patch 8.2.2325: Vim9: crash if map() changes the item type
Problem: Vim9: crash if map() changes the item type.
Solution: Check that the item type is still OK. (closes #7652)
Fix problem with mapnew() on range list.
diff --git a/src/vim9compile.c b/src/vim9compile.c
index 94f30d4..bcbc57d 100644
--- a/src/vim9compile.c
+++ b/src/vim9compile.c
@@ -1592,6 +1592,7 @@
garray_T *stack = &cctx->ctx_type_stack;
int argoff;
type_T **argtypes = NULL;
+ type_T *maptype = NULL;
RETURN_OK_IF_SKIP(cctx);
argoff = check_internal_func(func_idx, argcount);
@@ -1612,6 +1613,8 @@
argtypes = ((type_T **)stack->ga_data) + stack->ga_len - argcount;
if (internal_func_check_arg_types(argtypes, func_idx, argcount) == FAIL)
return FAIL;
+ if (internal_func_is_map(func_idx))
+ maptype = *argtypes;
}
if ((isn = generate_instr(cctx, ISN_BCALL)) == NULL)
@@ -1627,6 +1630,11 @@
internal_func_ret_type(func_idx, argcount, argtypes);
++stack->ga_len;
+ if (maptype != NULL && maptype->tt_member != NULL
+ && maptype->tt_member != &t_any)
+ // Check that map() didn't change the item types.
+ generate_TYPECHECK(cctx, maptype, -1);
+
return OK;
}