Problem:
Various out-of-bounds writes inherited from vim (examples assume MAXPATHL==4096):
- truncated item groups where minwid>maxwid:
nvim --clean +"set stl=%<%{%repeat('x',4096-11)%}%50.5(12🙂345%)"
leads to fillchars spilling over the end of the group/buffer while trying to
compensate for truncating at a multicell character because minwid<=maxwid is assumed
- left-aligned item groups with multi-byte fillchar:
nvim --clean +"set fillchars+=stl:∙ stl=%<%{%repeat('x',4096-3)%}%-2(X%)"
wrongly leads to padding at the end of the statusline and `out_p-out==4097`
because the bounds check assumes a 1-byte fillchar
- right-aligned item groups with 1-byte fillchar:
nvim --clean +"set stl=%<%{%repeat('x',4096-4)%}%4(XY%)"
leads to "YX" instead of "XY" at the end of the statusline
because `memmove` is done before adjusting the offset
- right-aligned item groups with multi-byte fillchar:
nvim --clean +"set fillchars+=stl:∙ stl=%5(X%)"
leads to "∙∙∙∙<e2>", i.e. the fillchar is being written over the group contents
and eventually being overwritten itself at the second byte with the final NUL,
because the padding counter assumes a 1-byte fillchar; to crash Neovim,
nvim --clean +"set fillchars+=stl:∙ stl=%<%{%repeat('x',4096-149)%}%50(X%)"
Solution:
Clearer variable names and no recycling of variables for different purposes.
Problem: Running `vim.filetype.match()` when current working directory
was removed from disk throws a `vim.fs.abspath` assertion error.
However, the matching might still be possible without trying to match
against full path (like if it is a known extension).
Solution: Safely compute absolute path and ignore it if it errors.
Problem: Clicking on a "below" virtual line interacts with the line
it is attached to for decor/drawing purposes, rather than
the line the extmark is placed at.
Solution: Account for "below" virtual lines when computing mouse line number.
Problem:
After 400f247397 the undotree test became flaky.
It seems to be caused by some kind of race condition where an entry in the undotree is not added when a change in the buffer happens (adding a bunch of sleep around buffer-change operations seems to fix the issue).
Solution:
Disable autoread plugin in undotree test.
Problem: Diagnostic virtual lines are hardcoded with "scroll" for
virt_lines_overflow option.
Solution: Add a `overflow` option to `virtual_lines` config
to support "wrap", "scroll", "trunc", and "auto".
Problem: Vim9: null value tests not sufficient
Solution: Add a more comprehensive test for null values
(Yegappan Lakshmanan)
closes: vim/vim#14701da9d345b3d
Co-authored-by: Yegappan Lakshmanan <yegappan@yahoo.com>
vim-patch:9.1.0053: MS-Windows: Key event test still fails
vim-patch:9.1.0057: MS-Windows: Key event test still fails
vim-patch:9.2.0540: tests: Test_mswin_event_mouse is flaky
vim-patch:9.2.0590: GTK4: drawing area loses focus shape on popup menu open
vim-patch:9.2.0595: MS-Windows: Wrong buffer size calculation for gvimext
vim-patch:9.2.0599: popup: title set with popup_setoptions() is not shown
vim-patch:057db5f7e CI: Bump actions/checkout in the github-actions group across 1 directory
vim-patch:48f2e78c8 runtime(doc): Add gtk4-slow doc tag
vim-patch:9e4042b2b translation(it): Update Italian man page
vim-patch:9.2.0604: tests: Test_mswin_event_mouse() is still flaky
vim-patch:9.2.0607: GTK4: inputdialog() does not work as expected
vim-patch:9.2.0613: tests: test_xxd_color2() checks for dash but uses sh
vim-patch:9.2.0616: GTK4: use-after-free on clipboard read timeout
vim-patch:9.2.0617: GvimExt: does not support different runtime dirs
vim-patch:9.2.0618: use-after-free in popup_getoptions() on dict_add() failure
vim-patch:9.2.0619: integer overflow in popup image size validation
vim-patch:0abffbff2 CI: Remove Cirrus CI and Coverity Scan
vim-patch:8.2.2583: Vim9: cannot compare result of getenv() with null
vim-patch:8.2.4087: cannot test items from an autoload script easily
vim-patch:8.2.4534: Vim9: "is" operator with empty string and null returns true
vim-patch:9.0.1674: help for builtin functions is not sorted properly
vim-patch:9.0.1727: minor problems with the teapot
vim-patch:9.0.1796: Vim9 problems with null_objects
vim-patch:9.0.1914: Vim9: few issues when accessing object members
vim-patch:9.0.2001: Vim9: segfault with islocked()
vim-patch:9.1.0385: Vim9: crash with null_class and null_object
vim-patch:9.1.0391: Vim9: could improve testing
vim-patch:9.1.0620: Vim9: segfauls with null objects
vim-patch:9.1.1865: tests: do not notice lines containing only a tab
vim-patch:9.1.2029: tests: the test_vim9_class.vim testfile is too long
vim-patch:9.2.0195: CI: test-suite gets killed for taking too long
Problem:
The 'autoread' option only checks for file changes reactively — on
FocusGained, :checktime, CmdlineEnter, etc. — by polling timestamps.
External changes are not detected until the user interacts with Neovim.
Solution:
Add a core module (runtime/lua/nvim/autoread.lua) enabled from
runtime/plugin/autoread.lua that watches each buffer's file using
vim._watch.watch() (libuv fs_event). On change detection it calls
:checktime, which invokes the existing buf_check_timestamp() logic
for reload/prompt handling. Watchers are managed via autocmds tied
to buffer lifecycle events and respect the 'autoread' option (global
and buffer-local).
Problem:
stdpath() may return a DOS 8.3 "shortened" filename, because Windows
truncates long usernames into `6ch~N` names in `TEMP/TMP` env vars.
We don't want to "leak" them into Nvim.
Solution:
For "run", pass `true` to `vim_FullName` to expand 8.3 filenames.
For "cache", call `os_realpath` to expand 8.3 filenames.
Co-authored-by: Justin M. Keyes <justinkz@gmail.com>
Problem:
Listing individual "skipped" notices for each non-actionable or
NVIM_TEST_INTEG test is noisy and makes the "skipped" list overwhelming
and less meaningful.
Solution:
- Mark non-actionable tests with "N/A".
- Report NVIM_TEST_INTEG tests as a separate 1-line summary.
Problem: possible integer overflow in spellfile tree bounds check
Solution: Rewrite the overflow check (Devon Krik)
The check 'startidx + len >= maxidx' uses signed int addition and can
overflow when startidx approaches INT_MAX. After overflow the wrapped
result bypasses the guard, allowing the subsequent loop to write
idxs[startidx + i] out of bounds on the heap.
Replace the addition with a safe subtractive check that maintains the
original >= semantics: len >= maxidx - startidx cannot overflow because
both operands are valid indices within [0, maxidx].
This fixes CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based
Buffer Overflow).
closes: vim/vim#20483276920e138
Co-authored-by: Devon Kirk <hyder365@users.noreply.github.com>
Problem: 'autoindent' not stripped with virtualedit=onemore (after
9.2.0510).
Solution: Restore the decrement of cursor column when it's on NUL.
fixes: neovim/neovim#40183closes: vim/vim#204764b13277edd
- Explicitly match the dot accessor
- Exclude the qualifier when matching qualified function calls
The dot accessor lookbehind on builtin function calls was slow, matching
across expression based dictionary accessors was visually inconsistent,
and it's arguably more semantically correct.
closes: vim/vim#2048178094ff1d7
Co-authored-by: Doug Kearns <dougkearns@gmail.com>
Problem:
Flickering may occur when paging up/down in big files, as ranges for semantic
tokens are requested. This happens with LSP servers like gopls which return
"/full" semantic tokens if the file is too big, where we fall back to
viewport-range token retrievals.
Solution:
Broaden the requested ranges to one viewport of "overscan" on each side plus
some padding if possible:
(viewport_topline - viewport_height)..(viewport_botline + viewport_height)
Problem:
`foldcolumn` is empty for virtual lines above the start of a nested
fold.
Solution:
For virtual lines, compute the outer fold level and display it by
reusing the logic from `fill_foldcolumn`.
Problem: tests: test_codestyle does not notice lines containing only a
tab
Solution: Fix the whitespace issue in eval.txt, update test_codestyle to
notice such issues (Hirohito Higashi)
closes: vim/vim#185955b5290ec02
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Problem:
`nvim -u NONE -d <(xxd one) <(xxd two)` has weird behavior.
Process substitution `<(...)` is a pipe and not a seekable file.
Test case:
cat /dev/random | head -c 10240 > one
cp one two
cat /dev/random | head -c 10240 >> two
nvim -u NONE -d <(xxd one) <(xxd two)
Solution:
Workaround the issue by skipping `nvim.difftool` if the 2 args are not
directories; fall-through to the builtin diff handling.
Signed-off-by: Tomas Slusny <slusnucky@gmail.com>
Problem: tests: test_cmdline.vim leaves swapfiles behind
Solution: Close open buffers using :bw! instead of :close!
bf1b41e387
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: tests: test_sort.vim leaves swapfiles behind
Solution: Close open buffers using :bw! instead of :close!
f8c550fea0
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: tests: test_registers fails when not run under X11
Solution: filter out warning message
b2a8df35e8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: unmarking a regular file when there are directories in the markings
list also removes the 2match highlight from those directories.
Solution: correctly rebuild the match pattern from the remaining markings,
using the right regex trailer for each entry in the list.
closes: vim/vim#20461affd4b5964
Co-authored-by: J. Paulo Seibt <jpseibt@gmail.com>
Problem:
A text edit positioned entirely past the last buffer line, with
newText ending in a newline, leaves a stray blank line: the
past-the-end path appends the trailing empty fragment produced by
vim.split() and does not set has_eol_text_edit, so the end-of-buffer
cleanup is skipped. Formatting servers emit such edits whenever
formatting moves text to the end of a document.
Regression from ec94014cd1 (#20137), which split the past-the-end
fast path off the clamp path that sets the flag.
Solution:
Set has_eol_text_edit in the past-the-end path, like the adjacent
path that clamps end_row.
Problem:
When a server sends workspace/codeLens/refresh while an automatic codelens
request is already scheduled, Nvim ignores the server refresh. This can leave
rendered codelens text stale until another buffer edit triggers a new request.
Solution:
Cancel the pending automatic request and send the server-requested refresh
immediately. This preserves request coalescing while giving explicit server
refreshes priority.
Problem:
Since 5181984d, `nvim_exec_autocmds({buf=…})` temporarily sets the
`buf`-window as current-window, and its statusline renders as
a "current-window statusline", regardless of the user's actual
current-window.
Solution:
Mark the statusline for redraw in `aucmd_restbuf()`, so it is redrawn
correctly after the event.
Co-authored-by: Luuk van Baal <luukvbaal@gmail.com>
Problem:
* 'shellcmdflag' states that its default value is set according to the
value of 'shell', but this behavior is not yet implemented on Windows.
The same applies to 'shellpipe', 'shellredir', and 'shellxquote'.
* On Windows, Git is often installed in paths containing spaces, and we
still do not correctly resolve the sh executable name as described in
'shell'.
* On Windows, the default value of 'shellslash' is always `false`,
which causes Unix-like shells to interpret `\` in paths returned by
some functions as escape charaters.
Solution:
Use a simple rule table to detect common shells (e.g. `cmd`,
`powershell`, shells whose names contain `csh` or `sh`) and apply
best-effort defaults, while leaving more complex scenarios to user
configuration.
Problem:
stdpath() may return a DOS 8.3 "shortened" filename, because Windows
truncates some long usernames into `6ch~N` names. Then features such
as `nvim_get_runtime_file` fail to find the file.
Analysis:
When expanding an 8.3 filename path like `C:/Users/ADMINI~1/AppData/*`,
we treat `~` as a special character and first check whether a directory
named `ADMINI~1` exists under `Users`. Since no such directory actually
exists, the expansion fails.
Solution:
Treat `~` as a literal character in `do_path_expand`. Since the `~/`
case is already handled in `gen_expand_wildcards`, any remaining `~` is
just a literal character and will later be escaped to `\~` by
`file_pat_to_reg_pat` if needed.
Now that wasmtime has introduced LTS releases (and tree-sitter tracks
them), we no longer need to pin the version exactly but can rely on
any major.minor version being compatible. This avoids having to edit
the CMake file on every patch bump.
Problem: style: Various lines are indented inconsistently
Solution: Retab these lines and correct some comments.
(zeertzjq)
closes: vim/vim#15259d9be94cf03
Problem: tests: test_restricted() fails
(after: v9.1.0091)
Solution: Add a space before the pipecmd and the actual Vim command to
run
52eb0b8677
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: test_channel may fail because of IPv6 config issues
Solution: Catch and skip the test, if getaddrinfo() fails with
'Address family not supported'
Mark tests as skipped when ch_open encounters E901
On some of the Debian build systems, the IPv6 channel tests fail because
`ch_open('[::1]:<port>', ...)` raises the error "E901: getaddrinfo() in
channel_open(): Address family for hostname not supported".
This appears to happen because getaddrinfo() can't perform the reverse
lookup for the ::1, which is a config issue on that system. Therefore,
instead of reporting a test failure, mark the test as skipped due to the
bad network config
closes: vim/vim#1347343cb8e1c3b
Co-authored-by: James McCoy <jamessan@jamessan.com>
Problem: docs say {str} is capped at 256 and longer returns an empty list.
Solution: it's 1024, and {str} plus each candidate are just truncated to
that, not rejected; fix the text.
closes: vim/vim#20453595d0a77e4
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: Test_screenpos() fails intermittently in the GUI testgui CI
job with "Expected {'row': 22} but got {'row': 23}". In the
GUI, the window height reported by getwininfo() before the
final redraw can be stale, so the cached wininfo.height does
not match the actual window height when the assertion runs.
Solution: Use winheight(winid) at assertion time so the height reflects
the window state after the redraw.
closes: vim/vim#20457781a91ac54
Co-authored-by: thinca <thinca@gmail.com>
Problem: A '}' inside a // line comment changes the indentation of the
following line inside an enum or struct (rendcrx).
Solution: Stop scanning the line once a line comment is reached, so a brace
inside the comment is no longer mistaken for an unmatched brace.
fixes: vim/vim#20455closes: vim/vim#204589dd86dff9b
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
