Hello tech@, I noticed that ADD_SPACE_{GOTO,RET} have their checks twisted around. I reckon we got lucky that L__gp is never NULL when called.
I'm reckon it's worth while to remove the tmp space all together, but that diff would require quite a bit of extra work, so lets just fix the check for now. OK? martijn@ Index: common/mem.h =================================================================== RCS file: /cvs/src/usr.bin/vi/common/mem.h,v retrieving revision 1.9 diff -u -p -r1.9 mem.h --- common/mem.h 7 May 2016 14:03:01 -0000 1.9 +++ common/mem.h 22 Jun 2017 19:04:35 -0000 @@ -79,7 +79,7 @@ */ #define ADD_SPACE_GOTO(sp, bp, blen, nlen) { \ GS *L__gp = (sp) == NULL ? NULL : (sp)->gp; \ - if (L__gp == NULL || (bp) == L__gp->tmp_bp) { \ + if (L__gp != NULL && (bp) == L__gp->tmp_bp) { \ F_CLR(L__gp, G_TMP_INUSE); \ BINC_GOTO((sp), L__gp->tmp_bp, L__gp->tmp_blen, (nlen));\ (bp) = L__gp->tmp_bp; \ @@ -90,7 +90,7 @@ } #define ADD_SPACE_RET(sp, bp, blen, nlen) { \ GS *L__gp = (sp) == NULL ? NULL : (sp)->gp; \ - if (L__gp == NULL || (bp) == L__gp->tmp_bp) { \ + if (L__gp != NULL && (bp) == L__gp->tmp_bp) { \ F_CLR(L__gp, G_TMP_INUSE); \ BINC_RET((sp), L__gp->tmp_bp, L__gp->tmp_blen, (nlen)); \ (bp) = L__gp->tmp_bp; \