Fix two issues causing a class of assertion failures found by jsg@ with afl.

1) rew_sub(): Make sure REWIND_MORE is acted upon even when followed by
REWIND_NONE.  This prevents .It from ending up inside other children of .Bl.
2) blk_exp_close(): Only allow extension of .Bl when it has at least
one .It.  Otherwise, a broken child block could be moved in front of
the .Bl, effectively resulting in a .Bl that ended before it began.

1 files changed, 27 insertions, 0 deletions

diff --git a/regress/usr.bin/mandoc/mdoc/Bl/breakingIt.out_ascii b/regress/usr.bin/mandoc/mdoc/Bl/breakingIt.out_ascii
new file mode 100644
index 00000000000..0013bba8b6b
--- /dev/null
+++ b/regress/usr.bin/mandoc/mdoc/Bl/breakingIt.out_ascii
@@ -0,0 +1,27 @@
+BL-BREAKINGIT(1)            General Commands Manual           BL-BREAKINGIT(1)
+
+NNAAMMEE
+     BBll--bbrreeaakkiinnggIItt - items breaking other blocks
+
+DDEESSCCRRIIPPTTIIOONN
+   BBrreeaakkiinngg ppaarrttiiaall eexxpplliicciitt mmaaccrrooss
+     Stray text.  <More stray text.>
+
+     tag     Tagged text.
+     Stray text.  <More stray text.>
+
+     ++oo   Bullet point.
+
+   BBrreeaakkiinngg ffuullll eexxpplliicciitt mmaaccrrooss
+     Stray text.
+
+           More stray text.
+
+     tag     Tagged text.
+     Stray text.
+
+           More stray text.
+
+     ++oo   Bullet point.
+
+OpenBSD                        December 19, 2014                       OpenBSD