Skip to content

Commit

Permalink
patch 8.2.4697: Vim9: crash when adding a duplicate key to a dictionary
Browse files Browse the repository at this point in the history
Problem:    Vim9: crash when adding a duplicate key to a dictionary.
Solution:   Clear the stack item when it has been moved into the dictionary.
            (closes #10087)
  • Loading branch information
brammool committed Apr 5, 2022
1 parent 4787003 commit 0d1f55c
Show file tree
Hide file tree
Showing 3 changed files with 9 additions and 2 deletions.
3 changes: 3 additions & 0 deletions src/testdir/test_vim9_expr.vim
Original file line number Diff line number Diff line change
Expand Up @@ -2774,6 +2774,9 @@ def Test_expr8_dict()
v9.CheckScriptFailure(['vim9script', "var x = {xxx: 1,"], 'E723:', 2)
v9.CheckDefAndScriptFailure(["var x = {['a']: xxx}"], ['E1001:', 'E121:'], 1)
v9.CheckDefAndScriptFailure(["var x = {a: 1, a: 2}"], 'E721:', 1)
g:key = 'x'
v9.CheckDefExecAndScriptFailure(["var x = {[g:key]: 'text', [g:key]: 'text'}"], 'E721:', 1)
unlet g:key
v9.CheckDefExecAndScriptFailure(["var x = g:anint.member"], ['E715:', 'E488:'], 1)
v9.CheckDefExecAndScriptFailure(["var x = g:dict_empty.member"], 'E716:', 1)

Expand Down
2 changes: 2 additions & 0 deletions src/version.c
Original file line number Diff line number Diff line change
Expand Up @@ -746,6 +746,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
4697,
/**/
4696,
/**/
Expand Down
6 changes: 4 additions & 2 deletions src/vim9execute.c
Original file line number Diff line number Diff line change
Expand Up @@ -196,8 +196,10 @@ exe_newdict(int count, ectx_T *ectx)
dict_unref(dict);
return FAIL;
}
item->di_tv = *STACK_TV_BOT(2 * (idx - count) + 1);
tv = STACK_TV_BOT(2 * (idx - count) + 1);
item->di_tv = *tv;
item->di_tv.v_lock = 0;
tv->v_type = VAR_UNKNOWN;
if (dict_add(dict, item) == FAIL)
{
// can this ever happen?
Expand Down Expand Up @@ -5363,7 +5365,7 @@ call_def_function(
did_emsg_def += save_did_emsg_def;

failed_early:
// Free all local variables, but not arguments.
// Free all arguments and local variables.
for (idx = 0; idx < ectx.ec_stack.ga_len; ++idx)
clear_tv(STACK_TV(idx));
ex_nesting_level = orig_nesting_level;
Expand Down

0 comments on commit 0d1f55c

Please sign in to comment.