Merge pull request #21338 from zeertzjq/vim-9.0.1030

vim-patch:9.0.{1030,1032}: using freed memory with the cmdline popup menu

2 files changed, 22 insertions, 0 deletions

diff --git a/src/nvim/cmdexpand.c b/src/nvim/cmdexpand.c
index 9619c81636..ca732c6cd9 100644
--- a/src/nvim/cmdexpand.c
+++ b/src/nvim/cmdexpand.c
@@ -745,6 +745,11 @@ char *ExpandOne(expand_T *xp, char *str, char *orig, int options, int mode)
     FreeWild(xp->xp_numfiles, xp->xp_files);
     xp->xp_numfiles = -1;
     XFREE_CLEAR(orig_save);
+
+    // The entries from xp_files may be used in the PUM, remove it.
+    if (compl_match_array != NULL) {
+      cmdline_pum_remove();
+    }
   }
   findex = 0;
 
diff --git a/src/nvim/testdir/test_cmdline.vim b/src/nvim/testdir/test_cmdline.vim
index 218a2143e8..d09c9e2171 100644
--- a/src/nvim/testdir/test_cmdline.vim
+++ b/src/nvim/testdir/test_cmdline.vim
@@ -2281,6 +2281,23 @@ func Test_wildmenu_pum()
   call delete('Xdir', 'rf')
 endfunc
 
+func Test_wildmenu_pum_clear_entries()
+  CheckRunVimInTerminal
+
+  " This was using freed memory.  Run in a terminal to get the pum to update.
+  let lines =<< trim END
+    set wildoptions=pum
+    set wildchar=<C-E>
+  END
+  call writefile(lines, 'XwildmenuTest', 'D')
+  let buf = RunVimInTerminal('-S XwildmenuTest', #{rows: 10})
+
+  call term_sendkeys(buf, ":\<C-E>\<C-E>")
+  call VerifyScreenDump(buf, 'Test_wildmenu_pum_clear_entries_1', {})
+
+  set wildoptions& wildchar&
+endfunc
+
 " this was going over the end of IObuff
 func Test_report_error_with_composing()
   let caught = 'no'