From a28639e71198238d5c09c43445dc448d7f3fb29b Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 19 Jan 2021 22:48:09 +0100
Subject: [PATCH] patch 8.2.2377: Vim9: crash when using a range after another
 expression

Problem:    Vim9: crash when using a range after another expression.
Solution:   Set the variable type to number. Fix using :put with a range and
            the "=" register. (closes #7706)
---
 src/testdir/test_vim9_cmd.vim |  4 ++++
 src/version.c                 |  2 ++
 src/vim9execute.c             | 36 +++++++++++++++++++----------------
 3 files changed, 26 insertions(+), 16 deletions(-)

diff --git a/src/testdir/test_vim9_cmd.vim b/src/testdir/test_vim9_cmd.vim
index 098cded98..12b9bf191 100644
--- a/src/testdir/test_vim9_cmd.vim
+++ b/src/testdir/test_vim9_cmd.vim
@@ -750,6 +750,10 @@ def Test_put_command()
   :+2put! a
   assert_equal('aaa', getline(4))
 
+  []->mapnew(() => 0)
+  :$put ='end'
+  assert_equal('end', getline('$'))
+
   bwipe!
 
   CheckDefFailure(['put =xxx'], 'E1001:')
diff --git a/src/version.c b/src/version.c
index b809cb2b7..57b1a0c47 100644
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2377,
 /**/
     2376,
 /**/
diff --git a/src/vim9execute.c b/src/vim9execute.c
index fdc49eb05..907a52f18 100644
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -3326,10 +3326,6 @@ call_def_function(
 		    exarg_T	ea;
 		    char	*errormsg;
 
-		    if (GA_GROW(&ectx.ec_stack, 1) == FAIL)
-			goto failed;
-		    ++ectx.ec_stack.ga_len;
-		    tv = STACK_TV_BOT(-1);
 		    ea.line2 = 0;
 		    ea.addr_count = 0;
 		    ea.addr_type = ADDR_LINES;
@@ -3337,6 +3333,13 @@ call_def_function(
 		    ea.skip = FALSE;
 		    if (parse_cmd_address(&ea, &errormsg, FALSE) == FAIL)
 			goto on_error;
+
+		    if (GA_GROW(&ectx.ec_stack, 1) == FAIL)
+			goto failed;
+		    ++ectx.ec_stack.ga_len;
+		    tv = STACK_TV_BOT(-1);
+		    tv->v_type = VAR_NUMBER;
+		    tv->v_lock = 0;
 		    if (ea.addr_count == 0)
 			tv->vval.v_number = curwin->w_cursor.lnum;
 		    else
@@ -3351,18 +3354,6 @@ call_def_function(
 		    char_u	*expr = NULL;
 		    int		dir = FORWARD;
 
-		    if (regname == '=')
-		    {
-			tv = STACK_TV_BOT(-1);
-			if (tv->v_type == VAR_STRING)
-			    expr = tv->vval.v_string;
-			else
-			{
-			    expr = typval2string(tv, TRUE); // allocates value
-			    clear_tv(tv);
-			}
-			--ectx.ec_stack.ga_len;
-		    }
 		    if (lnum < -2)
 		    {
 			// line number was put on the stack by ISN_RANGE
@@ -3377,6 +3368,19 @@ call_def_function(
 			dir = BACKWARD;
 		    else if (lnum >= 0)
 			curwin->w_cursor.lnum = iptr->isn_arg.put.put_lnum;
+
+		    if (regname == '=')
+		    {
+			tv = STACK_TV_BOT(-1);
+			if (tv->v_type == VAR_STRING)
+			    expr = tv->vval.v_string;
+			else
+			{
+			    expr = typval2string(tv, TRUE); // allocates value
+			    clear_tv(tv);
+			}
+			--ectx.ec_stack.ga_len;
+		    }
 		    check_cursor();
 		    do_put(regname, expr, dir, 1L, PUT_LINE|PUT_CURSLINE);
 		    vim_free(expr);
-- 
2.40.0