lemon: sync with upstream (2018-09-08)

Changes:
- Drop the old basename modification that was present in the Wireshark
  version of lemon.c. Use a new option available since 2018-04-20
  ("Add the -dDIRECTORY command-line option to LEMON.")
- Redo the static analyzer warning fixes, identifying the root causes
  and adding assertions instead of hiding code with __clang_analyzer__.
- Ignore compiler warnings instead of adding config.h, _U_, extra const
  keywords, unsigned/signed changes, etc.
- Remove lemon.html, it is out-of-date and external links are available.

In order to make future updates easier, document the exact steps that
were followed to create the lemon.c and lempar.c files. Future changes
SHOULD follow the same process.

My process to reach this updated lemon version:
1. Identify previous sync. Found v2.5.2rc0-147-g653af0f6d0 ("lemon: Sync
   with latest trunk.") which seems based on sqlite commit 2b3d584ffe.
2. Check successive Wireshark patches. Identified many non-functional
   changes to silence compiler warnings and static analyzer issues.
   Found one feature (basename) that can be replaced with upstream -d.
3. Write minimal patches and document changes.

Upstream typos and coding style issues (other than trailing whitespace)
were deliberately not fixed to remain as close as possible to upstream.

Change-Id: I606f46dede86e34520f962a9e7163912392aad57
Reviewed-on: https://code.wireshark.org/review/30290
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>

15 files changed, 915 insertions, 1519 deletions

diff --git a/cmake/modules/UseLemon.cmake b/cmake/modules/UseLemon.cmake
index 9332b151f6..849ffc1c87 100644
--- a/cmake/modules/UseLemon.cmake
+++ b/cmake/modules/UseLemon.cmake
@@ -14,7 +14,8 @@ MACRO(ADD_LEMON_FILES _source _generated)
           ${_out}.h
           ${_out}.out
          COMMAND lemon
-           T=${_lemonpardir}/lempar.c
+           -T${_lemonpardir}/lempar.c
+           -d.
            ${_in}
          DEPENDS
            ${_in}
diff --git a/tools/lemon/CMakeLists.txt b/tools/lemon/CMakeLists.txt
index bb073969bf..856d226ea6 100644
--- a/tools/lemon/CMakeLists.txt
+++ b/tools/lemon/CMakeLists.txt
@@ -7,31 +7,52 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 #
 
-set(lemon_FILES
-	lemon.c
-)
-
-set_source_files_properties(
-	${lemon_FILES}
+# To keep lemon.c as close to upstream as possible, deliberately ignore
+# some stylistic issues.
+set(lemon_cflags)
+if(NOT CMAKE_C_COMPILER_ID MATCHES "MSVC")
+	# Includes warnings from ENABLE_EXTRA_COMPILER_WARNINGS as well
+	set(lemon_cflags_test
+		# GCC 8.2.1 is not smart enough to recognize "Fall thru ..."
+		-Wimplicit-fallthrough
+		-Wsign-compare
+		-Wunused-parameter
+		-Wshorten-64-to-32
+		# From WIRESHARK_C_ONLY_FLAGS
+		-Wc++-compat
+		-Wold-style-definition
+		-Wstrict-prototypes
+	)
+	if(ENABLE_EXTRA_COMPILER_WARNINGS)
+		list(APPEND lemon_cflags_test
+			-Wpedantic
+			-Wstrict-overflow
+			-Wcast-qual
+			-Wredundant-decls
+			-Wmissing-prototypes
+			-Wmissing-declarations
+			-Wcast-align
+		)
+	endif()
+	foreach(THIS_FLAG IN LISTS lemon_cflags_test)
+		string(MAKE_C_IDENTIFIER "C${THIS_FLAG}_VALID" _flag_var)
+		check_c_linker_flag(${THIS_FLAG} ${_flag_var})
+		if(${_flag_var})
+			# Look for -Wfoo flags above in case it is cached, but
+			# actually disable the warning here with -Wno-foo.
+			string(REPLACE "-W" "-Wno-" THIS_FLAG "${THIS_FLAG}")
+			list(APPEND lemon_cflags ${THIS_FLAG})
+		endif()
+	endforeach()
+endif()
+set_source_files_properties(lemon.c
 	PROPERTIES
-	COMPILE_FLAGS "${WERROR_COMMON_FLAGS} ${NO_SANITIZE_CFLAGS}"
-)
-
-set(lemon_LIBS
-	# Do we need something here on any platform?
+	COMPILE_OPTIONS "${lemon_cflags}"
 )
-
-add_executable(lemon ${lemon_FILES})
-
-set_target_properties(lemon PROPERTIES
-	FOLDER "tools"
-	LINK_FLAGS "${NO_SANITIZE_LDFLAGS}"
-)
-
-target_link_libraries(lemon ${lemon_LIBS})
+add_executable(lemon lemon.c)
 
 #
-# Editor modelines  -  http://www.wireshark.org/tools/modelines.html
+# Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 #
 # Local variables:
 # c-basic-offset: 8
diff --git a/tools/lemon/README b/tools/lemon/README
index 67aa178580..b407ea8e75 100644
--- a/tools/lemon/README
+++ b/tools/lemon/README
@@ -1,18 +1,43 @@
-The Lemon Parser Generator's home page is:
+The Lemon Parser Generator's home page is:  https://www.hwaci.com/sw/lemon/
+Lemon seems now to be maintained at:        https://sqlite.org/lemon.html
 
-http://www.hwaci.com/sw/lemon/index.html
-Lemon seems now to be maintaned at :
-http://www.sqlite.org/
+Documentation is available at:  https://sqlite.org/src/doc/trunk/doc/lemon.html
+Git mirror of the upstream Fossil repository: https://github.com/mackyle/sqlite
 
-The file in this directory, lemon.html, was obtained from:
+The lempar.c and lemon.c are taken from sqlite and are modified as little as
+possible to make it easier to synchronize changes. Last updated at:
 
-http://www.hwaci.com/sw/lemon/lemon.html
+    commit 1150d3841d9381555a4b427835fd617d3465040d
+    Date:   Sat Sep 8 16:55:18 2018 +0000
+    Add a missing call to free() in Lemon.
 
-lemon.c has been modified to include the t= and d= command-line
-arguments. The changes were submitted to the Lemon maintainer,
-but have not appeared in the official Lemon distribution.
+To check for changes (adjust "previous commit" accordingly):
 
+    git clone --depth=1000 https://github.com/mackyle/sqlite
+    cd sqlite/tools
+    git log -p 1150d3841d.. lemon.c lempar.c
 
-A copy of all Wireshark changes are available at
-  https://github.com/alagoutte/sqlite/tree/wireshark
+To create a Wireshark version (steps 1-3) and validate the result (steps 4-5):
+1. Copy the two files.
+2. Run ./apply-patches.sh to apply local patches.
+3. Update the commit in this README (to ensure the base is known).
+4. Check for CSA warnings:  clang-check -analyze lemon.c --
+5. Build and run lemon:     ninja epan/dfilter/grammar.c
 
+The patches to lemon to silence compiler warnings and static analysis reports
+(for edge cases that cannot occur) are not proposed upstream because that
+process is difficult. From <https://www.sqlite.org/copyright.html>:
+
+    SQLite is open-source, meaning that you can make as many copies of it as you
+    want and do whatever you want with those copies, without limitation. But
+    SQLite is not open-contribution. In order to keep SQLite in the public
+    domain and ensure that the code does not become contaminated with
+    proprietary or licensed content, the project does not accept patches from
+    unknown persons.
+
+A note about the Lemon patches, we have no intention to fork Lemon and maintain
+it. These patches are written to address static analyzer warnings without
+actually modifying the functionality. If upstream is willing to accept patches,
+then that would be great and the intention is to make it as easy as possible.
+The lemon and lempar patches are dedicated to the public domain. (IANAL, but I
+hope this is sufficient.)
diff --git a/tools/lemon/apply-patches.sh b/tools/lemon/apply-patches.sh
new file mode 100755
index 0000000000..5ffb47c372
--- /dev/null
+++ b/tools/lemon/apply-patches.sh
@@ -0,0 +1,14 @@
+#!/bin/sh -e
+# Patch lemon.c and lempar.c to silence static analyzer warnings.
+# See also tools/lemon/README
+
+# Strip trailing whitespace
+sed -e 's/ \+$//' -i lemon.c lempar.c
+
+# Other patches
+for i in patches/*.patch; do
+    echo "Applying $i"
+    patch --silent -p1 -i "$i"
+done
+
+echo DONE
diff --git a/tools/lemon/lemon.c b/tools/lemon/lemon.c
index f2e541a549..ce4e364ba5 100644
--- a/tools/lemon/lemon.c
+++ b/tools/lemon/lemon.c
@@ -6,9 +6,6 @@
 **
 ** The author of this program disclaims copyright.
 */
-
-#include <config.h>
-
 #include <stdio.h>
 #include <stdarg.h>
 #include <string.h>
@@ -16,8 +13,6 @@
 #include <stdlib.h>
 #include <assert.h>
 
-#include "ws_attributes.h"
-
 #define ISSPACE(X) isspace((unsigned char)(X))
 #define ISDIGIT(X) isdigit((unsigned char)(X))
 #define ISALNUM(X) isalnum((unsigned char)(X))
@@ -44,8 +39,8 @@ extern int access(const char *path, int mode);
 #include <unistd.h>
 #endif
 
-#define PRIVATE static
-/* #define PRIVATE */
+/* #define PRIVATE static */
+#define PRIVATE
 
 #ifdef TEST
 #define MAXRHS 5       /* Set low to exercise exception code */
@@ -196,10 +191,8 @@ void Configlist_reset(void);
 void ErrorMsg(const char *, int,const char *, ...);
 
 /****** From the file "option.h" ******************************************/
-enum option_type {
-    OPT_FLAG=1,  OPT_INT,  OPT_DBL,  OPT_STR,
-    OPT_FFLAG, OPT_FINT, OPT_FDBL, OPT_FSTR
-};
+enum option_type { OPT_FLAG=1,  OPT_INT,  OPT_DBL,  OPT_STR,
+         OPT_FFLAG, OPT_FINT, OPT_FDBL, OPT_FSTR};
 struct s_options {
   enum option_type type;
   const char *label;
@@ -209,9 +202,7 @@ struct s_options {
 int    OptInit(char**,struct s_options*,FILE*);
 int    OptNArgs(void);
 char  *OptArg(int);
-#if 0
 void   OptErr(int);
-#endif
 void   OptPrint(void);
 
 /******** From the file "parse.h" *****************************************/
@@ -279,6 +270,8 @@ struct symbol {
   int dtnum;               /* The data type number.  In the parser, the value
                            ** stack is a union.  The .yy%d element of this
                            ** union is the correct data type for this object */
+  int bContent;            /* True if this symbol ever carries content - if
+                           ** it is ever more than just syntax */
   /* The following fields are used by MULTITERMINALs only */
   int nsubsym;             /* Number of constituent symbols in the MULTI */
   struct symbol **subsym;  /* Array of constituent symbols */
@@ -405,6 +398,7 @@ struct lemon {
   struct symbol *wildcard; /* Token that matches anything */
   char *name;              /* Name of the generated parser */
   char *arg;               /* Declaration of the 3th argument to parser */
+  char *ctx;               /* Declaration of 2nd argument to constructor */
   char *tokentype;         /* Type of terminal symbols in the parser stack */
   char *vartype;           /* The default type of non-terminal symbols */
   char *start;             /* Name of the start symbol for the grammar */
@@ -418,7 +412,6 @@ struct lemon {
   char *tokendest;         /* Code to execute to destroy token data */
   char *vardest;           /* Code for the default non-terminal destructor */
   char *filename;          /* Name of the input file */
-  char *basename;          /* Basename of inputer file (no directory or path) */
   char *outname;           /* Name of the current output file */
   char *tokenprefix;       /* A prefix added to token names in the .h file */
   int nconflict;           /* Number of parsing conflicts */
@@ -432,8 +425,8 @@ struct lemon {
 };
 
 #define MemoryCheck(X) if((X)==0){ \
-  fprintf(stderr,"Out of memory.  Aborting...\n"); \
-  exit(1); \
+  extern void memory_error(); \
+  memory_error(); \
 }
 
 /**************** From the file "table.h" *********************************/
@@ -540,13 +533,12 @@ static struct action *Action_sort(
   return ap;
 }
 
-PRIVATE void Action_add(
+void Action_add(
   struct action **app,
   enum e_action type,
   struct symbol *sp,
   char *arg
 ){
-  assert(app);
   struct action *newaction;
   newaction = Action_new();
   newaction->next = *app;
@@ -615,23 +607,23 @@ struct acttab {
 #define acttab_yylookahead(X,N)  ((X)->aAction[N].lookahead)
 
 /* Free all memory associated with the given acttab */
-PRIVATE void acttab_free(acttab *p){
+void acttab_free(acttab *p){
   free( p->aAction );
   free( p->aLookahead );
   free( p );
 }
 
 /* Allocate a new acttab structure */
-PRIVATE acttab *acttab_alloc(int nsymbol, int nterminal) {
-    acttab *p = (acttab *)calloc(1, sizeof(*p));
-    if (p == 0) {
-        fprintf(stderr, "Unable to allocate memory for a new acttab.");
-        exit(1);
-    }
-    memset(p, 0, sizeof(*p));
-    p->nsymbol = nsymbol;
-    p->nterminal = nterminal;
-    return p;
+acttab *acttab_alloc(int nsymbol, int nterminal){
+  acttab *p = (acttab *) calloc( 1, sizeof(*p) );
+  if( p==0 ){
+    fprintf(stderr,"Unable to allocate memory for a new acttab.");
+    exit(1);
+  }
+  memset(p, 0, sizeof(*p));
+  p->nsymbol = nsymbol;
+  p->nterminal = nterminal;
+  return p;
 }
 
 /* Add a new action to the current transaction set.
@@ -639,14 +631,14 @@ PRIVATE acttab *acttab_alloc(int nsymbol, int nterminal) {
 ** This routine is called once for each lookahead for a particular
 ** state.
 */
-PRIVATE void acttab_action(acttab *p, int lookahead, int action){
+void acttab_action(acttab *p, int lookahead, int action){
   if( p->nLookahead>=p->nLookaheadAlloc ){
     p->nLookaheadAlloc += 25;
     p->aLookahead = (struct lookahead_action *) realloc( p->aLookahead,
                              sizeof(p->aLookahead[0])*p->nLookaheadAlloc );
-    if (p->aLookahead == 0) {
-        fprintf(stderr, "malloc failed\n");
-        exit(1);
+    if( p->aLookahead==0 ){
+      fprintf(stderr,"malloc failed\n");
+      exit(1);
     }
   }
   if( p->nLookahead==0 ){
@@ -680,9 +672,9 @@ PRIVATE void acttab_action(acttab *p, int lookahead, int action){
 ** a smaller table.  For non-terminal symbols, which are never syntax errors,
 ** makeItSafe can be false.
 */
-PRIVATE int acttab_insert(acttab *p, int makeItSafe) {
-    int i, j, k, n, end;
-    assert(p->nLookahead>0);
+int acttab_insert(acttab *p, int makeItSafe){
+  int i, j, k, n, end;
+  assert( p->nLookahead>0 );
 
   /* Make sure we have enough space to hold the expanded action table
   ** in the worst case.  The worst case occurs if the transaction set
@@ -694,15 +686,17 @@ PRIVATE int acttab_insert(acttab *p, int makeItSafe) {
     p->nActionAlloc = p->nAction + n + p->nActionAlloc + 20;
     p->aAction = (struct lookahead_action *) realloc( p->aAction,
                           sizeof(p->aAction[0])*p->nActionAlloc);
-    if (p->aAction == 0) {
-        fprintf(stderr, "malloc failed\n");
-        exit(1);
+    if( p->aAction==0 ){
+      fprintf(stderr,"malloc failed\n");
+      exit(1);
     }
+    assert(oldAlloc < p->nActionAlloc);     /* hint for CSA */
     for(i=oldAlloc; i<p->nActionAlloc; i++){
       p->aAction[i].lookahead = -1;
       p->aAction[i].action = -1;
     }
   }
+  assert(p->aAction);  /* Hint for CSA (for p->aAction[i] below) */
 
   /* Scan the existing action table looking for an offset that is a
   ** duplicate of the current transaction set.  Fall out of the loop
@@ -711,7 +705,7 @@ PRIVATE int acttab_insert(acttab *p, int makeItSafe) {
   ** i is the index in p->aAction[] where p->mnLookahead is inserted.
   */
   end = makeItSafe ? p->mnLookahead : 0;
-  for (i = p->nAction - 1; i >= end; i--) {
+  for(i=p->nAction-1; i>=end; i--){
     if( p->aAction[i].lookahead==p->mnLookahead ){
       /* All lookaheads and actions in the aLookahead[] transaction
       ** must match against the candidate aAction[i] entry. */
@@ -741,13 +735,13 @@ PRIVATE int acttab_insert(acttab *p, int makeItSafe) {
   ** an empty offset in the aAction[] table in which we can add the
   ** aLookahead[] transaction.
   */
-  if (i<end) {
+  if( i<end ){
     /* Look for holes in the aAction[] table that fit the current
     ** aLookahead[] transaction.  Leave i set to the offset of the hole.
     ** If no holes are found, i is left at p->nAction, which means the
     ** transaction will be appended. */
-      i = makeItSafe ? p->mnLookahead : 0;
-      for (; i<p->nActionAlloc - p->mxLookahead; i++) {
+    i = makeItSafe ? p->mnLookahead : 0;
+    for(; i<p->nActionAlloc - p->mxLookahead; i++){
       if( p->aAction[i].lookahead<0 ){
         for(j=0; j<p->nLookahead; j++){
           k = p->aLookahead[j].lookahead - p->mnLookahead + i;
@@ -767,8 +761,8 @@ PRIVATE int acttab_insert(acttab *p, int makeItSafe) {
   /* Insert transaction set at index i. */
 #if 0
   printf("Acttab:");
-  for (j = 0; j<p->nLookahead; j++) {
-      printf(" %d", p->aLookahead[j].lookahead);
+  for(j=0; j<p->nLookahead; j++){
+    printf(" %d", p->aLookahead[j].lookahead);
   }
   printf(" inserted at %d\n", i);
 #endif
@@ -777,7 +771,7 @@ PRIVATE int acttab_insert(acttab *p, int makeItSafe) {
     p->aAction[k] = p->aLookahead[j];
     if( k>=p->nAction ) p->nAction = k+1;
   }
-  if (makeItSafe && i + p->nterminal >= p->nAction) p->nAction = i + p->nterminal + 1;
+  if( makeItSafe && i+p->nterminal>=p->nAction ) p->nAction = i+p->nterminal+1;
   p->nLookahead = 0;
 
   /* Return the offset that is added to the lookahead in order to get the
@@ -789,10 +783,10 @@ PRIVATE int acttab_insert(acttab *p, int makeItSafe) {
 ** Return the size of the action table without the trailing syntax error
 ** entries.
 */
-static int acttab_action_size(acttab *p) {
-    int n = p->nAction;
-    while (n>0 && p->aAction[n - 1].lookahead<0) { n--; }
-    return n;
+int acttab_action_size(acttab *p){
+  int n = p->nAction;
+  while( n>0 && p->aAction[n-1].lookahead<0 ){ n--; }
+  return n;
 }
 
 /********************** From the file "build.c" *****************************/
@@ -897,7 +891,6 @@ void FindFirstSets(struct lemon *lemp)
   return;
 }
 
-#ifndef __clang_analyzer__
 /* Compute all LR(0) states for the grammar.  Links
 ** are added to between some states so that the LR(1) follow sets
 ** can be computed later.
@@ -957,7 +950,6 @@ does not work properly.",sp->name);
   (void)getstate(lemp);
   return;
 }
-#endif
 
 /* Return a pointer to a state which is described by the configuration
 ** list which has been built from calls to Configlist_add.
@@ -998,7 +990,11 @@ PRIVATE struct state *getstate(struct lemon *lemp)
     stp->cfp = cfp;              /* Remember the configuration closure */
     stp->statenum = lemp->nstate++; /* Every state gets a sequence number */
     stp->ap = 0;                 /* No actions, yet. */
+#ifndef NDEBUG
+    int ret =
+#endif
     State_insert(stp,stp->bp);   /* Add to the state table */
+    assert(ret == 1);  /* CSA hint: stp did not leak, it has escaped. */
     buildshifts(lemp,stp);       /* Recursively compute successor states */
   }
   return stp;
@@ -1007,7 +1003,7 @@ PRIVATE struct state *getstate(struct lemon *lemp)
 /*
 ** Return true if two symbols are the same.
 */
-PRIVATE int same_symbol(struct symbol *a, struct symbol *b)
+int same_symbol(struct symbol *a, struct symbol *b)
 {
   int i;
   if( a==b ) return 1;
@@ -1020,7 +1016,6 @@ PRIVATE int same_symbol(struct symbol *a, struct symbol *b)
   return 1;
 }
 
-#ifndef __clang_analyzer__
 /* Construct all successor states to the given state.  A "successor"
 ** state is any state which can be reached by a shift action.
 */
@@ -1089,10 +1084,9 @@ void FindLinks(struct lemon *lemp)
   ** which the link is attached. */
   for(i=0; i<lemp->nstate; i++){
     stp = lemp->sorted[i];
-    if(stp){
-      for(cfp=stp->cfp; cfp; cfp=cfp->next){
-        cfp->stp = stp;
-      }
+    assert(stp);    /* Hint for CSA */
+    for(cfp=stp->cfp; cfp; cfp=cfp->next){
+      cfp->stp = stp;
     }
   }
 
@@ -1100,17 +1094,14 @@ void FindLinks(struct lemon *lemp)
   ** links are used in the follow-set computation. */
   for(i=0; i<lemp->nstate; i++){
     stp = lemp->sorted[i];
-    if(stp){
-      for(cfp=stp->cfp; cfp; cfp=cfp->next){
-        for(plp=cfp->bplp; plp; plp=plp->next){
-          other = plp->cfp;
-          Plink_add(&other->fplp,cfp);
-        }
+    for(cfp=stp->cfp; cfp; cfp=cfp->next){
+      for(plp=cfp->bplp; plp; plp=plp->next){
+        other = plp->cfp;
+        Plink_add(&other->fplp,cfp);
       }
     }
   }
 }
-#endif
 
 /* Compute all followsets.
 **
@@ -1126,28 +1117,24 @@ void FindFollowSets(struct lemon *lemp)
   int change;
 
   for(i=0; i<lemp->nstate; i++){
-    if(lemp->sorted[i]){
-      for(cfp=lemp->sorted[i]->cfp; cfp; cfp=cfp->next){
-        cfp->status = INCOMPLETE;
-      }
+    for(cfp=lemp->sorted[i]->cfp; cfp; cfp=cfp->next){
+      cfp->status = INCOMPLETE;
     }
   }
 
   do{
     progress = 0;
     for(i=0; i<lemp->nstate; i++){
-      if(lemp->sorted[i]){
-        for(cfp=lemp->sorted[i]->cfp; cfp; cfp=cfp->next){
-          if( cfp->status==COMPLETE ) continue;
-          for(plp=cfp->fplp; plp; plp=plp->next){
-            change = SetUnion(plp->cfp->fws,cfp->fws);
-            if( change ){
-              plp->cfp->status = INCOMPLETE;
-              progress = 1;
-            }
+      for(cfp=lemp->sorted[i]->cfp; cfp; cfp=cfp->next){
+        if( cfp->status==COMPLETE ) continue;
+        for(plp=cfp->fplp; plp; plp=plp->next){
+          change = SetUnion(plp->cfp->fws,cfp->fws);
+          if( change ){
+            plp->cfp->status = INCOMPLETE;
+            progress = 1;
           }
-          cfp->status = COMPLETE;
         }
+        cfp->status = COMPLETE;
       }
     }
   }while( progress );
@@ -1171,15 +1158,13 @@ void FindActions(struct lemon *lemp)
   */
   for(i=0; i<lemp->nstate; i++){   /* Loop over all states */
     stp = lemp->sorted[i];
-    if(stp){
-      for(cfp=stp->cfp; cfp; cfp=cfp->next){  /* Loop over all configurations */
-        if( cfp->rp->nrhs==cfp->dot ){        /* Is dot at extreme right? */
-          for(j=0; j<lemp->nterminal; j++){
-            if( SetFind(cfp->fws,j) ){
-              /* Add a reduce action to the state "stp" which will reduce by the
-              ** rule "cfp->rp" if the lookahead symbol is "lemp->symbols[j]" */
-              Action_add(&stp->ap,REDUCE,lemp->symbols[j],(char *)cfp->rp);
-            }
+    for(cfp=stp->cfp; cfp; cfp=cfp->next){  /* Loop over all configurations */
+      if( cfp->rp->nrhs==cfp->dot ){        /* Is dot at extreme right? */
+        for(j=0; j<lemp->nterminal; j++){
+          if( SetFind(cfp->fws,j) ){
+            /* Add a reduce action to the state "stp" which will reduce by the
+            ** rule "cfp->rp" if the lookahead symbol is "lemp->symbols[j]" */
+            Action_add(&stp->ap,REDUCE,lemp->symbols[j],(char *)cfp->rp);
           }
         }
       }
@@ -1527,46 +1512,13 @@ void ErrorMsg(const char *filename, int lineno, const char *format, ...){
 ** Main program file for the LEMON parser generator.
 */
 
-/* Locates the basename in a string possibly containing paths,
- * including forward-slash and backward-slash delimiters on Windows,
- * and allocates a new string containing just the basename.
- * Returns the pointer to that string.
- */
-PRIVATE char*
-make_basename(char* fullname)
-{
-  char *cp;
-  char *new_string;
-
-  /* Find the last forward slash */
-  cp = strrchr(fullname, '/');
-
-#ifdef _WIN32
-  /* On Windows, if no forward slash was found, look ofr
-   * backslash also */
-  if (!cp)
-    cp = strrchr(fullname, '\\');
-#endif
-
-  if (!cp) {
-    new_string = (char *) malloc( strlen(fullname) + 1 );
-    MemoryCheck( new_string );
-    strcpy(new_string, fullname);
-  }
-  else {
-    /* skip the slash */
-    cp++;
-    new_string = (char *) malloc( strlen(cp) + 1 );
-    MemoryCheck( new_string );
-    strcpy(new_string, cp);
-  }
-
-  return new_string;
-}
-
 /* Report an out-of-memory condition and abort.  This function
 ** is used mostly by the "MemoryCheck" macro in struct.h
 */
+void memory_error(void){
+  fprintf(stderr,"Out of memory.  Aborting...\n");
+  exit(1);
+}
 
 static int nDefine = 0;      /* Number of -D options on the command line */
 static char **azDefine = 0;  /* Name of the -D macros */
@@ -1574,29 +1526,43 @@ static char **azDefine = 0;  /* Name of the -D macros */
 /* This routine is called with the argument to each -D command-line option.
 ** Add the macro defined to the azDefine array.
 */
-static void handle_D_option(char *z) {
+static void handle_D_option(char *z){
   char **paz;
   nDefine++;
   azDefine = (char **) realloc(azDefine, sizeof(azDefine[0])*nDefine);
-  if (azDefine == 0) {
-      fprintf(stderr, "out of memory\n");
-      exit(1);
+  if( azDefine==0 ){
+    fprintf(stderr,"out of memory\n");
+    exit(1);
   }
   paz = &azDefine[nDefine-1];
   *paz = (char *) malloc( lemonStrlen(z)+1 );
-  if (*paz == 0) {
-      fprintf(stderr, "out of memory\n");
-      exit(1);
+  if( *paz==0 ){
+    fprintf(stderr,"out of memory\n");
+    exit(1);
   }
   lemon_strcpy(*paz, z);
   for(z=*paz; *z && *z!='='; z++){}
   *z = 0;
 }
 
+/* Rember the name of the output directory
+*/
+static char *outputDir = NULL;
+static void handle_d_option(char *z){
+  outputDir = (char *) malloc( lemonStrlen(z)+1 );
+  if( outputDir==0 ){
+    fprintf(stderr,"out of memory\n");
+    exit(1);
+  }
+  lemon_strcpy(outputDir, z);
+}
+
 static char *user_templatename = NULL;
-static void handle_T_option(char *z) {
+static void handle_T_option(char *z){
   user_templatename = (char *) malloc( lemonStrlen(z)+1 );
-  MemoryCheck(user_templatename);
+  if( user_templatename==0 ){
+    memory_error();
+  }
   lemon_strcpy(user_templatename, z);
 }
 
@@ -1627,7 +1593,7 @@ static struct rule *Rule_merge(struct rule *pA, struct rule *pB){
 ** Sort a list of rules in order of increasing iRule value
 */
 static struct rule *Rule_sort(struct rule *rp){
-  unsigned int i;
+  int i;
   struct rule *pNext;
   struct rule *x[32];
   memset(x, 0, sizeof(x));
@@ -1661,7 +1627,7 @@ static void stats_line(const char *zLabel, int iValue){
 }
 
 /* The main program.  Parse the command line and do it... */
-int main(int argc _U_, char **argv)
+int main(int argc, char **argv)
 {
   static int version = 0;
   static int rpflag = 0;
@@ -1672,35 +1638,33 @@ int main(int argc _U_, char **argv)
   static int mhflag = 0;
   static int nolinenosflag = 0;
   static int noResort = 0;
+
   static struct s_options options[] = {
-      { OPT_FLAG, "b", (char*)&basisflag, "Print only the basis in report." },
-  { OPT_FLAG, "c", (char*)&compress, "Don't compress the action table." },
-  { OPT_FSTR, "D", (char*)handle_D_option, "Define an %ifdef macro." },
-  { OPT_FSTR, "f", 0, "Ignored.  (Placeholder for -f compiler options.)" },
-  { OPT_FLAG, "g", (char*)&rpflag, "Print grammar without actions." },
-  { OPT_FSTR, "I", 0, "Ignored.  (Placeholder for '-I' compiler options.)" },
-  { OPT_FLAG, "m", (char*)&mhflag, "Output a makeheaders compatible file." },
-  { OPT_FLAG, "l", (char*)&nolinenosflag, "Do not print #line statements." },
-  { OPT_FSTR, "O", 0, "Ignored.  (Placeholder for '-O' compiler options.)" },
-  { OPT_FLAG, "p", (char*)&showPrecedenceConflict,
-  "Show conflicts resolved by precedence rules" },
-  { OPT_FLAG, "q", (char*)&quiet, "(Quiet) Don't print the report file." },
-  { OPT_FLAG, "r", (char*)&noResort, "Do not sort or renumber states" },
-  { OPT_FLAG, "s", (char*)&statistics,
-  "Print parser stats to standard output." },
-  { OPT_FLAG, "x", (char*)&version, "Print the version number." },
-  { OPT_FSTR, "T", (char*)handle_T_option, "Specify a template file." },
-  { OPT_FSTR, "W", NULL, "Ignored.  (Placeholder for '-W' compiler options.)" },
-    {OPT_FLAG, NULL, NULL, NULL}
+    {OPT_FLAG, "b", (char*)&basisflag, "Print only the basis in report."},
+    {OPT_FLAG, "c", (char*)&compress, "Don't compress the action table."},
+    {OPT_FSTR, "d", (char*)&handle_d_option, "Output directory.  Default '.'"},
+    {OPT_FSTR, "D", (char*)handle_D_option, "Define an %ifdef macro."},
+    {OPT_FSTR, "f", 0, "Ignored.  (Placeholder for -f compiler options.)"},
+    {OPT_FLAG, "g", (char*)&rpflag, "Print grammar without actions."},
+    {OPT_FSTR, "I", 0, "Ignored.  (Placeholder for '-I' compiler options.)"},
+    {OPT_FLAG, "m", (char*)&mhflag, "Output a makeheaders compatible file."},
+    {OPT_FLAG, "l", (char*)&nolinenosflag, "Do not print #line statements."},
+    {OPT_FSTR, "O", 0, "Ignored.  (Placeholder for '-O' compiler options.)"},
+    {OPT_FLAG, "p", (char*)&showPrecedenceConflict,
+                    "Show conflicts resolved by precedence rules"},
+    {OPT_FLAG, "q", (char*)&quiet, "(Quiet) Don't print the report file."},
+    {OPT_FLAG, "r", (char*)&noResort, "Do not sort or renumber states"},
+    {OPT_FLAG, "s", (char*)&statistics,
+                                   "Print parser stats to standard output."},
+    {OPT_FLAG, "x", (char*)&version, "Print the version number."},
+    {OPT_FSTR, "T", (char*)handle_T_option, "Specify a template file."},
+    {OPT_FSTR, "W", 0, "Ignored.  (Placeholder for '-W' compiler options.)"},
+    {OPT_FLAG,0,0,0}
   };
   int i;
   int exitcode;
   struct lemon lem;
   struct rule *rp;
-  struct symbol *dollar_sym;
-  struct symbol *default_sym;
-
-  memset(&lem, 0x0, sizeof(lem));
 
   OptInit(argv,options,stderr);
   if( version ){
@@ -1722,36 +1686,22 @@ int main(int argc _U_, char **argv)
   lem.filename = OptArg(0);
   lem.basisflag = basisflag;
   lem.nolinenosflag = nolinenosflag;
-  dollar_sym = Symbol_new("$");
-  lem.errsym = Symbol_new("error");
-  lem.errsym->useCnt = 0;
-
-  lem.basename = make_basename(lem.filename);
-
+  Symbol_new("$");
 
   /* Parse the input file */
   Parse(&lem);
   if( lem.errorcnt ) exit(lem.errorcnt);
-  if( lem.nrule==0 || lem.rule == NULL ){
-    free(dollar_sym);
+  assert(lem.rule);  /* Hint for CSA (no errors => rule found). */
+  if( lem.nrule==0 ){
     fprintf(stderr,"Empty grammar.\n");
     exit(1);
   }
+  lem.errsym = Symbol_find("error");
 
   /* Count and index the symbols of the grammar */
-  default_sym = Symbol_new("{default}");
+  Symbol_new("{default}");
   lem.nsymbol = Symbol_count();
   lem.symbols = Symbol_arrayof();
-  if (lem.nsymbol == 0 || !lem.symbols) {
-    free(dollar_sym);
-    free(default_sym);
-    free(lem.errsym);
-    if (lem.symbols)
-      free(lem.symbols);
-    fprintf(stderr, "Can't find symbols\n");
-    exit(1);
-  }
-
   for(i=0; i<lem.nsymbol; i++) lem.symbols[i]->index = i;
   qsort(lem.symbols,lem.nsymbol,sizeof(struct symbol*), Symbolcmpp);
   for(i=0; i<lem.nsymbol; i++) lem.symbols[i]->index = i;
@@ -1838,9 +1788,6 @@ int main(int argc _U_, char **argv)
     fprintf(stderr,"%d parsing conflicts.\n",lem.nconflict);
   }
 
-  free(default_sym);
-  free(dollar_sym);
-
   /* return 0 on success, 1 on failure. */
   exitcode = ((lem.errorcnt > 0) || (lem.nconflict > 0)) ? 1 : 0;
   exit(exitcode);
@@ -1958,13 +1905,13 @@ static char *msort(
     list = NEXT(list);
     NEXT(ep) = 0;
     for(i=0; i<LISTSIZE-1 && set[i]!=0; i++){
-        ep = merge(ep, set[i], cmp, (int)offset);
+      ep = merge(ep,set[i],cmp,offset);
       set[i] = 0;
     }
     set[i] = ep;
   }
   ep = 0;
-  for (i = 0; i<LISTSIZE; i++) if (set[i]) ep = merge(set[i], ep, cmp, (int)offset);
+  for(i=0; i<LISTSIZE; i++) if( set[i] ) ep = merge(set[i],ep,cmp,offset);
   return ep;
 }
 /************************ From the file "option.c" **************************/
@@ -1980,11 +1927,9 @@ static FILE *errstream;
 */
 static void errline(int n, int k, FILE *err)
 {
-  int spcnt = 0, i;
-  if( argv[0] ) {
-    fprintf(err,"%s",argv[0]);
-    spcnt = lemonStrlen(argv[0]) + 1;
-  }
+  int spcnt, i;
+  if( argv[0] ) fprintf(err,"%s",argv[0]);
+  spcnt = lemonStrlen(argv[0]) + 1;
   for(i=1; i<n && argv[i]; i++){
     fprintf(err," %s",argv[i]);
     spcnt += lemonStrlen(argv[i])+1;
@@ -2025,35 +1970,35 @@ static char emsg[] = "Command line syntax error: ";
 */
 static int handleflags(int i, FILE *err)
 {
-    int v;
-    int errcnt = 0;
-    int j;
-    for (j = 0; op[j].label; j++) {
-        if (strncmp(&argv[i][1], op[j].label, lemonStrlen(op[j].label)) == 0) break;
+  int v;
+  int errcnt = 0;
+  int j;
+  for(j=0; op[j].label; j++){
+    if( strncmp(&argv[i][1],op[j].label,lemonStrlen(op[j].label))==0 ) break;
+  }
+  v = argv[i][0]=='-' ? 1 : 0;
+  if( op[j].label==0 ){
+    if( err ){
+      fprintf(err,"%sundefined option.\n",emsg);
+      errline(i,1,err);
     }
-    v = argv[i][0] == '-' ? 1 : 0;
-    if (op[j].label == 0) {
-        if (err) {
-            fprintf(err, "%sundefined option.\n", emsg);
-            errline(i, 1, err);
-        }
-        errcnt++;
-    } else if (op[j].arg == 0) {
-        /* Ignore this option */
-    } else if (op[j].type == OPT_FLAG) {
-        *((int*)op[j].arg) = v;
-    } else if (op[j].type == OPT_FFLAG) {
-        (*(void(*)(int))(op[j].arg))(v);
-    } else if (op[j].type == OPT_FSTR) {
-        (*(void(*)(char *))(op[j].arg))(&argv[i][2]);
-    } else {
-        if (err) {
-            fprintf(err, "%smissing argument on switch.\n", emsg);
-            errline(i, 1, err);
-        }
-        errcnt++;
+    errcnt++;
+  }else if( op[j].arg==0 ){
+    /* Ignore this option */
+  }else if( op[j].type==OPT_FLAG ){
+    *((int*)op[j].arg) = v;
+  }else if( op[j].type==OPT_FFLAG ){
+    (*(void(*)(int))(op[j].arg))(v);
+  }else if( op[j].type==OPT_FSTR ){
+    (*(void(*)(char *))(op[j].arg))(&argv[i][2]);
+  }else{
+    if( err ){
+      fprintf(err,"%smissing argument on switch.\n",emsg);
+      errline(i,1,err);
     }
-    return errcnt;
+    errcnt++;
+  }
+  return errcnt;
 }
 
 /*
@@ -2061,13 +2006,12 @@ static int handleflags(int i, FILE *err)
 */
 static int handleswitch(int i, FILE *err)
 {
-  int errcnt = 0;
-#ifndef __clang_analyzer__
   int lv = 0;
   double dv = 0.0;
   char *sv = 0, *end;
   char *cp;
   int j;
+  int errcnt = 0;
   cp = strchr(argv[i],'=');
   assert( cp!=0 );
   *cp = 0;
@@ -2106,7 +2050,7 @@ static int handleswitch(int i, FILE *err)
         break;
       case OPT_INT:
       case OPT_FINT:
-        lv = (int)strtol(cp,&end,0);
+        lv = strtol(cp,&end,0);
         if( *end ){
           if( err ){
             fprintf(err,"%sillegal character in integer argument.\n",emsg);
@@ -2128,23 +2072,22 @@ static int handleswitch(int i, FILE *err)
         *(double*)(op[j].arg) = dv;
         break;
       case OPT_FDBL:
-          (*(void(*)(double))(op[j].arg))(dv);
-          break;
+        (*(void(*)(double))(op[j].arg))(dv);
+        break;
       case OPT_INT:
-          *(int*)(op[j].arg) = lv;
-          break;
+        *(int*)(op[j].arg) = lv;
+        break;
       case OPT_FINT:
-          (*(void(*)(int))(op[j].arg))((int)lv);
-          break;
+        (*(void(*)(int))(op[j].arg))((int)lv);
+        break;
       case OPT_STR:
-          *(char**)(op[j].arg) = sv;
-          break;
+        *(char**)(op[j].arg) = sv;
+        break;
       case OPT_FSTR:
-          (*(void(*)(char *))(op[j].arg))(sv);
-          break;
+        (*(void(*)(char *))(op[j].arg))(sv);
+        break;
     }
   }
-#endif
   return errcnt;
 }
 
@@ -2192,14 +2135,12 @@ char *OptArg(int n)
   return i>=0 ? argv[i] : 0;
 }
 
-#if 0
 void OptErr(int n)
 {
   int i;
   i = argindex(n);
   if( i>=0 ) errline(i,0,errstream);
 }
-#endif
 
 void OptPrint(void){
   int i;
@@ -2321,7 +2262,7 @@ static void parseonetoken(struct pstate *psp)
       psp->preccounter = 0;
       psp->firstrule = psp->lastrule = 0;
       psp->gp->nrule = 0;
-      /* FALL THROUGH */
+      /* Fall thru to next case */
     case WAITING_FOR_DECL_OR_RULE:
       if( x[0]=='%' ){
         psp->state = WAITING_FOR_DECL_KEYWORD;
@@ -2446,6 +2387,7 @@ to follow the previous rule.");
           for(i=0; i<psp->nrhs; i++){
             rp->rhs[i] = psp->rhs[i];
             rp->rhsalias[i] = psp->alias[i];
+            if( rp->rhsalias[i]!=0 ){ rp->rhs[i]->bContent = 1; }
           }
           rp->lhs = psp->lhs;
           rp->lhsalias = psp->lhsalias;
@@ -2494,7 +2436,6 @@ to follow the previous rule.");
         msp->nsubsym++;
         msp->subsym = (struct symbol **) realloc(msp->subsym,
           sizeof(struct symbol*)*msp->nsubsym);
-        MemoryCheck( msp->subsym );
         msp->subsym[msp->nsubsym-1] = Symbol_new(&x[1]);
         if( ISLOWER(x[1]) || ISLOWER(msp->subsym[0]->name[0]) ){
           ErrorMsg(psp->filename,psp->tokenlineno,
@@ -2564,6 +2505,9 @@ to follow the previous rule.");
         }else if( strcmp(x,"extra_argument")==0 ){
           psp->declargslot = &(psp->gp->arg);
           psp->insertLineMacro = 0;
+        }else if( strcmp(x,"extra_context")==0 ){
+          psp->declargslot = &(psp->gp->ctx);
+          psp->insertLineMacro = 0;
         }else if( strcmp(x,"token_type")==0 ){
           psp->declargslot = &(psp->gp->tokentype);
           psp->insertLineMacro = 0;
@@ -2595,8 +2539,8 @@ to follow the previous rule.");
         }else if( strcmp(x,"fallback")==0 ){
           psp->fallback = 0;
           psp->state = WAITING_FOR_FALLBACK_ID;
-        } else if (strcmp(x, "token") == 0) {
-            psp->state = WAITING_FOR_TOKEN_NAME;
+        }else if( strcmp(x,"token")==0 ){
+          psp->state = WAITING_FOR_TOKEN_NAME;
         }else if( strcmp(x,"wildcard")==0 ){
           psp->state = WAITING_FOR_WILDCARD_ID;
         }else if( strcmp(x,"token_class")==0 ){
@@ -2699,7 +2643,6 @@ to follow the previous rule.");
           n += nLine + lemonStrlen(psp->filename) + nBack;
         }
         *psp->declargslot = (char *) realloc(*psp->declargslot, n);
-        MemoryCheck( *psp->declargslot );
         zBuf = *psp->declargslot + nOld;
         if( addLineMacro ){
           if( nOld && zBuf[-1]!='\n' ){
@@ -2753,25 +2696,25 @@ to follow the previous rule.");
       }
       break;
     case WAITING_FOR_TOKEN_NAME:
-        /* Tokens do not have to be declared before use.  But they can be
-        ** in order to control their assigned integer number.  The number for
-        ** each token is assigned when it is first seen.  So by including
-        **
-        **     %token ONE TWO THREE
-        **
-        ** early in the grammar file, that assigns small consecutive values
-        ** to each of the tokens ONE TWO and THREE.
-        */
-        if (x[0] == '.') {
-            psp->state = WAITING_FOR_DECL_OR_RULE;
-        } else if (!ISUPPER(x[0])) {
-            ErrorMsg(psp->filename, psp->tokenlineno,
-                "%%token argument \"%s\" should be a token", x);
-            psp->errorcnt++;
-        } else {
-            (void)Symbol_new(x);
-        }
-        break;
+      /* Tokens do not have to be declared before use.  But they can be
+      ** in order to control their assigned integer number.  The number for
+      ** each token is assigned when it is first seen.  So by including
+      **
+      **     %token ONE TWO THREE
+      **
+      ** early in the grammar file, that assigns small consecutive values
+      ** to each of the tokens ONE TWO and THREE.
+      */
+      if( x[0]=='.' ){
+        psp->state = WAITING_FOR_DECL_OR_RULE;
+      }else if( !ISUPPER(x[0]) ){
+        ErrorMsg(psp->filename, psp->tokenlineno,
+          "%%token argument \"%s\" should be a token", x);
+        psp->errorcnt++;
+      }else{
+        (void)Symbol_new(x);
+      }
+      break;
     case WAITING_FOR_WILDCARD_ID:
       if( x[0]=='.' ){
         psp->state = WAITING_FOR_DECL_OR_RULE;
@@ -2815,7 +2758,6 @@ to follow the previous rule.");
         msp->nsubsym++;
         msp->subsym = (struct symbol **) realloc(msp->subsym,
           sizeof(struct symbol*)*msp->nsubsym);
-        MemoryCheck( msp->subsym );
         if( !ISUPPER(x[0]) ) x++;
         msp->subsym[msp->nsubsym-1] = Symbol_new(x);
       }else{
@@ -2896,7 +2838,7 @@ void Parse(struct lemon *gp)
   struct pstate ps;
   FILE *fp;
   char *filebuf;
-  unsigned long int filesize;
+  unsigned int filesize;
   int lineno;
   int c;
   char *cp, *nextcp;
@@ -2915,14 +2857,14 @@ void Parse(struct lemon *gp)
     gp->errorcnt++;
     return;
   }
-  fseek(fp, 0, SEEK_END);
+  fseek(fp,0,2);
   filesize = ftell(fp);
   rewind(fp);
   filebuf = (char *)malloc( filesize+1 );
   if( filesize>100000000 || filebuf==0 ){
     ErrorMsg(ps.filename,0,"Input file too large.");
-    gp->errorcnt++;
     free(filebuf);
+    gp->errorcnt++;
     fclose(fp);
     return;
   }
@@ -3113,31 +3055,34 @@ PRIVATE char *file_makename(struct lemon *lemp, const char *suffix)
 {
   char *name;
   char *cp;
-
-  name = (char*)malloc( lemonStrlen(lemp->filename) + lemonStrlen(suffix) + 5 );
+  char *filename = lemp->filename;
+  int sz;
+
+  if( outputDir ){
+    cp = strrchr(filename, '/');
+    if( cp ) filename = cp + 1;
+  }
+  sz = lemonStrlen(filename);
+  sz += lemonStrlen(suffix);
+  if( outputDir ) sz += lemonStrlen(outputDir) + 1;
+  sz += 5;
+  name = (char*)malloc( sz );
   if( name==0 ){
     fprintf(stderr,"Can't allocate space for a filename.\n");
     exit(1);
   }
-  lemon_strcpy(name,lemp->filename);
+  name[0] = 0;
+  if( outputDir ){
+    lemon_strcpy(name, outputDir);
+    lemon_strcat(name, "/");
+  }
+  lemon_strcat(name,filename);
   cp = strrchr(name,'.');
   if( cp ) *cp = 0;
   lemon_strcat(name,suffix);
   return name;
 }
 
-/* Generate a filename with the given suffix.  Uses only
-** the basename of the input file, not the entire path. This
-** is useful for creating output files when using outdirname.
-** Space to hold this name comes from malloc() and must be
-** freed by the calling function.
-*/
-PRIVATE char *file_makename_using_basename(struct lemon *lemp, const char *suffix)
-{
-  lemp->filename = lemp->basename;
-  return file_makename(lemp, suffix);
-}
-
 /* Open a file with a name based on the name of the input file,
 ** but with a different (specified) suffix, and return a pointer
 ** to the stream */
@@ -3148,8 +3093,8 @@ PRIVATE FILE *file_open(
 ){
   FILE *fp;
 
-  if (lemp->outname) free(lemp->outname);
-  lemp->outname = file_makename_using_basename(lemp, suffix);
+  if( lemp->outname ) free(lemp->outname);
+  lemp->outname = file_makename(lemp, suffix);
   fp = fopen(lemp->outname,mode);
   if( fp==0 && *mode=='w' ){
     fprintf(stderr,"Can't open file \"%s\".\n",lemp->outname);
@@ -3161,23 +3106,23 @@ PRIVATE FILE *file_open(
 
 /* Print the text of a rule
 */
-static void rule_print(FILE *out, struct rule *rp) {
-    int i, j;
-    fprintf(out, "%s", rp->lhs->name);
-    /*    if( rp->lhsalias ) fprintf(out,"(%s)",rp->lhsalias); */
-    fprintf(out, " ::=");
-    for (i = 0; i<rp->nrhs; i++) {
-        struct symbol *sp = rp->rhs[i];
-        if (sp->type == MULTITERMINAL) {
-            fprintf(out, " %s", sp->subsym[0]->name);
-            for (j = 1; j<sp->nsubsym; j++) {
-                fprintf(out, "|%s", sp->subsym[j]->name);
-            }
-        } else {
-            fprintf(out, " %s", sp->name);
-        }
-        /* if( rp->rhsalias[i] ) fprintf(out,"(%s)",rp->rhsalias[i]); */
+void rule_print(FILE *out, struct rule *rp){
+  int i, j;
+  fprintf(out, "%s",rp->lhs->name);
+  /*    if( rp->lhsalias ) fprintf(out,"(%s)",rp->lhsalias); */
+  fprintf(out," ::=");
+  for(i=0; i<rp->nrhs; i++){
+    struct symbol *sp = rp->rhs[i];
+    if( sp->type==MULTITERMINAL ){
+      fprintf(out," %s", sp->subsym[0]->name);
+      for(j=1; j<sp->nsubsym; j++){
+        fprintf(out,"|%s", sp->subsym[j]->name);
+      }
+    }else{
+      fprintf(out," %s", sp->name);
     }
+    /* if( rp->rhsalias[i] ) fprintf(out,"(%s)",rp->rhsalias[i]); */
+  }
 }
 
 /* Duplicate the input file without comments and without actions
@@ -3217,7 +3162,7 @@ void Reprint(struct lemon *lemp)
 
 /* Print a single rule.
 */
-PRIVATE void RulePrint(FILE *fp, struct rule *rp, int iCursor){
+void RulePrint(FILE *fp, struct rule *rp, int iCursor){
   struct symbol *sp;
   int i, j;
   fprintf(fp,"%s ::=",rp->lhs->name);
@@ -3238,7 +3183,7 @@ PRIVATE void RulePrint(FILE *fp, struct rule *rp, int iCursor){
 
 /* Print the rule for a configuration.
 */
-PRIVATE void ConfigPrint(FILE *fp, struct config *cfp){
+void ConfigPrint(FILE *fp, struct config *cfp){
   RulePrint(fp, cfp->rp, cfp->dot);
 }
 
@@ -3281,7 +3226,7 @@ char *tag;
 /* Print an action to the given file descriptor.  Return FALSE if
 ** nothing was actually printed.
 */
-PRIVATE int PrintAction(
+int PrintAction(
   struct action *ap,          /* The action to print */
   FILE *fp,                   /* Print the action here */
   int indent                  /* Indent by this amount */
@@ -3349,48 +3294,47 @@ PRIVATE int PrintAction(
 /* Generate the "*.out" log file */
 void ReportOutput(struct lemon *lemp)
 {
-  int i;
+  int i, n;
   struct state *stp;
   struct config *cfp;
   struct action *ap;
+  struct rule *rp;
   FILE *fp;
 
   fp = file_open(lemp,".out","wb");
   if( fp==0 ) return;
   for(i=0; i<lemp->nxstate; i++){
     stp = lemp->sorted[i];
-    if(stp){
-      fprintf(fp,"State %d:\n",stp->statenum);
-      if( lemp->basisflag ) cfp=stp->bp;
-      else                  cfp=stp->cfp;
-      while( cfp ){
-        char buf[20];
-        if( cfp->dot==cfp->rp->nrhs ){
-          lemon_sprintf(buf,"(%d)",cfp->rp->iRule);
-          fprintf(fp,"    %5s ",buf);
-        }else{
-          fprintf(fp,"          ");
-        }
-        ConfigPrint(fp,cfp);
-        fprintf(fp,"\n");
-#if 0
-        SetPrint(fp,cfp->fws,lemp);
-        PlinkPrint(fp,cfp->fplp,"To  ");
-        PlinkPrint(fp,cfp->bplp,"From");
-#endif
-        if( lemp->basisflag ) cfp=cfp->bp;
-        else                  cfp=cfp->next;
-
+    fprintf(fp,"State %d:\n",stp->statenum);
+    if( lemp->basisflag ) cfp=stp->bp;
+    else                  cfp=stp->cfp;
+    while( cfp ){
+      char buf[20];
+      if( cfp->dot==cfp->rp->nrhs ){
+        lemon_sprintf(buf,"(%d)",cfp->rp->iRule);
+        fprintf(fp,"    %5s ",buf);
+      }else{
+        fprintf(fp,"          ");
       }
+      ConfigPrint(fp,cfp);
       fprintf(fp,"\n");
-      for(ap=stp->ap; ap; ap=ap->next){
-        if( PrintAction(ap,fp,30) ) fprintf(fp,"\n");
-      }
+#if 0
+      SetPrint(fp,cfp->fws,lemp);
+      PlinkPrint(fp,cfp->fplp,"To  ");
+      PlinkPrint(fp,cfp->bplp,"From");
+#endif
+      if( lemp->basisflag ) cfp=cfp->bp;
+      else                  cfp=cfp->next;
+    }
+    fprintf(fp,"\n");
+    for(ap=stp->ap; ap; ap=ap->next){
+      if( PrintAction(ap,fp,30) ) fprintf(fp,"\n");
     }
     fprintf(fp,"\n");
   }
   fprintf(fp, "----------------------------------------------------\n");
   fprintf(fp, "Symbols:\n");
+  fprintf(fp, "The first-set of non-terminals is shown after the name.\n\n");
   for(i=0; i<lemp->nsymbol; i++){
     int j;
     struct symbol *sp;
@@ -3408,8 +3352,41 @@ void ReportOutput(struct lemon *lemp)
         }
       }
     }
+    if( sp->prec>=0 ) fprintf(fp," (precedence=%d)", sp->prec);
     fprintf(fp, "\n");
   }
+  fprintf(fp, "----------------------------------------------------\n");
+  fprintf(fp, "Syntax-only Symbols:\n");
+  fprintf(fp, "The following symbols never carry semantic content.\n\n");
+  for(i=n=0; i<lemp->nsymbol; i++){
+    int w;
+    struct symbol *sp = lemp->symbols[i];
+    if( sp->bContent ) continue;
+    w = (int)strlen(sp->name);
+    if( n>0 && n+w>75 ){
+      fprintf(fp,"\n");
+      n = 0;
+    }
+    if( n>0 ){
+      fprintf(fp, " ");
+      n++;
+    }
+    fprintf(fp, "%s", sp->name);
+    n += w;
+  }
+  if( n>0 ) fprintf(fp, "\n");
+  fprintf(fp, "----------------------------------------------------\n");
+  fprintf(fp, "Rules:\n");
+  for(rp=lemp->rule; rp; rp=rp->next){
+    fprintf(fp, "%4d: ", rp->iRule);
+    rule_print(fp, rp);
+    fprintf(fp,".");
+    if( rp->precsym ){
+      fprintf(fp," [%s precedence=%d]",
+              rp->precsym->name, rp->precsym->prec);
+    }
+    fprintf(fp,"\n");
+  }
   fclose(fp);
   return;
 }
@@ -3439,11 +3416,10 @@ PRIVATE char *pathsearch(char *argv0, char *name, int modemask)
     pathlist = getenv("PATH");
     if( pathlist==0 ) pathlist = ".:/bin:/usr/bin";
     pathbuf = (char *) malloc( lemonStrlen(pathlist) + 1 );
-    if( pathbuf == 0 )
-      return NULL;
-    pathbufptr = pathbuf;
     path = (char *)malloc( lemonStrlen(pathlist)+lemonStrlen(name)+2 );
-    if( (path!=0) ){
+    MemoryCheck(pathbuf); MemoryCheck(path);  /* Fail on allocation failure. */
+    if( (pathbuf != 0) && (path!=0) ){
+      pathbufptr = pathbuf;
       lemon_strcpy(pathbuf, pathlist);
       while( *pathbuf ){
         cp = strchr(pathbuf,':');
@@ -3456,8 +3432,8 @@ PRIVATE char *pathsearch(char *argv0, char *name, int modemask)
         else pathbuf = &cp[1];
         if( access(path,modemask)==0 ) break;
       }
+      free(pathbufptr);
     }
-    free(pathbufptr);
   }
   return path;
 }
@@ -3468,26 +3444,26 @@ PRIVATE char *pathsearch(char *argv0, char *name, int modemask)
 */
 PRIVATE int compute_action(struct lemon *lemp, struct action *ap)
 {
-    int act;
-    switch (ap->type) {
+  int act;
+  switch( ap->type ){
     case SHIFT:  act = ap->x.stp->statenum;                        break;
     case SHIFTREDUCE: {
-        /* Since a SHIFT is inherient after a prior REDUCE, convert any
-        ** SHIFTREDUCE action with a nonterminal on the LHS into a simple
-        ** REDUCE action: */
-        if (ap->sp->index >= lemp->nterminal) {
-            act = lemp->minReduce + ap->x.rp->iRule;
-        } else {
-            act = lemp->minShiftReduce + ap->x.rp->iRule;
-        }
-        break;
+      /* Since a SHIFT is inherient after a prior REDUCE, convert any
+      ** SHIFTREDUCE action with a nonterminal on the LHS into a simple
+      ** REDUCE action: */
+      if( ap->sp->index>=lemp->nterminal ){
+        act = lemp->minReduce + ap->x.rp->iRule;
+      }else{
+        act = lemp->minShiftReduce + ap->x.rp->iRule;
+      }
+      break;
     }
     case REDUCE: act = lemp->minReduce + ap->x.rp->iRule;          break;
     case ERROR:  act = lemp->errAction;                            break;
     case ACCEPT: act = lemp->accAction;                            break;
     default:     act = -1; break;
-    }
-    return act;
+  }
+  return act;
 }
 
 #define LINESIZE 1000
@@ -3531,9 +3507,11 @@ PRIVATE FILE *tplt_open(struct lemon *lemp)
   char buf[1000];
   FILE *in;
   char *tpltname;
-  int tpltname_allocd = LEMON_FALSE;
   char *cp;
 
+  /* We always require the -T option, avoid memleak in the other code path. */
+  assert(user_templatename);
+
   /* first, see if user specified a template filename on the command line. */
   if (user_templatename != 0) {
     if( access(user_templatename,004)==-1 ){
@@ -3564,27 +3542,19 @@ PRIVATE FILE *tplt_open(struct lemon *lemp)
     tpltname = templatename;
   }else{
     tpltname = pathsearch(lemp->argv0,templatename,0);
-    tpltname_allocd = LEMON_TRUE;
   }
   if( tpltname==0 ){
     fprintf(stderr,"Can't find the parser driver template file \"%s\".\n",
     templatename);
     lemp->errorcnt++;
-    if (tpltname_allocd)
-      free(tpltname);
     return 0;
   }
   in = fopen(tpltname,"rb");
   if( in==0 ){
     fprintf(stderr,"Can't open the template file \"%s\".\n",templatename);
     lemp->errorcnt++;
-    if (tpltname_allocd)
-      free(tpltname);
     return 0;
   }
-
-  if (tpltname_allocd)
-    free(tpltname);
   return in;
 }
 
@@ -3623,7 +3593,7 @@ PRIVATE void tplt_print(FILE *out, struct lemon *lemp, char *str, int *lineno)
 ** The following routine emits code for the destructor for the
 ** symbol sp
 */
-PRIVATE void emit_destructor_code(
+void emit_destructor_code(
   FILE *out,
   struct symbol *sp,
   struct lemon *lemp,
@@ -3669,7 +3639,7 @@ PRIVATE void emit_destructor_code(
 /*
 ** Return TRUE (non-zero) if the given symbol has a destructor.
 */
-PRIVATE int has_destructor(struct symbol *sp, struct lemon *lemp)
+int has_destructor(struct symbol *sp, struct lemon *lemp)
 {
   int ret;
   if( sp->type==TERMINAL ){
@@ -3712,9 +3682,8 @@ PRIVATE char *append_str(const char *zText, int n, int p1, int p2){
     n = lemonStrlen(zText);
   }
   if( (int) (n+sizeof(zInt)*2+used) >= alloced ){
-    alloced = (int)(n + sizeof(zInt)*2 + used + 200);
+    alloced = n + sizeof(zInt)*2 + used + 200;
     z = (char *) realloc(z,  alloced);
-    MemoryCheck( z );
   }
   if( z==0 ) return empty;
   while( n-- > 0 ){
@@ -3817,7 +3786,6 @@ PRIVATE int translate_code(struct lemon *lemp, struct rule *rp){
 
   append_str(0,0,0,0);
 
-  #ifndef __clang_analyzer__
   /* This const cast is wrong but harmless, if we're careful. */
   for(cp=(char *)rp->code; *cp; cp++){
     if( cp==zSkip ){
@@ -3867,7 +3835,6 @@ PRIVATE int translate_code(struct lemon *lemp, struct rule *rp){
     }
     append_str(cp, 1, 0, 0);
   } /* End loop */
-  #endif
 
   /* Main code generation completed */
   cp = append_str(0,0,0,0);
@@ -3989,13 +3956,13 @@ PRIVATE void emit_code(
 ** union, also set the ".dtnum" field of every terminal and nonterminal
 ** symbol.
 */
-PRIVATE void print_stack_union(
+void print_stack_union(
   FILE *out,                  /* The output stream */
   struct lemon *lemp,         /* The main info structure for this parser */
   int *plineno,               /* Pointer to the line number */
   int mhflag                  /* True if generating makeheaders output */
 ){
-  int lineno = *plineno;    /* The line number of the output */
+  int lineno;               /* The line number of the output */
   char **types;             /* A hash table of datatypes */
   int arraysize;            /* Size of the "types" array */
   int maxdtlength;          /* Maximum length of any ".datatype" field. */
@@ -4024,9 +3991,9 @@ PRIVATE void print_stack_union(
     if( len>maxdtlength ) maxdtlength = len;
   }
   stddt = (char*)malloc( maxdtlength*2 + 1 );
-  if (stddt == 0) {
-      fprintf(stderr, "Out of memory.\n");
-      exit(1);
+  if( stddt==0 ){
+    fprintf(stderr,"Out of memory.\n");
+    exit(1);
   }
 
   /* Build a hash table of datatypes. The ".dtnum" field of each symbol
@@ -4073,9 +4040,9 @@ PRIVATE void print_stack_union(
     if( types[hash]==0 ){
       sp->dtnum = hash + 1;
       types[hash] = (char*)malloc( lemonStrlen(stddt)+1 );
-      if (types[hash] == 0) {
-          fprintf(stderr, "Out of memory.\n");
-          exit(1);
+      if( types[hash]==0 ){
+        fprintf(stderr,"Out of memory.\n");
+        exit(1);
       }
       lemon_strcpy(types[hash],stddt);
     }
@@ -4083,6 +4050,7 @@ PRIVATE void print_stack_union(
 
   /* Print out the definition of YYTOKENTYPE and YYMINORTYPE */
   name = lemp->name ? lemp->name : "Parse";
+  lineno = *plineno;
   if( mhflag ){ fprintf(out,"#if INTERFACE\n"); lineno++; }
   fprintf(out,"#define %sTOKENTYPE %s\n",name,
     lemp->tokentype?lemp->tokentype:"void*");  lineno++;
@@ -4095,7 +4063,7 @@ PRIVATE void print_stack_union(
     fprintf(out,"  %s yy%d;\n",types[i],i+1); lineno++;
     free(types[i]);
   }
-  if( lemp->errsym->useCnt ){
+  if( lemp->errsym && lemp->errsym->useCnt ){
     fprintf(out,"  int yy%d;\n",lemp->errsym->dtnum); lineno++;
   }
   free(stddt);
@@ -4151,8 +4119,8 @@ struct axset {
 ** Compare to axset structures for sorting purposes
 */
 static int axset_compare(const void *a, const void *b){
-  const struct axset *p1 = (const struct axset*)a;
-  const struct axset *p2 = (const struct axset*)b;
+  struct axset *p1 = (struct axset*)a;
+  struct axset *p2 = (struct axset*)b;
   int c;
   c = p2->nAction - p1->nAction;
   if( c==0 ){
@@ -4245,10 +4213,10 @@ void ReportTable(
 
   /* Generate the defines */
   fprintf(out,"#define YYCODETYPE %s\n",
-    minimum_size_type(0, lemp->nsymbol+1, &szCodeType)); lineno++;
-  fprintf(out,"#define YYNOCODE %d\n",lemp->nsymbol+1);  lineno++;
+    minimum_size_type(0, lemp->nsymbol, &szCodeType)); lineno++;
+  fprintf(out,"#define YYNOCODE %d\n",lemp->nsymbol);  lineno++;
   fprintf(out,"#define YYACTIONTYPE %s\n",
-      minimum_size_type(0, lemp->maxAction, &szActionType)); lineno++;
+    minimum_size_type(0,lemp->maxAction,&szActionType)); lineno++;
   if( lemp->wildcard ){
     fprintf(out,"#define YYWILDCARD %d\n",
        lemp->wildcard->index); lineno++;
@@ -4271,20 +4239,40 @@ void ReportTable(
     while( i>=1 && (ISALNUM(lemp->arg[i-1]) || lemp->arg[i-1]=='_') ) i--;
     fprintf(out,"#define %sARG_SDECL %s;\n",name,lemp->arg);  lineno++;
     fprintf(out,"#define %sARG_PDECL ,%s\n",name,lemp->arg);  lineno++;
-    fprintf(out,"#define %sARG_FETCH %s = yypParser->%s\n",
+    fprintf(out,"#define %sARG_PARAM ,%s\n",name,&lemp->arg[i]);  lineno++;
+    fprintf(out,"#define %sARG_FETCH %s=yypParser->%s;\n",
                  name,lemp->arg,&lemp->arg[i]);  lineno++;
-    fprintf(out,"#define %sARG_STORE yypParser->%s = %s\n",
+    fprintf(out,"#define %sARG_STORE yypParser->%s=%s;\n",
                  name,&lemp->arg[i],&lemp->arg[i]);  lineno++;
   }else{
-    fprintf(out,"#define %sARG_SDECL\n",name);  lineno++;
-    fprintf(out,"#define %sARG_PDECL\n",name);  lineno++;
+    fprintf(out,"#define %sARG_SDECL\n",name); lineno++;
+    fprintf(out,"#define %sARG_PDECL\n",name); lineno++;
+    fprintf(out,"#define %sARG_PARAM\n",name); lineno++;
     fprintf(out,"#define %sARG_FETCH\n",name); lineno++;
     fprintf(out,"#define %sARG_STORE\n",name); lineno++;
   }
+  if( lemp->ctx && lemp->ctx[0] ){
+    i = lemonStrlen(lemp->ctx);
+    while( i>=1 && ISSPACE(lemp->ctx[i-1]) ) i--;
+    while( i>=1 && (ISALNUM(lemp->ctx[i-1]) || lemp->ctx[i-1]=='_') ) i--;
+    fprintf(out,"#define %sCTX_SDECL %s;\n",name,lemp->ctx);  lineno++;
+    fprintf(out,"#define %sCTX_PDECL ,%s\n",name,lemp->ctx);  lineno++;
+    fprintf(out,"#define %sCTX_PARAM ,%s\n",name,&lemp->ctx[i]);  lineno++;
+    fprintf(out,"#define %sCTX_FETCH %s=yypParser->%s;\n",
+                 name,lemp->ctx,&lemp->ctx[i]);  lineno++;
+    fprintf(out,"#define %sCTX_STORE yypParser->%s=%s;\n",
+                 name,&lemp->ctx[i],&lemp->ctx[i]);  lineno++;
+  }else{
+    fprintf(out,"#define %sCTX_SDECL\n",name); lineno++;
+    fprintf(out,"#define %sCTX_PDECL\n",name); lineno++;
+    fprintf(out,"#define %sCTX_PARAM\n",name); lineno++;
+    fprintf(out,"#define %sCTX_FETCH\n",name); lineno++;
+    fprintf(out,"#define %sCTX_STORE\n",name); lineno++;
+  }
   if( mhflag ){
     fprintf(out,"#endif\n"); lineno++;
   }
-  if( lemp->errsym->useCnt ){
+  if( lemp->errsym && lemp->errsym->useCnt ){
     fprintf(out,"#define YYERRORSYMBOL %d\n",lemp->errsym->index); lineno++;
     fprintf(out,"#define YYERRSYMDT yy%d\n",lemp->errsym->dtnum); lineno++;
   }
@@ -4297,9 +4285,9 @@ void ReportTable(
   ** we need to know how many states can be eliminated.
   */
   ax = (struct axset *) calloc(lemp->nxstate*2, sizeof(ax[0]));
-  if (ax == 0) {
-      fprintf(stderr, "malloc failed\n");
-      exit(1);
+  if( ax==0 ){
+    fprintf(stderr,"malloc failed\n");
+    exit(1);
   }
   for(i=0; i<lemp->nxstate; i++){
     stp = lemp->sorted[i];
@@ -4363,28 +4351,28 @@ void ReportTable(
   for(i=0; i<lemp->nxstate; i++){
     for(ap=lemp->sorted[i]->ap; ap; ap=ap->next){
       if( ap->type==REDUCE || ap->type==SHIFTREDUCE ){
-          ap->x.rp->doesReduce = i ? LEMON_TRUE : LEMON_FALSE ;
+        ap->x.rp->doesReduce = 1;
       }
     }
   }
 
   /* Finish rendering the constants now that the action table has
   ** been computed */
-  fprintf(out, "#define YYNSTATE             %d\n", lemp->nxstate);  lineno++;
-  fprintf(out, "#define YYNRULE              %d\n", lemp->nrule);  lineno++;
-  fprintf(out, "#define YYNTOKEN             %d\n", lemp->nterminal); lineno++;
-  fprintf(out, "#define YY_MAX_SHIFT         %d\n", lemp->nxstate - 1); lineno++;
+  fprintf(out,"#define YYNSTATE             %d\n",lemp->nxstate);  lineno++;
+  fprintf(out,"#define YYNRULE              %d\n",lemp->nrule);  lineno++;
+  fprintf(out,"#define YYNTOKEN             %d\n",lemp->nterminal); lineno++;
+  fprintf(out,"#define YY_MAX_SHIFT         %d\n",lemp->nxstate-1); lineno++;
   i = lemp->minShiftReduce;
-  fprintf(out, "#define YY_MIN_SHIFTREDUCE   %d\n", i); lineno++;
+  fprintf(out,"#define YY_MIN_SHIFTREDUCE   %d\n",i); lineno++;
   i += lemp->nrule;
-  fprintf(out, "#define YY_MAX_SHIFTREDUCE   %d\n", i - 1); lineno++;
-  fprintf(out, "#define YY_ERROR_ACTION      %d\n", lemp->errAction); lineno++;
-  fprintf(out, "#define YY_ACCEPT_ACTION     %d\n", lemp->accAction); lineno++;
-  fprintf(out, "#define YY_NO_ACTION         %d\n", lemp->noAction); lineno++;
-  fprintf(out, "#define YY_MIN_REDUCE        %d\n", lemp->minReduce); lineno++;
+  fprintf(out,"#define YY_MAX_SHIFTREDUCE   %d\n", i-1); lineno++;
+  fprintf(out,"#define YY_ERROR_ACTION      %d\n", lemp->errAction); lineno++;
+  fprintf(out,"#define YY_ACCEPT_ACTION     %d\n", lemp->accAction); lineno++;
+  fprintf(out,"#define YY_NO_ACTION         %d\n", lemp->noAction); lineno++;
+  fprintf(out,"#define YY_MIN_REDUCE        %d\n", lemp->minReduce); lineno++;
   i = lemp->minReduce + lemp->nrule;
-  fprintf(out, "#define YY_MAX_REDUCE        %d\n", i - 1); lineno++;
-  tplt_xfer(lemp->name, in, out, &lineno);
+  fprintf(out,"#define YY_MAX_REDUCE        %d\n", i-1); lineno++;
+  tplt_xfer(lemp->name,in,out,&lineno);
 
   /* Now output the action table and its associates:
   **
@@ -4403,17 +4391,17 @@ void ReportTable(
   lemp->tablesize += n*szActionType;
   fprintf(out,"#define YY_ACTTAB_COUNT (%d)\n", n); lineno++;
   fprintf(out,"static const YYACTIONTYPE yy_action[] = {\n"); lineno++;
-  for (i = j = 0; i<n; i++) {
-      int action = acttab_yyaction(pActtab, i);
-      if (action<0) action = lemp->noAction;
-      if (j == 0) fprintf(out, " /* %5d */ ", i);
-      fprintf(out, " %4d,", action);
-      if (j == 9 || i == n - 1) {
-          fprintf(out, "\n"); lineno++;
-          j = 0;
-      } else {
-          j++;
-      }
+  for(i=j=0; i<n; i++){
+    int action = acttab_yyaction(pActtab, i);
+    if( action<0 ) action = lemp->noAction;
+    if( j==0 ) fprintf(out," /* %5d */ ", i);
+    fprintf(out, " %4d,", action);
+    if( j==9 || i==n-1 ){
+      fprintf(out, "\n"); lineno++;
+      j = 0;
+    }else{
+      j++;
+    }
   }
   fprintf(out, "};\n"); lineno++;
 
@@ -4491,20 +4479,20 @@ void ReportTable(
   fprintf(out, "static const YYACTIONTYPE yy_default[] = {\n"); lineno++;
   n = lemp->nxstate;
   lemp->tablesize += n*szActionType;
-  for (i = j = 0; i<n; i++) {
-      stp = lemp->sorted[i];
-      if (j == 0) fprintf(out, " /* %5d */ ", i);
-      if (stp->iDfltReduce<0) {
-          fprintf(out, " %4d,", lemp->errAction);
-      } else {
-          fprintf(out, " %4d,", stp->iDfltReduce + lemp->minReduce);
-      }
-      if (j == 9 || i == n - 1) {
-          fprintf(out, "\n"); lineno++;
-          j = 0;
-      } else {
-          j++;
-      }
+  for(i=j=0; i<n; i++){
+    stp = lemp->sorted[i];
+    if( j==0 ) fprintf(out," /* %5d */ ", i);
+    if( stp->iDfltReduce<0 ){
+      fprintf(out, " %4d,", lemp->errAction);
+    }else{
+      fprintf(out, " %4d,", stp->iDfltReduce + lemp->minReduce);
+    }
+    if( j==9 || i==n-1 ){
+      fprintf(out, "\n"); lineno++;
+      j = 0;
+    }else{
+      j++;
+    }
   }
   fprintf(out, "};\n"); lineno++;
   tplt_xfer(lemp->name,in,out,&lineno);
@@ -4530,9 +4518,9 @@ void ReportTable(
 
   /* Generate a table containing the symbolic name of every symbol
   */
-  for (i = 0; i<lemp->nsymbol; i++) {
-      lemon_sprintf(line, "\"%s\",", lemp->symbols[i]->name);
-      fprintf(out, "  /* %4d */ \"%s\",\n", i, lemp->symbols[i]->name); lineno++;
+  for(i=0; i<lemp->nsymbol; i++){
+    lemon_sprintf(line,"\"%s\",",lemp->symbols[i]->name);
+    fprintf(out,"  /* %4d */ \"%s\",\n",i, lemp->symbols[i]->name); lineno++;
   }
   tplt_xfer(lemp->name,in,out,&lineno);
 
@@ -4577,7 +4565,7 @@ void ReportTable(
       if( sp==0 || sp->type==TERMINAL ||
           sp->index<=0 || sp->destructor!=0 ) continue;
       if( once ){
-        fprintf(out, "      /* Default NON-TERMINAL Destructor */\n"); lineno++;
+        fprintf(out, "      /* Default NON-TERMINAL Destructor */\n");lineno++;
         once = 0;
       }
       fprintf(out,"    case %d: /* %s */\n", sp->index, sp->name); lineno++;
@@ -4620,10 +4608,10 @@ void ReportTable(
   ** Note: This code depends on the fact that rules are number
   ** sequentually beginning with 0.
   */
-  for (i = 0, rp = lemp->rule; rp; rp = rp->next, i++) {
-      fprintf(out, "  { %4d, %4d }, /* (%d) ", rp->lhs->index, -rp->nrhs, i);
-      rule_print(out, rp);
-      fprintf(out, " */\n"); lineno++;
+  for(i=0, rp=lemp->rule; rp; rp=rp->next, i++){
+    fprintf(out,"  { %4d, %4d }, /* (%d) ",rp->lhs->index,-rp->nrhs,i);
+    rule_print(out, rp);
+    fprintf(out," */\n"); lineno++;
   }
   tplt_xfer(lemp->name,in,out,&lineno);
 
@@ -4860,8 +4848,8 @@ void CompressTables(struct lemon *lemp)
 ** token actions.
 */
 static int stateResortCompare(const void *a, const void *b){
-  const struct state *pA = *(const struct state *const *)a;
-  const struct state *pB = *(const struct state *const *)b;
+  const struct state *pA = *(const struct state**)a;
+  const struct state *pB = *(const struct state**)b;
   int n;
 
   n = pB->nNtAct - pA->nNtAct;
@@ -4935,7 +4923,10 @@ void SetSize(int n)
 char *SetNew(void){
   char *s;
   s = (char*)calloc( size, 1);
-  MemoryCheck( s );
+  if( s==0 ){
+    extern void memory_error();
+    memory_error();
+  }
   return s;
 }
 
@@ -5094,9 +5085,8 @@ int Strsafe_insert(const char *data)
       array.ht[h] = newnp;
     }
     free(x1a->tbl);
-    *x1a = array;
+    memcpy(x1a, &array, sizeof(array)); /* *x1a = array; */
   }
-#ifndef __clang_analyzer__
   /* Insert the new data */
   h = ph & (x1a->size-1);
   np = &(x1a->tbl[x1a->count++]);
@@ -5105,7 +5095,6 @@ int Strsafe_insert(const char *data)
   np->next = x1a->ht[h];
   x1a->ht[h] = np;
   np->from = &(x1a->ht[h]);
-#endif
   return 1;
 }
 
@@ -5171,8 +5160,8 @@ struct symbol *Symbol_new(const char *x)
 */
 int Symbolcmpp(const void *_a, const void *_b)
 {
-  const struct symbol *a = *(const struct symbol *const *) _a;
-  const struct symbol *b = *(const struct symbol *const *) _b;
+  const struct symbol *a = *(const struct symbol **) _a;
+  const struct symbol *b = *(const struct symbol **) _b;
   int i1 = a->type==MULTITERMINAL ? 3 : a->name[0]>'Z' ? 2 : 1;
   int i2 = b->type==MULTITERMINAL ? 3 : b->name[0]>'Z' ? 2 : 1;
   return i1==i2 ? a->index - b->index : i1 - i2;
@@ -5264,9 +5253,8 @@ int Symbol_insert(struct symbol *data, const char *key)
       array.ht[h] = newnp;
     }
     free(x2a->tbl);
-    *x2a = array;
+    memcpy(x2a, &array, sizeof(array)); /* *x2a = array; */
   }
-#ifndef __clang_analyzer__
   /* Insert the new data */
   h = ph & (x2a->size-1);
   np = &(x2a->tbl[x2a->count++]);
@@ -5276,7 +5264,6 @@ int Symbol_insert(struct symbol *data, const char *key)
   np->next = x2a->ht[h];
   x2a->ht[h] = np;
   np->from = &(x2a->ht[h]);
-#endif
   return 1;
 }
 
@@ -5310,7 +5297,7 @@ struct symbol *Symbol_Nth(int n)
 }
 
 /* Return the size of the array */
-int Symbol_count(void)
+int Symbol_count()
 {
   return x2a ? x2a->count : 0;
 }
@@ -5318,7 +5305,7 @@ int Symbol_count(void)
 /* Return an array of pointers to all data in the table.
 ** The array is obtained from malloc.  Return NULL if memory allocation
 ** problems, or if the array is empty. */
-struct symbol **Symbol_arrayof(void)
+struct symbol **Symbol_arrayof()
 {
   struct symbol **array;
   int i,arrSize;
@@ -5334,8 +5321,8 @@ struct symbol **Symbol_arrayof(void)
 /* Compare two configurations */
 int Configcmp(const char *_a,const char *_b)
 {
-  const struct config *a = (const struct config *) _a;
-  const struct config *b = (const struct config *) _b;
+  const struct config *a = (struct config *) _a;
+  const struct config *b = (struct config *) _b;
   int x;
   x = a->rp->index - b->rp->index;
   if( x==0 ) x = a->dot - b->dot;
@@ -5369,7 +5356,7 @@ PRIVATE unsigned statehash(struct config *a)
 }
 
 /* Allocate a new state structure */
-struct state *State_new(void)
+struct state *State_new()
 {
   struct state *newstate;
   newstate = (struct state *)calloc(1, sizeof(struct state) );
@@ -5463,9 +5450,8 @@ int State_insert(struct state *data, struct config *key)
       array.ht[h] = newnp;
     }
     free(x3a->tbl);
-    *x3a = array;
+    memcpy(x3a, &array, sizeof(array)); /* *x3a = array; */
   }
-#ifndef __clang_analyzer__
   /* Insert the new data */
   h = ph & (x3a->size-1);
   np = &(x3a->tbl[x3a->count++]);
@@ -5475,7 +5461,6 @@ int State_insert(struct state *data, struct config *key)
   np->next = x3a->ht[h];
   x3a->ht[h] = np;
   np->from = &(x3a->ht[h]);
-#endif
   return 1;
 }
 
@@ -5604,9 +5589,8 @@ int Configtable_insert(struct config *data)
       array.ht[h] = newnp;
     }
     free(x4a->tbl);
-    *x4a = array;
+    memcpy(x4a, &array, sizeof(array)); /* *x4a = array; */
   }
-#ifndef __clang_analyzer__
   /* Insert the new data */
   h = ph & (x4a->size-1);
   np = &(x4a->tbl[x4a->count++]);
@@ -5615,7 +5599,6 @@ int Configtable_insert(struct config *data)
   np->next = x4a->ht[h];
   x4a->ht[h] = np;
   np->from = &(x4a->ht[h]);
-#endif
   return 1;
 }
 
diff --git a/tools/lemon/lemon.html b/tools/lemon/lemon.html
deleted file mode 100644
index 9278399e77..0000000000
--- a/tools/lemon/lemon.html
+++ /dev/null
@@ -1,894 +0,0 @@
-<html>
-<head>
-<title>The Lemon Parser Generator</title>
-</head>
-<body bgcolor=white>
-<h1 align=center>The Lemon Parser Generator</h1>
-
-<p>Lemon is an LALR(1) parser generator for C or C++.  
-It does the same job as ``bison'' and ``yacc''.
-But lemon is not another bison or yacc clone.  It
-uses a different grammar syntax which is designed to
-reduce the number of coding errors.  Lemon also uses a more
-sophisticated parsing engine that is faster than yacc and
-bison and which is both reentrant and thread-safe.
-Furthermore, Lemon implements features that can be used
-to eliminate resource leaks, making is suitable for use
-in long-running programs such as graphical user interfaces
-or embedded controllers.</p>
-
-<p>This document is an introduction to the Lemon
-parser generator.</p>
-
-<h2>Theory of Operation</h2>
-
-<p>The main goal of Lemon is to translate a context free grammar (CFG)
-for a particular language into C code that implements a parser for
-that language.
-The program has two inputs:
-<ul>
-<li>The grammar specification.
-<li>A parser template file.
-</ul>
-Typically, only the grammar specification is supplied by the programmer.
-Lemon comes with a default parser template which works fine for most
-applications.  But the user is free to substitute a different parser
-template if desired.</p>
-
-<p>Depending on command-line options, Lemon will generate between
-one and three files of outputs.
-<ul>
-<li>C code to implement the parser.
-<li>A header file defining an integer ID for each terminal symbol.
-<li>An information file that describes the states of the generated parser
-    automaton.
-</ul>
-By default, all three of these output files are generated.
-The header file is suppressed if the ``-m'' command-line option is
-used and the report file is omitted when ``-q'' is selected.</p>
-
-<p>The grammar specification file uses a ``.y'' suffix, by convention.
-In the examples used in this document, we'll assume the name of the
-grammar file is ``gram.y''.  A typical use of Lemon would be the
-following command:
-<pre>
-   lemon gram.y
-</pre>
-This command will generate three output files named ``gram.c'',
-``gram.h'' and ``gram.out''.
-The first is C code to implement the parser.  The second
-is the header file that defines numerical values for all
-terminal symbols, and the last is the report that explains
-the states used by the parser automaton.</p>
-
-<h3>Command Line Options</h3>
-
-<p>The behavior of Lemon can be modified using command-line options.
-You can obtain a list of the available command-line options together
-with a brief explanation of what each does by typing
-<pre>
-   lemon -?
-</pre>
-As of this writing, the following command-line options are supported:
-<ul>
-<li><tt>-b</tt>
-<li><tt>-c</tt>
-<li><tt>-g</tt>
-<li><tt>-m</tt>
-<li><tt>-q</tt>
-<li><tt>-s</tt>
-<li><tt>-x</tt>
-</ul>
-The ``-b'' option reduces the amount of text in the report file by
-printing only the basis of each parser state, rather than the full
-configuration.
-The ``-c'' option suppresses action table compression.  Using -c
-will make the parser a little larger and slower but it will detect
-syntax errors sooner.
-The ``-g'' option causes no output files to be generated at all.
-Instead, the input grammar file is printed on standard output but
-with all comments, actions and other extraneous text deleted.  This
-is a useful way to get a quick summary of a grammar.
-The ``-m'' option causes the output C source file to be compatible
-with the ``makeheaders'' program.
-Makeheaders is a program that automatically generates header files
-from C source code.  When the ``-m'' option is used, the header
-file is not output since the makeheaders program will take care
-of generated all header files automatically.
-The ``-q'' option suppresses the report file.
-Using ``-s'' causes a brief summary of parser statistics to be
-printed.  Like this:
-<pre>
-   Parser statistics: 74 terminals, 70 nonterminals, 179 rules
-                      340 states, 2026 parser table entries, 0 conflicts
-</pre>
-Finally, the ``-x'' option causes Lemon to print its version number
-and copyright information
-and then stop without attempting to read the grammar or generate a parser.</p>
-
-<h3>The Parser Interface</h3>
-
-<p>Lemon doesn't generate a complete, working program.  It only generates
-a few subroutines that implement a parser.  This section describes
-the interface to those subroutines.  It is up to the programmer to
-call these subroutines in an appropriate way in order to produce a
-complete system.</p>
-
-<p>Before a program begins using a Lemon-generated parser, the program
-must first create the parser.
-A new parser is created as follows:
-<pre>
-   void *pParser = ParseAlloc( malloc );
-</pre>
-The ParseAlloc() routine allocates and initializes a new parser and
-returns a pointer to it.
-The actual data structure used to represent a parser is opaque --
-its internal structure is not visible or usable by the calling routine.
-For this reason, the ParseAlloc() routine returns a pointer to void
-rather than a pointer to some particular structure.
-The sole argument to the ParseAlloc() routine is a pointer to the
-subroutine used to allocate memory.  Typically this means ``malloc()''.</p>
-
-<p>After a program is finished using a parser, it can reclaim all
-memory allocated by that parser by calling
-<pre>
-   ParseFree(pParser, free);
-</pre>
-The first argument is the same pointer returned by ParseAlloc().  The
-second argument is a pointer to the function used to release bulk
-memory back to the system.</p>
-
-<p>After a parser has been allocated using ParseAlloc(), the programmer
-must supply the parser with a sequence of tokens (terminal symbols) to
-be parsed.  This is accomplished by calling the following function
-once for each token:
-<pre>
-   Parse(pParser, hTokenID, sTokenData, pArg);
-</pre>
-The first argument to the Parse() routine is the pointer returned by
-ParseAlloc().
-The second argument is a small positive integer that tells the parse the
-type of the next token in the data stream.
-There is one token type for each terminal symbol in the grammar.
-The gram.h file generated by Lemon contains #define statements that
-map symbolic terminal symbol names into appropriate integer values.
-(A value of 0 for the second argument is a special flag to the
-parser to indicate that the end of input has been reached.)
-The third argument is the value of the given token.  By default,
-the type of the third argument is integer, but the grammar will
-usually redefine this type to be some kind of structure.
-Typically the second argument will be a broad category of tokens
-such as ``identifier'' or ``number'' and the third argument will
-be the name of the identifier or the value of the number.</p>
-
-<p>The Parse() function may have either three or four arguments,
-depending on the grammar.  If the grammar specification file request
-it, the Parse() function will have a fourth parameter that can be
-of any type chosen by the programmer.  The parser doesn't do anything
-with this argument except to pass it through to action routines.
-This is a convenient mechanism for passing state information down
-to the action routines without having to use global variables.</p>
-
-<p>A typical use of a Lemon parser might look something like the
-following:
-<pre>
-   01 ParseTree *ParseFile(const char *zFilename){
-   02    Tokenizer *pTokenizer;
-   03    void *pParser;
-   04    Token sToken;
-   05    int hTokenId;
-   06    ParserState sState;
-   07
-   08    pTokenizer = TokenizerCreate(zFilename);
-   09    pParser = ParseAlloc( malloc );
-   10    InitParserState(&sState);
-   11    while( GetNextToken(pTokenizer, &hTokenId, &sToken) ){
-   12       Parse(pParser, hTokenId, sToken, &sState);
-   13    }
-   14    Parse(pParser, 0, sToken, &sState);
-   15    ParseFree(pParser, free );
-   16    TokenizerFree(pTokenizer);
-   17    return sState.treeRoot;
-   18 }
-</pre>
-This example shows a user-written routine that parses a file of
-text and returns a pointer to the parse tree.
-(We've omitted all error-handling from this example to keep it
-simple.)
-We assume the existence of some kind of tokenizer which is created
-using TokenizerCreate() on line 8 and deleted by TokenizerFree()
-on line 16.  The GetNextToken() function on line 11 retrieves the
-next token from the input file and puts its type in the 
-integer variable hTokenId.  The sToken variable is assumed to be
-some kind of structure that contains details about each token,
-such as its complete text, what line it occurs on, etc. </p>
-
-<p>This example also assumes the existence of structure of type
-ParserState that holds state information about a particular parse.
-An instance of such a structure is created on line 6 and initialized
-on line 10.  A pointer to this structure is passed into the Parse()
-routine as the optional 4th argument.
-The action routine specified by the grammar for the parser can use
-the ParserState structure to hold whatever information is useful and
-appropriate.  In the example, we note that the treeRoot field of
-the ParserState structure is left pointing to the root of the parse
-tree.</p>
-
-<p>The core of this example as it relates to Lemon is as follows:
-<pre>
-   ParseFile(){
-      pParser = ParseAlloc( malloc );
-      while( GetNextToken(pTokenizer,&hTokenId, &sToken) ){
-         Parse(pParser, hTokenId, sToken);
-      }
-      Parse(pParser, 0, sToken);
-      ParseFree(pParser, free );
-   }
-</pre>
-Basically, what a program has to do to use a Lemon-generated parser
-is first create the parser, then send it lots of tokens obtained by
-tokenizing an input source.  When the end of input is reached, the
-Parse() routine should be called one last time with a token type
-of 0.  This step is necessary to inform the parser that the end of
-input has been reached.  Finally, we reclaim memory used by the
-parser by calling ParseFree().</p>
-
-<p>There is one other interface routine that should be mentioned
-before we move on.
-The ParseTrace() function can be used to generate debugging output
-from the parser.  A prototype for this routine is as follows:
-<pre>
-   ParseTrace(FILE *stream, char *zPrefix);
-</pre>
-After this routine is called, a short (one-line) message is written
-to the designated output stream every time the parser changes states
-or calls an action routine.  Each such message is prefaced using
-the text given by zPrefix.  This debugging output can be turned off
-by calling ParseTrace() again with a first argument of NULL (0).</p>
-
-<h3>Differences With YACC and BISON</h3>
-
-<p>Programmers who have previously used the yacc or bison parser
-generator will notice several important differences between yacc and/or
-bison and Lemon.
-<ul>
-<li>In yacc and bison, the parser calls the tokenizer.  In Lemon,
-    the tokenizer calls the parser.
-<li>Lemon uses no global variables.  Yacc and bison use global variables
-    to pass information between the tokenizer and parser.
-<li>Lemon allows multiple parsers to be running simultaneously.  Yacc
-    and bison do not.
-</ul>
-These differences may cause some initial confusion for programmers
-with prior yacc and bison experience.
-But after years of experience using Lemon, I firmly
-believe that the Lemon way of doing things is better.</p>
-
-<h2>Input File Syntax</h2>
-
-<p>The main purpose of the grammar specification file for Lemon is
-to define the grammar for the parser.  But the input file also
-specifies additional information Lemon requires to do its job.
-Most of the work in using Lemon is in writing an appropriate
-grammar file.</p>
-
-<p>The grammar file for lemon is, for the most part, free format.
-It does not have sections or divisions like yacc or bison.  Any
-declaration can occur at any point in the file.
-Lemon ignores whitespace (except where it is needed to separate
-tokens) and it honors the same commenting conventions as C and C++.</p>
-
-<h3>Terminals and Nonterminals</h3>
-
-<p>A terminal symbol (token) is any string of alphanumeric
-and underscore characters
-that begins with an upper case letter.
-A terminal can contain lower class letters after the first character,
-but the usual convention is to make terminals all upper case.
-A nonterminal, on the other hand, is any string of alphanumeric
-and underscore characters than begins with a lower case letter.
-Again, the usual convention is to make nonterminals use all lower
-case letters.</p>
-
-<p>In Lemon, terminal and nonterminal symbols do not need to 
-be declared or identified in a separate section of the grammar file.
-Lemon is able to generate a list of all terminals and nonterminals
-by examining the grammar rules, and it can always distinguish a
-terminal from a nonterminal by checking the case of the first
-character of the name.</p>
-
-<p>Yacc and bison allow terminal symbols to have either alphanumeric
-names or to be individual characters included in single quotes, like
-this: ')' or '$'.  Lemon does not allow this alternative form for
-terminal symbols.  With Lemon, all symbols, terminals and nonterminals,
-must have alphanumeric names.</p>
-
-<h3>Grammar Rules</h3>
-
-<p>The main component of a Lemon grammar file is a sequence of grammar
-rules.
-Each grammar rule consists of a nonterminal symbol followed by
-the special symbol ``::='' and then a list of terminals and/or nonterminals.
-The rule is terminated by a period.
-The list of terminals and nonterminals on the right-hand side of the
-rule can be empty.
-Rules can occur in any order, except that the left-hand side of the
-first rule is assumed to be the start symbol for the grammar (unless
-specified otherwise using the <tt>%start</tt> directive described below.)
-A typical sequence of grammar rules might look something like this:
-<pre>
-  expr ::= expr PLUS expr.
-  expr ::= expr TIMES expr.
-  expr ::= LPAREN expr RPAREN.
-  expr ::= VALUE.
-</pre>
-</p>
-
-<p>There is one non-terminal in this example, ``expr'', and five
-terminal symbols or tokens: ``PLUS'', ``TIMES'', ``LPAREN'',
-``RPAREN'' and ``VALUE''.</p>
-
-<p>Like yacc and bison, Lemon allows the grammar to specify a block
-of C code that will be executed whenever a grammar rule is reduced
-by the parser.
-In Lemon, this action is specified by putting the C code (contained
-within curly braces <tt>{...}</tt>) immediately after the
-period that closes the rule.
-For example:
-<pre>
-  expr ::= expr PLUS expr.   { printf("Doing an addition...\n"); }
-</pre>
-</p>
-
-<p>In order to be useful, grammar actions must normally be linked to
-their associated grammar rules.
-In yacc and bison, this is accomplished by embedding a ``$$'' in the
-action to stand for the value of the left-hand side of the rule and
-symbols ``$1'', ``$2'', and so forth to stand for the value of
-the terminal or nonterminal at position 1, 2 and so forth on the
-right-hand side of the rule.
-This idea is very powerful, but it is also very error-prone.  The
-single most common source of errors in a yacc or bison grammar is
-to miscount the number of symbols on the right-hand side of a grammar
-rule and say ``$7'' when you really mean ``$8''.</p>
-
-<p>Lemon avoids the need to count grammar symbols by assigning symbolic
-names to each symbol in a grammar rule and then using those symbolic
-names in the action.
-In yacc or bison, one would write this:
-<pre>
-  expr -> expr PLUS expr  { $$ = $1 + $3; };
-</pre>
-But in Lemon, the same rule becomes the following:
-<pre>
-  expr(A) ::= expr(B) PLUS expr(C).  { A = B+C; }
-</pre>
-In the Lemon rule, any symbol in parentheses after a grammar rule
-symbol becomes a place holder for that symbol in the grammar rule.
-This place holder can then be used in the associated C action to
-stand for the value of that symbol.<p>
-
-<p>The Lemon notation for linking a grammar rule with its reduce
-action is superior to yacc/bison on several counts.
-First, as mentioned above, the Lemon method avoids the need to
-count grammar symbols.
-Secondly, if a terminal or nonterminal in a Lemon grammar rule
-includes a linking symbol in parentheses but that linking symbol
-is not actually used in the reduce action, then an error message
-is generated.
-For example, the rule
-<pre>
-  expr(A) ::= expr(B) PLUS expr(C).  { A = B; }
-</pre>
-will generate an error because the linking symbol ``C'' is used
-in the grammar rule but not in the reduce action.</p>
-
-<p>The Lemon notation for linking grammar rules to reduce actions
-also facilitates the use of destructors for reclaiming memory
-allocated by the values of terminals and nonterminals on the
-right-hand side of a rule.</p>
-
-<h3>Precedence Rules</h3>
-
-<p>Lemon resolves parsing ambiguities in exactly the same way as
-yacc and bison.  A shift-reduce conflict is resolved in favor
-of the shift, and a reduce-reduce conflict is resolved by reducing
-whichever rule comes first in the grammar file.</p>
-
-<p>Just like in
-yacc and bison, Lemon allows a measure of control 
-over the resolution of paring conflicts using precedence rules.
-A precedence value can be assigned to any terminal symbol
-using the %left, %right or %nonassoc directives.  Terminal symbols
-mentioned in earlier directives have a lower precedence that
-terminal symbols mentioned in later directives.  For example:</p>
-
-<p><pre>
-   %left AND.
-   %left OR.
-   %nonassoc EQ NE GT GE LT LE.
-   %left PLUS MINUS.
-   %left TIMES DIVIDE MOD.
-   %right EXP NOT.
-</pre></p>
-
-<p>In the preceding sequence of directives, the AND operator is
-defined to have the lowest precedence.  The OR operator is one
-precedence level higher.  And so forth.  Hence, the grammar would
-attempt to group the ambiguous expression
-<pre>
-     a AND b OR c
-</pre>
-like this
-<pre>
-     a AND (b OR c).
-</pre>
-The associativity (left, right or nonassoc) is used to determine
-the grouping when the precedence is the same.  AND is left-associative
-in our example, so
-<pre>
-     a AND b AND c
-</pre>
-is parsed like this
-<pre>
-     (a AND b) AND c.
-</pre>
-The EXP operator is right-associative, though, so
-<pre>
-     a EXP b EXP c
-</pre>
-is parsed like this
-<pre>
-     a EXP (b EXP c).
-</pre>
-The nonassoc precedence is used for non-associative operators.
-So
-<pre>
-     a EQ b EQ c
-</pre>
-is an error.</p>
-
-<p>The precedence of non-terminals is transferred to rules as follows:
-The precedence of a grammar rule is equal to the precedence of the
-left-most terminal symbol in the rule for which a precedence is
-defined.  This is normally what you want, but in those cases where
-you want to precedence of a grammar rule to be something different,
-you can specify an alternative precedence symbol by putting the
-symbol in square braces after the period at the end of the rule and
-before any C-code.  For example:</p>
-
-<p><pre>
-   expr = MINUS expr.  [NOT]
-</pre></p>
-
-<p>This rule has a precedence equal to that of the NOT symbol, not the
-MINUS symbol as would have been the case by default.</p>
-
-<p>With the knowledge of how precedence is assigned to terminal
-symbols and individual
-grammar rules, we can now explain precisely how parsing conflicts
-are resolved in Lemon.  Shift-reduce conflicts are resolved
-as follows:
-<ul>
-<li> If either the token to be shifted or the rule to be reduced
-     lacks precedence information, then resolve in favor of the
-     shift, but report a parsing conflict.
-<li> If the precedence of the token to be shifted is greater than
-     the precedence of the rule to reduce, then resolve in favor
-     of the shift.  No parsing conflict is reported.
-<li> If the precedence of the token it be shifted is less than the
-     precedence of the rule to reduce, then resolve in favor of the
-     reduce action.  No parsing conflict is reported.
-<li> If the precedences are the same and the shift token is
-     right-associative, then resolve in favor of the shift.
-     No parsing conflict is reported.
-<li> If the precedences are the same the the shift token is
-     left-associative, then resolve in favor of the reduce.
-     No parsing conflict is reported.
-<li> Otherwise, resolve the conflict by doing the shift and
-     report the parsing conflict.
-</ul>
-Reduce-reduce conflicts are resolved this way:
-<ul>
-<li> If either reduce rule 
-     lacks precedence information, then resolve in favor of the
-     rule that appears first in the grammar and report a parsing
-     conflict.
-<li> If both rules have precedence and the precedence is different
-     then resolve the dispute in favor of the rule with the highest
-     precedence and do not report a conflict.
-<li> Otherwise, resolve the conflict by reducing by the rule that
-     appears first in the grammar and report a parsing conflict.
-</ul>
-
-<h3>Special Directives</h3>
-
-<p>The input grammar to Lemon consists of grammar rules and special
-directives.  We've described all the grammar rules, so now we'll
-talk about the special directives.</p>
-
-<p>Directives in lemon can occur in any order.  You can put them before
-the grammar rules, or after the grammar rules, or in the mist of the
-grammar rules.  It doesn't matter.  The relative order of
-directives used to assign precedence to terminals is important, but
-other than that, the order of directives in Lemon is arbitrary.</p>
-
-<p>Lemon supports the following special directives:
-<ul>
-<li><tt>%code</tt>
-<li><tt>%default_destructor</tt>
-<li><tt>%default_type</tt>
-<li><tt>%destructor</tt>
-<li><tt>%extra_argument</tt>
-<li><tt>%include</tt>
-<li><tt>%left</tt>
-<li><tt>%name</tt>
-<li><tt>%nonassoc</tt>
-<li><tt>%parse_accept</tt>
-<li><tt>%parse_failure </tt>
-<li><tt>%right</tt>
-<li><tt>%stack_overflow</tt>
-<li><tt>%stack_size</tt>
-<li><tt>%start_symbol</tt>
-<li><tt>%syntax_error</tt>
-<li><tt>%token_destructor</tt>
-<li><tt>%token_prefix</tt>
-<li><tt>%token_type</tt>
-<li><tt>%type</tt>
-</ul>
-Each of these directives will be described separately in the
-following sections:</p>
-
-<h4>The <tt>%code</tt> directive</h4>
-
-<p>The %code directive is used to specify addition C/C++ code that
-is added to the end of the main output file.  This is similar to
-the %include directive except that %include is inserted at the
-beginning of the main output file.</p>
-
-<p>%code is typically used to include some action routines or perhaps
-a tokenizer as part of the output file.</p>
-
-<h4>The <tt>%default_destructor</tt> directive</h4>
-
-<p>The %default_destructor directive specifies a destructor to 
-use for non-terminals that do not have their own destructor
-specified by a separate %destructor directive.  See the documentation
-on the %destructor directive below for additional information.</p>
-
-<p>In some grammers, many different non-terminal symbols have the
-same datatype and hence the same destructor.  This directive is
-a convenience way to specify the same destructor for all those
-non-terminals using a single statement.</p>
-
-<h4>The <tt>%default_type</tt> directive</h4>
-
-<p>The %default_type directive specifies the datatype of non-terminal
-symbols that do no have their own datatype defined using a separate
-%type directive.  See the documentation on %type below for addition
-information.</p>
-
-<h4>The <tt>%destructor</tt> directive</h4>
-
-<p>The %destructor directive is used to specify a destructor for
-a non-terminal symbol.
-(See also the %token_destructor directive which is used to
-specify a destructor for terminal symbols.)</p>
-
-<p>A non-terminal's destructor is called to dispose of the
-non-terminal's value whenever the non-terminal is popped from
-the stack.  This includes all of the following circumstances:
-<ul>
-<li> When a rule reduces and the value of a non-terminal on
-     the right-hand side is not linked to C code.
-<li> When the stack is popped during error processing.
-<li> When the ParseFree() function runs.
-</ul>
-The destructor can do whatever it wants with the value of
-the non-terminal, but its design is to deallocate memory
-or other resources held by that non-terminal.</p>
-
-<p>Consider an example:
-<pre>
-   %type nt {void*}
-   %destructor nt { free($$); }
-   nt(A) ::= ID NUM.   { A = malloc( 100 ); }
-</pre>
-This example is a bit contrived but it serves to illustrate how
-destructors work.  The example shows a non-terminal named
-``nt'' that holds values of type ``void*''.  When the rule for
-an ``nt'' reduces, it sets the value of the non-terminal to
-space obtained from malloc().  Later, when the nt non-terminal
-is popped from the stack, the destructor will fire and call
-free() on this malloced space, thus avoiding a memory leak.
-(Note that the symbol ``$$'' in the destructor code is replaced
-by the value of the non-terminal.)</p>
-
-<p>It is important to note that the value of a non-terminal is passed
-to the destructor whenever the non-terminal is removed from the
-stack, unless the non-terminal is used in a C-code action.  If
-the non-terminal is used by C-code, then it is assumed that the
-C-code will take care of destroying it if it should really
-be destroyed.  More commonly, the value is used to build some
-larger structure and we don't want to destroy it, which is why
-the destructor is not called in this circumstance.</p>
-
-<p>By appropriate use of destructors, it is possible to
-build a parser using Lemon that can be used within a long-running
-program, such as a GUI, that will not leak memory or other resources.
-To do the same using yacc or bison is much more difficult.</p>
-
-<h4>The <tt>%extra_argument</tt> directive</h4>
-
-The %extra_argument directive instructs Lemon to add a 4th parameter
-to the parameter list of the Parse() function it generates.  Lemon
-doesn't do anything itself with this extra argument, but it does
-make the argument available to C-code action routines, destructors,
-and so forth.  For example, if the grammar file contains:</p>
-
-<p><pre>
-    %extra_argument { MyStruct *pAbc }
-</pre></p>
-
-<p>Then the Parse() function generated will have an 4th parameter
-of type ``MyStruct*'' and all action routines will have access to
-a variable named ``pAbc'' that is the value of the 4th parameter
-in the most recent call to Parse().</p>
-
-<h4>The <tt>%include</tt> directive</h4>
-
-<p>The %include directive specifies C code that is included at the
-top of the generated parser.  You can include any text you want --
-the Lemon parser generator copies it blindly.  If you have multiple
-%include directives in your grammar file the value of the last
-%include directive overwrites all the others.</p.
-
-<p>The %include directive is very handy for getting some extra #include
-preprocessor statements at the beginning of the generated parser.
-For example:</p>
-
-<p><pre>
-   %include {#include &lt;unistd.h&gt;}
-</pre></p>
-
-<p>This might be needed, for example, if some of the C actions in the
-grammar call functions that are prototyed in unistd.h.</p>
-
-<h4>The <tt>%left</tt> directive</h4>
-
-The %left directive is used (along with the %right and
-%nonassoc directives) to declare precedences of terminal
-symbols.  Every terminal symbol whose name appears after
-a %left directive but before the next period (``.'') is
-given the same left-associative precedence value.  Subsequent
-%left directives have higher precedence.  For example:</p>
-
-<p><pre>
-   %left AND.
-   %left OR.
-   %nonassoc EQ NE GT GE LT LE.
-   %left PLUS MINUS.
-   %left TIMES DIVIDE MOD.
-   %right EXP NOT.
-</pre></p>
-
-<p>Note the period that terminates each %left, %right or %nonassoc
-directive.</p>
-
-<p>LALR(1) grammars can get into a situation where they require
-a large amount of stack space if you make heavy use or right-associative
-operators.  For this reason, it is recommended that you use %left
-rather than %right whenever possible.</p>
-
-<h4>The <tt>%name</tt> directive</h4>
-
-<p>By default, the functions generated by Lemon all begin with the
-five-character string ``Parse''.  You can change this string to something
-different using the %name directive.  For instance:</p>
-
-<p><pre>
-   %name Abcde
-</pre></p>
-
-<p>Putting this directive in the grammar file will cause Lemon to generate
-functions named
-<ul>
-<li> AbcdeAlloc(),
-<li> AbcdeFree(),
-<li> AbcdeTrace(), and
-<li> Abcde().
-</ul>
-The %name directive allows you to generator two or more different
-parsers and link them all into the same executable.
-</p>
-
-<h4>The <tt>%nonassoc</tt> directive</h4>
-
-<p>This directive is used to assign non-associative precedence to
-one or more terminal symbols.  See the section on precedence rules
-or on the %left directive for additional information.</p>
-
-<h4>The <tt>%parse_accept</tt> directive</h4>
-
-<p>The %parse_accept directive specifies a block of C code that is
-executed whenever the parser accepts its input string.  To ``accept''
-an input string means that the parser was able to process all tokens
-without error.</p>
-
-<p>For example:</p>
-
-<p><pre>
-   %parse_accept {
-      printf("parsing complete!\n");
-   }
-</pre></p>
-
-
-<h4>The <tt>%parse_failure</tt> directive</h4>
-
-<p>The %parse_failure directive specifies a block of C code that
-is executed whenever the parser fails complete.  This code is not
-executed until the parser has tried and failed to resolve an input
-error using is usual error recovery strategy.  The routine is
-only invoked when parsing is unable to continue.</p>
-
-<p><pre>
-   %parse_failure {
-     fprintf(stderr,"Giving up.  Parser is hopelessly lost...\n");
-   }
-</pre></p>
-
-<h4>The <tt>%right</tt> directive</h4>
-
-<p>This directive is used to assign right-associative precedence to
-one or more terminal symbols.  See the section on precedence rules
-or on the %left directive for additional information.</p>
-
-<h4>The <tt>%stack_overflow</tt> directive</h4>
-
-<p>The %stack_overflow directive specifies a block of C code that
-is executed if the parser's internal stack ever overflows.  Typically
-this just prints an error message.  After a stack overflow, the parser
-will be unable to continue and must be reset.</p>
-
-<p><pre>
-   %stack_overflow {
-     fprintf(stderr,"Giving up.  Parser stack overflow\n");
-   }
-</pre></p>
-
-<p>You can help prevent parser stack overflows by avoiding the use
-of right recursion and right-precedence operators in your grammar.
-Use left recursion and and left-precedence operators instead, to
-encourage rules to reduce sooner and keep the stack size down.
-For example, do rules like this:
-<pre>
-   list ::= list element.      // left-recursion.  Good!
-   list ::= .
-</pre>
-Not like this:
-<pre>
-   list ::= element list.      // right-recursion.  Bad!
-   list ::= .
-</pre>
-
-<h4>The <tt>%stack_size</tt> directive</h4>
-
-<p>If stack overflow is a problem and you can't resolve the trouble
-by using left-recursion, then you might want to increase the size
-of the parser's stack using this directive.  Put an positive integer
-after the %stack_size directive and Lemon will generate a parse
-with a stack of the requested size.  The default value is 100.</p>
-
-<p><pre>
-   %stack_size 2000
-</pre></p>
-
-<h4>The <tt>%start_symbol</tt> directive</h4>
-
-<p>By default, the start-symbol for the grammar that Lemon generates
-is the first non-terminal that appears in the grammar file.  But you
-can choose a different start-symbol using the %start_symbol directive.</p>
-
-<p><pre>
-   %start_symbol  prog
-</pre></p>
-
-<h4>The <tt>%token_destructor</tt> directive</h4>
-
-<p>The %destructor directive assigns a destructor to a non-terminal
-symbol.  (See the description of the %destructor directive above.)
-This directive does the same thing for all terminal symbols.</p>
-
-<p>Unlike non-terminal symbols which may each have a different data type
-for their values, terminals all use the same data type (defined by
-the %token_type directive) and so they use a common destructor.  Other
-than that, the token destructor works just like the non-terminal
-destructors.</p>
-
-<h4>The <tt>%token_prefix</tt> directive</h4>
-
-<p>Lemon generates #defines that assign small integer constants
-to each terminal symbol in the grammar.  If desired, Lemon will
-add a prefix specified by this directive
-to each of the #defines it generates.
-So if the default output of Lemon looked like this:
-<pre>
-    #define AND              1
-    #define MINUS            2
-    #define OR               3
-    #define PLUS             4
-</pre>
-You can insert a statement into the grammar like this:
-<pre>
-    %token_prefix    TOKEN_
-</pre>
-to cause Lemon to produce these symbols instead:
-<pre>
-    #define TOKEN_AND        1
-    #define TOKEN_MINUS      2
-    #define TOKEN_OR         3
-    #define TOKEN_PLUS       4
-</pre>
-
-<h4>The <tt>%token_type</tt> and <tt>%type</tt> directives</h4>
-
-<p>These directives are used to specify the data types for values
-on the parser's stack associated with terminal and non-terminal
-symbols.  The values of all terminal symbols must be of the same
-type.  This turns out to be the same data type as the 3rd parameter
-to the Parse() function generated by Lemon.  Typically, you will
-make the value of a terminal symbol by a pointer to some kind of
-token structure.  Like this:</p>
-
-<p><pre>
-   %token_type    {Token*}
-</pre></p>
-
-<p>If the data type of terminals is not specified, the default value
-is ``int''.</p>
-
-<p>Non-terminal symbols can each have their own data types.  Typically
-the data type  of a non-terminal is a pointer to the root of a parse-tree
-structure that contains all information about that non-terminal.
-For example:</p>
-
-<p><pre>
-   %type   expr  {Expr*}
-</pre></p>
-
-<p>Each entry on the parser's stack is actually a union containing
-instances of all data types for every non-terminal and terminal symbol.
-Lemon will automatically use the correct element of this union depending
-on what the corresponding non-terminal or terminal symbol is.  But
-the grammar designer should keep in mind that the size of the union
-will be the size of its largest element.  So if you have a single
-non-terminal whose data type requires 1K of storage, then your 100
-entry parser stack will require 100K of heap space.  If you are willing
-and able to pay that price, fine.  You just need to know.</p>
-
-<h3>Error Processing</h3>
-
-<p>After extensive experimentation over several years, it has been
-discovered that the error recovery strategy used by yacc is about
-as good as it gets.  And so that is what Lemon uses.</p>
-
-<p>When a Lemon-generated parser encounters a syntax error, it
-first invokes the code specified by the %syntax_error directive, if
-any.  It then enters its error recovery strategy.  The error recovery
-strategy is to begin popping the parsers stack until it enters a
-state where it is permitted to shift a special non-terminal symbol
-named ``error''.  It then shifts this non-terminal and continues
-parsing.  But the %syntax_error routine will not be called again
-until at least three new tokens have been successfully shifted.</p>
-
-<p>If the parser pops its stack until the stack is empty, and it still
-is unable to shift the error symbol, then the %parse_failed routine
-is invoked and the parser resets itself to its start state, ready
-to begin parsing a new file.  This is what will happen at the very
-first syntax error, of course, if there are no instances of the 
-``error'' non-terminal in your grammar.</p>
-
-</body>
-</html>
-
diff --git a/tools/lemon/lempar.c b/tools/lemon/lempar.c
index 3564b137dc..8d17723cf3 100644
--- a/tools/lemon/lempar.c
+++ b/tools/lemon/lempar.c
@@ -66,8 +66,10 @@
 **                       zero the stack is dynamically sized using realloc()
 **    ParseARG_SDECL     A static variable declaration for the %extra_argument
 **    ParseARG_PDECL     A parameter declaration for the %extra_argument
+**    ParseARG_PARAM     Code to pass %extra_argument as a subroutine parameter
 **    ParseARG_STORE     Code to store %extra_argument into yypParser
 **    ParseARG_FETCH     Code to extract %extra_argument from yypParser
+**    ParseCTX_*         As ParseARG_ except for %extra_context
 **    YYERRORSYMBOL      is the code number of the error symbol.  If not
 **                       defined, then do no error processing.
 **    YYNSTATE           the combined number of states.
@@ -88,6 +90,7 @@
 /************* Begin control #defines *****************************************/
 %%
 /************* End control #defines *******************************************/
+#define YY_NLOOKAHEAD ((int)(sizeof(yy_lookahead)/sizeof(yy_lookahead[0])))
 
 /* Define the yytestcase() macro to be a no-op if is not already defined
 ** otherwise.
@@ -211,6 +214,7 @@ struct yyParser {
   int yyerrcnt;                 /* Shifts left before out of the error */
 #endif
   ParseARG_SDECL                /* A place to hold %extra_argument */
+  ParseCTX_SDECL                /* A place to hold %extra_context */
 #if YYSTACKDEPTH<=0
   int yystksz;                  /* Current side of the stack */
   yyStackEntry *yystack;        /* The parser's stack */
@@ -315,28 +319,29 @@ static int yyGrowStack(yyParser *p){
 
 /* Initialize a new parser that has already been allocated.
 */
-static void ParseInit(void *yypParser){
-  yyParser *pParser = (yyParser*)yypParser;
+static void ParseInit(void *yypRawParser ParseCTX_PDECL){
+  yyParser *yypParser = (yyParser*)yypRawParser;
+  ParseCTX_STORE
 #ifdef YYTRACKMAXSTACKDEPTH
-  pParser->yyhwm = 0;
+  yypParser->yyhwm = 0;
 #endif
 #if YYSTACKDEPTH<=0
-  pParser->yytos = NULL;
-  pParser->yystack = NULL;
-  pParser->yystksz = 0;
-  if( yyGrowStack(pParser) ){
-    pParser->yystack = &pParser->yystk0;
-    pParser->yystksz = 1;
+  yypParser->yytos = NULL;
+  yypParser->yystack = NULL;
+  yypParser->yystksz = 0;
+  if( yyGrowStack(yypParser) ){
+    yypParser->yystack = &yypParser->yystk0;
+    yypParser->yystksz = 1;
   }
 #endif
 #ifndef YYNOERRORRECOVERY
-  pParser->yyerrcnt = -1;
+  yypParser->yyerrcnt = -1;
 #endif
-  pParser->yytos = pParser->yystack;
-  pParser->yystack[0].stateno = 0;
-  pParser->yystack[0].major = 0;
+  yypParser->yytos = yypParser->yystack;
+  yypParser->yystack[0].stateno = 0;
+  yypParser->yystack[0].major = 0;
 #if YYSTACKDEPTH>0
-  pParser->yystackEnd = &pParser->yystack[YYSTACKDEPTH - 1];
+  yypParser->yystackEnd = &yypParser->yystack[YYSTACKDEPTH-1];
 #endif
 }
 
@@ -353,11 +358,14 @@ static void ParseInit(void *yypParser){
 ** A pointer to a parser.  This pointer is used in subsequent calls
 ** to Parse and ParseFree.
 */
-void *ParseAlloc(void *(*mallocProc)(YYMALLOCARGTYPE)){
-  yyParser *pParser;
-  pParser = (yyParser*)(*mallocProc)( (YYMALLOCARGTYPE)sizeof(yyParser) );
-  if( pParser ) ParseInit(pParser);
-  return pParser;
+void *ParseAlloc(void *(*mallocProc)(YYMALLOCARGTYPE) ParseCTX_PDECL){
+  yyParser *yypParser;
+  yypParser = (yyParser*)(*mallocProc)( (YYMALLOCARGTYPE)sizeof(yyParser) );
+  if( yypParser ){
+    ParseCTX_STORE
+    ParseInit(yypParser ParseCTX_PARAM);
+  }
+  return (void*)yypParser;
 }
 #endif /* Parse_ENGINEALWAYSONSTACK */
 
@@ -374,7 +382,8 @@ static void yy_destructor(
   YYCODETYPE yymajor,     /* Type code for object to destroy */
   YYMINORTYPE *yypminor   /* The object to be destroyed */
 ){
-  ParseARG_FETCH;
+  ParseARG_FETCH
+  ParseCTX_FETCH
   switch( yymajor ){
     /* Here is inserted the actions which take place when a
     ** terminal or non-terminal is destroyed.  This can happen
@@ -474,48 +483,48 @@ static unsigned char yycoverage[YYNSTATE][YYNTOKEN];
 ** Return the number of missed state/lookahead combinations.
 */
 #if defined(YYCOVERAGE)
-int ParseCoverage(FILE *out) {
-    int stateno, iLookAhead, i;
-    int nMissed = 0;
-    for (stateno = 0; stateno<YYNSTATE; stateno++) {
-        i = yy_shift_ofst[stateno];
-        for (iLookAhead = 0; iLookAhead<YYNTOKEN; iLookAhead++) {
-            if (yy_lookahead[i + iLookAhead] != iLookAhead) continue;
-            if (yycoverage[stateno][iLookAhead] == 0) nMissed++;
-            if (out) {
-                fprintf(out, "State %d lookahead %s %s\n", stateno,
-                    yyTokenName[iLookAhead],
-                    yycoverage[stateno][iLookAhead] ? "ok" : "missed");
-            }
-        }
+int ParseCoverage(FILE *out){
+  int stateno, iLookAhead, i;
+  int nMissed = 0;
+  for(stateno=0; stateno<YYNSTATE; stateno++){
+    i = yy_shift_ofst[stateno];
+    for(iLookAhead=0; iLookAhead<YYNTOKEN; iLookAhead++){
+      if( yy_lookahead[i+iLookAhead]!=iLookAhead ) continue;
+      if( yycoverage[stateno][iLookAhead]==0 ) nMissed++;
+      if( out ){
+        fprintf(out,"State %d lookahead %s %s\n", stateno,
+                yyTokenName[iLookAhead],
+                yycoverage[stateno][iLookAhead] ? "ok" : "missed");
+      }
     }
-    return nMissed;
+  }
+  return nMissed;
 }
 #endif
+
 /*
 ** Find the appropriate action for a parser given the terminal
 ** look-ahead token iLookAhead.
 */
-static unsigned int yy_find_shift_action(
-    yyParser *pParser,        /* The parser */
-    YYCODETYPE iLookAhead     /* The look-ahead token */
-) {
-    int i;
-    int stateno = pParser->yytos->stateno;
+static YYACTIONTYPE yy_find_shift_action(
+  YYCODETYPE iLookAhead,    /* The look-ahead token */
+  YYACTIONTYPE stateno      /* Current state number */
+){
+  int i;
 
-    if (stateno>YY_MAX_SHIFT) return stateno;
-    assert(stateno <= YY_SHIFT_COUNT);
+  if( stateno>YY_MAX_SHIFT ) return stateno;
+  assert( stateno <= YY_SHIFT_COUNT );
 #if defined(YYCOVERAGE)
-    yycoverage[stateno][iLookAhead] = 1;
+  yycoverage[stateno][iLookAhead] = 1;
 #endif
-    do {
-        i = yy_shift_ofst[stateno];
-        assert(i >= 0);
-        assert(i + YYNTOKEN <= (int)(sizeof(yy_lookahead) / sizeof(yy_lookahead[0])));
-        assert(iLookAhead != YYNOCODE);
-        assert(iLookAhead < YYNTOKEN);
-        i += iLookAhead;
-        if (yy_lookahead[i] != iLookAhead) {
+  do{
+    i = yy_shift_ofst[stateno];
+    assert( i>=0 );
+    /* assert( i+YYNTOKEN<=(int)YY_NLOOKAHEAD ); */
+    assert( iLookAhead!=YYNOCODE );
+    assert( iLookAhead < YYNTOKEN );
+    i += iLookAhead;
+    if( i>=YY_NLOOKAHEAD || yy_lookahead[i]!=iLookAhead ){
 #ifdef YYFALLBACK
       YYCODETYPE iFallback;            /* Fallback token */
       if( iLookAhead<sizeof(yyFallback)/sizeof(yyFallback[0])
@@ -541,6 +550,7 @@ static unsigned int yy_find_shift_action(
 #if YY_SHIFT_MAX+YYWILDCARD>=YY_ACTTAB_COUNT
           j<YY_ACTTAB_COUNT &&
 #endif
+          j<(int)(sizeof(yy_lookahead)/sizeof(yy_lookahead[0])) &&
           yy_lookahead[j]==YYWILDCARD && iLookAhead>0
         ){
 #ifndef NDEBUG
@@ -565,8 +575,8 @@ static unsigned int yy_find_shift_action(
 ** Find the appropriate action for a parser given the non-terminal
 ** look-ahead token iLookAhead.
 */
-static int yy_find_reduce_action(
-  int stateno,              /* Current state number */
+static YYACTIONTYPE yy_find_reduce_action(
+  YYACTIONTYPE stateno,     /* Current state number */
   YYCODETYPE iLookAhead     /* The look-ahead token */
 ){
   int i;
@@ -595,7 +605,8 @@ static int yy_find_reduce_action(
 ** The following routine is called if the stack overflows.
 */
 static void yyStackOverflow(yyParser *yypParser){
-   ParseARG_FETCH;
+   ParseARG_FETCH
+   ParseCTX_FETCH
 #ifndef NDEBUG
    if( yyTraceFILE ){
      fprintf(yyTraceFILE,"%sStack Overflow!\n",yyTracePrompt);
@@ -607,25 +618,26 @@ static void yyStackOverflow(yyParser *yypParser){
 /******** Begin %stack_overflow code ******************************************/
 %%
 /******** End %stack_overflow code ********************************************/
-   ParseARG_STORE; /* Suppress warning about unused %extra_argument var */
+   ParseARG_STORE /* Suppress warning about unused %extra_argument var */
+   ParseCTX_STORE
 }
 
 /*
 ** Print tracing information for a SHIFT action
 */
 #ifndef NDEBUG
-static void yyTraceShift(yyParser *yypParser, int yyNewState, const char *zTag) {
-    if (yyTraceFILE) {
-        if (yyNewState<YYNSTATE) {
-            fprintf(yyTraceFILE, "%s%s '%s', go to state %d\n",
-                yyTracePrompt, zTag, yyTokenName[yypParser->yytos->major],
-                yyNewState);
-        } else {
-            fprintf(yyTraceFILE, "%s%s '%s', pending reduce %d\n",
-                yyTracePrompt, zTag, yyTokenName[yypParser->yytos->major],
-                yyNewState - YY_MIN_REDUCE);
-        }
+static void yyTraceShift(yyParser *yypParser, int yyNewState, const char *zTag){
+  if( yyTraceFILE ){
+    if( yyNewState<YYNSTATE ){
+      fprintf(yyTraceFILE,"%s%s '%s', go to state %d\n",
+         yyTracePrompt, zTag, yyTokenName[yypParser->yytos->major],
+         yyNewState);
+    }else{
+      fprintf(yyTraceFILE,"%s%s '%s', pending reduce %d\n",
+         yyTracePrompt, zTag, yyTokenName[yypParser->yytos->major],
+         yyNewState - YY_MIN_REDUCE);
     }
+  }
 }
 #else
 # define yyTraceShift(X,Y,Z)
@@ -636,8 +648,8 @@ static void yyTraceShift(yyParser *yypParser, int yyNewState, const char *zTag)
 */
 static void yy_shift(
   yyParser *yypParser,          /* The parser to be shifted */
-  int yyNewState,               /* The new state to shift in */
-  int yyMajor,                  /* The major token to shift in */
+  YYACTIONTYPE yyNewState,      /* The new state to shift in */
+  YYCODETYPE yyMajor,           /* The major token to shift in */
   ParseTOKENTYPE yyMinor        /* The minor token to shift in */
 ){
   yyStackEntry *yytos;
@@ -649,7 +661,7 @@ static void yy_shift(
   }
 #endif
 #if YYSTACKDEPTH>0
-  if (yypParser->yytos>yypParser->yystackEnd) {
+  if( yypParser->yytos>yypParser->yystackEnd ){
     yypParser->yytos--;
     yyStackOverflow(yypParser);
     return;
@@ -667,8 +679,8 @@ static void yy_shift(
     yyNewState += YY_MIN_REDUCE - YY_MIN_SHIFTREDUCE;
   }
   yytos = yypParser->yytos;
-  yytos->stateno = (YYACTIONTYPE)yyNewState;
-  yytos->major = (YYCODETYPE)yyMajor;
+  yytos->stateno = yyNewState;
+  yytos->major = yyMajor;
   yytos->minor.yy0 = yyMinor;
   yyTraceShift(yypParser, yyNewState, "Shift");
 }
@@ -677,51 +689,53 @@ static void yy_shift(
 ** is used during the reduce.
 */
 static const struct {
-    YYCODETYPE lhs;       /* Symbol on the left-hand side of the rule */
-    signed char nrhs;     /* Negative of the number of RHS symbols in the rule */
+  YYCODETYPE lhs;       /* Symbol on the left-hand side of the rule */
+  signed char nrhs;     /* Negative of the number of RHS symbols in the rule */
 } yyRuleInfo[] = {
 %%
 };
 
 static void yy_accept(yyParser*);  /* Forward Declaration */
 
-                                   /*
-                                   ** Perform a reduce action and the shift that must immediately
-                                   ** follow the reduce.
-                                   **
-                                   ** The yyLookahead and yyLookaheadToken parameters provide reduce actions
-                                   ** access to the lookahead token (if any).  The yyLookahead will be YYNOCODE
-                                   ** if the lookahead token has already been consumed.  As this procedure is
-                                   ** only called from one place, optimizing compilers will in-line it, which
-                                   ** means that the extra parameters have no performance impact.
-                                   */
-static void yy_reduce(
-    yyParser *yypParser,         /* The parser */
-    unsigned int yyruleno,       /* Number of the rule by which to reduce */
-    int yyLookahead,             /* Lookahead token, or YYNOCODE if none */
-    ParseTOKENTYPE yyLookaheadToken  /* Value of the lookahead token */
-) {
+/*
+** Perform a reduce action and the shift that must immediately
+** follow the reduce.
+**
+** The yyLookahead and yyLookaheadToken parameters provide reduce actions
+** access to the lookahead token (if any).  The yyLookahead will be YYNOCODE
+** if the lookahead token has already been consumed.  As this procedure is
+** only called from one place, optimizing compilers will in-line it, which
+** means that the extra parameters have no performance impact.
+*/
+static YYACTIONTYPE yy_reduce(
+  yyParser *yypParser,         /* The parser */
+  unsigned int yyruleno,       /* Number of the rule by which to reduce */
+  int yyLookahead,             /* Lookahead token, or YYNOCODE if none */
+  ParseTOKENTYPE yyLookaheadToken  /* Value of the lookahead token */
+  ParseCTX_PDECL                   /* %extra_context */
+){
   int yygoto;                     /* The next state */
-  int yyact;                      /* The next action */
+  YYACTIONTYPE yyact;             /* The next action */
   yyStackEntry *yymsp;            /* The top of the parser's stack */
   int yysize;                     /* Amount to pop the stack */
-  ParseARG_FETCH;
+  ParseARG_FETCH
   (void)yyLookahead;
   (void)yyLookaheadToken;
   yymsp = yypParser->yytos;
 #ifndef NDEBUG
-  if (yyTraceFILE && yyruleno<(int)(sizeof(yyRuleName) / sizeof(yyRuleName[0]))) {
-      yysize = yyRuleInfo[yyruleno].nrhs;
-      if (yysize) {
-          fprintf(yyTraceFILE, "%sReduce %d [%s], go to state %d.\n",
-              yyTracePrompt,
-              yyruleno, yyRuleName[yyruleno], yymsp[yysize].stateno);
-      } else {
-          fprintf(yyTraceFILE, "%sReduce %d [%s].\n",
-              yyTracePrompt, yyruleno, yyRuleName[yyruleno]);
-      }
+  if( yyTraceFILE && yyruleno<(int)(sizeof(yyRuleName)/sizeof(yyRuleName[0])) ){
+    yysize = yyRuleInfo[yyruleno].nrhs;
+    if( yysize ){
+      fprintf(yyTraceFILE, "%sReduce %d [%s], go to state %d.\n",
+        yyTracePrompt,
+        yyruleno, yyRuleName[yyruleno], yymsp[yysize].stateno);
+    }else{
+      fprintf(yyTraceFILE, "%sReduce %d [%s].\n",
+        yyTracePrompt, yyruleno, yyRuleName[yyruleno]);
+    }
   }
 #endif /* NDEBUG */
+
   /* Check that the stack is large enough to grow by a single entry
   ** if the RHS of the rule is empty.  This ensures that there is room
   ** enough on the stack to push the LHS value */
@@ -733,15 +747,21 @@ static void yy_reduce(
     }
 #endif
 #if YYSTACKDEPTH>0
-    if (yypParser->yytos >= yypParser->yystackEnd) {
+    if( yypParser->yytos>=yypParser->yystackEnd ){
       yyStackOverflow(yypParser);
-      return;
+      /* The call to yyStackOverflow() above pops the stack until it is
+      ** empty, causing the main parser loop to exit.  So the return value
+      ** is never used and does not matter. */
+      return 0;
     }
 #else
     if( yypParser->yytos>=&yypParser->yystack[yypParser->yystksz-1] ){
       if( yyGrowStack(yypParser) ){
         yyStackOverflow(yypParser);
-        return;
+        /* The call to yyStackOverflow() above pops the stack until it is
+        ** empty, causing the main parser loop to exit.  So the return value
+        ** is never used and does not matter. */
+        return 0;
       }
       yymsp = yypParser->yytos;
     }
@@ -764,20 +784,21 @@ static void yy_reduce(
   assert( yyruleno<sizeof(yyRuleInfo)/sizeof(yyRuleInfo[0]) );
   yygoto = yyRuleInfo[yyruleno].lhs;
   yysize = yyRuleInfo[yyruleno].nrhs;
-  yyact = yy_find_reduce_action(yymsp[yysize].stateno, (YYCODETYPE)yygoto);
+  yyact = yy_find_reduce_action(yymsp[yysize].stateno,(YYCODETYPE)yygoto);
 
   /* There are no SHIFTREDUCE actions on nonterminals because the table
   ** generator has simplified them to pure REDUCE actions. */
-  assert(!(yyact>YY_MAX_SHIFT && yyact <= YY_MAX_SHIFTREDUCE));
+  assert( !(yyact>YY_MAX_SHIFT && yyact<=YY_MAX_SHIFTREDUCE) );
 
   /* It is not possible for a REDUCE to be followed by an error */
-  assert(yyact != YY_ERROR_ACTION);
+  assert( yyact!=YY_ERROR_ACTION );
 
-  yymsp += yysize + 1;
+  yymsp += yysize+1;
   yypParser->yytos = yymsp;
   yymsp->stateno = (YYACTIONTYPE)yyact;
   yymsp->major = (YYCODETYPE)yygoto;
   yyTraceShift(yypParser, yyact, "... then shift");
+  return yyact;
 }
 
 /*
@@ -787,7 +808,8 @@ static void yy_reduce(
 static void yy_parse_failed(
   yyParser *yypParser           /* The parser */
 ){
-  ParseARG_FETCH;
+  ParseARG_FETCH
+  ParseCTX_FETCH
 #ifndef NDEBUG
   if( yyTraceFILE ){
     fprintf(yyTraceFILE,"%sFail!\n",yyTracePrompt);
@@ -799,7 +821,8 @@ static void yy_parse_failed(
 /************ Begin %parse_failure code ***************************************/
 %%
 /************ End %parse_failure code *****************************************/
-  ParseARG_STORE; /* Suppress warning about unused %extra_argument variable */
+  ParseARG_STORE /* Suppress warning about unused %extra_argument variable */
+  ParseCTX_STORE
 }
 #endif /* YYNOERRORRECOVERY */
 
@@ -811,12 +834,14 @@ static void yy_syntax_error(
   int yymajor _U_,               /* The major type of the error token */
   ParseTOKENTYPE yyminor         /* The minor type of the error token */
 ){
-  ParseARG_FETCH;
+  ParseARG_FETCH
+  ParseCTX_FETCH
 #define TOKEN yyminor
 /************ Begin %syntax_error code ****************************************/
 %%
 /************ End %syntax_error code ******************************************/
-  ParseARG_STORE; /* Suppress warning about unused %extra_argument variable */
+  ParseARG_STORE /* Suppress warning about unused %extra_argument variable */
+  ParseCTX_STORE
 }
 
 /*
@@ -825,7 +850,8 @@ static void yy_syntax_error(
 static void yy_accept(
   yyParser *yypParser           /* The parser */
 ){
-  ParseARG_FETCH;
+  ParseARG_FETCH
+  ParseCTX_FETCH
 #ifndef NDEBUG
   if( yyTraceFILE ){
     fprintf(yyTraceFILE,"%sAccept!\n",yyTracePrompt);
@@ -840,7 +866,8 @@ static void yy_accept(
 /*********** Begin %parse_accept code *****************************************/
 %%
 /*********** End %parse_accept code *******************************************/
-  ParseARG_STORE; /* Suppress warning about unused %extra_argument variable */
+  ParseARG_STORE /* Suppress warning about unused %extra_argument variable */
+  ParseCTX_STORE
 }
 
 /* The main parser program.
@@ -869,54 +896,56 @@ void Parse(
   ParseARG_PDECL               /* Optional %extra_argument parameter */
 ){
   YYMINORTYPE yyminorunion;
-  unsigned int yyact;   /* The parser action. */
+  YYACTIONTYPE yyact;   /* The parser action. */
 #if !defined(YYERRORSYMBOL) && !defined(YYNOERRORRECOVERY)
   int yyendofinput;     /* True if we are at the end of input */
 #endif
 #ifdef YYERRORSYMBOL
   int yyerrorhit = 0;   /* True if yymajor has invoked an error */
 #endif
-  yyParser *yypParser;  /* The parser */
+  yyParser *yypParser = (yyParser*)yyp;  /* The parser */
+  ParseCTX_FETCH
+  ParseARG_STORE
 
-  yypParser = (yyParser*)yyp;
   assert( yypParser->yytos!=0 );
 #if !defined(YYERRORSYMBOL) && !defined(YYNOERRORRECOVERY)
   yyendofinput = (yymajor==0);
 #endif
-  ParseARG_STORE;
 
+  yyact = yypParser->yytos->stateno;
 #ifndef NDEBUG
-  if (yyTraceFILE) {
-      int stateno = yypParser->yytos->stateno;
-      if (stateno < YY_MIN_REDUCE) {
-          fprintf(yyTraceFILE, "%sInput '%s' in state %d\n",
-              yyTracePrompt, yyTokenName[yymajor], stateno);
-      } else {
-          fprintf(yyTraceFILE, "%sInput '%s' with pending reduce %d\n",
-              yyTracePrompt, yyTokenName[yymajor], stateno - YY_MIN_REDUCE);
-      }
+  if( yyTraceFILE ){
+    if( yyact < YY_MIN_REDUCE ){
+      fprintf(yyTraceFILE,"%sInput '%s' in state %d\n",
+              yyTracePrompt,yyTokenName[yymajor],yyact);
+    }else{
+      fprintf(yyTraceFILE,"%sInput '%s' with pending reduce %d\n",
+              yyTracePrompt,yyTokenName[yymajor],yyact-YY_MIN_REDUCE);
+    }
   }
 #endif
 
-  do {
-      yyact = yy_find_shift_action(yypParser, (YYCODETYPE)yymajor);
-      if (yyact >= YY_MIN_REDUCE) {
-          yy_reduce(yypParser, yyact - YY_MIN_REDUCE, yymajor, yyminor);
-      } else if (yyact <= YY_MAX_SHIFTREDUCE) {
-          yy_shift(yypParser, yyact, yymajor, yyminor);
+  do{
+    assert( yyact==yypParser->yytos->stateno );
+    yyact = yy_find_shift_action((YYCODETYPE)yymajor,yyact);
+    if( yyact >= YY_MIN_REDUCE ){
+      yyact = yy_reduce(yypParser,yyact-YY_MIN_REDUCE,yymajor,
+                        yyminor ParseCTX_PARAM);
+    }else if( yyact <= YY_MAX_SHIFTREDUCE ){
+      yy_shift(yypParser,yyact,(YYCODETYPE)yymajor,yyminor);
 #ifndef YYNOERRORRECOVERY
-          yypParser->yyerrcnt--;
+      yypParser->yyerrcnt--;
 #endif
-          yymajor = YYNOCODE;
-      } else if (yyact == YY_ACCEPT_ACTION) {
-          yypParser->yytos--;
-          yy_accept(yypParser);
-          return;
-      } else {
-          assert(yyact == YY_ERROR_ACTION);
-          yyminorunion.yy0 = yyminor; 
+      break;
+    }else if( yyact==YY_ACCEPT_ACTION ){
+      yypParser->yytos--;
+      yy_accept(yypParser);
+      return;
+    }else{
+      assert( yyact == YY_ERROR_ACTION );
+      yyminorunion.yy0 = yyminor;
 #ifdef YYERRORSYMBOL
-          int yymx;
+      int yymx;
 #endif
 #ifndef NDEBUG
       if( yyTraceFILE ){
@@ -978,6 +1007,8 @@ void Parse(
       }
       yypParser->yyerrcnt = 3;
       yyerrorhit = 1;
+      if( yymajor==YYNOCODE ) break;
+      yyact = yypParser->yytos->stateno;
 #elif defined(YYNOERRORRECOVERY)
       /* If the YYNOERRORRECOVERY macro is defined, then do not attempt to
       ** do any kind of error recovery.  Instead, simply invoke the syntax
@@ -988,8 +1019,7 @@ void Parse(
       */
       yy_syntax_error(yypParser,yymajor, yyminor);
       yy_destructor(yypParser,(YYCODETYPE)yymajor,&yyminorunion);
-      yymajor = YYNOCODE;
-
+      break;
 #else  /* YYERRORSYMBOL is not defined */
       /* This is what we do if the grammar does not define ERROR:
       **
@@ -1011,10 +1041,10 @@ void Parse(
         yypParser->yyerrcnt = -1;
 #endif
       }
-      yymajor = YYNOCODE;
+      break;
 #endif
     }
-  }while( yymajor!=YYNOCODE && yypParser->yytos>yypParser->yystack );
+  }while( yypParser->yytos>yypParser->yystack );
 #ifndef NDEBUG
   if( yyTraceFILE ){
     yyStackEntry *i;
@@ -1029,3 +1059,20 @@ void Parse(
 #endif
   return;
 }
+
+#if 0
+/*
+** Return the fallback token corresponding to canonical token iToken, or
+** 0 if iToken has no fallback.
+*/
+int ParseFallback(int iToken){
+#ifdef YYFALLBACK
+  if( iToken<(int)(sizeof(yyFallback)/sizeof(yyFallback[0])) ){
+    return yyFallback[iToken];
+  }
+#else
+  (void)iToken;
+#endif
+  return 0;
+}
+#endif
diff --git a/tools/lemon/patches/01-lempar-wireshark-warnings.patch b/tools/lemon/patches/01-lempar-wireshark-warnings.patch
new file mode 100644
index 0000000000..61ebbbf38f
--- /dev/null
+++ b/tools/lemon/patches/01-lempar-wireshark-warnings.patch
@@ -0,0 +1,48 @@
+Make ParseInit and ParseFinalize static to fix -Wmissing-prototypes in
+dtd_grammar.c. Hide ParseFinalize to fix -Wunused-function since this feature
+is not used by Wireshark.
+
+Mark yymajor as _U_ since none of the lemon grammar files seem to use it in
+their %syntax_error directive, this fixes -Wunused-parameter
+--- a/lempar.c
++++ b/lempar.c
+@@ -319,7 +319,7 @@ static int yyGrowStack(yyParser *p){
+ 
+ /* Initialize a new parser that has already been allocated.
+ */
+-void ParseInit(void *yypRawParser ParseCTX_PDECL){
++static void ParseInit(void *yypRawParser ParseCTX_PDECL){
+   yyParser *yypParser = (yyParser*)yypRawParser;
+   ParseCTX_STORE
+ #ifdef YYTRACKMAXSTACKDEPTH
+@@ -426,7 +426,7 @@ static void yy_pop_parser_stack(yyParser *pParser){
+ /*
+ ** Clear all secondary memory allocations from the parser
+ */
+-void ParseFinalize(void *p){
++static void ParseFinalize(void *p){
+   yyParser *pParser = (yyParser*)p;
+   while( pParser->yytos>pParser->yystack ) yy_pop_parser_stack(pParser);
+ #if YYSTACKDEPTH<=0
+@@ -831,7 +831,7 @@ static void yy_parse_failed(
+ */
+ static void yy_syntax_error(
+   yyParser *yypParser,           /* The parser */
+-  int yymajor,                   /* The major type of the error token */
++  int yymajor _U_,               /* The major type of the error token */
+   ParseTOKENTYPE yyminor         /* The minor type of the error token */
+ ){
+   ParseARG_FETCH
+@@ -1060,6 +1060,7 @@ void Parse(
+   return;
+ }
+ 
++#if 0
+ /*
+ ** Return the fallback token corresponding to canonical token iToken, or
+ ** 0 if iToken has no fallback.
+@@ -1074,3 +1075,4 @@ int ParseFallback(int iToken){
+ #endif
+   return 0;
+ }
++#endif
diff --git a/tools/lemon/patches/02-lemon-fix-dead-store.patch b/tools/lemon/patches/02-lemon-fix-dead-store.patch
new file mode 100644
index 0000000000..b3e7688b8f
--- /dev/null
+++ b/tools/lemon/patches/02-lemon-fix-dead-store.patch
@@ -0,0 +1,12 @@
+Avoid dead store warning, the same assignment happens later in this function.
+--- a/lemon.c
++++ b/lemon.c
+@@ -3950,7 +3950,7 @@ void print_stack_union(
+   int *plineno,               /* Pointer to the line number */
+   int mhflag                  /* True if generating makeheaders output */
+ ){
+-  int lineno = *plineno;    /* The line number of the output */
++  int lineno;               /* The line number of the output */
+   char **types;             /* A hash table of datatypes */
+   int arraysize;            /* Size of the "types" array */
+   int maxdtlength;          /* Maximum length of any ".datatype" field. */
diff --git a/tools/lemon/patches/03-lemon-null-deref-fp.patch b/tools/lemon/patches/03-lemon-null-deref-fp.patch
new file mode 100644
index 0000000000..74580efe7e
--- /dev/null
+++ b/tools/lemon/patches/03-lemon-null-deref-fp.patch
@@ -0,0 +1,33 @@
+Assertions to avoid false null-pointer dereferences.
+--- a/lemon.c
++++ b/lemon.c
+@@ -690,11 +690,13 @@ int acttab_insert(acttab *p, int makeItSafe){
+       fprintf(stderr,"malloc failed\n");
+       exit(1);
+     }
++    assert(oldAlloc < p->nActionAlloc);     /* hint for CSA */
+     for(i=oldAlloc; i<p->nActionAlloc; i++){
+       p->aAction[i].lookahead = -1;
+       p->aAction[i].action = -1;
+     }
+   }
++  assert(p->aAction);  /* Hint for CSA (for p->aAction[i] below) */
+ 
+   /* Scan the existing action table looking for an offset that is a
+   ** duplicate of the current transaction set.  Fall out of the loop
+@@ -1078,6 +1080,7 @@ void FindLinks(struct lemon *lemp)
+   ** which the link is attached. */
+   for(i=0; i<lemp->nstate; i++){
+     stp = lemp->sorted[i];
++    assert(stp);    /* Hint for CSA */
+     for(cfp=stp->cfp; cfp; cfp=cfp->next){
+       cfp->stp = stp;
+     }
+@@ -1684,6 +1687,7 @@ int main(int argc, char **argv)
+   /* Parse the input file */
+   Parse(&lem);
+   if( lem.errorcnt ) exit(lem.errorcnt);
++  assert(lem.rule);  /* Hint for CSA (no errors => rule found). */
+   if( lem.nrule==0 ){
+     fprintf(stderr,"Empty grammar.\n");
+     exit(1);
diff --git a/tools/lemon/patches/04-lemon-struct-copy-memleak-fp.patch b/tools/lemon/patches/04-lemon-struct-copy-memleak-fp.patch
new file mode 100644
index 0000000000..4bcaf87b72
--- /dev/null
+++ b/tools/lemon/patches/04-lemon-struct-copy-memleak-fp.patch
@@ -0,0 +1,44 @@
+Workaround for CSA limitation, it currently does not correctly handle structure
+assignment. Escaping the pointer via function call is a workaround to hide the
+false positive (use-after-free). Change done with:
+sed -e 's#\*\(x[1-4]a\) = array;$#memcpy(\1, \&array, sizeof(array)); /* & */#'
+
+Link: https://bugs.llvm.org/show_bug.cgi?id=39356
+--- a/lemon.c
++++ b/lemon.c
+@@ -5076,7 +5076,7 @@ int Strsafe_insert(const char *data)
+       array.ht[h] = newnp;
+     }
+     free(x1a->tbl);
+-    *x1a = array;
++    memcpy(x1a, &array, sizeof(array)); /* *x1a = array; */
+   }
+   /* Insert the new data */
+   h = ph & (x1a->size-1);
+@@ -5244,7 +5244,7 @@ int Symbol_insert(struct symbol *data, const char *key)
+       array.ht[h] = newnp;
+     }
+     free(x2a->tbl);
+-    *x2a = array;
++    memcpy(x2a, &array, sizeof(array)); /* *x2a = array; */
+   }
+   /* Insert the new data */
+   h = ph & (x2a->size-1);
+@@ -5441,7 +5441,7 @@ int State_insert(struct state *data, struct config *key)
+       array.ht[h] = newnp;
+     }
+     free(x3a->tbl);
+-    *x3a = array;
++    memcpy(x3a, &array, sizeof(array)); /* *x3a = array; */
+   }
+   /* Insert the new data */
+   h = ph & (x3a->size-1);
+@@ -5580,7 +5580,7 @@ int Configtable_insert(struct config *data)
+       array.ht[h] = newnp;
+     }
+     free(x4a->tbl);
+-    *x4a = array;
++    memcpy(x4a, &array, sizeof(array)); /* *x4a = array; */
+   }
+   /* Insert the new data */
+   h = ph & (x4a->size-1);
diff --git a/tools/lemon/patches/05-lemon-memleak-alloc-failure.patch b/tools/lemon/patches/05-lemon-memleak-alloc-failure.patch
new file mode 100644
index 0000000000..288ea22505
--- /dev/null
+++ b/tools/lemon/patches/05-lemon-memleak-alloc-failure.patch
@@ -0,0 +1,11 @@
+Avoid leaking pathbuf when path==0 by marking allocation failures as fatal.
+--- a/lemon.c
++++ b/lemon.c
+@@ -3413,6 +3413,7 @@ PRIVATE char *pathsearch(char *argv0, char *name, int modemask)
+     if( pathlist==0 ) pathlist = ".:/bin:/usr/bin";
+     pathbuf = (char *) malloc( lemonStrlen(pathlist) + 1 );
+     path = (char *)malloc( lemonStrlen(pathlist)+lemonStrlen(name)+2 );
++    MemoryCheck(pathbuf); MemoryCheck(path);  /* Fail on allocation failure. */
+     if( (pathbuf != 0) && (path!=0) ){
+       pathbufptr = pathbuf;
+       lemon_strcpy(pathbuf, pathlist);
diff --git a/tools/lemon/patches/06-lemon-memleak-template-assumption.patch b/tools/lemon/patches/06-lemon-memleak-template-assumption.patch
new file mode 100644
index 0000000000..c6e3264c2b
--- /dev/null
+++ b/tools/lemon/patches/06-lemon-memleak-template-assumption.patch
@@ -0,0 +1,17 @@
+The memory of pathsearch is leaked by tplt_open. Instead of functionally modify
+the code to fix the leak, just assert that we will never reach that code path
+since Wireshark always sets the template option.
+
+Not suitable for proposing to upstream since the assumption might not hold!
+--- a/lemon.c
++++ b/lemon.c
+@@ -3505,6 +3505,9 @@ PRIVATE FILE *tplt_open(struct lemon *lemp)
+   char *tpltname;
+   char *cp;
+ 
++  /* We always require the -T option, avoid memleak in the other code path. */
++  assert(user_templatename);
++
+   /* first, see if user specified a template filename on the command line. */
+   if (user_templatename != 0) {
+     if( access(user_templatename,004)==-1 ){
diff --git a/tools/lemon/patches/07-lemon-fix-reporttable-memleak.patch b/tools/lemon/patches/07-lemon-fix-reporttable-memleak.patch
new file mode 100644
index 0000000000..5d35036a68
--- /dev/null
+++ b/tools/lemon/patches/07-lemon-fix-reporttable-memleak.patch
@@ -0,0 +1,17 @@
+Fix memory leak in ReportTable, the data structure does not escape this
+function (directly or indirectly via another function), so freeing it seems the
+right thing to do.
+
+acttab_free was added upstream in commit 5c0b1c80aa, 2003-10-21 via
+"Convert lemon to use a single perfect hash table for storing the actions.
+This should make the resulting parser both smaller and faster. (CVS 1112)"
+--- a/lemon.c
++++ b/lemon.c
+@@ -4418,6 +4418,7 @@ void ReportTable(
+     }
+   }
+   fprintf(out, "};\n"); lineno++;
++  acttab_free(pActtab);
+ 
+   /* Output the yy_shift_ofst[] table */
+   n = lemp->nxstate;
diff --git a/tools/lemon/patches/08-lemon-stp-memleak-fp.patch b/tools/lemon/patches/08-lemon-stp-memleak-fp.patch
new file mode 100644
index 0000000000..07ff33e351
--- /dev/null
+++ b/tools/lemon/patches/08-lemon-stp-memleak-fp.patch
@@ -0,0 +1,17 @@
+CSA thought that stp would leak if State_insert returns early: when x3a is NULL
+(memory allocation failure) or when the state existed before (cannot happen for
+the initial state). So annotate it as such.
+--- a/lemon.c
++++ b/lemon.c
+@@ -990,7 +990,11 @@ PRIVATE struct state *getstate(struct lemon *lemp)
+     stp->cfp = cfp;              /* Remember the configuration closure */
+     stp->statenum = lemp->nstate++; /* Every state gets a sequence number */
+     stp->ap = 0;                 /* No actions, yet. */
++#ifndef NDEBUG
++    int ret =
++#endif
+     State_insert(stp,stp->bp);   /* Add to the state table */
++    assert(ret == 1);  /* CSA hint: stp did not leak, it has escaped. */
+     buildshifts(lemp,stp);       /* Recursively compute successor states */
+   }
+   return stp;