Commit: patch 9.2.0149: Vim9: segfault when unletting an imported variable

[Christian Brabandt]

patch 9.2.0149: Vim9: segfault when unletting an imported variable

Commit: https://github.com/vim/vim/commit/36971539936b31de44d0bc5a96c8a7b8a88c49b8
Author: Christian Brabandt <c...@256bit.org>
Date: Fri Mar 13 16:57:00 2026 +0000

patch 9.2.0149: Vim9: segfault when unletting an imported variable

Problem: do_unlet_var() unconditionally calls dictitem_remove() in its
final else branch, but for imported items lp->ll_dict is NULL,
causing a segfault (Peter Kenny)
Solution: Add a NULL check and return E1260 instead.

Affects :unlet at vim9script level and inside legacy :function.
The :def case already worked (handled in vim9cmds.c).

fixes: #19637
closes: #19657

Co-Authored-By: Claude Opus 4.6 <nor...@anthropic.com>
Signed-off-by: Yegappan Lakshmanan <yega...@yahoo.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/evalvars.c b/src/evalvars.c
index 9f0cc08c8..778e7152c 100644
--- a/src/evalvars.c
+++ b/src/evalvars.c
@@ -2150,9 +2150,14 @@ do_unlet_var(
else if (lp->ll_list != NULL)
// unlet a List item.
listitem_remove(lp->ll_list, lp->ll_li);
- else
+ else if (lp->ll_dict != NULL)
// unlet a Dictionary item.
dictitem_remove(lp->ll_dict, lp->ll_di, "unlet");
+ else
+ {
+ semsg(_(e_cannot_unlet_imported_item_str), lp->ll_name);
+ return FAIL;
+ }

return ret;
}
diff --git a/src/testdir/test_vim9_assign.vim b/src/testdir/test_vim9_assign.vim
index b915b666d..5043fad23 100644
--- a/src/testdir/test_vim9_assign.vim
+++ b/src/testdir/test_vim9_assign.vim
@@ -2869,6 +2869,26 @@ def Test_unlet()
END
v9.CheckScriptFailure(lines, 'E1260:', 1)

+ # unlet imported item at script level
+ lines =<< trim END
+ vim9script
+ import './XunletExport.vim' as exp
+ unlet exp.svar
+ END
+ v9.CheckScriptFailure(lines, 'E1260:', 3)
+
+ # unlet imported item in legacy function
+ lines =<< trim END
+ vim9script
+ import './XunletExport.vim' as exp
+ function F()
+ unlet exp.svar
+ endfunction
+ call F()
+ END
+ # error in line 1 of the F()
+ v9.CheckScriptFailure(lines, 'E1260:', 1)
+
$ENVVAR = 'foobar'
assert_equal('foobar', $ENVVAR)
unlet $ENVVAR
diff --git a/src/version.c b/src/version.c
index 063e0a2ed..762553cd5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 149,
/**/
148,
/**/