# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1591218003 -7200
# Node ID 4c66962d322b10ada781eb17a0a91c8d4712a7e2
# Parent  635e76ab37227d93ac3ca84755953cee6719114c
patch 8.2.0896: crash when calling searchcount() with a string

Commit: https://github.com/vim/vim/commit/14681627f39421cce289345d4ec9927c10fa3b1c
Author: Bram Moolenaar <Bram@vim.org>
Date:   Wed Jun 3 22:57:39 2020 +0200

    patch 8.2.0896: crash when calling searchcount() with a string

    Problem:    Crash when calling searchcount() with a string.
    Solution:   Check the argument is a dict. (closes https://github.com/vim/vim/issues/6192)

diff --git a/src/search.c b/src/search.c
--- a/src/search.c
+++ b/src/search.c
@@ -3175,7 +3175,7 @@ update_search_stat(
     int		    save_ws = p_ws;
     int		    wraparound = FALSE;
     pos_T	    p = (*pos);
-    static  pos_T   lastpos = {0, 0, 0};
+    static pos_T    lastpos = {0, 0, 0};
     static int	    cur = 0;
     static int	    cnt = 0;
     static int	    exact_match = FALSE;
@@ -4072,11 +4072,17 @@ f_searchcount(typval_T *argvars, typval_
 
     if (argvars[0].v_type != VAR_UNKNOWN)
     {
-	dict_T		*dict = argvars[0].vval.v_dict;
+	dict_T		*dict;
 	dictitem_T	*di;
 	listitem_T	*li;
 	int		error = FALSE;
 
+	if (argvars[0].v_type != VAR_DICT || argvars[0].vval.v_dict == NULL)
+	{
+	    emsg(_(e_dictreq));
+	    return;
+	}
+	dict = argvars[0].vval.v_dict;
 	di = dict_find(dict, (char_u *)"timeout", -1);
 	if (di != NULL)
 	{
diff --git a/src/testdir/test_search_stat.vim b/src/testdir/test_search_stat.vim
--- a/src/testdir/test_search_stat.vim
+++ b/src/testdir/test_search_stat.vim
@@ -259,6 +259,10 @@ func Test_search_stat()
   bwipe!
 endfunc
 
+func Test_searchcount_fails()
+  call assert_fails('echo searchcount("boo!")', 'E715:')
+endfunc
+
 func Test_search_stat_foldopen()
   CheckScreendump
 
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -747,6 +747,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    896,
+/**/
     895,
 /**/
     894,