From 885971e2f5eabc4108e083086c1d6d0a31a2782f Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Sun, 18 Jul 2021 22:25:29 +0200 Subject: patch 8.2.3182: Vim9: crash when using removing items from a constant list Problem: Vim9: crash when using removing items from a constant list. (Yegappan Lakshmanan) Solution: When a list was allocated with items copy them. --- src/list.c | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-) (limited to 'src/list.c') diff --git a/src/list.c b/src/list.c index d138d868cd..417f735e0d 100644 --- a/src/list.c +++ b/src/list.c @@ -1566,12 +1566,32 @@ list_remove(typval_T *argvars, typval_T *rettv, char_u *arg_errmsg) vimlist_remove(l, item, item2); if (rettv_list_alloc(rettv) == OK) { - l = rettv->vval.v_list; - l->lv_first = item; - l->lv_u.mat.lv_last = item2; - item->li_prev = NULL; - item2->li_next = NULL; - l->lv_len = cnt; + list_T *rl = rettv->vval.v_list; + + if (l->lv_with_items > 0) + { + // need to copy the list items and move the value + while (item != NULL) + { + li = listitem_alloc(); + if (li == NULL) + return; + li->li_tv = item->li_tv; + init_tv(&item->li_tv); + list_append(rl, li); + if (item == item2) + break; + item = item->li_next; + } + } + else + { + rl->lv_first = item; + rl->lv_u.mat.lv_last = item2; + item->li_prev = NULL; + item2->li_next = NULL; + rl->lv_len = cnt; + } } } } -- cgit v1.2.3