commit af8af8bfac5792fa64efbc524032d568cc7754f7
author Bram Moolenaar <Bram@vim.org> Mon Jan 04 22:05:24 2016 +0100
committer Bram Moolenaar <Bram@vim.org> Mon Jan 04 22:05:24 2016 +0100
tree 2d6bd98660f17197e6d630ccd2dc0be704e0dcd4
parent c71982b23978ef61d0a2f0fe5535e782e1c561ed

patch 7.4.1051
Problem:    Segfault when unletting "count".
Solution:   Check for readonly and locked first. (Dominique Pelle)
            Add a test.

src/eval.c

diff --git a/src/eval.c b/src/eval.c
index feaa71c..76dd653 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -3737,24 +3737,27 @@
     ht = find_var_ht(name, &varname);
     if (ht != NULL && *varname != NUL)
     {
-	if (ht == &globvarht)
-	    d = &globvardict;
-	else if (current_funccal != NULL
-				 && ht == &current_funccal->l_vars.dv_hashtab)
-	    d = &current_funccal->l_vars;
-	else
-	{
-	    di = find_var_in_ht(ht, *name, (char_u *)"", FALSE);
-	    d = di->di_tv.vval.v_dict;
-	}
 	hi = hash_find(ht, varname);
 	if (!HASHITEM_EMPTY(hi))
 	{
 	    di = HI2DI(hi);
 	    if (var_check_fixed(di->di_flags, name, FALSE)
-		    || var_check_ro(di->di_flags, name, FALSE)
-		    || tv_check_lock(d->dv_lock, name, FALSE))
+		    || var_check_ro(di->di_flags, name, FALSE))
 		return FAIL;
+
+	    if (ht == &globvarht)
+		d = &globvardict;
+	    else if (current_funccal != NULL
+				 && ht == &current_funccal->l_vars.dv_hashtab)
+		d = &current_funccal->l_vars;
+	    else
+	    {
+		di = find_var_in_ht(ht, *name, (char_u *)"", FALSE);
+		d = di->di_tv.vval.v_dict;
+	    }
+	    if (d == NULL || tv_check_lock(d->dv_lock, name, FALSE))
+		return FAIL;
+
 	    delete_var(ht, hi);
 	    return OK;
 	}