# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1647609304 -3600
# Node ID ed151877ebac47792e3f305c6c050ae0be4eb9b6
# Parent  72a573de6f5a676e637d562960e3bad6deaf0ccb
patch 8.2.4587: Vim9: double free after unpacking a list

Commit: https://github.com/vim/vim/commit/61efa16932d485fc724e4b94a8e7078a176c9946
Author: Bram Moolenaar <Bram@vim.org>
Date:   Fri Mar 18 13:10:48 2022 +0000

    patch 8.2.4587: Vim9: double free after unpacking a list

    Problem:    Vim9: double free after unpacking a list.
    Solution:   Make a copy of the value instead of moving it. (closes https://github.com/vim/vim/issues/9968)

diff --git a/src/testdir/test_vim9_script.vim b/src/testdir/test_vim9_script.vim
--- a/src/testdir/test_vim9_script.vim
+++ b/src/testdir/test_vim9_script.vim
@@ -2253,6 +2253,13 @@ def Test_for_loop_unpack()
         res->add(n)
       endfor
       assert_equal([2, 5], res)
+
+      var text: list<string> = ["hello there", "goodbye now"]
+      var splitted = ''
+      for [first; next] in mapnew(text, (i, v) => split(v))
+          splitted ..= string(first) .. string(next) .. '/'
+      endfor
+      assert_equal("'hello'['there']/'goodbye'['now']/", splitted)
   END
   v9.CheckDefAndScriptSuccess(lines)
 
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -751,6 +751,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    4587,
+/**/
     4586,
 /**/
     4585,
diff --git a/src/vim9execute.c b/src/vim9execute.c
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -4773,7 +4773,10 @@ exec_instructions(ectx_T *ectx)
 			    li = li->li_next;
 			for (i = 0; li != NULL; ++i)
 			{
-			    list_set_item(rem_list, i, &li->li_tv);
+			    typval_T tvcopy;
+
+			    copy_tv(&li->li_tv, &tvcopy);
+			    list_set_item(rem_list, i, &tvcopy);
 			    li = li->li_next;
 			}
 			--count;