Problem:
`get_scrolloffpad_value()` takes a window, but its else branch reads
`curwin->w_p_sop` instead of `wp->w_p_sop`.
Reachable from Vimscript, since `line('w0', winid)` runs
`update_topline()` on another window without making it current.
Solution:
Read the option from the window that was passed in.
AI-assisted
Problem:
Freeing an unrelated buffer deletes the cursor under the primary.
Scratch-buffer cleanup triggers this unexpectedly.
Solution:
Separate dead-cursor cleanup from dedupe/merge. Merge overlapping
cursors only at cascade boundaries, not during buffer/namespace cleanup
or cursor removal.
Problem:
Input (`getchar()`, `input()`, …) consumed by an expr mapping EVALUATION
can leak into `CmdAtom.keys`, depending on count placement ("2dse" vs
"d2se").
Solution:
Skip payload capture while `expr_map_lock` is active.
- Input read during expr EVALUATION is recorded in `CmdAtom.lhs`.
- Only input read by mapping EXECUTION is appended to `CmdAtom.keys`.
Problem:
Pending mapping atoms prevent live insert-cascading (`nnoremap i ^i`).
Flushing them at insert-session start (3a02a39957) adds a separate
cascade boundary, which muddles the architecture.
Solution:
Let the first insert-span cascade pending mapping atoms on insert-entry.
This is an alternative fix for #41692.
Composite children (`.atoms`) BEFORE:
{ { 'motion', '^' }, { 'insert', '1iX<Esc>' } }
Composite children (`.atoms`) AFTER:
{ { 'motion', '^' }, { 'insert', '1i<Esc>' }, { 'insert', 'iX<Esc>' } }
Problem:
Both handle lookups write into the same `Error` before either one is
checked, and `api_set_error()` unconditionally `xmalloc`s `err->msg`
without freeing what is already there. When both handles are invalid,
the message allocated for the window is silently overwritten by the one
for the buffer and leaked.
Solution:
Check the window before looking up the buffer. As a side effect the
reported error no longer names the buffer when the window was wrong too.
AI-assisted
Problem:
A Normal-mode mapping that moves before entering Insert, does not
live-mirror. Its pending motion defers insert-cascade until Insert ends.
Solution:
Cascade pending atoms before the Insert entry replay, then start the
live insert span.
Problem:
The "spill" indicator that ui2 appends when messages overflow the
available height is drawn with whatever highlight the message tail
happens to have, so it is indistinguishable from the message text.
Solution:
Give the [+x] chunks an explicit `MoreMsg` highlight, and only fall back
to the message tail highlight for chunks that don't carry one of their
own.
AI-assisted
Problem:
Changing from an empty-line cursor after a multicursor jump can crash
while flushing a deferred clipboard update. Exact context restore can
leave an omitted register with a null array and stale non-zero size.
Solution:
Make free_register() fully reset the register after freeing its contents,
so it always leaves a valid empty register. Add a regression test.
Signed-off-by: sami <samiulsami7786@gmail.com>
Problem:
`unpack_string()` validates the declared length against `*size`, the
size *before* `mpack_rtoken()` consumed the token header, rather than
`size2`, the remainder after it. The header is one to five bytes, so any
declared length in the window `(size2, *size]` slips through. The
returned `String` then covers up to five bytes past the end of the
buffer, and `size2 - tok.length` underflows, leaving `*size` near
`SIZE_MAX` so every later unpack call on that entry believes it has an
unbounded buffer.
Reachable from ShaDa, where a history entry ending in a five-byte string
header followed by four bytes is enough, so a corrupted or hostile
`main.shada` triggers it at startup.
Solution:
Check the remainder left after the header.
AI-assisted
Problem:
The early return for an invalid window handle bypasses the
`set_destroy()` at the end of the block, so the set's backing allocation
leaks whenever an earlier iteration already called `set_put()`.
Triggered by `{ wins = { valid_win, 9999 } }`.
Solution:
Destroy the set before returning.
The new test passes either way, since the leak is only visible to a
sanitizer; it is there so the ASAN job covers the path.
AI-assisted
Problem:
`find_window_by_handle()` returns NULL only after `VALIDATE_INT` has
already set `err`, so the `api_set_error()` that followed allocated a
second message over the first pointer and leaked it.
Solution:
Drop the redundant call and keep the helper's message, which is already
set and better worded.
AI-assisted
Problem:
The ui2 dialog implements paging for the arrow keys, Home/End and the
page keys, but not for the mouse wheel. When `mouse` contains `"c"`,
turning the wheel does nothing at all.
Solution:
Handle <ScrollWheelUp>/<ScrollWheelDown>, scrolling by the `mousescroll`
`"ver"` amount.
AI-assisted
Problem:
`menu_mode_chars` includes the two-character `"tl"` value. The hardcoded
`1` is the `key_len` argument of `tv_dict_add_dict()`, which truncated
it to `"t"`, the designator for a tooltip. Scripts keying on the
documented mode designators therefore miss terminal mode entries and
misread them as tooltips.
Solution:
Pass the real length of the designator.
AI-assisted
Problem:
`REMAP_NONE` is -1 and `REMAP_SCRIPT` is -2. These are enumerated
values, not bit flags, so `&` is the wrong operator: `x & -1` is `x`,
and `-1 & -2` is -2, which is truthy. Both kinds of non-remapping menu
therefore reported `noremap` and `sid` as 1 and became
indistinguishable.
The sibling `menu_get_info()` already compares with `==`.
Solution:
Compare rather than mask.
The expectations in menu_spec.lua had the
conflated values baked in, so 22 entries from plain `*noremenu` commands
now report `sid = 0`, and the two from `nnoremenu <script> Export.Script`
now report `noremap = 0`.
AI-assisted
Problem:
The loop frees `fuzmatch[count].str` on every iteration instead of
`fuzmatch[i].str`.
The function has no callers in Nvim, so there is no impact today. The
indexing is a slip from the port; Vim's implementation is correct.
Solution:
Index with the loop variable, as Vim does.
AI-assisted
Problem: The `macos-14` image is deprecated and will be removed in
November 2026 (and have scheduled brownouts during October 2026).
Solution: Bump the image to `macos-15`, which is the oldest supported
version on GHA.
Problem: The 3rd-party default homebrew tap `aws/tap` is untrusted,
which now triggers a warning in our macOS workflows.
Solution: "Untap" (disable) the tap (which we don't use).
Problem: Support for Intel macOS is increasingly being dropped since
Apple itself retired the architecture (with macOS 27 already being
ARM-only). In particular, homebrew is already dropping support, with
some 3rd-party taps like `hashicorp/tap/vagrant` (that are enabled on GH
runners by default) no longer being available. This makes `brew upgrade`
fail on Intel.
Solution: Skip `brew upgrade` in `install_deps.sh`, as we don't rely on
the bleeding edge version of the installed dependencies. This skips
checking the tap (which we don't use) and hence lets the workflows pass.
(It also shaves of some seconds from the CI time.)
Note: This is strictly speaking a GHA issue and should be handled by
adapting the runner images; but since GHA has already announced that
they will drop all Intel macOS images in 2027, this is unlikely to
happen.
It also means that this is a stopgap solution to allow 0.13 to keep Tier
1 support for Intel macOS, but next year we'll have to drop support as
well.
Problem:
`]C` jumps the primary onto another cursor, which dedupes at the next
edit. Every `]C` consumes a cursor.
Solution:
`]C` adds a cursor at the current position before jumping. This
effectively "rotates" the primary cursor.
Problem:
A non-edit mapping that moves the cursor by API (Lua,
`:call nvim_win_set_cursor()`, …) is not cascaded.
Solution:
Fallback to LHS-replay if the cursor moved and follow-mode is enabled.
Problem:
`scroll_cursor_halfway()` resets its `above` and `below` row counters on
every iteration of the `topline` scan, because they are declared inside
the loop. Each iteration then takes one line from each side regardless
of how many screen rows those lines occupy, so tall wrapped lines below
the cursor leave it near the top of the window instead of centered.
Affects the default `nosmoothscroll` path, reached from "zz" and from
`update_topline()`. Regression from 9b9ccac625 (vim-patch:9.0.1121),
which moved the declarations to their first use while porting; the
upstream patch did not touch them.
Solution:
Declare the counters at function scope, as Vim does, so they accumulate
across iterations.
Problem:
"v{motion}<Esc>" moves the primary cursor to the selection end, but the
other cursors snap back to their anchors unless follow-mode ("q=") is
on. The selection preview showed them at the selection end.
Solution:
Replay the abandoned selection at every cursor, not only in follow-mode.
An abandoned typed selection now always emits a "visual" CmdAtom.
Problem: Nvim has many Lua APIs that start callback-driven work: timers,
jobs, libuv handles, and other event-loop tasks. Callers that need to
sequence or cancel that work have to build their own coroutine wrappers,
task bookkeeping, and cleanup rules. This makes async control flow hard
to share, test, and document.
Solution: Add `vim.async`, a structured-concurrency module vendored from
async.nvim. It provides task handles, await/pawait helpers,
sleep/timeout helpers, completion-order iteration, and semaphores on top
of Nvim's event loop.
The API follows the same broad model as Trio: async work has an owner,
tasks are awaited explicitly, and cancellation is cooperative. Include
generated vimdoc with an introductory overview and examples, a news
entry, and functional tests for the new module.
AI-assisted
Problem:
'guicursor' is not respected when extra cursors exist.
Per-cursor selection toggles Visual off, and the sandbox restores it
only after restore_current_state(), whose ui_cursor_shape() caches the
Normal shape.
Solution:
Restore Visual before restore_current_state().
Problem: there should be exactly one cell of padding between sections,
and exactly one cell of minimum padding between the left and the right.
- Spaces between sections waste space when a section is empty.
According to a comment in #33036, this was the reason to avoid `%k`
and implement the keymap section with a vim expression, but other
sections still have this problem.
- The diagnostics section wastes space because it is not entirely empty
when there are diagnostics in another buffer.
- The terminal exit code section can touch the right side, e.g. the
ruler, even though it belongs to the left side.
Solution:
- Use auto-hiding item groups (`%(` without width fields) to get rid of
unneeded spaces when a section shows no information.
This simplifies the 'showcmd' and 'keymap' sections in particular.
- As a slight simplification, `term_exitcode` is moved into the flags
section since it is formatted with square brackets like a flag.
- Count the diagnostics for the current buffer specifically.
- Ensure at least one cell of padding between the left and the right
side by adding a space next to the separator `%=`.
Problem: some sections are implemented with `%{%`, even though
reevaluation of the expression result is not needed.
This leads to otherwise needless %-escaping in `progress_status`.
Solution: use `%{` instead.
Problem: `%{` and `%{%` (without items) replace spaces with fillchars.
This looks out-of-place inside the terminal exit code section, and in
contrast to all other sections, the 'busy' section is surrounded by
fillchars, which looks inconsistent, and with some terminal-font
combinations, ◐ overlaps the fillchar, e.g. Alacritty & JetBrains Mono.
Solution: use non-breaking spaces U+202F to avoid fillchar substitution.
Problem: sections that appear/disappear frequently can make otherwise
more stable sections jump around a lot.
Solution: sort the sections on the right roughly by volatility:
'showcmd' in first place, 'keymap' next to the ruler.
Problem:
`shada_read()` rebuilds `v:oldfiles` for any "forced" read, which first
*clears* the list. For an in-memory caller such as multicursor, the list
is never repopulated. So `v:oldfiles` is empty after `Q` + edit.
Solution:
Rebuild `v:oldfiles` only when `kShaDaGetOldfiles` is requested.
`shada_read_everything()` (`:rshada[!]`, startup) always requests it.
old bug from 411a06c8b6
Problem:
During 'autocomplete', a completion-ending `<BS>` restarts completion
immediately. Multicursor insert-cascade skips replay (`edit()` refuses
to nest if compl/pum is active), so the mcursors do not update until
ESC.
Solution:
Flush pending keys in `TRIGGER_AUTOCOMPLETE`, just before autocomplete
restarts again.
Problem:
Insert entered by a Visual-mode operator mapping (`xnoremap c c`) does
not live-mirror at cursors.
Solution:
Decide `typed` from the Visual session's own provenance (`vatom`, which
spans the selection and knows whether it was user input) instead of only
negating it.
Problem:
`parse_ssh_config()` compares tables against a freshly allocated empty
table.
- In `parse_multiple_values()`, the guard which avoids flushing an empty
accumulator never applies. Runs of separators and trailing whitespace
push empty strings into the results, and `is_valid()` does not filter
them. `Host alpha beta ` parses as `{ 'alpha', '', 'beta' }`.
- In `parse_value()`, the condition reduces to `chr == '"' and quoted`.
`quoted` starts false and only that branch sets it, so it can never
become true: quotes are never recognised and are inserted literally,
and the unterminated-quote check is unreachable.
Solution:
Compare `#val` instead. Add a test for repeated and trailing separators.
AI-assisted
Problem: Drawing 'statuscolumn' leads to a heap-buffer-overflow if a
sign/number column comes after many items.
Solution: Avoid curitem >= stl_items_len when writing to stl_items.
Problem:
`IterArray:take()` iterates up to `self._tail`, but `_tail` is
exclusive. When no element fails the predicate, the loop reads one index
past the last element and calls the predicate with `nil`.
Solution:
Stop at `self._tail - inc`, which is the last in-range index for both
iteration directions. Add tests using a predicate which dereferences its
argument and matches every element, forward and reversed.
AI-assisted
Problem: While advancing the syntax highlighting, store_current_state()
calls syn_stack_find_entry() about once per parsed line, and
that function rescans the state-cache list from its head every
time. With the list capped at 1000 entries this linear rescan
dominates the cost of highlighting a large file.
Solution: Keep a cached position to the entry last located in the list
and resume the scan from it when it is at or before the wanted
line, advancing the finger as new states are stored
(Julien Voisin).
The list is sorted by line number, so when the remembered entry is at or
before the wanted line the answer can only follow it, never precede it;
resuming from there returns the same entry as a scan from the head. The
"at or before" guard keeps this correct for any lookup order: a backward
or random-access lookup whose remembered entry is past the wanted line
falls back to a full scan. The pointer is cleared whenever an entry is
freed, the array is reallocated or the block is freed, so it cannot
dangle.
Parsing the syntax of a 20000-line C file is about a third faster, a
5000-line file about a quarter faster, benchmarked via something like
this:
```
call synID(1, 1, 1) " warm-up
let s = reltime()
for l in range(1, line('$')) | call synID(l, 1, 1) | endfor
call writefile([reltimefloat(reltime(s))], $T)
```
closes: vim/vim#21166f1b4549129
Co-authored-by: Julien Voisin <julien.voisin@dustri.org>
Problem: NFA regexp matching is slower than necessary for ASCII text
because two indirect function calls are made for every
character.
Solution: Add an inline fast path for an ASCII byte that is not followed
by a composing character (Julien Voisin).
The main loop of nfa_regmatch() fetched the current character and its
byte length with two calls through the mb_ptr2char and mb_ptr2len
function pointers on every character. These pointers cannot be inlined,
yet for ASCII text, which is the common case, both merely return the byte
and a length of one.
Handle that case inline. NUL is checked first so that reading the next
byte cannot go past the end of the line, and the "next byte is ASCII"
condition matches the check in utfc_ptr2len(), so a base character
followed by a composing character still falls through to the original
calls.
A "perf stat -e instructions" on a full scroll of a 60000 line C file with
syntax highlighting enabled shows an instructions count reduction of 4%.
closes: vim/vim#2117958390ca285
Co-authored-by: Julien Voisin <julien.voisin@dustri.org>
Problem: Cursor correction can move the cursor up at the end of the
buffer when 'scrolloffpad' is enabled (gx089).
Solution: Allow missing context below EOF in cursor_correct(). Add
regression tests for CTRL-D and CTRL-E (Seunghee Kim).
fixes: vim/vim#21096
closes: vim/vim#211886a3db67a52
Co-authored-by: SeungheeKim <ksh368@naver.com>
comment,editorconfig plugins in Vim's runtime/pack/, are N/A.
Editorconfig is unrelated but Vim did not fix the bundled version
from editorconfig-vim and did not port the upstream fix.
0d54ea8630
Global variables with "_for_testing" suffix are modified
in "f_test_override()", N/A to Nvim.
If a test needs them, then port the relevant code outside
"f_test_override()" via LuaJIT C FFI.
Problem:
`inspect_tree()` documents `title` as
`string|fun(bufnr:integer):string|nil`, but the implementation handles
only `nil` and function values. A string title leaves `title` unset and
fails the assertion below.
Solution:
Use the string as the title.
Problem:
An explicitly passed `range` to `vim.lsp.buf.format()` in linewise
visual mode is silently replaced by the selection.
Solution:
Parenthesise the mode check.
Problem:
The `textDocument/documentLink` handler resolves the confirmation buffer
from the request URI and checks it for `nil`, then reads lines from
buffer `0`. When the confirmation buffer is not current, links are
computed from unrelated text and returned against the confirmation
buffer's line numbers, producing missing or misplaced links.
Solution:
Read lines from the resolved `bufnr`.
AI-assisted
