Doug Kearns [Sat, 13 Jun 2026 14:57:31 +0000 (14:57 +0000)]
patch 9.2.0626: Vim9: illegal characters allowed in dict key names with dot notation
Problem: In a Vim9 script, colons and hashes are accepted in a dict key
name when using dot notation.
Solution: Restrict dict key names used with dot notation to alphanumeric
and underscore characters, as documented (Doug Kearns).
closes: #20507
Signed-off-by: Doug Kearns <dougkearns@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0624: C-N/C-P cannot be mapped in complete() completion
Problem: Keys valid in CTRL-X mode are never mapped while insert
completion is active, so <C-N> and <C-P> cannot be remapped
for completion started by complete().
Solution: Do not disable mappings in CTRL_X_EVAL mode. In this mode a
mapping cannot interfere with selecting the completion
method, which is what the no-mapping rule exists for.
related: #6440
related: #16880
closes: #20489
Signed-off-by: Thomas M Kehrenberg <tmke8@posteo.net> Signed-off-by: Christian Brabandt <cb@256bit.org>
Devon Kirk [Fri, 12 Jun 2026 10:10:50 +0000 (10:10 +0000)]
patch 9.2.0623: possible integer overflow in spellfile tree bounds check
Problem: possible integer overflow in spellfile tree bounds check
Solution: Rewrite the overflow check (Devon Krik)
The check 'startidx + len >= maxidx' uses signed int addition and can
overflow when startidx approaches INT_MAX. After overflow the wrapped
result bypasses the guard, allowing the subsequent loop to write
idxs[startidx + i] out of bounds on the heap.
Replace the addition with a safe subtractive check that maintains the
original >= semantics: len >= maxidx - startidx cannot overflow because
both operands are valid indices within [0, maxidx].
This fixes CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based
Buffer Overflow).
closes: #20483
Signed-off-by: Devon Kirk <hyder365@users.noreply.github.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0622: str2blob() does not work with wide UTF-16 encoding
Problem: str2blob() does not work with wide UTF-16 encoding
Solution: Use iconv() and convert the UTF-16 and similar encodings
directly (Yasuhiro Matsumoto)
str2blob() routed every target encoding through convert_string(), which
treats all Unicode encodings as utf-8 and therefore left the bytes
unconverted. As a result str2blob(['Hello'], {'encoding': 'utf-16le'})
returned 0z48656C6C6F instead of 0z480065006C006C006F00, breaking the
round-trip with blob2str(). Add the same wide-encoding handling blob2str()
uses: join the list items with a newline, convert the whole string at once
with the endianness-preserving encoding name, and append the raw bytes.
closes: #20466
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Doug Kearns [Fri, 12 Jun 2026 09:28:05 +0000 (09:28 +0000)]
runtime(vim): Update base syntax, simplify function call matching
- Explicitly match the dot accessor
- Exclude the qualifier when matching qualified function calls
The dot accessor lookbehind on builtin function calls was slow, matching
across expression based dictionary accessors was visually inconsistent,
and it's arguably more semantically correct.
closes: #20481
Signed-off-by: Doug Kearns <dougkearns@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Cirrus CI shut down on 2026-06-01, so its badge and .cirrus.yml no longer
work. The Coverity Scan project for Vim is also gone (the badge and project
page return 404). Remove both badges and their related configuration.
closes: #20431
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: unmarking a regular file when there are directories in the markings
list also removes the 2match highlight from those directories.
Solution: correctly rebuild the match pattern from the remaining markings,
using the right regex trailer for each entry in the list.
closes: #20461
Signed-off-by: J. Paulo Seibt <jpseibt@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0619: integer overflow in popup image size validation
Problem: integer overflow in popup image size validation
(after v9.2.0612)
Solution: Compute the expected size using a 64-bit varnumber_T
(Yasuhiro Matsumoto).
The image size validation computed iw * ih * 4 in a 32-bit long, which
overflows on MS-Windows (LLP64) and can wrap to a value that matches a
short blob, so the validation passes and the pixels are later read out
of bounds. Compute the expected size in a 64-bit varnumber_T.
closes: #20463
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0618: use-after-free in popup_getoptions() on dict_add() failure
Problem: use-after-free in popup_getoptions() on dict_add() failure
Solution: Set b to NULL (Yasuhiro Matsumoto).
When dict_add() failed, dictitem_free() unref'd and freed the blob, but
the error cleanup then read the freed blob's refcount and could free it
again. Clear the pointer after dictitem_free().
closes: #20464
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
K.Takata [Wed, 10 Jun 2026 20:46:21 +0000 (20:46 +0000)]
patch 9.2.0617: GvimExt: does not support different runtime dirs
Problem: GvimExt: does not support different runtime dir types
Solution: Add support for all Vim supported runtime directories
(Ken Takata)
Vim itself supports certain runtime directory structures.
However, GvimExt supports only one type of them.
Check three types of runtime directory structures.
1. gvim.exe is in runtimedir.
2. gvim.exe is in the parent of runtimedir.
runtimedir is "vimXX".
3. gvim.exe is in the parent of runtimedir.
runtimedir is "runtime".
patch 9.2.0616: GTK4: use-after-free on clipboard read timeout
Problem: clip_mch_request_selection() stack-allocates ClipReadData
and waits up to 3 seconds for the async callback to fire.
If the timeout expires before the callback runs, the
function returns and the stack frame is gone, but the async
read is still pending; when the callback eventually fires
it a use-after-free.
Solution: Heap-allocate ClipReadData and add an "abandoned" flag
(Yasuhiro Matsumoto).
closes: #20467
Co-Authored-by: Claude <noreply@anthropic.com> Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0615: sixel encoder drops pixels on the right edge of shapes
Problem: sixel encoder drops pixels on the right edge of shapes
(after v9.2.0612)
Solution: Update xmax only when the new x is greater, mirroring the
existing xmin handling (Yasuhiro Matsumoto)
The per-colour xmax was updated with an unconditional assignment while
filling the band row by row, so it held the right edge of the last row
containing the colour instead of the maximum over all six rows.
Compare before updating, like xmin.
closes: #20468
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: Background redraws under an opacity popup update ScreenLines[]
but suppress terminal output, so the terminal no longer
matches ScreenLines[] for those cells. Later draws skipped
them as "unchanged", leaving parts of the old popup on screen
after popup_settext() or popup_clear().
Solution: Track cells whose output was suppressed under an opacity popup
and force their next output.
fixes: #20459
closes: #20471
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0612: Cannot render images in popup windows
Problem: Cannot render images in popup windows
Solution: Add support for rendering images using the kitty, sixel, cairo
and GDI backend (Yasuhiro Matsumoto).
Add an "image" attribute to popup_create()/popup_setoptions() that
renders a raw RGB/RGBA pixel buffer inside a popup window. Terminal
backends emit the buffer as DEC sixel or kitty graphics sequences; the
MS-Windows GUI uses GDI and the GTK GUI uses Cairo. The popup auto-sizes
its cell box from the image dimensions. getbgcolor() returns the current
background colour so scripts can pre-composite RGBA pixels.
closes: #20136
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
glepnir [Tue, 9 Jun 2026 19:45:35 +0000 (19:45 +0000)]
runtime(doc): wrong {str} length limit in matchfuzzy() docs
Problem: docs say {str} is capped at 256 and longer returns an empty list.
Solution: it's 1024, and {str} plus each candidate are just truncated to
that, not rejected; fix the text.
closes: #20453
Signed-off-by: glepnir <glephunter@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
K.Takata [Tue, 9 Jun 2026 19:40:52 +0000 (19:40 +0000)]
patch 9.2.0611: MS-Windows: evim.exe not working with VIMDLL
Problem: When gvim.exe is built with VIMDLL=yes, and gvim.exe is copied
to evim.exe, evim.exe didn't start in the easy mode.
Solution: Check the executable file type in addition to its filename
(Ken Takata).
closes: #20454
Signed-off-by: K.Takata <kentkt@csc.jp> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0610: cindent: closing brace in a comment affects the next line's indent
Problem: A '}' inside a // line comment changes the indentation of the
following line inside an enum or struct (rendcrx).
Solution: Stop scanning the line once a line comment is reached, so a brace
inside the comment is no longer mistaken for an unmatched brace.
fixes: #20455
closes: #20458
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Hirohito Higashi <h.east.727@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0609: completion info popup cannot be scrolled with the keyboard
Problem: The info popup shown beside the insert-mode and command-line
completion menu can only be scrolled with the mouse wheel, so
the part below the visible area is unreachable when working
from the keyboard.
Solution: While the completion menu is shown, scroll the info popup with
CTRL-SHIFT-Up/Down (one line), CTRL-SHIFT-PageUp/PageDown (one
page) and CTRL-SHIFT-N/CTRL-SHIFT-P (one line). The menu stays
open and the selected item does not change.
related: #20418
fixes: #20441
closes: #20444
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Hirohito Higashi <h.east.727@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Tue, 9 Jun 2026 18:58:08 +0000 (18:58 +0000)]
patch 9.2.0607: GTK4: inputdialog() does not work as expected
Problem: GTK4: inputdialog() does not work as expected
Solution: Refactor the dialog code to create a custom window instead of
using GtkAlertDialog, while at it, also makes mnemonics
work as expected (Foxe Chen).
closes: #20448
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Tue, 9 Jun 2026 18:49:31 +0000 (18:49 +0000)]
patch 9.2.0606: GTK4: does not support all clipboard formats
Problem: GTK4: GUI does not support Vim's internal specific
formats that preserve motion type and encoding. It also
doesn't support the 'html' option in 'clipboard'.
Solution: Refactor code and support for all clipboard formats
(Foxe Chen).
closes: #20445
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
thinca [Tue, 9 Jun 2026 18:39:52 +0000 (18:39 +0000)]
patch 9.2.0605: tests: Test_screenpos() is flaky in GUI
Problem: Test_screenpos() fails intermittently in the GUI testgui CI
job with "Expected {'row': 22} but got {'row': 23}". In the
GUI, the window height reported by getwininfo() before the
final redraw can be stale, so the cached wininfo.height does
not match the actual window height when the assertion runs.
Solution: Use winheight(winid) at assertion time so the height reflects
the window state after the redraw.
closes: #20457
Signed-off-by: thinca <thinca@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Shad [Sun, 7 Jun 2026 19:22:33 +0000 (19:22 +0000)]
patch 9.2.0602: popup: No opacity when background not set for Popup group
Problem: popup: When the Popup highlight group has no guibg/ctermbg the
popup becomes fully transparent.
Solution: Create an entry if no popup_attr exists (highlight group
cleared for example), and test if popup_attr exists but
without guibg/ctermbg attributes to fallaback to normal bg
color.
glepnir [Sun, 7 Jun 2026 18:42:50 +0000 (18:42 +0000)]
patch 9.2.0601: matchfuzzypos() returns garbage positions for long candidates
Problem: A needle that only matches past char 1024 gives an INT_MIN + 1
score with unset positions, e.g.
matchfuzzypos([repeat('a',1024)..'z'], 'az').
Solution: Drop the candidate when match_positions() returns SCORE_MIN.
closes: #20435
Signed-off-by: glepnir <glephunter@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Fri, 5 Jun 2026 17:41:26 +0000 (17:41 +0000)]
patch 9.2.0600: clientserver method needs to be given as argument
Problem: clientserver method needs to be given as argument
Solution: Add support for the $VIM_CLIENTSERVER environment variable,
which defines which clientserver method Vim should use
(Foxe Chen).
closes: #20409
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0599: popup: title set with popup_setoptions() is not shown
Problem: When only the title is changed with popup_setoptions(), the
popup is not redrawn until another event happens, so the new
title does not appear right away.
Solution: Redraw the popup when the title changes. Also allocate the new
title and border highlights before freeing the old ones, so the
current value is not lost on allocation failure.
fixes: #20426
closes: #20430
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Hirohito Higashi <h.east.727@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: Test_statusline() occasionally fails in CI, reading buffer text
instead of the status line (e.g. '9012...' instead of '57,39').
Solution: In s:get_statusline() redraw unconditionally and read the screen
cells directly with screenstring(), instead of relying on
ScreenLines() whose own redraw! can process events and change the
window layout between the redraw and reading the cells. This
matches the already-stable s:Assert_match_statusline() helper in
test_statuslineopt.vim.
closes: #20428
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Hirohito Higashi <h.east.727@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0597: [security]: possible code execution with python complete
Problem: [security]: another possible code execution with python complete
(David Carliez)
Solution: Strip default expressions and annotations from generated
source for pythoncomplete and python3complete.
patch 9.2.0596: cmdline completion popup cannot be scrolled with the mouse
Problem: In command-line completion with a popup menu ('wildoptions'
contains "pum"), the info popup shown next to the menu could
not be scrolled, unlike the Insert mode completion info popup
which scrolls with the mouse wheel.
Solution: When the mouse pointer is on top of the info popup, scroll it
with the mouse wheel in command-line mode as well, without
closing the completion popup menu.
closes: #20146
closes: #20418
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Hirohito Higashi <h.east.727@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
K.Takata [Thu, 4 Jun 2026 19:40:30 +0000 (19:40 +0000)]
patch 9.2.0595: MS-Windows: Wrong buffer size calculation for gvimext
Problem: MS-Windows: Wrong buffer size calculation for gvimext
(after 7e6d3bd3da555e151ba518081a964a0cdb39ac33).
Solution: Declare buffer as WCHAR, drop type casts, use
ARRAY_LENGTH macro (Ken Takata).
closes: #20424
Signed-off-by: K.Takata <kentkt@csc.jp> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0594: Use-after-free with ":wqall" and a running terminal job
Problem: Using ":wqall" with a running terminal buffer can free the
buffer that is currently being iterated over in the buffer
list, resulting in a use-after-free (after v9.2.0593).
Solution: After stopping the job, check whether the buffer is still valid
and restart the iteration from the first buffer if it was freed
(Hirohito Higashi).
related: #20417
closes: #20423
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Wed, 3 Jun 2026 19:18:04 +0000 (19:18 +0000)]
patch 9.2.0593: :wqall ignores term_setkill() on running terminal buffers
Problem: :wqall ignores term_setkill() on running terminal buffers
Solution: In do_wqall(), call term_try_stop_job() on the running
terminal buffer first (Foxe Chen).
closes: #20417
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
glepnir [Wed, 3 Jun 2026 18:48:46 +0000 (18:48 +0000)]
patch 9.2.0591: 'scrolljump' ignored when scrolling up
Problem: srolljump=-100 only scrolls half a page going up, but works
fine going down. update_topline() always falls back to
scroll_cursor_halfway() when the cursor is far above topline.
Solution: Only center when sj is smaller than half the window. Otherwise
call scroll_cursor_top like the downward path does (glepnir).
fixes: #1527
closes: #20366
Signed-off-by: glepnir <glephunter@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Wed, 3 Jun 2026 18:19:42 +0000 (18:19 +0000)]
patch 9.2.0590: GTK4: drawing area loses focus shape on popup menu open
Problem: GTK4: any focus change on the drawarea turns the cursor
into an outline, including transient focus movement to a
GUI popup menu and back. The cursor flashes outline-shape
during menu interaction. The GTK3 GUI does not have this
problem because it ties the cursor shape to toplevel window
focus, not drawarea focus.
Solution: Gate focus_in_event() and focus_out_event() on
gtk_window_is_active() of the toplevel window, matching
GTK3 behaviour. Reverts v9.2.0588 (Foxe Chen).
closes: #20415
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0588: GTK4: drawing area loses focus after closing a menubar popover
Problem: After a menubar popover (e.g. File, Edit) was opened and then
dismissed without selecting an item, keyboard focus remained
outside the drawing area, leaving the cursor stuck in the
unfocused (outline) shape until the pointer was moved over the
drawarea (Foxe Chen)
Solution: Install an emission hook on GtkPopover::closed and, when a
popover that descends from gui.menubar closes, queue an idle
callback that grabs focus back to the drawing area. The grab
must be deferred because GTK is still completing the close
transition when the signal fires (Yasuhiro Matsumoto).
fixes: #20274
closes: #20291
Co-Authored-by: Claude <noreply@anthropic.com> Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Tue, 2 Jun 2026 17:44:42 +0000 (17:44 +0000)]
patch 9.2.0587: GTK4: left scrollbar overlaps drawarea
Problem: GTK4: the drawarea is wrapped in a GtkOverlay with the
scrollbar form layered on top, so the left scrollbar
appears over the drawarea instead of beside it.
Solution: Place the drawarea and the scrollbars as siblings inside
the form widget, removing the GtkOverlay. Add
gui_mch_update_scrollbar_size() to query the actual
scrollbar dimensions and call it from gui_set_shellsize(),
rename GtkForm to VimForm so the GTK namespace is not used
(Foxe Chen).
closes: #20375
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Mon, 1 Jun 2026 21:08:20 +0000 (21:08 +0000)]
patch 9.2.0586: Crash with TextPut autocmd when pasting in terminal buffer
Problem: Crash with TextPut autocmd when pasting in normal mode in a
terminal buffer.
Solution: Skip the TextPut autocmds when reg and insert are both NULL
and regname is not '.' (Foxe Chen).
closes: #20407
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
runtime(c): classify type qualifiers, function specifiers and C23 attributes
Move const, volatile, restrict and _Atomic to a new cTypeQualifier group
and inline and _Noreturn to cFunctionSpec. Add the C23 standard attributes
deprecated, fallthrough, maybe_unused, nodiscard, unsequenced and
reproducible as cStandardAttribute, and reclassify the existing noreturn
into the same group.
The new groups link to cStorageClass, so the default highlighting and any
existing cStorageClass override are unchanged, while allowing finer-grained
customization.
fixes: #19574
closes: #20368
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
glepnir [Mon, 1 Jun 2026 20:43:56 +0000 (20:43 +0000)]
patch 9.2.0585: line number wrong after undoing a deletion in quickfix buffer
Problem: Deleting a quickfix line and undoing it leaves the entry
pointing one line below where it should.
Solution: Don't shift already cleared entries in qf_mark_adjust.
closes: #20379
Signed-off-by: glepnir <glephunter@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Mon, 1 Jun 2026 20:26:18 +0000 (20:26 +0000)]
patch 9.2.0584: GTK4: missing UI features
Problem: GTK4: :popup, menu item show/hide and menu bar state
updates are not implemented.
Solution: Implement gui_make_popup(), gui_mch_menu_hidden() and
gui_mch_draw_menubar() (Foxe Chen).
closes: #20393
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
glepnir [Mon, 1 Jun 2026 20:15:35 +0000 (20:15 +0000)]
patch 9.2.0583: completion: indent not ignored for fuzzy line completion
Problem: Indent is not stripped in whole-line completion (CTRL-X
CTRL-L).
Solution: Skip the matched line's indent for whole-line matches in
search_for_fuzzy_match (glepnir).
closes: #20405
Signed-off-by: glepnir <glephunter@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0581: After maximizing and deleting the quickfix buffer, window height is wrong
Problem: After maximizing and deleting the quickfix buffer, window
height is wrong (tertium)
Solution: Reset the winfixheight option when a quickfix buffer is
deleted from a window (Yegappan Lakshmanan)
fixes: #3378
closes: #20403
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Hirohito Higashi [Sun, 31 May 2026 21:11:55 +0000 (21:11 +0000)]
patch 9.2.0580: xxd: binary output is not colored with -R
Problem: With xxd the -R option colors the hex output but leaves the
binary output produced by -b uncolored (Boris Verkhovskiy)
Solution: Color the binary (bits) output per byte with the same colors as
the hex output, update the documentation and add a test
(Hirohito Higashi).
fixes: #20385
closes: #20401
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Christian Brabandt <cb@256bit.org> Signed-off-by: Miguel Barro <miguel.barro@live.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0578: GTK4: :unmenu does not remove entries from the menubar
Problem: GTK4: gui_mch_destroy_menu() never removed the entry from its
parent GMenu, so :unmenu was effectively a no-op against the
visible menubar model. After "Refresh menu" the Buffers menu
items doubled because runtime/menu.vim BMShow() re-appended
Refresh / Delete / Alternate / Next / Previous / -SEP- into a
still-populated GMenu. The GAction registered for the item
and the reference on its submenu GMenu were also leaked.
Solution: Compute the entry's position in the parent GMenu by walking
the vimmenu_T sibling list, call g_menu_remove(), remove the
GAction we registered, and release our reference on the
submenu GMenu (Yasuhiro Matsumoto)
fixes: #20262
closes: #20314
Co-Authored-by: Claude <noreply@anthropic.com> Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Sun, 31 May 2026 20:09:52 +0000 (20:09 +0000)]
patch 9.2.0577: GTK4: window resizing issues
Problem: GTK4: window size does not account for client-side decorations
Solution: Compute the client side decoration height from
gui_resize_shell() (Foxe Chen)
fixes: #20365
closes: #20388
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0576: popup_create() not blocked in secure/sandbox
Problem: popup_create() is not gated by check_secure(), unlike the
similar deferred-callback registrars timer_start() and
feedkeys(). A popup created with a 'time' and 'callback' (or with
close/filter callbacks) registers code that runs after the secure/sandbox
context has been left, which is inconsistent with how
timer_start() and feedkeys() handle the same situation.
Solution: Call check_secure() at the top of popup_create(), matching the
timer_start()/feedkeys() pattern.
thinca [Sun, 31 May 2026 19:43:42 +0000 (19:43 +0000)]
patch 9.2.0574: tests: missing test for v9.2.0572
Problem: tests: missing test for v9.2.0572 (the patch accidentally
included some additional unwanted changes from #20372)
(thinca)
Solution: Add additional test for delfunc
(thinca)
Patch 9.2.0572 fixed ":call d.key()" and ":delfunction d.key" failing
with E1017 in Vim9 script, but only the :call form was covered by a
regression test. Add Test_delfunction_dict_funcref to exercise both
"delfunction d.key" and "delfunction d['k2']".
closes: #20372
Signed-off-by: thinca <thinca@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Peter Kenny [Sun, 31 May 2026 19:14:21 +0000 (19:14 +0000)]
patch 9.2.0573: Vim9: missing EX_WHOLE on some block keywords
Problem: Several Vim9 keywords lack EX_WHOLE and can be shortened in
Vim9 script, inconsistent with endif/enddef/endfor/endwhile/
endtry which already have it. The error from :endd in a
nested function also hardcodes "enddef" instead of reporting
what the user typed. fullcommand("ho") returns "horizontal"
even though :ho is below the documented 3-char minimum.
Solution: Add EX_WHOLE to :class, :def, :endclass, :endinterface,
:endenum, :public and :static. In get_function_body() pass
the user-typed command to the error message. Force :ho to
CMD_SIZE in find_ex_command() so fullcommand() reflects the
modifier minimum. Extend tests and documentation accordingly
(Peter Kenny).
fixes: #20032
closes: #20191
Signed-off-by: Peter Kenny <github.com@k1w1.cyou> Signed-off-by: Christian Brabandt <cb@256bit.org>
Hirohito Higashi [Sun, 31 May 2026 18:43:42 +0000 (18:43 +0000)]
patch 9.2.0572: lines disappear with wrapping virtual text after a double-width char
Problem: With 'nowrap', when a line ends with a double-width character
exactly at the window width and has wrapping "after" virtual
text, the lines below disappear and "@@@" is shown.
Solution: Detect that the last character fills the rightmost column using
its displayed width (win_chartabsize(), so a <Tab> or double-width
character is handled like a single-width one), and also when it
overflows the last column. Also clarify in the help that "wrap"
only takes effect with the 'wrap' option set.
fixes: #20384
related: #12213
closes: #20395
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: zeertzjq <zeertzjq@outlook.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
thinca [Sun, 31 May 2026 18:28:34 +0000 (18:28 +0000)]
patch 9.2.0571: Vim9: memory leak in compile_nested_function() on failure
Problem: compile_nested_function() calls define_function(), which registers
the new ufunc in func_hashtab with uf_refcount == 1. For a local
nested function the caller then reserves a local lvalue and
generates a FUNCREF instruction; if either step fails, the code
jumps to the theend label and leaves the ufunc behind with
refcount 1 and no external reference, leaking it. This mirrors
patch 8.2.3951, which fixed the same leak for the "text after
:enddef" branch a few lines above.
Solution: Call func_ptr_unref() on the ufunc before "goto theend" on both
failure paths in the local-variable branch (thinca).
closes: #20394
Co-Authored-by: Claude <noreply@anthropic.com> Signed-off-by: thinca <thinca@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Foxe Chen [Sun, 31 May 2026 18:24:21 +0000 (18:24 +0000)]
patch 9.2.0570: GTK4: mouse wheel scrolling does not work correctly
Problem: GTK4: mouse wheel scrolling does not work correctly
Solution: Use gui_mch_getmouse() to obtain the pointer position, and
add GTK_EVENT_CONTROLLER_SCROLL_DISCRETE to the scroll
controller flags (Foxe Chen).
closes: #20389
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0569: out-of-bounds access in libvterm CSI 8 t resize
Problem: In the bundled libvterm the CSI 8 ; rows ; cols t sequence reaches
on_resize() without validating its arguments. Missing, zero or
negative dimensions cause a negative-size memmove() in
resize_buffer() and out-of-bounds accesses in set_lineinfo() and
DECALN, all reachable from output rendered in a terminal window
(Yukihiro Nakamura).
Solution: Reject missing, zero or negative dimensions before calling
on_resize(). Also clamp a negative cell width in on_text() as
hardening for the bundled libvterm.
thinca [Sun, 31 May 2026 12:33:07 +0000 (12:33 +0000)]
patch 9.2.0568: pythoncomplete: g:pythoncomplete_allow_import had no effect
Problem: The security patch 9.2.0561 added a vim.eval() call inside
Completer.evalsource() to honor g:pythoncomplete_allow_import.
But the 'vim' module is only imported inside the outer
vimcomplete() / vimpy3complete() function, not at the script's
top level, so referring to it from a Completer method raises
NameError. The surrounding bare 'except' silently swallows
the error and leaves allow_imports at 0, meaning the opt-in
never takes effect -- 'import os' (and any other
buffer-level import) is always skipped, no candidates are
produced for 'os.<...>' and
Test_popup_and_preview_autocommand() fails on the Windows
CI matrix (Linux skips the test because Python 2 is absent).
Solution: Re-import 'vim' at the top of evalsource() in both
pythoncomplete.vim and python3complete.vim so the eval reads
the global, and set g:pythoncomplete_allow_import = 1 in the
test (it is the opt-in intended for callers that trust the
buffer contents) (thinca).
closes: #20386
Signed-off-by: thinca <thinca@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
thinca [Sat, 30 May 2026 18:36:34 +0000 (18:36 +0000)]
patch 9.2.0567: dict function name allocation failure not handled
Problem: When defining a dictionary function, the function name string
is allocated with vim_strnsave() but the result is not
checked. On allocation failure the dict entry is left with
type VAR_FUNC and a NULL name, and in the overwrite case the
previous entry has already been freed before the NULL is
stored.
Solution: Allocate the name before modifying the dict entry and bail out
on failure, freeing it on all error paths (thinca)
closes: #20376
Co-Authored-by: Claude <noreply@anthropic.com> Signed-off-by: thinca <thinca@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
Yohei Kojima [Sat, 30 May 2026 18:07:21 +0000 (18:07 +0000)]
patch 9.2.0566: <C-w>f duplicates window if do_ecmd() is aborted
Problem: If got_int is true when win_close() is called, it unexpectedly
fails in the branch that detects failure in apply_autocmds().
This causes wingotofile in do_window() to duplicate current
window when do_ecmd() is aborted with got_int.
Solution: Fix do_window() to save the got_int value before trying to
close the split window (Yohei Kojima).
Steps to reproduce:
1. run `touch a && touch .a.swp && echo a > b && vim b`
2. Type `<C-w>f`
3. In the warning dialogue, type `a` to abort
4. Current window is duplicated
closes: #20382
Signed-off-by: Yohei Kojima <yk@y-koj.net> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0565: [security]: out-of-bounds read in update_snapshot()
Problem: Out-of-bounds read in update_snapshot() when a terminal cell
fills all VTERM_MAX_CHARS_PER_CELL slots (a base character
plus five combining marks): the loop over cell.chars[] has no
upper bound and libvterm leaves the array unterminated when full, so
it reads past the array and appends out-of-bounds values to a
buffer sized for only VTERM_MAX_CHARS_PER_CELL characters.
Solution: Bound the loop with i < VTERM_MAX_CHARS_PER_CELL, mirroring
the loop in handle_pushline() (Christian Brabandt).
Foxe Chen [Fri, 29 May 2026 19:47:24 +0000 (19:47 +0000)]
patch 9.2.0564: GTK4: tabline does not respond to mouse clicks
Problem: GTK4: tabline does not respond to mouse clicks
Solution: Connect on_select_tab() to "switch-page" to fire the tabline
event, and on_tab_reordered() to "page-reordered" to call
tabpage_move() with the new index (Foxe Chen).
closes: #20362
Signed-off-by: Foxe Chen <chen.foxe@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0563: GTK3/Wayland: crash with right mouse-button in tabline
Problem: GTK3/Wayland: crash with right mouse-button in tabline
Solution: Use gui.mainwin and get coordinates (Christoffer Aasted).
GtkNotebook (tabline) is a windowless container widget causing a
nullptr deref inside `gdk_window_get_effective_parent()` as Wayland
lacks a surface to anchor to.
fixes: #18864
closes: #20348
Signed-off-by: Christoffer Aasted <dezzadk@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
patch 9.2.0560: filetype: busybox shebang lines are not recognized
Problem: filetype: busybox shebang lines are not recognized
Solution: Add filetype detection pattern for #!busybox sh, detect
ash as shell in the shebang lines (Christoffer Aasted).
closes: #20358
Signed-off-by: Christoffer Aasted <dezzadk@gmail.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
projects / thirdparty / vim.git / log
