Problem: Writing a message with a large number of newlines
(:echo "foo\n"->repeat(1000000)) takes longer than it has to
(since c973c7ae).
Solution: Accumulate newlines in a single API call when possible.
Problem: LspNotify never passed a buffer when executing the autocmds, so
buffer-local LspNotify autocmd subscriptions didn't have the correct buf
in the event metadata. It was also wrapped in a schedule() so the actual
autocmd was delayed until after the event loop.
This could result in the wrong buffer receiving the notification if
multiple LspNotify autocmds with buffer filters were added. Only the
"latest" one would actually receive non-buffer-filtered autocmds, not
the matching one. It also caused listeners to receive the notification
"out of sync" with when the notification is actually sent. If a buffer
is being deleted (which fires a textDocument/didClose notification), the
notification is scheduled and fired after the buffer is already gone.
Solution: For LSP notifications that pertain to a particular buffer, set
it when executing the LspNotify autocmds so the callback functions that
are filtered on that buffer will get the correct notifications and the
metadata buf field will be correct. Additionally, there is no need to
wrap the LspNotify callback in vim.schedule when it can be called inline
when the notification to the rpc server is fired.
This is tested by removing now-unnecessary autocmds from semantic tokens
(InsertEnter and BufWinEnter should no longer be necessary now that
requests are fired by LspNotify). Without this fix, simply modifying a
buffer doesn't actually trigger LspNotify correctly, and the test for
that fails.
Problem: When multiline semantic token support was introduced, the loop
that finds the end line for a particular token didn't sanitize the token
length sent back by the LSP server. If the server returned an overflowed
length (near uint32 max), neovim would burn cpu and loop for an
extremely long time while trying to find the "end line" represented by
the massively large token, causing neovim to seemingly hang.
Solution: Stop looping once the calculated end_line reaches the actual
last line of the buffer.
Fixes#36257
Problem:
- Current 'statuscolumn' click label caveat is restrictive.
- v:virtnum is not unique to a line if it has both above and
below virtual lines.
- 'statuscolumn' click handler may expect v:virt/lnum to be set.
Solution:
- Store per-row click definitions for the statuscolumn in a
(nested line/virt number) map.
- Implement strategy that gives each 'statuscolumn' row a unique
v:virtnum.
- Set v:virt/lnum when determining which line is clicked.
vim-patch:9.2.0654: GTK4: using uninitialised colors in gui_mch_init()
vim-patch:9.2.0655: GTK4: missing NULL checks in vim_form_measure()
vim-patch:9.2.0657: GTK4: missing menu when right-clicking in tabline
vim-patch:9.2.0658: xxd: signed integer overflow in huntype()
vim-patch:9.2.0659: GTK4: no balloon support in GUI
vim-patch:9.2.0660: Dragging the scrollbar does not trigger WinScrolled
vim-patch:9.2.0665: GTK4: GTK critical error on exit printed
vim-patch:9.2.0667: patch 9.2.0590 was wrong
vim-patch:9.2.0668: GTK4: minimum horizontal size is too small
vim-patch:60899596a runtime(doc): Regenerate help tags file
vim-patch:9.2.0671: [security]: possible out-of-bounds read with sodium encrypted files
vim-patch:9.2.0672: corrupted text property causes internal error
vim-patch:9.2.0674: configure: clears dynamic ruby linker flags
vim-patch:9.2.0196: textprop: negative IDs and can cause a crash
vim-patch:9.2.0207: MS-Windows: freeze on second :hardcopy
vim-patch:9.2.0218: visual selection highlighting in X11 GUI is wrong.
vim-patch:9.2.0406: VisualNOS not used when Wayland selection ownership lost
This was initially added so that the __NVIM_DETACH environment variable
can be added to the jobs started in this test. That environment variable
is no longer needed, and there is also vim.tbl_extend() that can be used
to add an environment variable to a job anyway.
Also, make a shallow copy of opts.env in setup_child_nvim(), as mutating
the opts.env passed in may mask problems in other tests.
Problem: A wrapped command line and screen width may be redrawn
repeatedly after calls to `redrawstatus` from lua.
Solution: redrawcmd() redraws the command line, but msg_clr_eos() may
invalidate cmdline_was_last_drawn during the redraw process.
Restore cmdline_was_last_drawn when redrawcmd() completes.
Co-authored-by: Sam Reynoso <sam@codeoutpost.com>
Co-authored-by: Luuk van Baal <luukvbaal@gmail.com>
Problem: linked_editing_range was still doing most of the capability
boilerplate itself.
Solution: refactor it to make use of the common Capability framework for
handling enabling, disabling, etc.
Problem: tests: Test_cd_from_non_existing_dir() fails on Solaris
Solution: Skip the test on Solaris (Vladimír Marek).
Test_cd_from_non_existing_dir() depends on deleting the current working
directory. Solaris does not allow that, so skip the test there.
closes: vim/vim#20563b464c36bf9
Co-authored-by: Vladimír Marek <vlmarek13@gmail.com>
Patch 9.2.0306 fixed malformed lz4 extraction commands by using "tar -I lz4"
on Linux and leaving non-Linux tar implementations to auto-detect lz4 input.
That still fails on systems where tar does not support either -I lz4 or
automatic lz4 decompression, such as Solaris /usr/bin/tar.
Keep the existing Linux path using GNU tar's "-I lz4" support. For non-Linux
systems, use lz4 explicitly to decompress the archive to stdout and feed the
resulting tar stream to the configured tar extraction command. This is the
same style tar.vim already used for lz4 archives before patch 9.2.0306.
Follow-up for vim/vim#19925closes: vim/vim#20555b0ce576fbc
Co-authored-by: Vladimír Marek <vlmarek13@gmail.com>
Problem: tests: Test_recover_corrupted_swap_file() cannot handle
symlinks
Solution: Use writefile(readblob()) instead (Vladimír Marek)
Test_recover_corrupted_swap_file1() copies prebuilt corrupt swap samples
before recovering them. In an out-of-source-tree build those sample
files may be symlinks into the source tree. filecopy() preserves
symlinks, so the copied target may remain a symlink. Recovery opens
swap files with O_NOFOLLOW, so that copied symlink cannot be opened.
Read the sample as a blob and write it back so the recovery target is a
real swap file.
closes: vim/vim#2056188cbd00312
Co-authored-by: Vladimír Marek <vlmarek13@gmail.com>
Problem: On MS-Windows it is not possible to switch to a buffer by name
with ":b" (including via command-line completion) when the
buffer name contains '%'.
Solution: Do not escape '%' and '#' for the ":buffer" command on
MS-Windows. Since ":buffer" has no EX_XFILE these are not
expanded, and escaping them as "\%"/"\#" makes buffer name
matching fail when '%'/'#' is in 'isfname' (the backslash is
treated as a path separator).
fixes: vim/vim#20529closes: vim/vim#205481a96e07bf6
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: Crash with TextPut autocmd when pasting in normal mode in a
terminal buffer.
Solution: Skip the TextPut autocmds when reg and insert are both NULL
and regname is not '.' (Foxe Chen).
closes: vim/vim#204072e7833bde9
Co-authored-by: Foxe Chen <chen.foxe@gmail.com>
Problem:
:Man does not syntax highlight codeblocks (injected language).
Analysis:
init_pager() swapped pcall(parse_ref, ref) return values order, so
vim.b.man_sect was set to the manpage name instead of the section
number, so C syntax highlighting did not load.
Solution:
Swap the calls.
Problem:
- Transient mutation of the parent env is visible to any concurrent
code. Or at least just kinda sloppy.
- Latent bug:`channel_job_start` queues the spawn and returns before
`uv_spawn` runs, so the prior `os_unsetenv` immediately after the call
could in principle race with the deferred spawn.
Solution:
Pass `env` to the channel.
Today there is a constraint that these arguments to the enable filter be
mutually exclusive, but I do not know why such a constraint exists (it
is perfectly reasonable to want to enable a capabilility for just one
buffer and just one client).
Problem: [security]: s:NetrwLocalRmFile() escapes only the backslash in
the file name before passing it to :execute, so a name
containing "|" injects arbitrary Ex commands when the file is
deleted (cipher-creator)
Solution: Use fnameescape() to correctly escape the file name
(Yasuhiro Matsumoto).
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh
Supported by AI
55bc757a5d
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem: [security]: a crafted spell file with a self-referential
BY_INDEX node in the prefix tree can drive dump_prefixes()
past the end of its MAXWLEN-sized depth arrays on :spelldump
(cipher-creator)
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
walkers already do (Yasuhiro Matsumoto)
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h
Supported by AI
8325b193bb
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem: When defining a dictionary function, the function name string
is allocated with vim_strnsave() but the result is not
checked. On allocation failure the dict entry is left with
type VAR_FUNC and a NULL name, and in the overwrite case the
previous entry has already been freed before the NULL is
stored.
Solution: Allocate the name before modifying the dict entry and bail out
on failure, freeing it on all error paths (thinca)
closes: vim/vim#203762b2dfc4f5a
Co-authored-by: thinca <thinca@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Problem: ins_compl_equal_sc() uses MB_TOLOWER() on single bytes, but
it indexes raw bytes, not decoded characters (after v9.1.0651).
Solution: Use TOLOWER_LOC(), matching what STRNICMP()/ins_compl_equal()
does (glephunter).
closes: vim/vim#205359f5d32cf5c
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: With 'longest', 'smartcase' is ignored when filtering matches:
"inp" offers only "InputEvent", and an uppercase pattern gives
different results for CTRL-N and CTRL-P.
Solution: 'longest' rewrites the leader with the common prefix, picking
up uppercase the user never typed. Judge case from the typed
text instead, and match the auto-inserted part of the leader
case-insensitively so CTRL-N and CTRL-P give the same result.
(glepnir)
related: neovim/neovim#40259
closes: vim/vim#2053350fe45aca7
Co-authored-by: glepnir <glephunter@gmail.com>
Problem:
Can't open swapfile when using a device path starting with `//?/`,
because `?` is a reserved char on Widnows.
Solution:
For device UNC paths, replace `//?/UNC/` and `//./UNC/` with `//`.
For other device paths, just strip their prefix (i.e. `//?/`, `//./`).
This aligns swapfile naming for device paths with regular UNC and DOS
paths.
Co-authored-by: Justin M. Keyes <justinkz@gmail.com>
All wasm parsers shared a single global TSWasmStore via
ts_parser_set_wasm_store(). A TSWasmStore is owned by exactly one parser:
ts_parser_delete() frees it through ts_wasm_store_delete(). So the first
wasm parser collected freed the shared store, leaving the global pointer
dangling, and creating the next wasm parser dereferenced freed memory in
ts_wasm_store_reset() -> wasmtime_store_context(), crashing with SIGSEGV.
Give each parser its own store via ts_wasm_store_new() instead. This is
the 1:1 store-per-parser model intended by tree-sitter (see
tree-sitter/tree-sitter#3454): the global store remains only as the
language loader, ts_parser_delete() cleanly frees each parser's own
store, and the wasm engine is shared safely because ts_wasm_store_new()
clones its engine reference internally.
AI-assisted: Claude Code
Problem:
A colored (guisp) underline showing through a 'winblend' float
lost its special color and followed the foreground instead.
Solution:
In the blend-through case, blend the underline's special color
only when the cell below sets sp explicitly; otherwise clear it.
Problem: Coverity complains about Null pointer dereferences
Solution: before accessing ccline->cmdbuff check that ccline is not NULL
Fixes: Coverity issue 1646601
closes: vim/vim#17189362be6ba27
Co-authored-by: Christian Brabandt <cb@256bit.org>
vim-patch:9.2.0641: GTK4: crash in gui_mch_menu_hidden()
vim-patch:47bb4bed4 editorconfig: don't change spaces to tabs in git commit message
vim-patch:9.2.0644: popup image: duplicate sync-output code
vim-patch:9.2.0646: GTK3 GUI slow on HiDPI/4K with software rendering
vim-patch:9.2.0650: Vim aborts at startup when built with the example -O2 CFLAGS
vim-patch:9.2.0652: popup: stale kitty image after clipwindow scrolls out of view
vim-patch:9.0.1865: Vim9: garbage collection may cause crash
vim-patch:9.1.0481: Vim9: term_getjob() throws an exception on error
vim-patch:9.1.0625: tests: test output all translated messages for all translations
vim-patch:9.1.0682: Vim9: Segfault with uninitialized funcref
vim-patch:9.1.1225: extra NULL check in VIM_CLEAR()
vim-patch:9.1.1696: tabnr from getwininfo() for popup windows is always 0
vim-patch:9.1.2113: potential NULL pointer dereference issues
vim-patch:9.2.0648: MS-Windows: Compile warnings
Problem: [security]: a crafted spell file can drive tree_count_words()
past the end of its MAXWLEN-sized depth arrays; the descent
loop has no depth bound.
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
walkers already do; apply the same guard to sug_filltree().
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
Supported by AI.
a80874d9b8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: Coverity warns for using a NULL pointer.
Solution: Check for memory allocaion failure.
96cbbe29de
Co-authored-by: Bram Moolenaar <Bram@vim.org>
This commit makes processing the erlangOperator and erlangBitType syntax
items faster.
- erlangOperator changes:
- Vim now parses erlangOperator faster because we define the operators
individually.
- The order of operators in erlangOperator had to be changed to make
the edge cases work the same as before (for example
erlangEqualsBinary).
- erlangBitType changes:
- Vim now parses erlangBitType faster because:
1. Now the long `\%(integer\|float\|...\)` sections are preceded by
"beginning of word" patterns (`\<`).
2. Now we use the old regexp engine (`\%#=1`).
Previously when an Erlang file contained long lines with erlangOperator
or erlangBitType patterns near the end, redrawing these lines was slow,
and typing at the end of the line was also slow.
For example, redrawing a 1787 characters long test line is now roughly
six times faster.
fixes: vim/vim#5593closes: vim/vim#20524c6705b2c3e
Co-authored-by: Csaba Hoch <csaba.hoch@gmail.com>
