vim-patch:7.4.1638

Problem:    When binding a function to a dict the reference count is wrong.
Solution:   Decrement dict reference count, only reference the function when
            actually making a copy. (Ken Takata)

https://github.com/vim/vim/commit/e4eb6ff089e79e659acf33c17dd0fda7177de526

1 files changed, 7 insertions, 3 deletions

diff --git a/src/nvim/eval.c b/src/nvim/eval.c
index 50bcfe4e2a..8ca70222b1 100644
--- a/src/nvim/eval.c
+++ b/src/nvim/eval.c
@@ -9590,6 +9590,7 @@ static void partial_free(partial_T *pt)
     clear_tv(&pt->pt_argv[i]);
   }
   xfree(pt->pt_argv);
+  dict_unref(pt->pt_dict);
   func_unref(pt->pt_name);
   xfree(pt->pt_name);
   xfree(pt);
@@ -18385,14 +18386,18 @@ handle_subscript (
         pt->pt_dict = selfdict;
         selfdict = NULL;
         if (rettv->v_type == VAR_FUNC) {
-          // just a function: use selfdict
+          // Just a function: Take over the function name and use
+          // selfdict.
           pt->pt_name = rettv->vval.v_string;
         } else {
           partial_T *ret_pt = rettv->vval.v_partial;
           int i;
 
-          // partial: use selfdict and copy args
+          // Partial: copy the function name, use selfdict and copy
+          // args. Can't take over name or args, the partial might
+          // be referenced elsewhere.
           pt->pt_name = vim_strsave(ret_pt->pt_name);
+          func_ref(pt->pt_name);
           if (ret_pt->pt_argc > 0) {
             size_t arg_size = sizeof(typval_T) * ret_pt->pt_argc;
             pt->pt_argv = (typval_T *)xmalloc(arg_size);
@@ -18408,7 +18413,6 @@ handle_subscript (
           }
           partial_unref(ret_pt);
         }
-        func_ref(pt->pt_name);
         rettv->v_type = VAR_PARTIAL;
         rettv->vval.v_partial = pt;
       }