Re: Crash with undotree() function

[Lech Lorens]

On 24-Aug-2010 Christian Brabandt <cbli...@256bit.org> wrote:
> Hi,
> I have been playing with the undotree() function lately. Unfortunately, 
> it didn't take long, until it crashed :(
> 
> Here is a way to reproduce it:
> 
> chrisbra t41:~/vim [1016]% vim -u NONE -N -c ':echo undotree().entries'
> Vim: Caught deadly signal ABRT
> 
> Vim: Finished.
> zsh: abort      vim -u NONE -N

This happens due to a double free(). The attached patch fixes the
problem. I'll prepare a test for this.

-- 
Cheers,
Lech

-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

diff --git a/src/eval.c b/src/eval.c
index fc01006..3e874b0 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -7097,6 +7097,7 @@ dict_add_list(d, key, list)
 	dictitem_free(item);
 	return FAIL;
     }
+    ++list->lv_refcount;
     return OK;
 }