Mercurial > vim
changeset 21000:3b29ac3394dc v8.2.1051
patch 8.2.1051: crash when changing a list while using reduce() on it
Commit: https://github.com/vim/vim/commit/ca275a05d8b79f6a9101604fdede2373d0dea44e
Author: Bram Moolenaar <Bram@vim.org>
Date: Wed Jun 24 22:07:46 2020 +0200
patch 8.2.1051: crash when changing a list while using reduce() on it
Problem: Crash when changing a list while using reduce() on it.
Solution: Lock the list. (closes https://github.com/vim/vim/issues/6330)
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Wed, 24 Jun 2020 22:15:04 +0200 |
| parents | 0c32e18e0a19 |
| children | c179f9052a2c |
| files | src/list.c src/testdir/test_listdict.vim src/version.c |
| diffstat | 3 files changed, 17 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/src/list.c +++ b/src/list.c @@ -2461,6 +2461,8 @@ f_reduce(typval_T *argvars, typval_T *re list_T *l = argvars[0].vval.v_list; listitem_T *li = NULL; int r; + int prev_locked = l->lv_lock; + int called_emsg_start = called_emsg; CHECK_LIST_MATERIALIZE(l); if (argvars[2].v_type == VAR_UNKNOWN) @@ -2480,6 +2482,7 @@ f_reduce(typval_T *argvars, typval_T *re li = l->lv_first; } + l->lv_lock = VAR_FIXED; // disallow the list changing here copy_tv(&initial, rettv); for ( ; li != NULL; li = li->li_next) { @@ -2488,9 +2491,10 @@ f_reduce(typval_T *argvars, typval_T *re rettv->v_type = VAR_UNKNOWN; r = call_func(func_name, -1, rettv, 2, argv, &funcexe); clear_tv(&argv[0]); - if (r == FAIL) - return; + if (r == FAIL || called_emsg != called_emsg_start) + break; } + l->lv_lock = prev_locked; } else {
--- a/src/testdir/test_listdict.vim +++ b/src/testdir/test_listdict.vim @@ -709,6 +709,15 @@ func Test_reduce() call assert_fails("call reduce({}, { acc, val -> acc + val }, 1)", 'E897:') call assert_fails("call reduce(0, { acc, val -> acc + val }, 1)", 'E897:') call assert_fails("call reduce('', { acc, val -> acc + val }, 1)", 'E897:') + + let g:lut = [1, 2, 3, 4] + func EvilRemove() + call remove(g:lut, 1) + return 1 + endfunc + call assert_fails("call reduce(g:lut, { acc, val -> EvilRemove() }, 1)", 'E742:') + unlet g:lut + delfunc EvilRemove endfunc " splitting a string to a List using split()