patch 9.0.0432: crash when using for loop variable in closurev9.0.0432

Problem:    Crash when using for loop variable in closure.
Solution:   Check that the variable wasn't deleted. (issue #11094)

5 files changed, 41 insertions, 2 deletions

diff --git a/src/errors.h b/src/errors.h
index 45f0d6a66c..050cec768d 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -3331,4 +3331,6 @@ EXTERN char e_cannot_use_partial_with_dictionary_for_defer[]
 	INIT(= N_("E1300: Cannot use a partial with dictionary for :defer"));
 EXTERN char e_string_number_list_or_blob_required_for_argument_nr[]
 	INIT(= N_("E1301: String, Number, List or Blob required for argument %d"));
+EXTERN char e_script_variable_was_deleted[]
+	INIT(= N_("E1302: Script variable was deleted"));
 #endif
diff --git a/src/testdir/dumps/Test_vim9_closure_fails.dump b/src/testdir/dumps/Test_vim9_closure_fails.dump
new file mode 100644
index 0000000000..1189a3a919
--- /dev/null
+++ b/src/testdir/dumps/Test_vim9_closure_fails.dump
@@ -0,0 +1,6 @@
+|~+0#4040ff13#ffffff0| @73
+|~| @73
+|E+0#ffffff16#e000002|r@1|o|r| |d|e|t|e|c|t|e|d| |w|h|i|l|e| |p|r|o|c|e|s@1|i|n|g| |f|u|n|c|t|i|o|n| |<|l|a|m|b|d|a|>|1|:| +0#0000000#ffffff0@23
+|l+0#af5f00255&|i|n|e| @3|1|:| +0#0000000&@64
+|E+0#ffffff16#e000002|1|3|0|2|:| |S|c|r|i|p|t| |v|a|r|i|a|b|l|e| |w|a|s| |d|e|l|e|t|e|d| +0#0000000#ffffff0@40
+|P+0#00e0003&|r|e|s@1| |E|N|T|E|R| |o|r| |t|y|p|e| |c|o|m@1|a|n|d| |t|o| |c|o|n|t|i|n|u|e> +0#0000000&@35
diff --git a/src/testdir/test_vim9_func.vim b/src/testdir/test_vim9_func.vim
index fce215e47c..70a71ea932 100644
--- a/src/testdir/test_vim9_func.vim
+++ b/src/testdir/test_vim9_func.vim
@@ -2943,6 +2943,30 @@ def Test_nested_closure_fails()
   v9.CheckScriptFailure(lines, 'E1012:')
 enddef
 
+def Run_Test_closure_in_for_loop_fails()
+  var lines =<< trim END
+    vim9script
+    for n in [0]
+        timer_start(10, (_) => {
+            echo n
+        })
+    endfor
+  END
+  writefile(lines, 'XTest_closure_fails', 'D')
+
+  # Check that an error shows
+  var buf = g:RunVimInTerminal('-S XTest_closure_fails', {'rows': 6})
+  g:VerifyScreenDump(buf, 'Test_vim9_closure_fails', {})
+
+  # clean up
+  g:StopVimInTerminal(buf)
+enddef
+
+func Test_closure_in_for_loop_fails()
+  CheckScreendump
+  call Run_Test_closure_in_for_loop_fails()
+endfunc
+
 def Test_global_closure()
   var lines =<< trim END
       vim9script
@@ -3321,7 +3345,7 @@ def Run_Test_silent_echo()
     enddef
     defcompile
   END
-  writefile(lines, 'XTest_silent_echo')
+  writefile(lines, 'XTest_silent_echo', 'D')
 
   # Check that the balloon shows up after a mouse move
   var buf = g:RunVimInTerminal('-S XTest_silent_echo', {'rows': 6})
@@ -3330,7 +3354,6 @@ def Run_Test_silent_echo()
 
   # clean up
   g:StopVimInTerminal(buf)
-  delete('XTest_silent_echo')
 enddef
 
 def SilentlyError()
diff --git a/src/version.c b/src/version.c
index eb979bc046..3c7c9c82da 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    432,
+/**/
     431,
 /**/
     430,
diff --git a/src/vim9execute.c b/src/vim9execute.c
index 30ff7a7755..d4d1ad6995 100644
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -1716,6 +1716,12 @@ get_script_svar(scriptref_T *sref, int dfunc_idx)
 	return NULL;
     }
     sv = ((svar_T *)si->sn_var_vals.ga_data) + sref->sref_idx;
+    if (sv->sv_name == NULL)
+    {
+	if (dfunc != NULL)
+	    emsg(_(e_script_variable_was_deleted));
+	return NULL;
+    }
     if (!equal_type(sv->sv_type, sref->sref_type, 0))
     {
 	if (dfunc != NULL)