[vim/vim] winlayout, taglist: unlink GC-chained list/dict on append failure (PR #20743)

[mattn]

get_framelayout() (winlayout()) and add_llist_tags() (taglist()) release a list_alloc()'d list or dict_alloc()'d dict with vim_free() when the append fails. Those objects are linked into the garbage-collection chain, so vim_free() leaves a dangling pointer there, a latent crash during garbage collection. Use list_free() and dict_unref() so the object is unlinked.

related: #20668

---

You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/20743

Commit Summary

• 963f1c6 winlayout: use list_free() for GC-linked list on append failure
• ad31983 taglist: use dict_unref() not vim_free() on append failure

File Changes

(2 files)

• M src/evalwindow.c (4)
• M src/tag.c (2)

Patch Links:

• https://github.com/vim/vim/pull/20743.patch
• https://github.com/vim/vim/pull/20743.diff

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/20743@github.com>