thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 8.2.2325: Vim9: crash if map() changes the item type

Browse Source 
Problem:    Vim9: crash if map() changes the item type.
Solution:   Check that the item type is still OK. (closes #7652)
            Fix problem with mapnew() on range list.
This commit is contained in:
Bram Moolenaar
2021-01-10 22:42:50 +01:00
parent 6f02b00bb0
commit 75ab91ff34
8 changed files with 50 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/vim9compile.c
View File

@@ -1592,6 +1592,7 @@ generate_BCALL(cctx_T *cctx, int func_idx, int argcount, int method_call)
garray_T *stack = &cctx->ctx_type_stack;
int argoff;
type_T **argtypes = NULL;
type_T *maptype = NULL;
RETURN_OK_IF_SKIP(cctx);
argoff = check_internal_func(func_idx, argcount);
@@ -1612,6 +1613,8 @@ generate_BCALL(cctx_T *cctx, int func_idx, int argcount, int method_call)
argtypes = ((type_T **)stack->ga_data) + stack->ga_len - argcount;
if (internal_func_check_arg_types(argtypes, func_idx, argcount) == FAIL)
return FAIL;
if (internal_func_is_map(func_idx))
maptype = *argtypes;
}
if ((isn = generate_instr(cctx, ISN_BCALL)) == NULL)
@@ -1627,6 +1630,11 @@ generate_BCALL(cctx_T *cctx, int func_idx, int argcount, int method_call)
internal_func_ret_type(func_idx, argcount, argtypes);
++stack->ga_len;
if (maptype != NULL && maptype->tt_member != NULL
&& maptype->tt_member != &t_any)
// Check that map() didn't change the item types.
generate_TYPECHECK(cctx, maptype, -1);
return OK;
}