quickjs 0.19.0 → 0.20.0.rc1

data/ext/quickjsrb/quickjs/libregexp.c

@@ -34,16 +34,20 @@
 
 /*
   TODO:
-
+  - remove REOP_char_i and REOP_range_i by precomputing the case folding.
+  - add specific opcodes for simple unicode property tests so that the
+    generated bytecode is smaller.
   - Add a lock step execution mode (=linear time execution guaranteed)
     when the regular expression is "simple" i.e. no backreference nor
     complicated lookahead. The opcodes are designed for this execution
     model.
 */
 
-#if defined(TEST)
+#if defined(TEST) 
 #define DUMP_REOP
 #endif
+//#define DUMP_REOP
+//#define DUMP_EXEC
 
 typedef enum {
 #define DEF(id, size) REOP_ ## id,
@@ -53,7 +57,7 @@ typedef enum {
 } REOPCodeEnum;
 
 #define CAPTURE_COUNT_MAX 255
-#define STACK_SIZE_MAX 255
+#define REGISTER_COUNT_MAX 255
 /* must be large enough to have a negligible runtime cost and small
    enough to call the interrupt callback often. */
 #define INTERRUPT_COUNTER_INIT 10000
@@ -75,6 +79,7 @@ typedef struct {
     BOOL ignore_case;
     BOOL multi_line;
     BOOL dotall;
+    uint8_t group_name_scope;
     int capture_count;
     int total_capture_count; /* -1 = not computed yet */
     int has_named_captures; /* -1 = don't know, 0 = no, 1 = yes */
@@ -103,10 +108,10 @@ static const REOpCode reopcode_info[REOP_COUNT] = {
 #undef DEF
 };
 
-#define RE_HEADER_FLAGS         0
-#define RE_HEADER_CAPTURE_COUNT 2
-#define RE_HEADER_STACK_SIZE    3
-#define RE_HEADER_BYTECODE_LEN  4
+#define RE_HEADER_FLAGS          0
+#define RE_HEADER_CAPTURE_COUNT  2
+#define RE_HEADER_REGISTER_COUNT 3
+#define RE_HEADER_BYTECODE_LEN   4
 
 #define RE_HEADER_LEN 8
 
@@ -117,7 +122,7 @@ static inline int is_digit(int c) {
 /* insert 'len' bytes at position 'pos'. Return < 0 if error. */
 static int dbuf_insert(DynBuf *s, int pos, int len)
 {
-    if (dbuf_realloc(s, s->size + len))
+    if (dbuf_claim(s, len))
         return -1;
     memmove(s->buf + pos + len, s->buf + pos, s->size - pos);
     s->size += len;
@@ -459,15 +464,15 @@ static __maybe_unused void lre_dump_bytecode(const uint8_t *buf,
                                                      int buf_len)
 {
     int pos, len, opcode, bc_len, re_flags, i;
-    uint32_t val;
+    uint32_t val, val2;
 
     assert(buf_len >= RE_HEADER_LEN);
 
     re_flags = lre_get_flags(buf);
     bc_len = get_u32(buf + RE_HEADER_BYTECODE_LEN);
     assert(bc_len + RE_HEADER_LEN <= buf_len);
-    printf("flags: 0x%x capture_count=%d stack_size=%d\n",
-           re_flags, buf[RE_HEADER_CAPTURE_COUNT], buf[RE_HEADER_STACK_SIZE]);
+    printf("flags: 0x%x capture_count=%d reg_count=%d\n",
+           re_flags, buf[RE_HEADER_CAPTURE_COUNT], buf[RE_HEADER_REGISTER_COUNT]);
     if (re_flags & LRE_FLAG_NAMED_GROUPS) {
         const char *p;
         p = (char *)buf + RE_HEADER_LEN + bc_len;
@@ -476,7 +481,7 @@ static __maybe_unused void lre_dump_bytecode(const uint8_t *buf,
             if (i != 1)
                 printf(",");
             printf("<%s>", p);
-            p += strlen(p) + 1;
+            p += strlen(p) + LRE_GROUP_NAME_TRAILER_LEN;
         }
         printf("\n");
         assert(p == (char *)(buf + buf_len));
@@ -518,34 +523,62 @@ static __maybe_unused void lre_dump_bytecode(const uint8_t *buf,
         case REOP_goto:
         case REOP_split_goto_first:
         case REOP_split_next_first:
-        case REOP_loop:
         case REOP_lookahead:
         case REOP_negative_lookahead:
             val = get_u32(buf + pos + 1);
             val += (pos + 5);
             printf(" %u", val);
             break;
-        case REOP_simple_greedy_quant:
-            printf(" %u %u %u %u",
-                   get_u32(buf + pos + 1) + (pos + 17),
-                   get_u32(buf + pos + 1 + 4),
-                   get_u32(buf + pos + 1 + 8),
-                   get_u32(buf + pos + 1 + 12));
+        case REOP_loop:
+            val2 = buf[pos + 1];
+            val = get_u32(buf + pos + 2);
+            val += (pos + 6);
+            printf(" r%u, %u", val2, val);
+            break;
+        case REOP_loop_split_goto_first:
+        case REOP_loop_split_next_first:
+        case REOP_loop_check_adv_split_goto_first:
+        case REOP_loop_check_adv_split_next_first:
+            {
+                uint32_t limit;
+                val2 = buf[pos + 1];
+                limit = get_u32(buf + pos + 2);
+                val = get_u32(buf + pos + 6);
+                val += (pos + 10);
+                printf(" r%u, %u, %u", val2, limit, val);
+            }
             break;
         case REOP_save_start:
         case REOP_save_end:
+            printf(" %u", buf[pos + 1]);
+            break;
         case REOP_back_reference:
         case REOP_back_reference_i:
         case REOP_backward_back_reference:
         case REOP_backward_back_reference_i:
-            printf(" %u", buf[pos + 1]);
+            {
+                int n, i;
+                n = buf[pos + 1];
+                len += n;
+                for(i = 0; i < n; i++) {
+                    if (i != 0)
+                        printf(",");
+                    printf(" %u", buf[pos + 2 + i]);
+                }
+            }
             break;
         case REOP_save_reset:
             printf(" %u %u", buf[pos + 1], buf[pos + 2]);
             break;
-        case REOP_push_i32:
-            val = get_u32(buf + pos + 1);
-            printf(" %d", val);
+        case REOP_set_i32:
+            val = buf[pos + 1];
+            val2 = get_u32(buf + pos + 2);
+            printf(" r%u, %d", val, val2);
+            break;
+        case REOP_set_char_pos:
+        case REOP_check_advance:
+            val = buf[pos + 1];
+            printf(" r%u", val);
             break;
         case REOP_range:
         case REOP_range_i:
@@ -604,6 +637,27 @@ static int re_emit_goto(REParseState *s, int op, uint32_t val)
     return pos;
 }
 
+static int re_emit_goto_u8(REParseState *s, int op, uint32_t arg, uint32_t val)
+{
+    int pos;
+    dbuf_putc(&s->byte_code, op);
+    dbuf_putc(&s->byte_code, arg);
+    pos = s->byte_code.size;
+    dbuf_put_u32(&s->byte_code, val - (pos + 4));
+    return pos;
+}
+
+static int re_emit_goto_u8_u32(REParseState *s, int op, uint32_t arg0, uint32_t arg1, uint32_t val)
+{
+    int pos;
+    dbuf_putc(&s->byte_code, op);
+    dbuf_putc(&s->byte_code, arg0);
+    dbuf_put_u32(&s->byte_code, arg1);
+    pos = s->byte_code.size;
+    dbuf_put_u32(&s->byte_code, val - (pos + 4));
+    return pos;
+}
+
 static void re_emit_op_u8(REParseState *s, int op, uint32_t val)
 {
     dbuf_putc(&s->byte_code, op);
@@ -705,9 +759,21 @@ int lre_parse_escape(const uint8_t **pp, int allow_utf16)
         c = '\v';
         break;
     case 'x':
+        {
+            int h0, h1;
+
+            h0 = from_hex(*p++);
+            if (h0 < 0)
+                return -1;
+            h1 = from_hex(*p++);
+            if (h1 < 0)
+                return -1;
+            c = (h0 << 4) | h1;
+        }
+        break;
     case 'u':
         {
-            int h, n, i;
+            int h, i;
             uint32_t c1;
 
             if (*p == '{' && allow_utf16) {
@@ -725,14 +791,8 @@ int lre_parse_escape(const uint8_t **pp, int allow_utf16)
                 }
                 p++;
             } else {
-                if (c == 'x') {
-                    n = 2;
-                } else {
-                    n = 4;
-                }
-
                 c = 0;
-                for(i = 0; i < n; i++) {
+                for(i = 0; i < 4; i++) {
                     h = from_hex(*p++);
                     if (h < 0) {
                         return -1;
@@ -1020,7 +1080,7 @@ static int get_class_atom(REParseState *s, REStringList *cr,
                 goto default_escape;
             if (cr_init_char_range(s, cr, c))
                 return -1;
-            c = CLASS_RANGE_BASE;
+            c += CLASS_RANGE_BASE;
             break;
         case 'c':
             c = *p;
@@ -1491,17 +1551,18 @@ static int re_parse_char_class(REParseState *s, const uint8_t **pp)
     return -1;
 }
 
-/* Return:
-   - true if the opcodes may not advance the char pointer
-   - false if the opcodes always advance the char pointer
+/* need_check_adv: false if the opcodes always advance the char pointer
+   need_capture_init: true if all the captures in the atom are not set
 */
-static BOOL re_need_check_advance(const uint8_t *bc_buf, int bc_buf_len)
+static BOOL re_need_check_adv_and_capture_init(BOOL *pneed_capture_init,
+                                               const uint8_t *bc_buf, int bc_buf_len)
 {
     int pos, opcode, len;
     uint32_t val;
-    BOOL ret;
+    BOOL need_check_adv, need_capture_init;
 
-    ret = TRUE;
+    need_check_adv = TRUE;
+    need_capture_init = FALSE;
     pos = 0;
     while (pos < bc_buf_len) {
         opcode = bc_buf[pos];
@@ -1511,28 +1572,30 @@ static BOOL re_need_check_advance(const uint8_t *bc_buf, int bc_buf_len)
         case REOP_range_i:
             val = get_u16(bc_buf + pos + 1);
             len += val * 4;
-            goto simple_char;
+            need_check_adv = FALSE;
+            break;
         case REOP_range32:
         case REOP_range32_i:
             val = get_u16(bc_buf + pos + 1);
             len += val * 8;
-            goto simple_char;
+            need_check_adv = FALSE;
+            break;
         case REOP_char:
         case REOP_char_i:
         case REOP_char32:
         case REOP_char32_i:
         case REOP_dot:
         case REOP_any:
-        simple_char:
-            ret = FALSE;
+        case REOP_space:
+        case REOP_not_space:
+            need_check_adv = FALSE;
             break;
         case REOP_line_start:
         case REOP_line_start_m:
         case REOP_line_end:
         case REOP_line_end_m:
-        case REOP_push_i32:
-        case REOP_push_char_pos:
-        case REOP_drop:
+        case REOP_set_i32:
+        case REOP_set_char_pos:
         case REOP_word_boundary:
         case REOP_word_boundary_i:
         case REOP_not_word_boundary:
@@ -1543,67 +1606,25 @@ static BOOL re_need_check_advance(const uint8_t *bc_buf, int bc_buf_len)
         case REOP_save_start:
         case REOP_save_end:
         case REOP_save_reset:
+            break;
         case REOP_back_reference:
         case REOP_back_reference_i:
         case REOP_backward_back_reference:
         case REOP_backward_back_reference_i:
+            val = bc_buf[pos + 1];
+            len += val;
+            need_capture_init = TRUE;
             break;
         default:
             /* safe behavior: we cannot predict the outcome */
-            return TRUE;
+            need_capture_init = TRUE;
+            goto done;
         }
         pos += len;
     }
-    return ret;
-}
-
-/* return -1 if a simple quantifier cannot be used. Otherwise return
-   the number of characters in the atom. */
-static int re_is_simple_quantifier(const uint8_t *bc_buf, int bc_buf_len)
-{
-    int pos, opcode, len, count;
-    uint32_t val;
-
-    count = 0;
-    pos = 0;
-    while (pos < bc_buf_len) {
-        opcode = bc_buf[pos];
-        len = reopcode_info[opcode].size;
-        switch(opcode) {
-        case REOP_range:
-        case REOP_range_i:
-            val = get_u16(bc_buf + pos + 1);
-            len += val * 4;
-            goto simple_char;
-        case REOP_range32:
-        case REOP_range32_i:
-            val = get_u16(bc_buf + pos + 1);
-            len += val * 8;
-            goto simple_char;
-        case REOP_char:
-        case REOP_char_i:
-        case REOP_char32:
-        case REOP_char32_i:
-        case REOP_dot:
-        case REOP_any:
-        simple_char:
-            count++;
-            break;
-        case REOP_line_start:
-        case REOP_line_start_m:
-        case REOP_line_end:
-        case REOP_line_end_m:
-        case REOP_word_boundary:
-        case REOP_word_boundary_i:
-        case REOP_not_word_boundary:
-        case REOP_not_word_boundary_i:
-            break;
-        default:
-            return -1;
-        }
-        pos += len;
-    }
-    return count;
+ done:
+    *pneed_capture_init = need_capture_init;
+    return need_check_adv;
 }
 
 /* '*pp' is the first char after '<' */
@@ -1662,16 +1683,16 @@ static int re_parse_group_name(char *buf, int buf_size, const uint8_t **pp)
 }
 
 /* if capture_name = NULL: return the number of captures + 1.
-   Otherwise, return the capture index corresponding to capture_name
-   or -1 if none */
+   Otherwise, return the number of matching capture groups  */
 static int re_parse_captures(REParseState *s, int *phas_named_captures,
-                             const char *capture_name)
+                             const char *capture_name, BOOL emit_group_index)
 {
     const uint8_t *p;
-    int capture_index;
+    int capture_index, n;
     char name[TMP_BUF_SIZE];
 
     capture_index = 1;
+    n = 0;
     *phas_named_captures = 0;
     for (p = s->buf_start; p < s->buf_end; p++) {
         switch (*p) {
@@ -1683,8 +1704,11 @@ static int re_parse_captures(REParseState *s, int *phas_named_captures,
                     if (capture_name) {
                         p += 3;
                         if (re_parse_group_name(name, sizeof(name), &p) == 0) {
-                            if (!strcmp(name, capture_name))
-                                return capture_index;
+                            if (!strcmp(name, capture_name)) {
+                                if (emit_group_index)
+                                    dbuf_putc(&s->byte_code, capture_index);
+                                n++;
+                            }
                         }
                     }
                     capture_index++;
@@ -1709,17 +1733,18 @@ static int re_parse_captures(REParseState *s, int *phas_named_captures,
         }
     }
  done:
-    if (capture_name)
-        return -1;
-    else
+    if (capture_name) {
+        return n;
+    } else {
         return capture_index;
+    }
 }
 
 static int re_count_captures(REParseState *s)
 {
     if (s->total_capture_count < 0) {
         s->total_capture_count = re_parse_captures(s, &s->has_named_captures,
-                                                   NULL);
+                                                   NULL, FALSE);
     }
     return s->total_capture_count;
 }
@@ -1731,25 +1756,53 @@ static BOOL re_has_named_captures(REParseState *s)
     return s->has_named_captures;
 }
 
-static int find_group_name(REParseState *s, const char *name)
+static int find_group_name(REParseState *s, const char *name, BOOL emit_group_index)
 {
     const char *p, *buf_end;
     size_t len, name_len;
-    int capture_index;
+    int capture_index, n;
 
     p = (char *)s->group_names.buf;
-    if (!p) return -1;
+    if (!p)
+        return 0;
     buf_end = (char *)s->group_names.buf + s->group_names.size;
     name_len = strlen(name);
     capture_index = 1;
+    n = 0;
     while (p < buf_end) {
         len = strlen(p);
-        if (len == name_len && memcmp(name, p, name_len) == 0)
-            return capture_index;
-        p += len + 1;
+        if (len == name_len && memcmp(name, p, name_len) == 0) {
+            if (emit_group_index)
+                dbuf_putc(&s->byte_code, capture_index);
+            n++;
+        }
+        p += len + LRE_GROUP_NAME_TRAILER_LEN;
         capture_index++;
     }
-    return -1;
+    return n;
+}
+
+static BOOL is_duplicate_group_name(REParseState *s, const char *name, int scope)
+{
+    const char *p, *buf_end;
+    size_t len, name_len;
+    int scope1;
+    
+    p = (char *)s->group_names.buf;
+    if (!p)
+        return 0;
+    buf_end = (char *)s->group_names.buf + s->group_names.size;
+    name_len = strlen(name);
+    while (p < buf_end) {
+        len = strlen(p);
+        if (len == name_len && memcmp(name, p, name_len) == 0) {
+            scope1 = (uint8_t)p[len + 1];
+            if (scope == scope1)
+                return TRUE;
+        }
+        p += len + LRE_GROUP_NAME_TRAILER_LEN;
+    }
+    return FALSE;
 }
 
 static int re_parse_disjunction(REParseState *s, BOOL is_backward_dir);
@@ -1793,7 +1846,7 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
 {
     const uint8_t *p;
     int c, last_atom_start, quant_min, quant_max, last_capture_count;
-    BOOL greedy, add_zero_advance_check, is_neg, is_backward_lookahead;
+    BOOL greedy, is_neg, is_backward_lookahead;
     REStringList cr_s, *cr = &cr_s;
 
     last_atom_start = -1;
@@ -1921,7 +1974,7 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
                 p = s->buf_ptr;
                 if (re_parse_expect(s, &p, ')'))
                     return -1;
-                re_emit_op(s, REOP_match);
+                re_emit_op(s, REOP_lookahead_match + is_neg);
                 /* jump after the 'match' after the lookahead is successful */
                 if (dbuf_error(&s->byte_code))
                     return -1;
@@ -1932,12 +1985,16 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
                                         &p)) {
                     return re_parse_error(s, "invalid group name");
                 }
-                if (find_group_name(s, s->u.tmp_buf) > 0) {
+                /* poor's man method to test duplicate group
+                   names. */
+                /* XXX: this method does not catch all the errors*/
+                if (is_duplicate_group_name(s, s->u.tmp_buf, s->group_name_scope)) {
                     return re_parse_error(s, "duplicate group name");
                 }
                 /* group name with a trailing zero */
                 dbuf_put(&s->group_names, (uint8_t *)s->u.tmp_buf,
                          strlen(s->u.tmp_buf) + 1);
+                dbuf_putc(&s->group_names, s->group_name_scope);
                 s->has_named_captures = 1;
                 goto parse_capture;
             } else {
@@ -1948,6 +2005,7 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
             p++;
             /* capture without group name */
             dbuf_putc(&s->group_names, 0);
+            dbuf_putc(&s->group_names, 0);
         parse_capture:
             if (s->capture_count >= CAPTURE_COUNT_MAX)
                 return re_parse_error(s, "too many captures");
@@ -1974,17 +2032,18 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
         case 'b':
         case 'B':
             if (p[1] != 'b') {
-                re_emit_op(s, s->ignore_case ? REOP_not_word_boundary_i : REOP_not_word_boundary);
+                re_emit_op(s, s->ignore_case && s->is_unicode ? REOP_not_word_boundary_i : REOP_not_word_boundary);
             } else {
-                re_emit_op(s, s->ignore_case ? REOP_word_boundary_i : REOP_word_boundary);
+                re_emit_op(s, s->ignore_case && s->is_unicode ? REOP_word_boundary_i : REOP_word_boundary);
             }
             p += 2;
             break;
         case 'k':
             {
                 const uint8_t *p1;
-                int dummy_res;
-
+                int dummy_res, n;
+                BOOL is_forward;
+                
                 p1 = p;
                 if (p1[2] != '<') {
                     /* annex B: we tolerate invalid group names in non
@@ -2003,21 +2062,33 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
                     else
                         goto parse_class_atom;
                 }
-                c = find_group_name(s, s->u.tmp_buf);
-                if (c < 0) {
+                is_forward = FALSE;
+                n = find_group_name(s, s->u.tmp_buf, FALSE);
+                if (n == 0) {
                     /* no capture name parsed before, try to look
                        after (inefficient, but hopefully not common */
-                    c = re_parse_captures(s, &dummy_res, s->u.tmp_buf);
-                    if (c < 0) {
+                    n = re_parse_captures(s, &dummy_res, s->u.tmp_buf, FALSE);
+                    if (n == 0) {
                         if (s->is_unicode || re_has_named_captures(s))
                             return re_parse_error(s, "group name not defined");
                         else
                             goto parse_class_atom;
                     }
+                    is_forward = TRUE;
+                }
+                last_atom_start = s->byte_code.size;
+                last_capture_count = s->capture_count;
+                
+                /* emit back references to all the captures indexes matching the group name */
+                re_emit_op_u8(s, REOP_back_reference + 2 * is_backward_dir + s->ignore_case, n);
+                if (is_forward) {
+                    re_parse_captures(s, &dummy_res, s->u.tmp_buf, TRUE);
+                } else {
+                    find_group_name(s, s->u.tmp_buf, TRUE);
                 }
                 p = p1;
             }
-            goto emit_back_reference;
+            break;
         case '0':
             p += 2;
             c = 0;
@@ -2063,11 +2134,11 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
                     }
                     return re_parse_error(s, "back reference out of range in regular expression");
                 }
-            emit_back_reference:
                 last_atom_start = s->byte_code.size;
                 last_capture_count = s->capture_count;
                 
-                re_emit_op_u8(s, REOP_back_reference + 2 * is_backward_dir + s->ignore_case, c);
+                re_emit_op_u8(s, REOP_back_reference + 2 * is_backward_dir + s->ignore_case, 1);
+                dbuf_putc(&s->byte_code, c);
             }
             break;
         default:
@@ -2100,8 +2171,15 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
         if (is_backward_dir)
             re_emit_op(s, REOP_prev);
         if (c >= CLASS_RANGE_BASE) {
-            int ret;
-            ret = re_emit_string_list(s, cr);
+            int ret = 0;
+            /* optimize the common 'space' tests */
+            if (c == (CLASS_RANGE_BASE + CHAR_RANGE_s)) {
+                re_emit_op(s, REOP_space);
+            } else if (c == (CLASS_RANGE_BASE + CHAR_RANGE_S)) {
+                re_emit_op(s, REOP_not_space);
+            } else {
+                ret = re_emit_string_list(s, cr);
+            }
             re_string_list_free(cr);
             if (ret)
                 return -1;
@@ -2176,52 +2254,39 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
             if (last_atom_start < 0) {
                 return re_parse_error(s, "nothing to repeat");
             }
-            if (greedy) {
+            {
+                BOOL need_capture_init, add_zero_advance_check;
                 int len, pos;
-
-                if (quant_max > 0) {
-                    /* specific optimization for simple quantifiers */
-                    if (dbuf_error(&s->byte_code))
+                
+                /* the spec tells that if there is no advance when
+                   running the atom after the first quant_min times,
+                   then there is no match. We remove this test when we
+                   are sure the atom always advances the position. */
+                add_zero_advance_check =
+                    re_need_check_adv_and_capture_init(&need_capture_init,
+                                                       s->byte_code.buf + last_atom_start,
+                                                       s->byte_code.size - last_atom_start);
+            
+                /* general case: need to reset the capture at each
+                   iteration. We don't do it if there are no captures
+                   in the atom or if we are sure all captures are
+                   initialized in the atom. If quant_min = 0, we still
+                   need to reset once the captures in case the atom
+                   does not match. */
+                if (need_capture_init && last_capture_count != s->capture_count) {
+                    if (dbuf_insert(&s->byte_code, last_atom_start, 3))
                         goto out_of_memory;
-                    len = re_is_simple_quantifier(s->byte_code.buf + last_atom_start,
-                                                 s->byte_code.size - last_atom_start);
-                    if (len > 0) {
-                        re_emit_op(s, REOP_match);
-
-                        if (dbuf_insert(&s->byte_code, last_atom_start, 17))
-                            goto out_of_memory;
-                        pos = last_atom_start;
-                        s->byte_code.buf[pos++] = REOP_simple_greedy_quant;
-                        put_u32(&s->byte_code.buf[pos],
-                                s->byte_code.size - last_atom_start - 17);
-                        pos += 4;
-                        put_u32(&s->byte_code.buf[pos], quant_min);
-                        pos += 4;
-                        put_u32(&s->byte_code.buf[pos], quant_max);
-                        pos += 4;
-                        put_u32(&s->byte_code.buf[pos], len);
-                        pos += 4;
-                        goto done;
-                    }
+                    int pos = last_atom_start;
+                    s->byte_code.buf[pos++] = REOP_save_reset;
+                    s->byte_code.buf[pos++] = last_capture_count;
+                    s->byte_code.buf[pos++] = s->capture_count - 1;
                 }
 
-                if (dbuf_error(&s->byte_code))
-                    goto out_of_memory;
-            }
-            /* the spec tells that if there is no advance when
-               running the atom after the first quant_min times,
-               then there is no match. We remove this test when we
-               are sure the atom always advances the position. */
-            add_zero_advance_check = re_need_check_advance(s->byte_code.buf + last_atom_start,
-                                                           s->byte_code.size - last_atom_start);
-
-            {
-                int len, pos;
                 len = s->byte_code.size - last_atom_start;
                 if (quant_min == 0) {
                     /* need to reset the capture in case the atom is
                        not executed */
-                    if (last_capture_count != s->capture_count) {
+                    if (!need_capture_init && last_capture_count != s->capture_count) {
                         if (dbuf_insert(&s->byte_code, last_atom_start, 3))
                             goto out_of_memory;
                         s->byte_code.buf[last_atom_start++] = REOP_save_reset;
@@ -2232,76 +2297,63 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
                         s->byte_code.size = last_atom_start;
                     } else if (quant_max == 1 || quant_max == INT32_MAX) {
                         BOOL has_goto = (quant_max == INT32_MAX);
-                        if (dbuf_insert(&s->byte_code, last_atom_start, 5 + add_zero_advance_check))
+                        if (dbuf_insert(&s->byte_code, last_atom_start, 5 + add_zero_advance_check * 2))
                             goto out_of_memory;
                         s->byte_code.buf[last_atom_start] = REOP_split_goto_first +
                             greedy;
                         put_u32(s->byte_code.buf + last_atom_start + 1,
-                                len + 5 * has_goto + add_zero_advance_check * 2);
+                                len + 5 * has_goto + add_zero_advance_check * 2 * 2);
                         if (add_zero_advance_check) {
-                            s->byte_code.buf[last_atom_start + 1 + 4] = REOP_push_char_pos;
-                            re_emit_op(s, REOP_check_advance);
+                            s->byte_code.buf[last_atom_start + 1 + 4] = REOP_set_char_pos;
+                            s->byte_code.buf[last_atom_start + 1 + 4 + 1] = 0;
+                            re_emit_op_u8(s, REOP_check_advance, 0);
                         }
                         if (has_goto)
                             re_emit_goto(s, REOP_goto, last_atom_start);
                     } else {
-                        if (dbuf_insert(&s->byte_code, last_atom_start, 10 + add_zero_advance_check))
+                        if (dbuf_insert(&s->byte_code, last_atom_start, 11 + add_zero_advance_check * 2))
                             goto out_of_memory;
                         pos = last_atom_start;
-                        s->byte_code.buf[pos++] = REOP_push_i32;
-                        put_u32(s->byte_code.buf + pos, quant_max);
-                        pos += 4;
                         s->byte_code.buf[pos++] = REOP_split_goto_first + greedy;
-                        put_u32(s->byte_code.buf + pos, len + 5 + add_zero_advance_check * 2);
+                        put_u32(s->byte_code.buf + pos, 6 + add_zero_advance_check * 2 + len + 10);
                         pos += 4;
+
+                        s->byte_code.buf[pos++] = REOP_set_i32;
+                        s->byte_code.buf[pos++] = 0;
+                        put_u32(s->byte_code.buf + pos, quant_max);
+                        pos += 4;
+                        last_atom_start = pos;
                         if (add_zero_advance_check) {
-                            s->byte_code.buf[pos++] = REOP_push_char_pos;
-                            re_emit_op(s, REOP_check_advance);
+                            s->byte_code.buf[pos++] = REOP_set_char_pos;
+                            s->byte_code.buf[pos++] = 0;
                         }
-                        re_emit_goto(s, REOP_loop, last_atom_start + 5);
-                        re_emit_op(s, REOP_drop);
+                        re_emit_goto_u8_u32(s, (add_zero_advance_check ? REOP_loop_check_adv_split_next_first : REOP_loop_split_next_first) - greedy, 0, quant_max, last_atom_start);
                     }
                 } else if (quant_min == 1 && quant_max == INT32_MAX &&
                            !add_zero_advance_check) {
                     re_emit_goto(s, REOP_split_next_first - greedy,
                                  last_atom_start);
                 } else {
-                    if (quant_min == 1) {
-                        /* nothing to add */
-                    } else {
-                        if (dbuf_insert(&s->byte_code, last_atom_start, 5))
-                            goto out_of_memory;
-                        s->byte_code.buf[last_atom_start] = REOP_push_i32;
-                        put_u32(s->byte_code.buf + last_atom_start + 1,
-                                quant_min);
-                        last_atom_start += 5;
-                        re_emit_goto(s, REOP_loop, last_atom_start);
-                        re_emit_op(s, REOP_drop);
+                    if (quant_min == quant_max)
+                        add_zero_advance_check = FALSE;
+                    if (dbuf_insert(&s->byte_code, last_atom_start, 6 + add_zero_advance_check * 2))
+                        goto out_of_memory;
+                    /* Note: we assume the string length is < INT32_MAX */
+                    pos = last_atom_start;
+                    s->byte_code.buf[pos++] = REOP_set_i32;
+                    s->byte_code.buf[pos++] = 0;
+                    put_u32(s->byte_code.buf + pos, quant_max);
+                    pos += 4;
+                    last_atom_start = pos;
+                    if (add_zero_advance_check) {
+                        s->byte_code.buf[pos++] = REOP_set_char_pos;
+                        s->byte_code.buf[pos++] = 0;
                     }
-                    if (quant_max == INT32_MAX) {
-                        pos = s->byte_code.size;
-                        re_emit_op_u32(s, REOP_split_goto_first + greedy,
-                                       len + 5 + add_zero_advance_check * 2);
-                        if (add_zero_advance_check)
-                            re_emit_op(s, REOP_push_char_pos);
-                        /* copy the atom */
-                        dbuf_put_self(&s->byte_code, last_atom_start, len);
-                        if (add_zero_advance_check)
-                            re_emit_op(s, REOP_check_advance);
-                        re_emit_goto(s, REOP_goto, pos);
-                    } else if (quant_max > quant_min) {
-                        re_emit_op_u32(s, REOP_push_i32, quant_max - quant_min);
-                        pos = s->byte_code.size;
-                        re_emit_op_u32(s, REOP_split_goto_first + greedy,
-                                       len + 5 + add_zero_advance_check * 2);
-                        if (add_zero_advance_check)
-                            re_emit_op(s, REOP_push_char_pos);
-                        /* copy the atom */
-                        dbuf_put_self(&s->byte_code, last_atom_start, len);
-                        if (add_zero_advance_check)
-                            re_emit_op(s, REOP_check_advance);
-                        re_emit_goto(s, REOP_loop, pos);
-                        re_emit_op(s, REOP_drop);
+                    if (quant_min == quant_max) {
+                        /* a simple loop is enough */
+                        re_emit_goto_u8(s, REOP_loop, 0, last_atom_start);
+                    } else {
+                        re_emit_goto_u8_u32(s, (add_zero_advance_check ? REOP_loop_check_adv_split_next_first : REOP_loop_split_next_first) - greedy, 0, quant_max - quant_min, last_atom_start);
                     }
                 }
                 last_atom_start = -1;
@@ -2311,7 +2363,6 @@ static int re_parse_term(REParseState *s, BOOL is_backward_dir)
             break;
         }
     }
- done:
     s->buf_ptr = p;
     return 0;
  out_of_memory:
@@ -2340,7 +2391,7 @@ static int re_parse_alternative(REParseState *s, BOOL is_backward_dir)
                speed is not really critical here) */
             end = s->byte_code.size;
             term_size = end - term_start;
-            if (dbuf_realloc(&s->byte_code, end + term_size))
+            if (dbuf_claim(&s->byte_code, term_size))
                 return -1;
             memmove(s->byte_code.buf + start + term_size,
                     s->byte_code.buf + start,
@@ -2376,6 +2427,8 @@ static int re_parse_disjunction(REParseState *s, BOOL is_backward_dir)
 
         pos = re_emit_op_u32(s, REOP_goto, 0);
 
+        s->group_name_scope++;
+        
         if (re_parse_alternative(s, is_backward_dir))
             return -1;
 
@@ -2386,8 +2439,9 @@ static int re_parse_disjunction(REParseState *s, BOOL is_backward_dir)
     return 0;
 }
 
-/* the control flow is recursive so the analysis can be linear */
-static int compute_stack_size(const uint8_t *bc_buf, int bc_buf_len)
+/* Allocate the registers as a stack. The control flow is recursive so
+   the analysis can be linear. */
+static int compute_register_count(uint8_t *bc_buf, int bc_buf_len)
 {
     int stack_size, stack_size_max, pos, opcode, len;
     uint32_t val;
@@ -2403,19 +2457,29 @@ static int compute_stack_size(const uint8_t *bc_buf, int bc_buf_len)
         assert(opcode < REOP_COUNT);
         assert((pos + len) <= bc_buf_len);
         switch(opcode) {
-        case REOP_push_i32:
-        case REOP_push_char_pos:
+        case REOP_set_i32:
+        case REOP_set_char_pos:
+            bc_buf[pos + 1] = stack_size;
             stack_size++;
             if (stack_size > stack_size_max) {
-                if (stack_size > STACK_SIZE_MAX)
+                if (stack_size > REGISTER_COUNT_MAX)
                     return -1;
                 stack_size_max = stack_size;
             }
             break;
-        case REOP_drop:
         case REOP_check_advance:
+        case REOP_loop:
+        case REOP_loop_split_goto_first:
+        case REOP_loop_split_next_first:
             assert(stack_size > 0);
             stack_size--;
+            bc_buf[pos + 1] = stack_size;
+            break;
+        case REOP_loop_check_adv_split_goto_first:
+        case REOP_loop_check_adv_split_next_first:
+            assert(stack_size >= 2);
+            stack_size -= 2;
+            bc_buf[pos + 1] = stack_size;
             break;
         case REOP_range:
         case REOP_range_i:
@@ -2427,6 +2491,13 @@ static int compute_stack_size(const uint8_t *bc_buf, int bc_buf_len)
             val = get_u16(bc_buf + pos + 1);
             len += val * 8;
             break;
+        case REOP_back_reference:
+        case REOP_back_reference_i:
+        case REOP_backward_back_reference:
+        case REOP_backward_back_reference_i:
+            val = bc_buf[pos + 1];
+            len += val;
+            break;
         }
         pos += len;
     }
@@ -2453,7 +2524,7 @@ uint8_t *lre_compile(int *plen, char *error_msg, int error_msg_size,
                      void *opaque)
 {
     REParseState s_s, *s = &s_s;
-    int stack_size;
+    int register_count;
     BOOL is_sticky;
 
     memset(s, 0, sizeof(*s));
@@ -2514,19 +2585,19 @@ uint8_t *lre_compile(int *plen, char *error_msg, int error_msg_size,
         goto error;
     }
 
-    stack_size = compute_stack_size(s->byte_code.buf, s->byte_code.size);
-    if (stack_size < 0) {
+    register_count = compute_register_count(s->byte_code.buf, s->byte_code.size);
+    if (register_count < 0) {
         re_parse_error(s, "too many imbricated quantifiers");
         goto error;
     }
 
     s->byte_code.buf[RE_HEADER_CAPTURE_COUNT] = s->capture_count;
-    s->byte_code.buf[RE_HEADER_STACK_SIZE] = stack_size;
+    s->byte_code.buf[RE_HEADER_REGISTER_COUNT] = register_count;
     put_u32(s->byte_code.buf + RE_HEADER_BYTECODE_LEN,
             s->byte_code.size - RE_HEADER_LEN);
 
     /* add the named groups if needed */
-    if (s->group_names.size > (s->capture_count - 1)) {
+    if (s->group_names.size > (s->capture_count - 1) * LRE_GROUP_NAME_TRAILER_LEN) {
         dbuf_put(&s->byte_code, s->group_names.buf, s->group_names.size);
         put_u16(s->byte_code.buf + RE_HEADER_FLAGS,
                 lre_get_flags(s->byte_code.buf) | LRE_FLAG_NAMED_GROUPS);
@@ -2547,14 +2618,6 @@ static BOOL is_line_terminator(uint32_t c)
     return (c == '\n' || c == '\r' || c == CP_LS || c == CP_PS);
 }
 
-static BOOL is_word_char(uint32_t c)
-{
-    return ((c >= '0' && c <= '9') ||
-            (c >= 'a' && c <= 'z') ||
-            (c >= 'A' && c <= 'Z') ||
-            (c == '_'));
-}
-
 #define GET_CHAR(c, cptr, cbuf_end, cbuf_type)                          \
     do {                                                                \
         if (cbuf_type == 0) {                                           \
@@ -2638,23 +2701,26 @@ static BOOL is_word_char(uint32_t c)
         }                                                               \
     } while (0)
 
-typedef uintptr_t StackInt;
-
 typedef enum {
     RE_EXEC_STATE_SPLIT,
     RE_EXEC_STATE_LOOKAHEAD,
     RE_EXEC_STATE_NEGATIVE_LOOKAHEAD,
-    RE_EXEC_STATE_GREEDY_QUANT,
 } REExecStateEnum;
 
-typedef struct REExecState {
-    REExecStateEnum type : 8;
-    uint8_t stack_len;
-    size_t count; /* only used for RE_EXEC_STATE_GREEDY_QUANT */
-    const uint8_t *cptr;
-    const uint8_t *pc;
-    void *buf[0];
-} REExecState;
+#if INTPTR_MAX >= INT64_MAX
+#define BP_TYPE_BITS 3
+#else
+#define BP_TYPE_BITS 2
+#endif
+
+typedef union {
+    uint8_t *ptr;
+    intptr_t val; /* for bp, the low BP_SHIFT bits store REExecStateEnum */
+    struct {
+        uintptr_t val : sizeof(uintptr_t) * 8 - BP_TYPE_BITS;
+        uintptr_t type : BP_TYPE_BITS;
+    } bp;
+} StackElem;
 
 typedef struct {
     const uint8_t *cbuf;
@@ -2662,55 +2728,15 @@ typedef struct {
     /* 0 = 8 bit chars, 1 = 16 bit chars, 2 = 16 bit chars, UTF-16 */
     int cbuf_type;
     int capture_count;
-    int stack_size_max;
     BOOL is_unicode;
     int interrupt_counter;
     void *opaque; /* used for stack overflow check */
 
-    size_t state_size;
-    uint8_t *state_stack;
-    size_t state_stack_size;
-    size_t state_stack_len;
+    StackElem *stack_buf;
+    size_t stack_size;
+    StackElem static_stack_buf[32]; /* static stack to avoid allocation in most cases */
 } REExecContext;
 
-static int push_state(REExecContext *s,
-                      uint8_t **capture,
-                      StackInt *stack, size_t stack_len,
-                      const uint8_t *pc, const uint8_t *cptr,
-                      REExecStateEnum type, size_t count)
-{
-    REExecState *rs;
-    uint8_t *new_stack;
-    size_t new_size, i, n;
-    StackInt *stack_buf;
-
-    if (unlikely((s->state_stack_len + 1) > s->state_stack_size)) {
-        /* reallocate the stack */
-        new_size = s->state_stack_size * 3 / 2;
-        if (new_size < 8)
-            new_size = 8;
-        new_stack = lre_realloc(s->opaque, s->state_stack, new_size * s->state_size);
-        if (!new_stack)
-            return -1;
-        s->state_stack_size = new_size;
-        s->state_stack = new_stack;
-    }
-    rs = (REExecState *)(s->state_stack + s->state_stack_len * s->state_size);
-    s->state_stack_len++;
-    rs->type = type;
-    rs->count = count;
-    rs->stack_len = stack_len;
-    rs->cptr = cptr;
-    rs->pc = pc;
-    n = 2 * s->capture_count;
-    for(i = 0; i < n; i++)
-        rs->buf[i] = capture[i];
-    stack_buf = (StackInt *)(rs->buf + n);
-    for(i = 0; i < stack_len; i++)
-        stack_buf[i] = stack[i];
-    return 0;
-}
-
 static int lre_poll_timeout(REExecContext *s)
 {
     if (unlikely(--s->interrupt_counter <= 0)) {
@@ -2721,95 +2747,182 @@ static int lre_poll_timeout(REExecContext *s)
     return 0;
 }
 
+static no_inline int stack_realloc(REExecContext *s, size_t n)
+{
+    StackElem *new_stack;
+    size_t new_size;
+    new_size = s->stack_size * 3 / 2;
+    if (new_size < n)
+        new_size = n;
+    if (s->stack_buf == s->static_stack_buf) {
+        new_stack = lre_realloc(s->opaque, NULL, new_size * sizeof(StackElem));
+        if (!new_stack)
+            return -1;
+        /* XXX: could use correct size */
+        memcpy(new_stack, s->stack_buf, s->stack_size * sizeof(StackElem));
+    } else {
+        new_stack = lre_realloc(s->opaque, s->stack_buf, new_size * sizeof(StackElem));
+        if (!new_stack)
+            return -1;
+    }
+    s->stack_size = new_size;
+    s->stack_buf = new_stack;
+    return 0;
+}
+
 /* return 1 if match, 0 if not match or < 0 if error. */
 static intptr_t lre_exec_backtrack(REExecContext *s, uint8_t **capture,
-                                   StackInt *stack, int stack_len,
-                                   const uint8_t *pc, const uint8_t *cptr,
-                                   BOOL no_recurse)
+                                   const uint8_t *pc, const uint8_t *cptr)
 {
-    int opcode, ret;
+    int opcode;
     int cbuf_type;
-    uint32_t val, c;
+    uint32_t val, c, idx;
     const uint8_t *cbuf_end;
-
+    StackElem *sp, *bp, *stack_end;
+#ifdef DUMP_EXEC
+    const uint8_t *pc_start = pc; /* TEST */
+#endif
     cbuf_type = s->cbuf_type;
     cbuf_end = s->cbuf_end;
 
+    sp = s->stack_buf;
+    bp = s->stack_buf;
+    stack_end = s->stack_buf + s->stack_size;
+    
+#define CHECK_STACK_SPACE(n)                            \
+    if (unlikely((stack_end - sp) < (n))) {             \
+        size_t saved_sp = sp - s->stack_buf;            \
+        size_t saved_bp = bp - s->stack_buf;            \
+        if (stack_realloc(s, sp - s->stack_buf + (n)))  \
+            return LRE_RET_MEMORY_ERROR;                \
+        stack_end = s->stack_buf + s->stack_size;       \
+        sp = s->stack_buf + saved_sp;                   \
+        bp = s->stack_buf + saved_bp;                   \
+    }
+
+    /* XXX: could test if the value was saved to reduce the stack size
+       but slower */
+#define SAVE_CAPTURE(idx, value)                        \
+    {                                                   \
+        CHECK_STACK_SPACE(2);                           \
+        sp[0].val = idx;                                \
+        sp[1].ptr = capture[idx];                       \
+        sp += 2;                                        \
+        capture[idx] = (value);                         \
+    }
+
+    /* avoid saving the previous value if already saved */
+#define SAVE_CAPTURE_CHECK(idx, value)          \
+    {                                           \
+        StackElem *sp1;                         \
+        sp1 = sp;                               \
+        for(;;) {                               \
+            if (sp1 > bp) {                             \
+                if (sp1[-2].val == idx)                 \
+                    break;                              \
+                sp1 -= 2;                               \
+            } else {                                    \
+                CHECK_STACK_SPACE(2);                   \
+                sp[0].val = idx;                        \
+                sp[1].ptr = capture[idx];               \
+                sp += 2;                                \
+                break;                                  \
+            }                                           \
+        }                                               \
+        capture[idx] = (value);                         \
+    }
+
+
+#ifdef DUMP_EXEC
+    printf("%5s %5s %5s %5s %s\n", "PC", "CP", "BP", "SP", "OPCODE");
+#endif    
     for(;;) {
-        //        printf("top=%p: pc=%d\n", th_list.top, (int)(pc - (bc_buf + RE_HEADER_LEN)));
         opcode = *pc++;
+#ifdef DUMP_EXEC
+        printf("%5ld %5ld %5ld %5ld %s\n",
+               pc - 1 - pc_start,
+               cbuf_type == 0 ? cptr - s->cbuf : (cptr - s->cbuf) / 2,
+               bp - s->stack_buf,
+               sp - s->stack_buf,
+               reopcode_info[opcode].name);
+#endif        
         switch(opcode) {
         case REOP_match:
-            {
-                REExecState *rs;
-                if (no_recurse)
-                    return (intptr_t)cptr;
-                ret = 1;
-                goto recurse;
-            no_match:
-                if (no_recurse)
+            return 1;
+        no_match:
+            for(;;) {
+                REExecStateEnum type;
+                if (bp == s->stack_buf)
                     return 0;
-                ret = 0;
-            recurse:
+                /* undo the modifications to capture[] */
+                while (sp > bp) {
+                    capture[sp[-2].val] = sp[-1].ptr;
+                    sp -= 2;
+                }
+                
+                pc = sp[-3].ptr;
+                cptr = sp[-2].ptr;
+                type = sp[-1].bp.type;
+                bp = s->stack_buf + sp[-1].bp.val;
+                sp -= 3;
+                if (type != RE_EXEC_STATE_LOOKAHEAD)
+                    break;
+            }
+            if (lre_poll_timeout(s))
+                return LRE_RET_TIMEOUT;
+            break;
+        case REOP_lookahead_match:
+            /* pop all the saved states until reaching the start of
+               the lookahead and keep the updated captures and
+               variables and the corresponding undo info. */
+            {
+                StackElem *sp1, *sp_top, *next_sp;
+                REExecStateEnum type;
+
+                sp_top = sp;
                 for(;;) {
-                    if (lre_poll_timeout(s))
-                        return LRE_RET_TIMEOUT;
-                    if (s->state_stack_len == 0)
-                        return ret;
-                    rs = (REExecState *)(s->state_stack +
-                                         (s->state_stack_len - 1) * s->state_size);
-                    if (rs->type == RE_EXEC_STATE_SPLIT) {
-                        if (!ret) {
-                        pop_state:
-                            memcpy(capture, rs->buf,
-                                   sizeof(capture[0]) * 2 * s->capture_count);
-                        pop_state1:
-                            pc = rs->pc;
-                            cptr = rs->cptr;
-                            stack_len = rs->stack_len;
-                            memcpy(stack, rs->buf + 2 * s->capture_count,
-                                   stack_len * sizeof(stack[0]));
-                            s->state_stack_len--;
-                            break;
-                        }
-                    } else if (rs->type == RE_EXEC_STATE_GREEDY_QUANT) {
-                        if (!ret) {
-                            uint32_t char_count, i;
-                            memcpy(capture, rs->buf,
-                                   sizeof(capture[0]) * 2 * s->capture_count);
-                            stack_len = rs->stack_len;
-                            memcpy(stack, rs->buf + 2 * s->capture_count,
-                                   stack_len * sizeof(stack[0]));
-                            pc = rs->pc;
-                            cptr = rs->cptr;
-                            /* go backward */
-                            char_count = get_u32(pc + 12);
-                            for(i = 0; i < char_count; i++) {
-                                PREV_CHAR(cptr, s->cbuf, cbuf_type);
-                            }
-                            pc = (pc + 16) + (int)get_u32(pc);
-                            rs->cptr = cptr;
-                            rs->count--;
-                            if (rs->count == 0) {
-                                s->state_stack_len--;
-                            }
-                            break;
-                        }
-                    } else {
-                        ret = ((rs->type == RE_EXEC_STATE_LOOKAHEAD && ret) ||
-                               (rs->type == RE_EXEC_STATE_NEGATIVE_LOOKAHEAD && !ret));
-                        if (ret) {
-                            /* keep the capture in case of positive lookahead */
-                            if (rs->type == RE_EXEC_STATE_LOOKAHEAD)
-                                goto pop_state1;
-                            else
-                                goto pop_state;
-                        }
+                    sp1 = sp;
+                    sp = bp;
+                    pc = sp[-3].ptr;
+                    cptr = sp[-2].ptr;
+                    type = sp[-1].bp.type;
+                    bp = s->stack_buf + sp[-1].bp.val;
+                    sp[-1].ptr = (void *)sp1; /* save the next value for the copy step */
+                    sp -= 3;
+                    if (type == RE_EXEC_STATE_LOOKAHEAD)
+                        break;
+                }
+                if (sp != s->stack_buf) {
+                    /* keep the undo info if there is a saved state */
+                    sp1 = sp;
+                    while (sp1 < sp_top) {
+                        next_sp = (void *)sp1[2].ptr;
+                        sp1 += 3;
+                        while (sp1 < next_sp)
+                            *sp++ = *sp1++;
                     }
-                    s->state_stack_len--;
                 }
             }
             break;
+        case REOP_negative_lookahead_match:
+            /* pop all the saved states until reaching start of the negative lookahead */
+            for(;;) {
+                REExecStateEnum type;
+                type = bp[-1].bp.type;
+                /* undo the modifications to capture[] */
+                while (sp > bp) {
+                    capture[sp[-2].val] = sp[-1].ptr;
+                    sp -= 2;
+                }
+                pc = sp[-3].ptr;
+                cptr = sp[-2].ptr;
+                type = sp[-1].bp.type;
+                bp = s->stack_buf + sp[-1].bp.val;
+                sp -= 3;
+                if (type == RE_EXEC_STATE_NEGATIVE_LOOKAHEAD)
+                    break;
+            }
+            goto no_match;
         case REOP_char32:
         case REOP_char32_i:
             val = get_u32(pc);
@@ -2842,24 +2955,27 @@ static intptr_t lre_exec_backtrack(REExecContext *s, uint8_t **capture,
                     pc1 = pc;
                     pc = pc + (int)val;
                 }
-                ret = push_state(s, capture, stack, stack_len,
-                                 pc1, cptr, RE_EXEC_STATE_SPLIT, 0);
-                if (ret < 0)
-                    return LRE_RET_MEMORY_ERROR;
-                break;
+                CHECK_STACK_SPACE(3);
+                sp[0].ptr = (uint8_t *)pc1;
+                sp[1].ptr = (uint8_t *)cptr;
+                sp[2].bp.val = bp - s->stack_buf;
+                sp[2].bp.type = RE_EXEC_STATE_SPLIT;
+                sp += 3;
+                bp = sp;
             }
+            break;
         case REOP_lookahead:
         case REOP_negative_lookahead:
             val = get_u32(pc);
             pc += 4;
-            ret = push_state(s, capture, stack, stack_len,
-                             pc + (int)val, cptr,
-                             RE_EXEC_STATE_LOOKAHEAD + opcode - REOP_lookahead,
-                             0);
-            if (ret < 0)
-                return LRE_RET_MEMORY_ERROR;
+            CHECK_STACK_SPACE(3);
+            sp[0].ptr = (uint8_t *)(pc + (int)val);
+            sp[1].ptr = (uint8_t *)cptr;
+            sp[2].bp.val = bp - s->stack_buf;
+            sp[2].bp.type = RE_EXEC_STATE_LOOKAHEAD + opcode - REOP_lookahead;
+            sp += 3;
+            bp = sp;
             break;
-
         case REOP_goto:
             val = get_u32(pc);
             pc += 4 + (int)val;
@@ -2898,11 +3014,26 @@ static intptr_t lre_exec_backtrack(REExecContext *s, uint8_t **capture,
                 goto no_match;
             GET_CHAR(c, cptr, cbuf_end, cbuf_type);
             break;
+        case REOP_space:
+            if (cptr == cbuf_end)
+                goto no_match;
+            GET_CHAR(c, cptr, cbuf_end, cbuf_type);
+            if (!lre_is_space(c))
+                goto no_match;
+            break;
+        case REOP_not_space:
+            if (cptr == cbuf_end)
+                goto no_match;
+            GET_CHAR(c, cptr, cbuf_end, cbuf_type);
+            if (lre_is_space(c))
+                goto no_match;
+            break;
         case REOP_save_start:
         case REOP_save_end:
             val = *pc++;
             assert(val < s->capture_count);
-            capture[2 * val + opcode - REOP_save_start] = (uint8_t *)cptr;
+            idx = 2 * val + opcode - REOP_save_start;
+            SAVE_CAPTURE(idx, (uint8_t *)cptr);
             break;
         case REOP_save_reset:
             {
@@ -2911,35 +3042,97 @@ static intptr_t lre_exec_backtrack(REExecContext *s, uint8_t **capture,
                 val2 = pc[1];
                 pc += 2;
                 assert(val2 < s->capture_count);
+                CHECK_STACK_SPACE(2 * (val2 - val + 1));
                 while (val <= val2) {
-                    capture[2 * val] = NULL;
-                    capture[2 * val + 1] = NULL;
+                    idx = 2 * val;
+                    SAVE_CAPTURE(idx, NULL);
+                    idx = 2 * val + 1;
+                    SAVE_CAPTURE(idx, NULL);
                     val++;
                 }
             }
             break;
-        case REOP_push_i32:
-            val = get_u32(pc);
-            pc += 4;
-            stack[stack_len++] = val;
-            break;
-        case REOP_drop:
-            stack_len--;
+        case REOP_set_i32:
+            idx = 2 * s->capture_count + pc[0];
+            val = get_u32(pc + 1);
+            pc += 5;
+            SAVE_CAPTURE_CHECK(idx, (void *)(uintptr_t)val);
             break;
         case REOP_loop:
-            val = get_u32(pc);
-            pc += 4;
-            if (--stack[stack_len - 1] != 0) {
-                pc += (int)val;
-                if (lre_poll_timeout(s))
-                    return LRE_RET_TIMEOUT;
+            {
+                uint32_t val2;
+                idx = 2 * s->capture_count + pc[0];
+                val = get_u32(pc + 1);
+                pc += 5;
+
+                val2 = (uintptr_t)capture[idx] - 1;
+                SAVE_CAPTURE_CHECK(idx, (void *)(uintptr_t)val2);
+                if (val2 != 0) {
+                    pc += (int)val;
+                    if (lre_poll_timeout(s))
+                        return LRE_RET_TIMEOUT;
+                }
+            }
+            break;
+        case REOP_loop_split_goto_first:
+        case REOP_loop_split_next_first:
+        case REOP_loop_check_adv_split_goto_first:
+        case REOP_loop_check_adv_split_next_first:
+            {
+                const uint8_t *pc1;
+                uint32_t val2, limit;
+                idx = 2 * s->capture_count + pc[0];
+                limit = get_u32(pc + 1);
+                val = get_u32(pc + 5);
+                pc += 9;
+
+                /* decrement the counter */
+                val2 = (uintptr_t)capture[idx] - 1;
+                SAVE_CAPTURE_CHECK(idx, (void *)(uintptr_t)val2);
+
+                if (val2 > limit) {
+                    /* normal loop if counter > limit */
+                    pc += (int)val;
+                    if (lre_poll_timeout(s))
+                        return LRE_RET_TIMEOUT;
+                } else {
+                    /* check advance */
+                    if ((opcode == REOP_loop_check_adv_split_goto_first ||
+                         opcode == REOP_loop_check_adv_split_next_first) &&
+                        capture[idx + 1] == cptr &&
+                        val2 != limit) {
+                        goto no_match;
+                    }
+                    
+                    /* otherwise conditional split */
+                    if (val2 != 0) {
+                        if (opcode == REOP_loop_split_next_first ||
+                            opcode == REOP_loop_check_adv_split_next_first) {
+                            pc1 = pc + (int)val;
+                        } else {
+                            pc1 = pc;
+                            pc = pc + (int)val;
+                        }
+                        CHECK_STACK_SPACE(3);
+                        sp[0].ptr = (uint8_t *)pc1;
+                        sp[1].ptr = (uint8_t *)cptr;
+                        sp[2].bp.val = bp - s->stack_buf;
+                        sp[2].bp.type = RE_EXEC_STATE_SPLIT;
+                        sp += 3;
+                        bp = sp;
+                    }
+                }
             }
             break;
-        case REOP_push_char_pos:
-            stack[stack_len++] = (uintptr_t)cptr;
+        case REOP_set_char_pos:
+            idx = 2 * s->capture_count + pc[0];
+            pc++;
+            SAVE_CAPTURE_CHECK(idx, (uint8_t *)cptr);
             break;
         case REOP_check_advance:
-            if (stack[--stack_len] == (uintptr_t)cptr)
+            idx = 2 * s->capture_count + pc[0];
+            pc++;
+            if (capture[idx] == cptr)
                 goto no_match;
             break;
         case REOP_word_boundary:
@@ -2955,18 +3148,22 @@ static intptr_t lre_exec_backtrack(REExecContext *s, uint8_t **capture,
                     v1 = FALSE;
                 } else {
                     PEEK_PREV_CHAR(c, cptr, s->cbuf, cbuf_type);
-                    if (ignore_case)
-                        c = lre_canonicalize(c, s->is_unicode);
-                    v1 = is_word_char(c);
+                    if (c < 256) {
+                        v1 = (lre_is_word_byte(c) != 0);
+                    } else {
+                        v1 = ignore_case && (c == 0x017f || c == 0x212a);
+                    }
                 }
                 /* current char */
                 if (cptr >= cbuf_end) {
                     v2 = FALSE;
                 } else {
                     PEEK_CHAR(c, cptr, cbuf_end, cbuf_type);
-                    if (ignore_case)
-                        c = lre_canonicalize(c, s->is_unicode);
-                    v2 = is_word_char(c);
+                    if (c < 256) {
+                        v2 = (lre_is_word_byte(c) != 0);
+                    } else {
+                        v2 = ignore_case && (c == 0x017f || c == 0x212a);
+                    }
                 }
                 if (v1 ^ v2 ^ is_boundary)
                     goto no_match;
@@ -2978,43 +3175,53 @@ static intptr_t lre_exec_backtrack(REExecContext *s, uint8_t **capture,
         case REOP_backward_back_reference_i:
             {
                 const uint8_t *cptr1, *cptr1_end, *cptr1_start;
+                const uint8_t *pc1;
                 uint32_t c1, c2;
+                int i, n;
 
-                val = *pc++;
-                if (val >= s->capture_count)
-                    goto no_match;
-                cptr1_start = capture[2 * val];
-                cptr1_end = capture[2 * val + 1];
-                if (!cptr1_start || !cptr1_end)
-                    break;
-                if (opcode == REOP_back_reference ||
-                    opcode == REOP_back_reference_i) {
-                    cptr1 = cptr1_start;
-                    while (cptr1 < cptr1_end) {
-                        if (cptr >= cbuf_end)
-                            goto no_match;
-                        GET_CHAR(c1, cptr1, cptr1_end, cbuf_type);
-                        GET_CHAR(c2, cptr, cbuf_end, cbuf_type);
-                        if (opcode == REOP_back_reference_i) {
-                            c1 = lre_canonicalize(c1, s->is_unicode);
-                            c2 = lre_canonicalize(c2, s->is_unicode);
-                        }
-                        if (c1 != c2)
-                            goto no_match;
-                    }
-                } else {
-                    cptr1 = cptr1_end;
-                    while (cptr1 > cptr1_start) {
-                        if (cptr == s->cbuf)
-                            goto no_match;
-                        GET_PREV_CHAR(c1, cptr1, cptr1_start, cbuf_type);
-                        GET_PREV_CHAR(c2, cptr, s->cbuf, cbuf_type);
-                        if (opcode == REOP_backward_back_reference_i) {
-                            c1 = lre_canonicalize(c1, s->is_unicode);
-                            c2 = lre_canonicalize(c2, s->is_unicode);
+                n = *pc++;
+                pc1 = pc;
+                pc += n;
+
+                for(i = 0; i < n; i++) {
+                    val = pc1[i];
+                    if (val >= s->capture_count)
+                        goto no_match;
+                    cptr1_start = capture[2 * val];
+                    cptr1_end = capture[2 * val + 1];
+                    /* test the first not empty capture */
+                    if (cptr1_start && cptr1_end) {
+                        if (opcode == REOP_back_reference ||
+                            opcode == REOP_back_reference_i) {
+                            cptr1 = cptr1_start;
+                            while (cptr1 < cptr1_end) {
+                                if (cptr >= cbuf_end)
+                                    goto no_match;
+                                GET_CHAR(c1, cptr1, cptr1_end, cbuf_type);
+                                GET_CHAR(c2, cptr, cbuf_end, cbuf_type);
+                                if (opcode == REOP_back_reference_i) {
+                                    c1 = lre_canonicalize(c1, s->is_unicode);
+                                    c2 = lre_canonicalize(c2, s->is_unicode);
+                                }
+                                if (c1 != c2)
+                                    goto no_match;
+                            }
+                        } else {
+                            cptr1 = cptr1_end;
+                            while (cptr1 > cptr1_start) {
+                                if (cptr == s->cbuf)
+                                    goto no_match;
+                                GET_PREV_CHAR(c1, cptr1, cptr1_start, cbuf_type);
+                                GET_PREV_CHAR(c2, cptr, s->cbuf, cbuf_type);
+                                if (opcode == REOP_backward_back_reference_i) {
+                                    c1 = lre_canonicalize(c1, s->is_unicode);
+                                    c2 = lre_canonicalize(c2, s->is_unicode);
+                                }
+                                if (c1 != c2)
+                                    goto no_match;
+                            }
                         }
-                        if (c1 != c2)
-                            goto no_match;
+                        break;
                     }
                 }
             }
@@ -3104,50 +3311,10 @@ static intptr_t lre_exec_backtrack(REExecContext *s, uint8_t **capture,
                 goto no_match;
             PREV_CHAR(cptr, s->cbuf, cbuf_type);
             break;
-        case REOP_simple_greedy_quant:
-            {
-                uint32_t next_pos, quant_min, quant_max;
-                size_t q;
-                intptr_t res;
-                const uint8_t *pc1;
-
-                next_pos = get_u32(pc);
-                quant_min = get_u32(pc + 4);
-                quant_max = get_u32(pc + 8);
-                pc += 16;
-                pc1 = pc;
-                pc += (int)next_pos;
-
-                q = 0;
-                for(;;) {
-                    if (lre_poll_timeout(s))
-                        return LRE_RET_TIMEOUT;
-                    res = lre_exec_backtrack(s, capture, stack, stack_len,
-                                             pc1, cptr, TRUE);
-                    if (res == LRE_RET_MEMORY_ERROR ||
-                        res == LRE_RET_TIMEOUT)
-                        return res;
-                    if (!res)
-                        break;
-                    cptr = (uint8_t *)res;
-                    q++;
-                    if (q >= quant_max && quant_max != INT32_MAX)
-                        break;
-                }
-                if (q < quant_min)
-                    goto no_match;
-                if (q > quant_min) {
-                    /* will examine all matches down to quant_min */
-                    ret = push_state(s, capture, stack, stack_len,
-                                     pc1 - 16, cptr,
-                                     RE_EXEC_STATE_GREEDY_QUANT,
-                                     q - quant_min);
-                    if (ret < 0)
-                        return LRE_RET_MEMORY_ERROR;
-                }
-            }
-            break;
         default:
+#ifdef DUMP_EXEC
+            printf("unknown opcode pc=%ld\n", pc - 1 - pc_start);
+#endif            
             abort();
         }
     }
@@ -3161,14 +3328,12 @@ int lre_exec(uint8_t **capture,
              int cbuf_type, void *opaque)
 {
     REExecContext s_s, *s = &s_s;
-    int re_flags, i, alloca_size, ret;
-    StackInt *stack_buf;
+    int re_flags, i, ret;
     const uint8_t *cptr;
 
     re_flags = lre_get_flags(bc_buf);
     s->is_unicode = (re_flags & (LRE_FLAG_UNICODE | LRE_FLAG_UNICODE_SETS)) != 0;
     s->capture_count = bc_buf[RE_HEADER_CAPTURE_COUNT];
-    s->stack_size_max = bc_buf[RE_HEADER_STACK_SIZE];
     s->cbuf = cbuf;
     s->cbuf_end = cbuf + (clen << cbuf_type);
     s->cbuf_type = cbuf_type;
@@ -3177,17 +3342,11 @@ int lre_exec(uint8_t **capture,
     s->interrupt_counter = INTERRUPT_COUNTER_INIT;
     s->opaque = opaque;
 
-    s->state_size = sizeof(REExecState) +
-        s->capture_count * sizeof(capture[0]) * 2 +
-        s->stack_size_max * sizeof(stack_buf[0]);
-    s->state_stack = NULL;
-    s->state_stack_len = 0;
-    s->state_stack_size = 0;
+    s->stack_buf = s->static_stack_buf;
+    s->stack_size = countof(s->static_stack_buf);
 
     for(i = 0; i < s->capture_count * 2; i++)
         capture[i] = NULL;
-    alloca_size = s->stack_size_max * sizeof(stack_buf[0]);
-    stack_buf = alloca(alloca_size);
 
     cptr = cbuf + (cindex << cbuf_type);
     if (0 < cindex && cindex < clen && s->cbuf_type == 2) {
@@ -3197,12 +3356,19 @@ int lre_exec(uint8_t **capture,
         }
     }
 
-    ret = lre_exec_backtrack(s, capture, stack_buf, 0, bc_buf + RE_HEADER_LEN,
-                             cptr, FALSE);
-    lre_realloc(s->opaque, s->state_stack, 0);
+    ret = lre_exec_backtrack(s, capture, bc_buf + RE_HEADER_LEN, cptr);
+
+    if (s->stack_buf != s->static_stack_buf)
+        lre_realloc(s->opaque, s->stack_buf, 0);
     return ret;
 }
 
+int lre_get_alloc_count(const uint8_t *bc_buf)
+{
+    return bc_buf[RE_HEADER_CAPTURE_COUNT] * 2 +
+        bc_buf[RE_HEADER_REGISTER_COUNT];
+}
+
 int lre_get_capture_count(const uint8_t *bc_buf)
 {
     return bc_buf[RE_HEADER_CAPTURE_COUNT];
@@ -3241,7 +3407,7 @@ int main(int argc, char **argv)
     int len, flags, ret, i;
     uint8_t *bc;
     char error_msg[64];
-    uint8_t *capture[CAPTURE_COUNT_MAX * 2];
+    uint8_t *capture;
     const char *input;
     int input_len, capture_count;
 
@@ -3260,6 +3426,7 @@ int main(int argc, char **argv)
     input = argv[3];
     input_len = strlen(input);
 
+    capture = malloc(sizeof(capture[0]) * lre_get_alloc_count(bc));
     ret = lre_exec(capture, bc, (uint8_t *)input, 0, input_len, 0, NULL);
     printf("ret=%d\n", ret);
     if (ret == 1) {
@@ -3275,6 +3442,7 @@ int main(int argc, char **argv)
             printf("\n");
         }
     }
+    free(capture);
     return 0;
 }
 #endif