Skip to content

Commit 885971e

Browse files
committed
patch 8.2.3182: Vim9: crash when using removing items from a constant list
Problem: Vim9: crash when using removing items from a constant list. (Yegappan Lakshmanan) Solution: When a list was allocated with items copy them.
1 parent 9ff9c7b commit 885971e

3 files changed

Lines changed: 34 additions & 6 deletions

File tree

src/list.c

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1566,12 +1566,32 @@ list_remove(typval_T *argvars, typval_T *rettv, char_u *arg_errmsg)
15661566
vimlist_remove(l, item, item2);
15671567
if (rettv_list_alloc(rettv) == OK)
15681568
{
1569-
l = rettv->vval.v_list;
1570-
l->lv_first = item;
1571-
l->lv_u.mat.lv_last = item2;
1572-
item->li_prev = NULL;
1573-
item2->li_next = NULL;
1574-
l->lv_len = cnt;
1569+
list_T *rl = rettv->vval.v_list;
1570+
1571+
if (l->lv_with_items > 0)
1572+
{
1573+
// need to copy the list items and move the value
1574+
while (item != NULL)
1575+
{
1576+
li = listitem_alloc();
1577+
if (li == NULL)
1578+
return;
1579+
li->li_tv = item->li_tv;
1580+
init_tv(&item->li_tv);
1581+
list_append(rl, li);
1582+
if (item == item2)
1583+
break;
1584+
item = item->li_next;
1585+
}
1586+
}
1587+
else
1588+
{
1589+
rl->lv_first = item;
1590+
rl->lv_u.mat.lv_last = item2;
1591+
item->li_prev = NULL;
1592+
item2->li_next = NULL;
1593+
rl->lv_len = cnt;
1594+
}
15751595
}
15761596
}
15771597
}

src/testdir/test_vim9_builtin.vim

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2083,6 +2083,12 @@ def Test_remote_startserver()
20832083
CheckDefFailure(['remote_startserver({})'], 'E1013: Argument 1: type mismatch, expected string but got dict<unknown>')
20842084
enddef
20852085

2086+
def Test_remove_const_list()
2087+
var l: list<number> = [1, 2, 3, 4]
2088+
assert_equal([1, 2], remove(l, 0, 1))
2089+
assert_equal([3, 4], l)
2090+
enddef
2091+
20862092
def Test_remove_return_type()
20872093
var l = remove({one: [1, 2], two: [3, 4]}, 'one')
20882094
var res = 0

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -755,6 +755,8 @@ static char *(features[]) =
755755

756756
static int included_patches[] =
757757
{ /* Add new patch number below this line */
758+
/**/
759+
3182,
758760
/**/
759761
3181,
760762
/**/

0 commit comments

Comments
 (0)