Merge pull request #18301 from zeertzjq/fix-lua-unmap-crash

fix(mappings): fix double-free when unmapping simplifiable Lua mapping

src/nvim/getchar.c

@@ -3299,7 +3299,9 @@ int buf_do_map(int maptype, MapArguments *args, int mode, bool is_abbrev, buf_T
                   XFREE_CLEAR(mp->m_str);
                   XFREE_CLEAR(mp->m_orig_str);
                   XFREE_CLEAR(mp->m_desc);
+                  if (!mp->m_simplified) {
                     NLUA_CLEAR_REF(mp->m_luaref);
+                  }
 
                   mp->m_str = vim_strsave(rhs);
                   mp->m_orig_str = vim_strsave(orig_rhs);
@@ -3500,7 +3502,9 @@ static void mapblock_free(mapblock_T **mpp)
 
   mp = *mpp;
   xfree(mp->m_keys);
+  if (!mp->m_simplified) {
     NLUA_CLEAR_REF(mp->m_luaref);
+  }
   XFREE_CLEAR(mp->m_str);
   XFREE_CLEAR(mp->m_orig_str);
   XFREE_CLEAR(mp->m_desc);

test/functional/api/keymap_spec.lua

@@ -874,6 +874,27 @@ describe('nvim_set_keymap, nvim_del_keymap', function()
     eq('\nNo mapping found', helpers.exec_capture('nmap asdf'))
   end)
 
+  it('no double-free when unmapping simplifiable lua mappings', function()
+    eq(0, exec_lua [[
+      GlobalCount = 0
+      vim.api.nvim_set_keymap('n', '<C-I>', '', {callback = function() GlobalCount = GlobalCount + 1 end })
+      return GlobalCount
+    ]])
+
+    feed('<C-I>\n')
+
+    eq(1, exec_lua[[return GlobalCount]])
+
+    exec_lua [[
+      vim.api.nvim_del_keymap('n', '<C-I>')
+    ]]
+
+    feed('<C-I>\n')
+
+    eq(1, exec_lua[[return GlobalCount]])
+    eq('\nNo mapping found', helpers.exec_capture('nmap <C-I>'))
+  end)
+
   it('can set descriptions on keymaps', function()
     meths.set_keymap('n', 'lhs', 'rhs', {desc="map description"})
     eq(generate_mapargs('n', 'lhs', 'rhs', {desc="map description"}), get_mapargs('n', 'lhs'))
@@ -1040,4 +1061,25 @@ describe('nvim_buf_set_keymap, nvim_buf_del_keymap', function()
     eq(1, exec_lua[[return GlobalCount]])
     eq('\nNo mapping found', helpers.exec_capture('nmap asdf'))
   end)
+
+  it('no double-free when unmapping simplifiable lua mappings', function()
+    eq(0, exec_lua [[
+      GlobalCount = 0
+      vim.api.nvim_buf_set_keymap(0, 'n', '<C-I>', '', {callback = function() GlobalCount = GlobalCount + 1 end })
+      return GlobalCount
+    ]])
+
+    feed('<C-I>\n')
+
+    eq(1, exec_lua[[return GlobalCount]])
+
+    exec_lua [[
+      vim.api.nvim_buf_del_keymap(0, 'n', '<C-I>')
+    ]]
+
+    feed('<C-I>\n')
+
+    eq(1, exec_lua[[return GlobalCount]])
+    eq('\nNo mapping found', helpers.exec_capture('nmap <C-I>'))
+  end)
 end)