patch 8.2.2377: Vim9: crash when using a range after another expression

Problem:    Vim9: crash when using a range after another expression.
Solution:   Set the variable type to number. Fix using :put with a range and
            the "=" register. (closes #7706)

diff --git a/src/testdir/test_vim9_cmd.vim b/src/testdir/test_vim9_cmd.vim
index 098cded98abf2fa51508defc9c99882b5a97001e..12b9bf191b0fb4792e0f6a3384489eee7d6613db 100644 (file)
--- a/src/testdir/test_vim9_cmd.vim
+++ b/src/testdir/test_vim9_cmd.vim
@@ -750,6 +750,10 @@ def Test_put_command()
   :+2put! a
   assert_equal('aaa', getline(4))
 
+  []->mapnew(() => 0)
+  :$put ='end'
+  assert_equal('end', getline('$'))
+
   bwipe!
 
   CheckDefFailure(['put =xxx'], 'E1001:')

diff --git a/src/version.c b/src/version.c
index b809cb2b7e4bca116f56ff218a3d1235c4281ce8..57b1a0c47414f1645282f65456eb8ee640385e41 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2377,
 /**/
     2376,
 /**/

diff --git a/src/vim9execute.c b/src/vim9execute.c
index fdc49eb05d2535a0670a123fc50f7f593c05d77b..907a52f18f2ba2bad302eb6b6be2c50f03c31f65 100644 (file)
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -3326,10 +3326,6 @@ call_def_function(
                    exarg_T     ea;
                    char        *errormsg;
 
-                   if (GA_GROW(&ectx.ec_stack, 1) == FAIL)
-                       goto failed;
-                   ++ectx.ec_stack.ga_len;
-                   tv = STACK_TV_BOT(-1);
                    ea.line2 = 0;
                    ea.addr_count = 0;
                    ea.addr_type = ADDR_LINES;
@@ -3337,6 +3333,13 @@ call_def_function(
                    ea.skip = FALSE;
                    if (parse_cmd_address(&ea, &errormsg, FALSE) == FAIL)
                        goto on_error;
+
+                   if (GA_GROW(&ectx.ec_stack, 1) == FAIL)
+                       goto failed;
+                   ++ectx.ec_stack.ga_len;
+                   tv = STACK_TV_BOT(-1);
+                   tv->v_type = VAR_NUMBER;
+                   tv->v_lock = 0;
                    if (ea.addr_count == 0)
                        tv->vval.v_number = curwin->w_cursor.lnum;
                    else
@@ -3351,18 +3354,6 @@ call_def_function(
                    char_u      *expr = NULL;
                    int         dir = FORWARD;
 
-                   if (regname == '=')
-                   {
-                       tv = STACK_TV_BOT(-1);
-                       if (tv->v_type == VAR_STRING)
-                           expr = tv->vval.v_string;
-                       else
-                       {
-                           expr = typval2string(tv, TRUE); // allocates value
-                           clear_tv(tv);
-                       }
-                       --ectx.ec_stack.ga_len;
-                   }
                    if (lnum < -2)
                    {
                        // line number was put on the stack by ISN_RANGE
@@ -3377,6 +3368,19 @@ call_def_function(
                        dir = BACKWARD;
                    else if (lnum >= 0)
                        curwin->w_cursor.lnum = iptr->isn_arg.put.put_lnum;
+
+                   if (regname == '=')
+                   {
+                       tv = STACK_TV_BOT(-1);
+                       if (tv->v_type == VAR_STRING)
+                           expr = tv->vval.v_string;
+                       else
+                       {
+                           expr = typval2string(tv, TRUE); // allocates value
+                           clear_tv(tv);
+                       }
+                       --ectx.ec_stack.ga_len;
+                   }
                    check_cursor();
                    do_put(regname, expr, dir, 1L, PUT_LINE|PUT_CURSLINE);
                    vim_free(expr);