp().
2595 // Must match with 'regexpengine'.
2596 static int regexp_engine = 0;
2597 
2598 #ifdef DEBUG
2599 static char_u regname[][30] = {
2600 		    "AUTOMATIC Regexp Engine",
2601 		    "BACKTRACKING Regexp Engine",
2602 		    "NFA Regexp Engine"
2603 			    };
2604 #endif
2605 
2606 /*
2607  * Compile a regular expression into internal code.
2608  * Returns the program in allocated memory.
2609  * Use vim_regfree() to free the memory.
2610  * Returns NULL for an error.
2611  */
2612     regprog_T *
2613 vim_regcomp(char_u *expr_arg, int re_flags)
2614 {
2615     regprog_T   *prog = NULL;
2616     char_u	*expr = expr_arg;
2617     int		called_emsg_before;
2618 
2619     regexp_engine = p_re;
2620 
2621     // Check for prefix "\%#=", that sets the regexp engine
2622     if (STRNCMP(expr, "\\%#=", 4) == 0)
2623     {
2624 	int newengine = expr[4] - '0';
2625 
2626 	if (newengine == AUTOMATIC_ENGINE
2627 	    || newengine == BACKTRACKING_ENGINE
2628 	    || newengine == NFA_ENGINE)
2629 	{
2630 	    regexp_engine = expr[4] - '0';
2631 	    expr += 5;
2632 #ifdef DEBUG
2633 	    smsg("New regexp mode selected (%d): %s",
2634 					   regexp_engine, regname[newengine]);
2635 #endif
2636 	}
2637 	else
2638 	{
2639 	    emsg(_("E864: \\%#= can only be followed by 0, 1, or 2. The automatic engine will be used "));
2640 	    regexp_engine = AUTOMATIC_ENGINE;
2641 	}
2642     }
2643 #ifdef DEBUG
2644     bt_regengine.expr = expr;
2645     nfa_regengine.expr = expr;
2646 #endif
2647     // reg_iswordc() uses rex.reg_buf
2648     rex.reg_buf = curbuf;
2649 
2650     /*
2651      * First try the NFA engine, unless backtracking was requested.
2652      */
2653     called_emsg_before = called_emsg;
2654     if (regexp_engine != BACKTRACKING_ENGINE)
2655 	prog = nfa_regengine.regcomp(expr,
2656 		re_flags + (regexp_engine == AUTOMATIC_ENGINE ? RE_AUTO : 0));
2657     else
2658 	prog = bt_regengine.regcomp(expr, re_flags);
2659 
2660     // Check for error compiling regexp with initial engine.
2661     if (prog == NULL)
2662     {
2663 #ifdef BT_REGEXP_DEBUG_LOG
2664 	if (regexp_engine != BACKTRACKING_ENGINE)   // debugging log for NFA
2665 	{
2666 	    FILE *f;
2667 	    f = fopen(BT_REGEXP_DEBUG_LOG_NAME, "a");
2668 	    if (f)
2669 	    {
2670 		fprintf(f, "Syntax error in \"%s\"\n", expr);
2671 		fclose(f);
2672 	    }
2673 	    else
2674 		semsg("(NFA) Could not open \"%s\" to write !!!",
2675 			BT_REGEXP_DEBUG_LOG_NAME);
2676 	}
2677 #endif
2678 	/*
2679 	 * If the NFA engine failed, try the backtracking engine.
2680 	 * The NFA engine also fails for patterns that it can't handle well
2681 	 * but are still valid patterns, thus a retry should work.
2682 	 * But don't try if an error message was given.
2683 	 */
2684 	if (regexp_engine == AUTOMATIC_ENGINE
2685 					  && called_emsg == called_emsg_before)
2686 	{
2687 	    regexp_engine = BACKTRACKING_ENGINE;
2688 	    prog = bt_regengine.regcomp(expr, re_flags);
2689 	}
2690     }
2691 
2692     if (prog != NULL)
2693     {
2694 	// Store the info needed to call regcomp() again when the engine turns
2695 	// out to be very slow when executing it.
2696 	prog->re_engine = regexp_engine;
2697 	prog->re_flags  = re_flags;
2698     }
2699 
2700     return prog;
2701 }
2702 
2703 /*
2704  * Free a compiled regexp program, returned by vim_regcomp().
2705  */
2706     void
2707 vim_regfree(regprog_T *prog)
2708 {
2709     if (prog != NULL)
2710 	prog->engine->regfree(prog);
2711 }
2712 
2713 #if defined(EXITFREE) || defined(PROTO)
2714     void
2715 free_regexp_stuff(void)
2716 {
2717     ga_clear(&regstack);
2718     ga_clear(&backpos);
2719     vim_free(reg_tofree);
2720     vim_free(reg_prev_sub);
2721 }
2722 #endif
2723 
2724 #ifdef FEAT_EVAL
2725     static void
2726 report_re_switch(char_u *pat)
2727 {
2728     if (p_verbose > 0)
2729     {
2730 	verbose_enter();
2731 	msg_puts(_("Switching to backtracking RE engine for pattern: "));
2732 	msg_puts((char *)pat);
2733 	verbose_leave();
2734     }
2735 }
2736 #endif
2737 
2738 #if (defined(FEAT_X11) && (defined(FEAT_TITLE) || defined(FEAT_XCLIPBOARD))) \
2739 	|| defined(PROTO)
2740 /*
2741  * Return whether "prog" is currently being executed.
2742  */
2743     int
2744 regprog_in_use(regprog_T *prog)
2745 {
2746     return prog->re_in_use;
2747 }
2748 #endif
2749 
2750 /*
2751  * Match a regexp against a string.
2752  * "rmp->regprog" is a compiled regexp as returned by vim_regcomp().
2753  * Note: "rmp->regprog" may be freed and changed.
2754  * Uses curbuf for line count and 'iskeyword'.
2755  * When "nl" is TRUE consider a "\n" in "line" to be a line break.
2756  *
2757  * Return TRUE if there is a match, FALSE if not.
2758  */
2759     static int
2760 vim_regexec_string(
2761     regmatch_T	*rmp,
2762     char_u	*line,  // string to match against
2763     colnr_T	col,    // column to start looking for match
2764     int		nl)
2765 {
2766     int		result;
2767     regexec_T	rex_save;
2768     int		rex_in_use_save = rex_in_use;
2769 
2770     // Cannot use the same prog recursively, it contains state.
2771     if (rmp->regprog->re_in_use)
2772     {
2773 	emsg(_(e_recursive));
2774 	return FALSE;
2775     }
2776     rmp->regprog->re_in_use = TRUE;
2777 
2778     if (rex_in_use)
2779 	// Being called recursively, save the state.
2780 	rex_save = rex;
2781     rex_in_use = TRUE;
2782 
2783     rex.reg_startp = NULL;
2784     rex.reg_endp = NULL;
2785     rex.reg_startpos = NULL;
2786     rex.reg_endpos = NULL;
2787 
2788     result = rmp->regprog->engine->regexec_nl(rmp, line, col, nl);
2789     rmp->regprog->re_in_use = FALSE;
2790 
2791     // NFA engine aborted because it's very slow.
2792     if (rmp->regprog->re_engine == AUTOMATIC_ENGINE
2793 					       && result == NFA_TOO_EXPENSIVE)
2794     {
2795 	int    save_p_re = p_re;
2796 	int    re_flags = rmp->regprog->re_flags;
2797 	char_u *pat = vim_strsave(((nfa_regprog_T *)rmp->regprog)->pattern);
2798 
2799 	p_re = BACKTRACKING_ENGINE;
2800 	vim_regfree(rmp->regprog);
2801 	if (pat != NULL)
2802 	{
2803 #ifdef FEAT_EVAL
2804 	    report_re_switch(pat);
2805 #endif
2806 	    rmp->regprog = vim_regcomp(pat, re_flags);
2807 	    if (rmp->regprog != NULL)
2808 	    {
2809 		rmp->regprog->re_in_use = TRUE;
2810 		result = rmp->regprog->engine->regexec_nl(rmp, line, col, nl);
2811 		rmp->regprog->re_in_use = FALSE;
2812 	    }
2813 	    vim_free(pat);
2814 	}
2815 
2816 	p_re = save_p_re;
2817     }
2818 
2819     rex_in_use = rex_in_use_save;
2820     if (rex_in_use)
2821 	rex = rex_save;
2822 
2823     return result > 0;
2824 }
2825 
2826 /*
2827  * Note: "*prog" may be freed and changed.
2828  * Return TRUE if there is a match, FALSE if not.
2829  */
2830     int
2831 vim_regexec_prog(
2832     regprog_T	**prog,
2833     int		ignore_case,
2834     char_u	*line,
2835     colnr_T	col)
2836 {
2837     int		r;
2838     regmatch_T	regmatch;
2839 
2840     regmatch.regprog = *prog;
2841     regmatch.rm_ic = ignore_case;
2842     r = vim_regexec_string(&regmatch, line, col, FALSE);
2843     *prog = regmatch.regprog;
2844     return r;
2845 }
2846 
2847 /*
2848  * Note: "rmp->regprog" may be freed and changed.
2849  * Return TRUE if there is a match, FALSE if not.
2850  */
2851     int
2852 vim_regexec(regmatch_T *rmp, char_u *line, colnr_T col)
2853 {
2854     return vim_regexec_string(rmp, line, col, FALSE);
2855 }
2856 
2857 /*
2858  * Like vim_regexec(), but consider a "\n" in "line" to be a line break.
2859  * Note: "rmp->regprog" may be freed and changed.
2860  * Return TRUE if there is a match, FALSE if not.
2861  */
2862     int
2863 vim_regexec_nl(regmatch_T *rmp, char_u *line, colnr_T col)
2864 {
2865     return vim_regexec_string(rmp, line, col, TRUE);
2866 }
2867 
2868 /*
2869  * Match a regexp against multiple lines.
2870  * "rmp->regprog" must be a compiled regexp as returned by vim_regcomp().
2871  * Note: "rmp->regprog" may be freed and changed, even set to NULL.
2872  * Uses curbuf for line count and 'iskeyword'.
2873  *
2874  * Return zero if there is no match.  Return number of lines contained in the
2875  * match otherwise.
2876  */
2877     long
2878 vim_regexec_multi(
2879     regmmatch_T *rmp,
2880     win_T       *win,		// window in which to search or NULL
2881     buf_T       *buf,		// buffer in which to search
2882     linenr_T	lnum,		// nr of line to start looking for match
2883     colnr_T	col,		// column to start looking for match
2884     proftime_T	*tm,		// timeout limit or NULL
2885     int		*timed_out)	// flag is set when timeout limit reached
2886 {
2887     int		result;
2888     regexec_T	rex_save;
2889     int		rex_in_use_save = rex_in_use;
2890 
2891     // Cannot use the same prog recursively, it contains state.
2892     if (rmp->regprog->re_in_use)
2893     {
2894 	emsg(_(e_recursive));
2895 	return FALSE;
2896     }
2897     rmp->regprog->re_in_use = TRUE;
2898 
2899     if (rex_in_use)
2900 	// Being called recursively, save the state.
2901 	rex_save = rex;
2902     rex_in_use = TRUE;
2903 
2904     result = rmp->regprog->engine->regexec_multi(
2905 				      rmp, win, buf, lnum, col, tm, timed_out);
2906     rmp->regprog->re_in_use = FALSE;
2907 
2908     // NFA engine aborted because it's very slow.
2909     if (rmp->regprog->re_engine == AUTOMATIC_ENGINE
2910 					       && result == NFA_TOO_EXPENSIVE)
2911     {
2912 	int    save_p_re = p_re;
2913 	int    re_flags = rmp->regprog->re_flags;
2914 	char_u *pat = vim_strsave(((nfa_regprog_T *)rmp->regprog)->pattern);
2915 
2916 	p_re = BACKTRACKING_ENGINE;
2917 	vim_regfree(rmp->regprog);
2918 	if (pat != NULL)
2919 	{
2920 #ifdef FEAT_EVAL
2921 	    report_re_switch(pat);
2922 #endif
2923 #ifdef FEAT_SYN_HL
2924 	    // checking for \z misuse was already done when compiling for NFA,
2925 	    // allow all here
2926 	    reg_do_extmatch = REX_ALL;
2927 #endif
2928 	    rmp->regprog = vim_regcomp(pat, re_flags);
2929 #ifdef FEAT_SYN_HL
2930 	    reg_do_extmatch = 0;
2931 #endif
2932 
2933 	    if (rmp->regprog != NULL)
2934 	    {
2935 		rmp->regprog->re_in_use = TRUE;
2936 		result = rmp->regprog->engine->regexec_multi(
2937 				      rmp, win, buf, lnum, col, tm, timed_out);
2938 		rmp->regprog->re_in_use = FALSE;
2939 	    }
2940 	    vim_free(pat);
2941 	}
2942 	p_re = save_p_re;
2943     }
2944 
2945     rex_in_use = rex_in_use_save;
2946     if (rex_in_use)
2947 	rex = rex_save;
2948 
2949     return result <= 0 ? 0 : result;
2950 }
2951