Mercurial > vim

comparison src/vim9compile.c @ 23565:34aa2907082a v8.2.2325

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 8.2.2325: Vim9: crash if map() changes the item type Commit: https://github.com/vim/vim/commit/75ab91ff3403e725a79ac9c7351b78e9aff71d67 Author: Bram Moolenaar <Bram@vim.org> Date: Sun Jan 10 22:42:50 2021 +0100 patch 8.2.2325: Vim9: crash if map() changes the item type Problem: Vim9: crash if map() changes the item type. Solution: Check that the item type is still OK. (closes https://github.com/vim/vim/issues/7652) Fix problem with mapnew() on range list.
author Bram Moolenaar <Bram@vim.org>
date Sun, 10 Jan 2021 22:45:06 +0100
parents 647ff61c0bcd
children 4cd173b3d572
comparison
equal deleted inserted replaced
23564:469359887d3e 23565:34aa2907082a
1590 { 1590 {
1591 isn_T *isn; 1591 isn_T *isn;
1592 garray_T *stack = &cctx->ctx_type_stack; 1592 garray_T *stack = &cctx->ctx_type_stack;
1593 int argoff; 1593 int argoff;
1594 type_T **argtypes = NULL; 1594 type_T **argtypes = NULL;
1595 type_T *maptype = NULL;
1595 1596
1596 RETURN_OK_IF_SKIP(cctx); 1597 RETURN_OK_IF_SKIP(cctx);
1597 argoff = check_internal_func(func_idx, argcount); 1598 argoff = check_internal_func(func_idx, argcount);
1598 if (argoff < 0) 1599 if (argoff < 0)
1599 return FAIL; 1600 return FAIL;
1610 { 1611 {
1611 // Check the types of the arguments. 1612 // Check the types of the arguments.
1612 argtypes = ((type_T **)stack->ga_data) + stack->ga_len - argcount; 1613 argtypes = ((type_T **)stack->ga_data) + stack->ga_len - argcount;
1613 if (internal_func_check_arg_types(argtypes, func_idx, argcount) == FAIL) 1614 if (internal_func_check_arg_types(argtypes, func_idx, argcount) == FAIL)
1614 return FAIL; 1615 return FAIL;
1616 if (internal_func_is_map(func_idx))
1617 maptype = *argtypes;
1615 } 1618 }
1616 1619
1617 if ((isn = generate_instr(cctx, ISN_BCALL)) == NULL) 1620 if ((isn = generate_instr(cctx, ISN_BCALL)) == NULL)
1618 return FAIL; 1621 return FAIL;
1619 isn->isn_arg.bfunc.cbf_idx = func_idx; 1622 isn->isn_arg.bfunc.cbf_idx = func_idx;
1624 if (ga_grow(stack, 1) == FAIL) 1627 if (ga_grow(stack, 1) == FAIL)
1625 return FAIL; 1628 return FAIL;
1626 ((type_T **)stack->ga_data)[stack->ga_len] = 1629 ((type_T **)stack->ga_data)[stack->ga_len] =
1627 internal_func_ret_type(func_idx, argcount, argtypes); 1630 internal_func_ret_type(func_idx, argcount, argtypes);
1628 ++stack->ga_len; 1631 ++stack->ga_len;
1632
1633 if (maptype != NULL && maptype->tt_member != NULL
1634 && maptype->tt_member != &t_any)
1635 // Check that map() didn't change the item types.
1636 generate_TYPECHECK(cctx, maptype, -1);
1629 1637
1630 return OK; 1638 return OK;
1631 } 1639 }
1632 1640
1633 /* 1641 /*