patch 8.1.1591: on error garbage collection may free memory in usev8.1.1591

Problem:    On error garbage collection may free memory in use.
Solution:   Reset may_garbage_collect when evaluating expression mapping.
            Add tests. (Ozaki Kiichi, closes #4579)

6 files changed, 82 insertions, 4 deletions

diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c
index 8871f5dbfa..036a2a7352 100644
--- a/src/ex_cmds2.c
+++ b/src/ex_cmds2.c
@@ -367,8 +367,8 @@ check_due_timer(void)
 	    int save_vgetc_busy = vgetc_busy;
 	    int save_did_emsg = did_emsg;
 	    int save_called_emsg = called_emsg;
-	    int	save_must_redraw = must_redraw;
-	    int	save_trylevel = trylevel;
+	    int save_must_redraw = must_redraw;
+	    int save_trylevel = trylevel;
 	    int save_did_throw = did_throw;
 	    int save_ex_pressedreturn = get_pressedreturn();
 	    int save_may_garbage_collect = may_garbage_collect;
diff --git a/src/getchar.c b/src/getchar.c
index 80e98ec60e..f6734a79a6 100644
--- a/src/getchar.c
+++ b/src/getchar.c
@@ -2540,13 +2540,18 @@ vgetorpeek(int advance)
 			 */
 			if (mp->m_expr)
 			{
-			    int		save_vgetc_busy = vgetc_busy;
+			    int save_vgetc_busy = vgetc_busy;
+			    int save_may_garbage_collect = may_garbage_collect;
 
 			    vgetc_busy = 0;
+			    may_garbage_collect = FALSE;
+
 			    save_m_keys = vim_strsave(mp->m_keys);
 			    save_m_str = vim_strsave(mp->m_str);
 			    s = eval_map_expr(save_m_str, NUL);
+
 			    vgetc_busy = save_vgetc_busy;
+			    may_garbage_collect = save_may_garbage_collect;
 			}
 			else
 #endif
diff --git a/src/testdir/test_mapping.vim b/src/testdir/test_mapping.vim
index a361b2fdc8..7f90b0385c 100644
--- a/src/testdir/test_mapping.vim
+++ b/src/testdir/test_mapping.vim
@@ -397,3 +397,39 @@ func Test_motionforce_omap()
   delfunc Select
   delfunc GetCommand
 endfunc
+
+func Test_error_in_map_expr()
+  if !has('terminal') || (has('win32') && has('gui_running'))
+    throw 'Skipped: cannot run Vim in a terminal window'
+  endif
+
+  let lines =<< trim [CODE]
+  func Func()
+    " fail to create list
+    let x = [
+  endfunc
+  nmap <expr> ! Func()
+  set updatetime=50
+  [CODE]
+  call writefile(lines, 'Xtest.vim')
+
+  let buf = term_start(GetVimCommandClean() .. ' -S Xtest.vim', {'term_rows': 8})
+  let job = term_getjob(buf)
+  call WaitForAssert({-> assert_notequal('', term_getline(buf, 8))})
+
+  " GC must not run during map-expr processing, which can make Vim crash.
+  call term_sendkeys(buf, '!')
+  call term_wait(buf, 100)
+  call term_sendkeys(buf, "\<CR>")
+  call term_wait(buf, 100)
+  call assert_equal('run', job_status(job))
+
+  call term_sendkeys(buf, ":qall!\<CR>")
+  call WaitFor({-> job_status(job) ==# 'dead'})
+  if has('unix')
+    call assert_equal('', job_info(job).termsig)
+  endif
+
+  call delete('Xtest.vim')
+  exe buf .. 'bwipe!'
+endfunc
diff --git a/src/testdir/test_timers.vim b/src/testdir/test_timers.vim
index 906613497f..de13bcbe89 100644
--- a/src/testdir/test_timers.vim
+++ b/src/testdir/test_timers.vim
@@ -333,4 +333,39 @@ func Test_nocatch_garbage_collect()
   delfunc FeedChar
 endfunc
 
+func Test_error_in_timer_callback()
+  if !has('terminal') || (has('win32') && has('gui_running'))
+    throw 'Skipped: cannot run Vim in a terminal window'
+  endif
+
+  let lines =<< trim [CODE]
+  func Func(timer)
+    " fail to create list
+    let x = [
+  endfunc
+  set updatetime=50
+  call timer_start(1, 'Func')
+  [CODE]
+  call writefile(lines, 'Xtest.vim')
+
+  let buf = term_start(GetVimCommandClean() .. ' -S Xtest.vim', {'term_rows': 8})
+  let job = term_getjob(buf)
+  call WaitForAssert({-> assert_notequal('', term_getline(buf, 8))})
+
+  " GC must not run during timer callback, which can make Vim crash.
+  call term_wait(buf, 100)
+  call term_sendkeys(buf, "\<CR>")
+  call term_wait(buf, 100)
+  call assert_equal('run', job_status(job))
+
+  call term_sendkeys(buf, ":qall!\<CR>")
+  call WaitFor({-> job_status(job) ==# 'dead'})
+  if has('unix')
+    call assert_equal('', job_info(job).termsig)
+  endif
+
+  call delete('Xtest.vim')
+  exe buf .. 'bwipe!'
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/testdir/test_vimscript.vim b/src/testdir/test_vimscript.vim
index 328d19fa5a..bf3e052ec9 100644
--- a/src/testdir/test_vimscript.vim
+++ b/src/testdir/test_vimscript.vim
@@ -1665,7 +1665,7 @@ func Test_refcount()
     delfunc DictFunc
 endfunc
 
-func! Test_funccall_garbage_collect()
+func Test_funccall_garbage_collect()
     func Func(x, ...)
         call add(a:x, a:000)
     endfunc
diff --git a/src/version.c b/src/version.c
index 5db753ca4c..c21c12c6d7 100644
--- a/src/version.c
+++ b/src/version.c
@@ -778,6 +778,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1591,
+/**/
     1590,
 /**/
     1589,