From 3a4cd39d476474e20e88ebf120ca6070cc0d0072 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 30 Jul 2022 22:17:18 +0100
Subject: [PATCH] patch 9.0.0117: text of removed textprop with text is not
 freed

Problem:    Text of removed textprop with text is not freed.
Solution:   Free the text when the property is removed.  Reduce the array size
            to ignore NULLs at the end.
---
 src/testdir/test_textprop.vim | 19 +++++++++++++++++++
 src/textprop.c                | 33 ++++++++++++++++++++++++++++++---
 src/version.c                 |  2 ++
 3 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/src/testdir/test_textprop.vim b/src/testdir/test_textprop.vim
index 5a3f9b3a66d09..a3a3c00bb49f0 100644
--- a/src/testdir/test_textprop.vim
+++ b/src/testdir/test_textprop.vim
@@ -2213,4 +2213,23 @@ func Test_prop_inserts_text()
   call delete('XscriptPropsWithText')
 endfunc
 
+func Test_removed_prop_with_text_cleans_up_array()
+  new
+  call setline(1, 'some text here')
+  call prop_type_add('some', #{highlight: 'ErrorMsg'})
+  let id1 = prop_add(1, 5, #{type: 'some', text: "SOME"})
+  call assert_equal(-1, id1)
+  let id2 = prop_add(1, 10, #{type: 'some', text: "HERE"})
+  call assert_equal(-2, id2)
+
+  " removing the props resets the index
+  call prop_remove(#{id: id1})
+  call prop_remove(#{id: id2})
+  let id1 = prop_add(1, 5, #{type: 'some', text: "SOME"})
+  call assert_equal(-1, id1)
+
+  call prop_type_delete('some')
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/textprop.c b/src/textprop.c
index d7db7aa3e12e4..939b1640747c1 100644
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -1233,9 +1233,10 @@ f_prop_remove(typval_T *argvars, typval_T *rettv)
     dict_T	*dict;
     buf_T	*buf = curbuf;
     int		do_all;
-    int		id = -1;
+    int		id = -MAXCOL;
     int		type_id = -1;
     int		both;
+    int		did_remove_text = FALSE;
 
     rettv->vval.v_number = 0;
 
@@ -1286,12 +1287,12 @@ f_prop_remove(typval_T *argvars, typval_T *rettv)
     }
     both = dict_get_bool(dict, "both", FALSE);
 
-    if (id == -1 && type_id == -1)
+    if (id == -MAXCOL && type_id == -1)
     {
 	emsg(_(e_need_at_least_one_of_id_or_type));
 	return;
     }
-    if (both && (id == -1 || type_id == -1))
+    if (both && (id == -MAXCOL || type_id == -1))
     {
 	emsg(_(e_need_id_and_type_with_both));
 	return;
@@ -1350,6 +1351,21 @@ f_prop_remove(typval_T *argvars, typval_T *rettv)
 		    buf->b_ml.ml_line_len -= sizeof(textprop_T);
 		    --idx;
 
+		    if (textprop.tp_id < 0)
+		    {
+			garray_T    *gap = &buf->b_textprop_text;
+			int	    ii = -textprop.tp_id - 1;
+
+			// negative ID: property with text - free the text
+			if (ii < gap->ga_len)
+			{
+			    char_u **p = ((char_u **)gap->ga_data) + ii;
+			    vim_free(*p);
+			    *p = NULL;
+			    did_remove_text = TRUE;
+			}
+		    }
+
 		    if (first_changed == 0)
 			first_changed = lnum;
 		    last_changed = lnum;
@@ -1360,11 +1376,22 @@ f_prop_remove(typval_T *argvars, typval_T *rettv)
 	    }
 	}
     }
+
     if (first_changed > 0)
     {
 	changed_lines_buf(buf, first_changed, last_changed + 1, 0);
 	redraw_buf_later(buf, VALID);
     }
+
+    if (did_remove_text)
+    {
+	garray_T    *gap = &buf->b_textprop_text;
+
+	// Reduce the growarray size for NULL pointers at the end.
+	while (gap->ga_len > 0
+			 && ((char_u **)gap->ga_data)[gap->ga_len - 1] == NULL)
+	    --gap->ga_len;
+    }
 }
 
 /*
diff --git a/src/version.c b/src/version.c
index fcfb69bbaacbc..770b1b6a235d2 100644
--- a/src/version.c
+++ b/src/version.c
@@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    117,
 /**/
     116,
 /**/