When blk_full() handles an .It line in .Bl -column and indirectly

calls phrase_ta() to handle a .Ta child macro, advance the body
pointer accordingly, such that a subsequent tab character rewinds
the right body block and doesn't fail an assertion.  That happened
when there was nothing between the .Ta and the tab character.
Bug reported by tim@ some time ago.

diff --git a/usr.bin/mandoc/mdoc_macro.c b/usr.bin/mandoc/mdoc_macro.c
index fe74b5e..7f53a3a 100644 (file)
--- a/usr.bin/mandoc/mdoc_macro.c
+++ b/usr.bin/mandoc/mdoc_macro.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: mdoc_macro.c,v 1.159 2015/10/12 00:07:27 schwarze Exp $ */
+/*     $OpenBSD: mdoc_macro.c,v 1.160 2015/10/15 22:27:09 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010, 2012-2015 Ingo Schwarze <schwarze@openbsd.org>
@@ -1106,6 +1106,11 @@ blk_full(MACRO_PROT_ARGS)
                                mdoc->flags |= MDOC_PPHRASE;
                        parse_rest(mdoc, TOKEN_NONE, line, &la, buf);
                        mdoc->flags &= ~MDOC_PPHRASE;
+
+                       /* There may have been `Ta' macros. */
+
+                       while (body->next != NULL)
+                               body = body->next;
                        continue;
                }