xref: /vim-8.2.3635/src/eval.c (revision f2a44e5c)
1 /* vi:set ts=8 sts=4 sw=4 noet:
2  *
3  * VIM - Vi IMproved	by Bram Moolenaar
4  *
5  * Do ":help uganda"  in Vim to read copying and usage conditions.
6  * Do ":help credits" in Vim to see a list of people who contributed.
7  * See README.txt for an overview of the Vim source code.
8  */
9 
10 /*
11  * eval.c: Expression evaluation.
12  */
13 #define USING_FLOAT_STUFF
14 
15 #include "vim.h"
16 
17 #if defined(FEAT_EVAL) || defined(PROTO)
18 
19 #ifdef VMS
20 # include <float.h>
21 #endif
22 
23 static char *e_missbrac = N_("E111: Missing ']'");
24 static char *e_dictrange = N_("E719: Cannot use [:] with a Dictionary");
25 #ifdef FEAT_FLOAT
26 static char *e_float_as_string = N_("E806: using Float as a String");
27 #endif
28 static char *e_nowhitespace = N_("E274: No white space allowed before parenthesis");
29 
30 #define NAMESPACE_CHAR	(char_u *)"abglstvw"
31 
32 /*
33  * When recursively copying lists and dicts we need to remember which ones we
34  * have done to avoid endless recursiveness.  This unique ID is used for that.
35  * The last bit is used for previous_funccal, ignored when comparing.
36  */
37 static int current_copyID = 0;
38 
39 static int echo_attr = 0;   // attributes used for ":echo"
40 
41 /*
42  * Info used by a ":for" loop.
43  */
44 typedef struct
45 {
46     int		fi_semicolon;	// TRUE if ending in '; var]'
47     int		fi_varcount;	// nr of variables in the list
48     listwatch_T	fi_lw;		// keep an eye on the item used.
49     list_T	*fi_list;	// list being used
50     int		fi_bi;		// index of blob
51     blob_T	*fi_blob;	// blob being used
52 } forinfo_T;
53 
54 static int tv_op(typval_T *tv1, typval_T *tv2, char_u  *op);
55 static int eval2(char_u **arg, typval_T *rettv, int evaluate);
56 static int eval3(char_u **arg, typval_T *rettv, int evaluate);
57 static int eval4(char_u **arg, typval_T *rettv, int evaluate);
58 static int eval5(char_u **arg, typval_T *rettv, int evaluate);
59 static int eval6(char_u **arg, typval_T *rettv, int evaluate, int want_string);
60 static int eval7(char_u **arg, typval_T *rettv, int evaluate, int want_string);
61 static int eval7_leader(typval_T *rettv, char_u *start_leader, char_u **end_leaderp);
62 
63 static int get_string_tv(char_u **arg, typval_T *rettv, int evaluate);
64 static int get_lit_string_tv(char_u **arg, typval_T *rettv, int evaluate);
65 static int free_unref_items(int copyID);
66 static int get_env_tv(char_u **arg, typval_T *rettv, int evaluate);
67 static char_u *make_expanded_name(char_u *in_start, char_u *expr_start, char_u *expr_end, char_u *in_end);
68 static int tv_check_lock(typval_T *tv, char_u *name, int use_gettext);
69 
70 /*
71  * Return "n1" divided by "n2", taking care of dividing by zero.
72  */
73 	varnumber_T
74 num_divide(varnumber_T n1, varnumber_T n2)
75 {
76     varnumber_T	result;
77 
78     if (n2 == 0)	// give an error message?
79     {
80 	if (n1 == 0)
81 	    result = VARNUM_MIN; // similar to NaN
82 	else if (n1 < 0)
83 	    result = -VARNUM_MAX;
84 	else
85 	    result = VARNUM_MAX;
86     }
87     else
88 	result = n1 / n2;
89 
90     return result;
91 }
92 
93 /*
94  * Return "n1" modulus "n2", taking care of dividing by zero.
95  */
96 	varnumber_T
97 num_modulus(varnumber_T n1, varnumber_T n2)
98 {
99     // Give an error when n2 is 0?
100     return (n2 == 0) ? 0 : (n1 % n2);
101 }
102 
103 #if defined(EBCDIC) || defined(PROTO)
104 /*
105  * Compare struct fst by function name.
106  */
107     static int
108 compare_func_name(const void *s1, const void *s2)
109 {
110     struct fst *p1 = (struct fst *)s1;
111     struct fst *p2 = (struct fst *)s2;
112 
113     return STRCMP(p1->f_name, p2->f_name);
114 }
115 
116 /*
117  * Sort the function table by function name.
118  * The sorting of the table above is ASCII dependent.
119  * On machines using EBCDIC we have to sort it.
120  */
121     static void
122 sortFunctions(void)
123 {
124     int		funcCnt = (int)(sizeof(functions) / sizeof(struct fst)) - 1;
125 
126     qsort(functions, (size_t)funcCnt, sizeof(struct fst), compare_func_name);
127 }
128 #endif
129 
130 /*
131  * Initialize the global and v: variables.
132  */
133     void
134 eval_init(void)
135 {
136     evalvars_init();
137     func_init();
138 
139 #ifdef EBCDIC
140     /*
141      * Sort the function table, to enable binary search.
142      */
143     sortFunctions();
144 #endif
145 }
146 
147 #if defined(EXITFREE) || defined(PROTO)
148     void
149 eval_clear(void)
150 {
151     evalvars_clear();
152     free_scriptnames();  // must come after evalvars_clear().
153     free_locales();
154 
155     // autoloaded script names
156     free_autoload_scriptnames();
157 
158     // unreferenced lists and dicts
159     (void)garbage_collect(FALSE);
160 
161     // functions not garbage collected
162     free_all_functions();
163 }
164 #endif
165 
166 /*
167  * Top level evaluation function, returning a boolean.
168  * Sets "error" to TRUE if there was an error.
169  * Return TRUE or FALSE.
170  */
171     int
172 eval_to_bool(
173     char_u	*arg,
174     int		*error,
175     char_u	**nextcmd,
176     int		skip)	    // only parse, don't execute
177 {
178     typval_T	tv;
179     varnumber_T	retval = FALSE;
180 
181     if (skip)
182 	++emsg_skip;
183     if (eval0(arg, &tv, nextcmd, !skip) == FAIL)
184 	*error = TRUE;
185     else
186     {
187 	*error = FALSE;
188 	if (!skip)
189 	{
190 	    retval = (tv_get_number_chk(&tv, error) != 0);
191 	    clear_tv(&tv);
192 	}
193     }
194     if (skip)
195 	--emsg_skip;
196 
197     return (int)retval;
198 }
199 
200 /*
201  * Call eval1() and give an error message if not done at a lower level.
202  */
203     static int
204 eval1_emsg(char_u **arg, typval_T *rettv, int evaluate)
205 {
206     char_u	*start = *arg;
207     int		ret;
208     int		did_emsg_before = did_emsg;
209     int		called_emsg_before = called_emsg;
210 
211     ret = eval1(arg, rettv, evaluate);
212     if (ret == FAIL)
213     {
214 	// Report the invalid expression unless the expression evaluation has
215 	// been cancelled due to an aborting error, an interrupt, or an
216 	// exception, or we already gave a more specific error.
217 	// Also check called_emsg for when using assert_fails().
218 	if (!aborting() && did_emsg == did_emsg_before
219 					  && called_emsg == called_emsg_before)
220 	    semsg(_(e_invexpr2), start);
221     }
222     return ret;
223 }
224 
225     int
226 eval_expr_typval(typval_T *expr, typval_T *argv, int argc, typval_T *rettv)
227 {
228     char_u	*s;
229     char_u	buf[NUMBUFLEN];
230     funcexe_T	funcexe;
231 
232     if (expr->v_type == VAR_FUNC)
233     {
234 	s = expr->vval.v_string;
235 	if (s == NULL || *s == NUL)
236 	    return FAIL;
237 	vim_memset(&funcexe, 0, sizeof(funcexe));
238 	funcexe.evaluate = TRUE;
239 	if (call_func(s, -1, rettv, argc, argv, &funcexe) == FAIL)
240 	    return FAIL;
241     }
242     else if (expr->v_type == VAR_PARTIAL)
243     {
244 	partial_T   *partial = expr->vval.v_partial;
245 
246 	s = partial_name(partial);
247 	if (s == NULL || *s == NUL)
248 	    return FAIL;
249 	vim_memset(&funcexe, 0, sizeof(funcexe));
250 	funcexe.evaluate = TRUE;
251 	funcexe.partial = partial;
252 	if (call_func(s, -1, rettv, argc, argv, &funcexe) == FAIL)
253 	    return FAIL;
254     }
255     else
256     {
257 	s = tv_get_string_buf_chk(expr, buf);
258 	if (s == NULL)
259 	    return FAIL;
260 	s = skipwhite(s);
261 	if (eval1_emsg(&s, rettv, TRUE) == FAIL)
262 	    return FAIL;
263 	if (*s != NUL)  // check for trailing chars after expr
264 	{
265 	    clear_tv(rettv);
266 	    semsg(_(e_invexpr2), s);
267 	    return FAIL;
268 	}
269     }
270     return OK;
271 }
272 
273 /*
274  * Like eval_to_bool() but using a typval_T instead of a string.
275  * Works for string, funcref and partial.
276  */
277     int
278 eval_expr_to_bool(typval_T *expr, int *error)
279 {
280     typval_T	rettv;
281     int		res;
282 
283     if (eval_expr_typval(expr, NULL, 0, &rettv) == FAIL)
284     {
285 	*error = TRUE;
286 	return FALSE;
287     }
288     res = (tv_get_number_chk(&rettv, error) != 0);
289     clear_tv(&rettv);
290     return res;
291 }
292 
293 /*
294  * Top level evaluation function, returning a string.  If "skip" is TRUE,
295  * only parsing to "nextcmd" is done, without reporting errors.  Return
296  * pointer to allocated memory, or NULL for failure or when "skip" is TRUE.
297  */
298     char_u *
299 eval_to_string_skip(
300     char_u	*arg,
301     char_u	**nextcmd,
302     int		skip)	    // only parse, don't execute
303 {
304     typval_T	tv;
305     char_u	*retval;
306 
307     if (skip)
308 	++emsg_skip;
309     if (eval0(arg, &tv, nextcmd, !skip) == FAIL || skip)
310 	retval = NULL;
311     else
312     {
313 	retval = vim_strsave(tv_get_string(&tv));
314 	clear_tv(&tv);
315     }
316     if (skip)
317 	--emsg_skip;
318 
319     return retval;
320 }
321 
322 /*
323  * Skip over an expression at "*pp".
324  * Return FAIL for an error, OK otherwise.
325  */
326     int
327 skip_expr(char_u **pp)
328 {
329     typval_T	rettv;
330 
331     *pp = skipwhite(*pp);
332     return eval1(pp, &rettv, FALSE);
333 }
334 
335 /*
336  * Top level evaluation function, returning a string.
337  * When "convert" is TRUE convert a List into a sequence of lines and convert
338  * a Float to a String.
339  * Return pointer to allocated memory, or NULL for failure.
340  */
341     char_u *
342 eval_to_string(
343     char_u	*arg,
344     char_u	**nextcmd,
345     int		convert)
346 {
347     typval_T	tv;
348     char_u	*retval;
349     garray_T	ga;
350 #ifdef FEAT_FLOAT
351     char_u	numbuf[NUMBUFLEN];
352 #endif
353 
354     if (eval0(arg, &tv, nextcmd, TRUE) == FAIL)
355 	retval = NULL;
356     else
357     {
358 	if (convert && tv.v_type == VAR_LIST)
359 	{
360 	    ga_init2(&ga, (int)sizeof(char), 80);
361 	    if (tv.vval.v_list != NULL)
362 	    {
363 		list_join(&ga, tv.vval.v_list, (char_u *)"\n", TRUE, FALSE, 0);
364 		if (tv.vval.v_list->lv_len > 0)
365 		    ga_append(&ga, NL);
366 	    }
367 	    ga_append(&ga, NUL);
368 	    retval = (char_u *)ga.ga_data;
369 	}
370 #ifdef FEAT_FLOAT
371 	else if (convert && tv.v_type == VAR_FLOAT)
372 	{
373 	    vim_snprintf((char *)numbuf, NUMBUFLEN, "%g", tv.vval.v_float);
374 	    retval = vim_strsave(numbuf);
375 	}
376 #endif
377 	else
378 	    retval = vim_strsave(tv_get_string(&tv));
379 	clear_tv(&tv);
380     }
381 
382     return retval;
383 }
384 
385 /*
386  * Call eval_to_string() without using current local variables and using
387  * textlock.  When "use_sandbox" is TRUE use the sandbox.
388  */
389     char_u *
390 eval_to_string_safe(
391     char_u	*arg,
392     char_u	**nextcmd,
393     int		use_sandbox)
394 {
395     char_u	*retval;
396     funccal_entry_T funccal_entry;
397 
398     save_funccal(&funccal_entry);
399     if (use_sandbox)
400 	++sandbox;
401     ++textlock;
402     retval = eval_to_string(arg, nextcmd, FALSE);
403     if (use_sandbox)
404 	--sandbox;
405     --textlock;
406     restore_funccal();
407     return retval;
408 }
409 
410 /*
411  * Top level evaluation function, returning a number.
412  * Evaluates "expr" silently.
413  * Returns -1 for an error.
414  */
415     varnumber_T
416 eval_to_number(char_u *expr)
417 {
418     typval_T	rettv;
419     varnumber_T	retval;
420     char_u	*p = skipwhite(expr);
421 
422     ++emsg_off;
423 
424     if (eval1(&p, &rettv, TRUE) == FAIL)
425 	retval = -1;
426     else
427     {
428 	retval = tv_get_number_chk(&rettv, NULL);
429 	clear_tv(&rettv);
430     }
431     --emsg_off;
432 
433     return retval;
434 }
435 
436 /*
437  * Top level evaluation function.
438  * Returns an allocated typval_T with the result.
439  * Returns NULL when there is an error.
440  */
441     typval_T *
442 eval_expr(char_u *arg, char_u **nextcmd)
443 {
444     typval_T	*tv;
445 
446     tv = ALLOC_ONE(typval_T);
447     if (tv != NULL && eval0(arg, tv, nextcmd, TRUE) == FAIL)
448 	VIM_CLEAR(tv);
449 
450     return tv;
451 }
452 
453 /*
454  * Call some Vim script function and return the result in "*rettv".
455  * Uses argv[0] to argv[argc - 1] for the function arguments.  argv[argc]
456  * should have type VAR_UNKNOWN.
457  * Returns OK or FAIL.
458  */
459     int
460 call_vim_function(
461     char_u      *func,
462     int		argc,
463     typval_T	*argv,
464     typval_T	*rettv)
465 {
466     int		ret;
467     funcexe_T	funcexe;
468 
469     rettv->v_type = VAR_UNKNOWN;		// clear_tv() uses this
470     vim_memset(&funcexe, 0, sizeof(funcexe));
471     funcexe.firstline = curwin->w_cursor.lnum;
472     funcexe.lastline = curwin->w_cursor.lnum;
473     funcexe.evaluate = TRUE;
474     ret = call_func(func, -1, rettv, argc, argv, &funcexe);
475     if (ret == FAIL)
476 	clear_tv(rettv);
477 
478     return ret;
479 }
480 
481 /*
482  * Call Vim script function "func" and return the result as a number.
483  * Returns -1 when calling the function fails.
484  * Uses argv[0] to argv[argc - 1] for the function arguments. argv[argc] should
485  * have type VAR_UNKNOWN.
486  */
487     varnumber_T
488 call_func_retnr(
489     char_u      *func,
490     int		argc,
491     typval_T	*argv)
492 {
493     typval_T	rettv;
494     varnumber_T	retval;
495 
496     if (call_vim_function(func, argc, argv, &rettv) == FAIL)
497 	return -1;
498 
499     retval = tv_get_number_chk(&rettv, NULL);
500     clear_tv(&rettv);
501     return retval;
502 }
503 
504 /*
505  * Call Vim script function "func" and return the result as a string.
506  * Returns NULL when calling the function fails.
507  * Uses argv[0] to argv[argc - 1] for the function arguments. argv[argc] should
508  * have type VAR_UNKNOWN.
509  */
510     void *
511 call_func_retstr(
512     char_u      *func,
513     int		argc,
514     typval_T	*argv)
515 {
516     typval_T	rettv;
517     char_u	*retval;
518 
519     if (call_vim_function(func, argc, argv, &rettv) == FAIL)
520 	return NULL;
521 
522     retval = vim_strsave(tv_get_string(&rettv));
523     clear_tv(&rettv);
524     return retval;
525 }
526 
527 /*
528  * Call Vim script function "func" and return the result as a List.
529  * Uses argv[0] to argv[argc - 1] for the function arguments. argv[argc] should
530  * have type VAR_UNKNOWN.
531  * Returns NULL when there is something wrong.
532  */
533     void *
534 call_func_retlist(
535     char_u      *func,
536     int		argc,
537     typval_T	*argv)
538 {
539     typval_T	rettv;
540 
541     if (call_vim_function(func, argc, argv, &rettv) == FAIL)
542 	return NULL;
543 
544     if (rettv.v_type != VAR_LIST)
545     {
546 	clear_tv(&rettv);
547 	return NULL;
548     }
549 
550     return rettv.vval.v_list;
551 }
552 
553 #ifdef FEAT_FOLDING
554 /*
555  * Evaluate 'foldexpr'.  Returns the foldlevel, and any character preceding
556  * it in "*cp".  Doesn't give error messages.
557  */
558     int
559 eval_foldexpr(char_u *arg, int *cp)
560 {
561     typval_T	tv;
562     varnumber_T	retval;
563     char_u	*s;
564     int		use_sandbox = was_set_insecurely((char_u *)"foldexpr",
565 								   OPT_LOCAL);
566 
567     ++emsg_off;
568     if (use_sandbox)
569 	++sandbox;
570     ++textlock;
571     *cp = NUL;
572     if (eval0(arg, &tv, NULL, TRUE) == FAIL)
573 	retval = 0;
574     else
575     {
576 	// If the result is a number, just return the number.
577 	if (tv.v_type == VAR_NUMBER)
578 	    retval = tv.vval.v_number;
579 	else if (tv.v_type != VAR_STRING || tv.vval.v_string == NULL)
580 	    retval = 0;
581 	else
582 	{
583 	    // If the result is a string, check if there is a non-digit before
584 	    // the number.
585 	    s = tv.vval.v_string;
586 	    if (!VIM_ISDIGIT(*s) && *s != '-')
587 		*cp = *s++;
588 	    retval = atol((char *)s);
589 	}
590 	clear_tv(&tv);
591     }
592     --emsg_off;
593     if (use_sandbox)
594 	--sandbox;
595     --textlock;
596 
597     return (int)retval;
598 }
599 #endif
600 
601 /*
602  * Get an lval: variable, Dict item or List item that can be assigned a value
603  * to: "name", "na{me}", "name[expr]", "name[expr:expr]", "name[expr][expr]",
604  * "name.key", "name.key[expr]" etc.
605  * Indexing only works if "name" is an existing List or Dictionary.
606  * "name" points to the start of the name.
607  * If "rettv" is not NULL it points to the value to be assigned.
608  * "unlet" is TRUE for ":unlet": slightly different behavior when something is
609  * wrong; must end in space or cmd separator.
610  *
611  * flags:
612  *  GLV_QUIET:       do not give error messages
613  *  GLV_READ_ONLY:   will not change the variable
614  *  GLV_NO_AUTOLOAD: do not use script autoloading
615  *
616  * Returns a pointer to just after the name, including indexes.
617  * When an evaluation error occurs "lp->ll_name" is NULL;
618  * Returns NULL for a parsing error.  Still need to free items in "lp"!
619  */
620     char_u *
621 get_lval(
622     char_u	*name,
623     typval_T	*rettv,
624     lval_T	*lp,
625     int		unlet,
626     int		skip,
627     int		flags,	    // GLV_ values
628     int		fne_flags)  // flags for find_name_end()
629 {
630     char_u	*p;
631     char_u	*expr_start, *expr_end;
632     int		cc;
633     dictitem_T	*v;
634     typval_T	var1;
635     typval_T	var2;
636     int		empty1 = FALSE;
637     listitem_T	*ni;
638     char_u	*key = NULL;
639     int		len;
640     hashtab_T	*ht;
641     int		quiet = flags & GLV_QUIET;
642 
643     // Clear everything in "lp".
644     vim_memset(lp, 0, sizeof(lval_T));
645 
646     if (skip)
647     {
648 	// When skipping just find the end of the name.
649 	lp->ll_name = name;
650 	return find_name_end(name, NULL, NULL, FNE_INCL_BR | fne_flags);
651     }
652 
653     // Find the end of the name.
654     p = find_name_end(name, &expr_start, &expr_end, fne_flags);
655     if (expr_start != NULL)
656     {
657 	// Don't expand the name when we already know there is an error.
658 	if (unlet && !VIM_ISWHITE(*p) && !ends_excmd(*p)
659 						    && *p != '[' && *p != '.')
660 	{
661 	    emsg(_(e_trailing));
662 	    return NULL;
663 	}
664 
665 	lp->ll_exp_name = make_expanded_name(name, expr_start, expr_end, p);
666 	if (lp->ll_exp_name == NULL)
667 	{
668 	    // Report an invalid expression in braces, unless the
669 	    // expression evaluation has been cancelled due to an
670 	    // aborting error, an interrupt, or an exception.
671 	    if (!aborting() && !quiet)
672 	    {
673 		emsg_severe = TRUE;
674 		semsg(_(e_invarg2), name);
675 		return NULL;
676 	    }
677 	}
678 	lp->ll_name = lp->ll_exp_name;
679     }
680     else
681 	lp->ll_name = name;
682 
683     // Without [idx] or .key we are done.
684     if ((*p != '[' && *p != '.') || lp->ll_name == NULL)
685 	return p;
686 
687     cc = *p;
688     *p = NUL;
689     // Only pass &ht when we would write to the variable, it prevents autoload
690     // as well.
691     v = find_var(lp->ll_name, (flags & GLV_READ_ONLY) ? NULL : &ht,
692 						      flags & GLV_NO_AUTOLOAD);
693     if (v == NULL && !quiet)
694 	semsg(_(e_undefvar), lp->ll_name);
695     *p = cc;
696     if (v == NULL)
697 	return NULL;
698 
699     /*
700      * Loop until no more [idx] or .key is following.
701      */
702     lp->ll_tv = &v->di_tv;
703     var1.v_type = VAR_UNKNOWN;
704     var2.v_type = VAR_UNKNOWN;
705     while (*p == '[' || (*p == '.' && lp->ll_tv->v_type == VAR_DICT))
706     {
707 	if (!(lp->ll_tv->v_type == VAR_LIST && lp->ll_tv->vval.v_list != NULL)
708 		&& !(lp->ll_tv->v_type == VAR_DICT
709 					   && lp->ll_tv->vval.v_dict != NULL)
710 		&& !(lp->ll_tv->v_type == VAR_BLOB
711 					   && lp->ll_tv->vval.v_blob != NULL))
712 	{
713 	    if (!quiet)
714 		emsg(_("E689: Can only index a List, Dictionary or Blob"));
715 	    return NULL;
716 	}
717 	if (lp->ll_range)
718 	{
719 	    if (!quiet)
720 		emsg(_("E708: [:] must come last"));
721 	    return NULL;
722 	}
723 
724 	len = -1;
725 	if (*p == '.')
726 	{
727 	    key = p + 1;
728 	    for (len = 0; ASCII_ISALNUM(key[len]) || key[len] == '_'; ++len)
729 		;
730 	    if (len == 0)
731 	    {
732 		if (!quiet)
733 		    emsg(_(e_emptykey));
734 		return NULL;
735 	    }
736 	    p = key + len;
737 	}
738 	else
739 	{
740 	    // Get the index [expr] or the first index [expr: ].
741 	    p = skipwhite(p + 1);
742 	    if (*p == ':')
743 		empty1 = TRUE;
744 	    else
745 	    {
746 		empty1 = FALSE;
747 		if (eval1(&p, &var1, TRUE) == FAIL)	// recursive!
748 		    return NULL;
749 		if (tv_get_string_chk(&var1) == NULL)
750 		{
751 		    // not a number or string
752 		    clear_tv(&var1);
753 		    return NULL;
754 		}
755 	    }
756 
757 	    // Optionally get the second index [ :expr].
758 	    if (*p == ':')
759 	    {
760 		if (lp->ll_tv->v_type == VAR_DICT)
761 		{
762 		    if (!quiet)
763 			emsg(_(e_dictrange));
764 		    clear_tv(&var1);
765 		    return NULL;
766 		}
767 		if (rettv != NULL
768 			&& !(rettv->v_type == VAR_LIST
769 						 && rettv->vval.v_list != NULL)
770 			&& !(rettv->v_type == VAR_BLOB
771 						&& rettv->vval.v_blob != NULL))
772 		{
773 		    if (!quiet)
774 			emsg(_("E709: [:] requires a List or Blob value"));
775 		    clear_tv(&var1);
776 		    return NULL;
777 		}
778 		p = skipwhite(p + 1);
779 		if (*p == ']')
780 		    lp->ll_empty2 = TRUE;
781 		else
782 		{
783 		    lp->ll_empty2 = FALSE;
784 		    if (eval1(&p, &var2, TRUE) == FAIL)	// recursive!
785 		    {
786 			clear_tv(&var1);
787 			return NULL;
788 		    }
789 		    if (tv_get_string_chk(&var2) == NULL)
790 		    {
791 			// not a number or string
792 			clear_tv(&var1);
793 			clear_tv(&var2);
794 			return NULL;
795 		    }
796 		}
797 		lp->ll_range = TRUE;
798 	    }
799 	    else
800 		lp->ll_range = FALSE;
801 
802 	    if (*p != ']')
803 	    {
804 		if (!quiet)
805 		    emsg(_(e_missbrac));
806 		clear_tv(&var1);
807 		clear_tv(&var2);
808 		return NULL;
809 	    }
810 
811 	    // Skip to past ']'.
812 	    ++p;
813 	}
814 
815 	if (lp->ll_tv->v_type == VAR_DICT)
816 	{
817 	    if (len == -1)
818 	    {
819 		// "[key]": get key from "var1"
820 		key = tv_get_string_chk(&var1);	// is number or string
821 		if (key == NULL)
822 		{
823 		    clear_tv(&var1);
824 		    return NULL;
825 		}
826 	    }
827 	    lp->ll_list = NULL;
828 	    lp->ll_dict = lp->ll_tv->vval.v_dict;
829 	    lp->ll_di = dict_find(lp->ll_dict, key, len);
830 
831 	    // When assigning to a scope dictionary check that a function and
832 	    // variable name is valid (only variable name unless it is l: or
833 	    // g: dictionary). Disallow overwriting a builtin function.
834 	    if (rettv != NULL && lp->ll_dict->dv_scope != 0)
835 	    {
836 		int prevval;
837 		int wrong;
838 
839 		if (len != -1)
840 		{
841 		    prevval = key[len];
842 		    key[len] = NUL;
843 		}
844 		else
845 		    prevval = 0; // avoid compiler warning
846 		wrong = (lp->ll_dict->dv_scope == VAR_DEF_SCOPE
847 			       && rettv->v_type == VAR_FUNC
848 			       && var_check_func_name(key, lp->ll_di == NULL))
849 			|| !valid_varname(key);
850 		if (len != -1)
851 		    key[len] = prevval;
852 		if (wrong)
853 		    return NULL;
854 	    }
855 
856 	    if (lp->ll_di == NULL)
857 	    {
858 		// Can't add "v:" or "a:" variable.
859 		if (lp->ll_dict == get_vimvar_dict()
860 			 || &lp->ll_dict->dv_hashtab == get_funccal_args_ht())
861 		{
862 		    semsg(_(e_illvar), name);
863 		    clear_tv(&var1);
864 		    return NULL;
865 		}
866 
867 		// Key does not exist in dict: may need to add it.
868 		if (*p == '[' || *p == '.' || unlet)
869 		{
870 		    if (!quiet)
871 			semsg(_(e_dictkey), key);
872 		    clear_tv(&var1);
873 		    return NULL;
874 		}
875 		if (len == -1)
876 		    lp->ll_newkey = vim_strsave(key);
877 		else
878 		    lp->ll_newkey = vim_strnsave(key, len);
879 		clear_tv(&var1);
880 		if (lp->ll_newkey == NULL)
881 		    p = NULL;
882 		break;
883 	    }
884 	    // existing variable, need to check if it can be changed
885 	    else if ((flags & GLV_READ_ONLY) == 0
886 			     && var_check_ro(lp->ll_di->di_flags, name, FALSE))
887 	    {
888 		clear_tv(&var1);
889 		return NULL;
890 	    }
891 
892 	    clear_tv(&var1);
893 	    lp->ll_tv = &lp->ll_di->di_tv;
894 	}
895 	else if (lp->ll_tv->v_type == VAR_BLOB)
896 	{
897 	    long bloblen = blob_len(lp->ll_tv->vval.v_blob);
898 
899 	    /*
900 	     * Get the number and item for the only or first index of the List.
901 	     */
902 	    if (empty1)
903 		lp->ll_n1 = 0;
904 	    else
905 		// is number or string
906 		lp->ll_n1 = (long)tv_get_number(&var1);
907 	    clear_tv(&var1);
908 
909 	    if (lp->ll_n1 < 0
910 		    || lp->ll_n1 > bloblen
911 		    || (lp->ll_range && lp->ll_n1 == bloblen))
912 	    {
913 		if (!quiet)
914 		    semsg(_(e_blobidx), lp->ll_n1);
915 		clear_tv(&var2);
916 		return NULL;
917 	    }
918 	    if (lp->ll_range && !lp->ll_empty2)
919 	    {
920 		lp->ll_n2 = (long)tv_get_number(&var2);
921 		clear_tv(&var2);
922 		if (lp->ll_n2 < 0
923 			|| lp->ll_n2 >= bloblen
924 			|| lp->ll_n2 < lp->ll_n1)
925 		{
926 		    if (!quiet)
927 			semsg(_(e_blobidx), lp->ll_n2);
928 		    return NULL;
929 		}
930 	    }
931 	    lp->ll_blob = lp->ll_tv->vval.v_blob;
932 	    lp->ll_tv = NULL;
933 	    break;
934 	}
935 	else
936 	{
937 	    /*
938 	     * Get the number and item for the only or first index of the List.
939 	     */
940 	    if (empty1)
941 		lp->ll_n1 = 0;
942 	    else
943 		// is number or string
944 		lp->ll_n1 = (long)tv_get_number(&var1);
945 	    clear_tv(&var1);
946 
947 	    lp->ll_dict = NULL;
948 	    lp->ll_list = lp->ll_tv->vval.v_list;
949 	    lp->ll_li = list_find(lp->ll_list, lp->ll_n1);
950 	    if (lp->ll_li == NULL)
951 	    {
952 		if (lp->ll_n1 < 0)
953 		{
954 		    lp->ll_n1 = 0;
955 		    lp->ll_li = list_find(lp->ll_list, lp->ll_n1);
956 		}
957 	    }
958 	    if (lp->ll_li == NULL)
959 	    {
960 		clear_tv(&var2);
961 		if (!quiet)
962 		    semsg(_(e_listidx), lp->ll_n1);
963 		return NULL;
964 	    }
965 
966 	    /*
967 	     * May need to find the item or absolute index for the second
968 	     * index of a range.
969 	     * When no index given: "lp->ll_empty2" is TRUE.
970 	     * Otherwise "lp->ll_n2" is set to the second index.
971 	     */
972 	    if (lp->ll_range && !lp->ll_empty2)
973 	    {
974 		lp->ll_n2 = (long)tv_get_number(&var2);
975 						    // is number or string
976 		clear_tv(&var2);
977 		if (lp->ll_n2 < 0)
978 		{
979 		    ni = list_find(lp->ll_list, lp->ll_n2);
980 		    if (ni == NULL)
981 		    {
982 			if (!quiet)
983 			    semsg(_(e_listidx), lp->ll_n2);
984 			return NULL;
985 		    }
986 		    lp->ll_n2 = list_idx_of_item(lp->ll_list, ni);
987 		}
988 
989 		// Check that lp->ll_n2 isn't before lp->ll_n1.
990 		if (lp->ll_n1 < 0)
991 		    lp->ll_n1 = list_idx_of_item(lp->ll_list, lp->ll_li);
992 		if (lp->ll_n2 < lp->ll_n1)
993 		{
994 		    if (!quiet)
995 			semsg(_(e_listidx), lp->ll_n2);
996 		    return NULL;
997 		}
998 	    }
999 
1000 	    lp->ll_tv = &lp->ll_li->li_tv;
1001 	}
1002     }
1003 
1004     clear_tv(&var1);
1005     return p;
1006 }
1007 
1008 /*
1009  * Clear lval "lp" that was filled by get_lval().
1010  */
1011     void
1012 clear_lval(lval_T *lp)
1013 {
1014     vim_free(lp->ll_exp_name);
1015     vim_free(lp->ll_newkey);
1016 }
1017 
1018 /*
1019  * Set a variable that was parsed by get_lval() to "rettv".
1020  * "endp" points to just after the parsed name.
1021  * "op" is NULL, "+" for "+=", "-" for "-=", "*" for "*=", "/" for "/=",
1022  * "%" for "%=", "." for ".=" or "=" for "=".
1023  */
1024     void
1025 set_var_lval(
1026     lval_T	*lp,
1027     char_u	*endp,
1028     typval_T	*rettv,
1029     int		copy,
1030     int		is_const,    // Disallow to modify existing variable for :const
1031     char_u	*op)
1032 {
1033     int		cc;
1034     listitem_T	*ri;
1035     dictitem_T	*di;
1036 
1037     if (lp->ll_tv == NULL)
1038     {
1039 	cc = *endp;
1040 	*endp = NUL;
1041 	if (lp->ll_blob != NULL)
1042 	{
1043 	    int	    error = FALSE, val;
1044 
1045 	    if (op != NULL && *op != '=')
1046 	    {
1047 		semsg(_(e_letwrong), op);
1048 		return;
1049 	    }
1050 
1051 	    if (lp->ll_range && rettv->v_type == VAR_BLOB)
1052 	    {
1053 		int	il, ir;
1054 
1055 		if (lp->ll_empty2)
1056 		    lp->ll_n2 = blob_len(lp->ll_blob) - 1;
1057 
1058 		if (lp->ll_n2 - lp->ll_n1 + 1 != blob_len(rettv->vval.v_blob))
1059 		{
1060 		    emsg(_("E972: Blob value does not have the right number of bytes"));
1061 		    return;
1062 		}
1063 		if (lp->ll_empty2)
1064 		    lp->ll_n2 = blob_len(lp->ll_blob);
1065 
1066 		ir = 0;
1067 		for (il = lp->ll_n1; il <= lp->ll_n2; il++)
1068 		    blob_set(lp->ll_blob, il,
1069 			    blob_get(rettv->vval.v_blob, ir++));
1070 	    }
1071 	    else
1072 	    {
1073 		val = (int)tv_get_number_chk(rettv, &error);
1074 		if (!error)
1075 		{
1076 		    garray_T *gap = &lp->ll_blob->bv_ga;
1077 
1078 		    // Allow for appending a byte.  Setting a byte beyond
1079 		    // the end is an error otherwise.
1080 		    if (lp->ll_n1 < gap->ga_len
1081 			    || (lp->ll_n1 == gap->ga_len
1082 				&& ga_grow(&lp->ll_blob->bv_ga, 1) == OK))
1083 		    {
1084 			blob_set(lp->ll_blob, lp->ll_n1, val);
1085 			if (lp->ll_n1 == gap->ga_len)
1086 			    ++gap->ga_len;
1087 		    }
1088 		    // error for invalid range was already given in get_lval()
1089 		}
1090 	    }
1091 	}
1092 	else if (op != NULL && *op != '=')
1093 	{
1094 	    typval_T tv;
1095 
1096 	    if (is_const)
1097 	    {
1098 		emsg(_(e_cannot_mod));
1099 		*endp = cc;
1100 		return;
1101 	    }
1102 
1103 	    // handle +=, -=, *=, /=, %= and .=
1104 	    di = NULL;
1105 	    if (get_var_tv(lp->ll_name, (int)STRLEN(lp->ll_name),
1106 					     &tv, &di, TRUE, FALSE) == OK)
1107 	    {
1108 		if ((di == NULL
1109 			 || (!var_check_ro(di->di_flags, lp->ll_name, FALSE)
1110 			   && !tv_check_lock(&di->di_tv, lp->ll_name, FALSE)))
1111 			&& tv_op(&tv, rettv, op) == OK)
1112 		    set_var(lp->ll_name, &tv, FALSE);
1113 		clear_tv(&tv);
1114 	    }
1115 	}
1116 	else
1117 	    set_var_const(lp->ll_name, rettv, copy, is_const);
1118 	*endp = cc;
1119     }
1120     else if (var_check_lock(lp->ll_newkey == NULL
1121 		? lp->ll_tv->v_lock
1122 		: lp->ll_tv->vval.v_dict->dv_lock, lp->ll_name, FALSE))
1123 	;
1124     else if (lp->ll_range)
1125     {
1126 	listitem_T *ll_li = lp->ll_li;
1127 	int	    ll_n1 = lp->ll_n1;
1128 
1129 	if (is_const)
1130 	{
1131 	    emsg(_("E996: Cannot lock a range"));
1132 	    return;
1133 	}
1134 
1135 	/*
1136 	 * Check whether any of the list items is locked
1137 	 */
1138 	for (ri = rettv->vval.v_list->lv_first; ri != NULL && ll_li != NULL; )
1139 	{
1140 	    if (var_check_lock(ll_li->li_tv.v_lock, lp->ll_name, FALSE))
1141 		return;
1142 	    ri = ri->li_next;
1143 	    if (ri == NULL || (!lp->ll_empty2 && lp->ll_n2 == ll_n1))
1144 		break;
1145 	    ll_li = ll_li->li_next;
1146 	    ++ll_n1;
1147 	}
1148 
1149 	/*
1150 	 * Assign the List values to the list items.
1151 	 */
1152 	for (ri = rettv->vval.v_list->lv_first; ri != NULL; )
1153 	{
1154 	    if (op != NULL && *op != '=')
1155 		tv_op(&lp->ll_li->li_tv, &ri->li_tv, op);
1156 	    else
1157 	    {
1158 		clear_tv(&lp->ll_li->li_tv);
1159 		copy_tv(&ri->li_tv, &lp->ll_li->li_tv);
1160 	    }
1161 	    ri = ri->li_next;
1162 	    if (ri == NULL || (!lp->ll_empty2 && lp->ll_n2 == lp->ll_n1))
1163 		break;
1164 	    if (lp->ll_li->li_next == NULL)
1165 	    {
1166 		// Need to add an empty item.
1167 		if (list_append_number(lp->ll_list, 0) == FAIL)
1168 		{
1169 		    ri = NULL;
1170 		    break;
1171 		}
1172 	    }
1173 	    lp->ll_li = lp->ll_li->li_next;
1174 	    ++lp->ll_n1;
1175 	}
1176 	if (ri != NULL)
1177 	    emsg(_("E710: List value has more items than target"));
1178 	else if (lp->ll_empty2
1179 		? (lp->ll_li != NULL && lp->ll_li->li_next != NULL)
1180 		: lp->ll_n1 != lp->ll_n2)
1181 	    emsg(_("E711: List value has not enough items"));
1182     }
1183     else
1184     {
1185 	/*
1186 	 * Assign to a List or Dictionary item.
1187 	 */
1188 	if (is_const)
1189 	{
1190 	    emsg(_("E996: Cannot lock a list or dict"));
1191 	    return;
1192 	}
1193 	if (lp->ll_newkey != NULL)
1194 	{
1195 	    if (op != NULL && *op != '=')
1196 	    {
1197 		semsg(_(e_letwrong), op);
1198 		return;
1199 	    }
1200 
1201 	    // Need to add an item to the Dictionary.
1202 	    di = dictitem_alloc(lp->ll_newkey);
1203 	    if (di == NULL)
1204 		return;
1205 	    if (dict_add(lp->ll_tv->vval.v_dict, di) == FAIL)
1206 	    {
1207 		vim_free(di);
1208 		return;
1209 	    }
1210 	    lp->ll_tv = &di->di_tv;
1211 	}
1212 	else if (op != NULL && *op != '=')
1213 	{
1214 	    tv_op(lp->ll_tv, rettv, op);
1215 	    return;
1216 	}
1217 	else
1218 	    clear_tv(lp->ll_tv);
1219 
1220 	/*
1221 	 * Assign the value to the variable or list item.
1222 	 */
1223 	if (copy)
1224 	    copy_tv(rettv, lp->ll_tv);
1225 	else
1226 	{
1227 	    *lp->ll_tv = *rettv;
1228 	    lp->ll_tv->v_lock = 0;
1229 	    init_tv(rettv);
1230 	}
1231     }
1232 }
1233 
1234 /*
1235  * Handle "tv1 += tv2", "tv1 -= tv2", "tv1 *= tv2", "tv1 /= tv2", "tv1 %= tv2"
1236  * and "tv1 .= tv2"
1237  * Returns OK or FAIL.
1238  */
1239     static int
1240 tv_op(typval_T *tv1, typval_T *tv2, char_u *op)
1241 {
1242     varnumber_T	n;
1243     char_u	numbuf[NUMBUFLEN];
1244     char_u	*s;
1245 
1246     // Can't do anything with a Funcref, Dict, v:true on the right.
1247     if (tv2->v_type != VAR_FUNC && tv2->v_type != VAR_DICT
1248 		      && tv2->v_type != VAR_BOOL && tv2->v_type != VAR_SPECIAL)
1249     {
1250 	switch (tv1->v_type)
1251 	{
1252 	    case VAR_UNKNOWN:
1253 	    case VAR_DICT:
1254 	    case VAR_FUNC:
1255 	    case VAR_PARTIAL:
1256 	    case VAR_BOOL:
1257 	    case VAR_SPECIAL:
1258 	    case VAR_JOB:
1259 	    case VAR_CHANNEL:
1260 		break;
1261 
1262 	    case VAR_BLOB:
1263 		if (*op != '+' || tv2->v_type != VAR_BLOB)
1264 		    break;
1265 		// BLOB += BLOB
1266 		if (tv1->vval.v_blob != NULL && tv2->vval.v_blob != NULL)
1267 		{
1268 		    blob_T  *b1 = tv1->vval.v_blob;
1269 		    blob_T  *b2 = tv2->vval.v_blob;
1270 		    int	i, len = blob_len(b2);
1271 		    for (i = 0; i < len; i++)
1272 			ga_append(&b1->bv_ga, blob_get(b2, i));
1273 		}
1274 		return OK;
1275 
1276 	    case VAR_LIST:
1277 		if (*op != '+' || tv2->v_type != VAR_LIST)
1278 		    break;
1279 		// List += List
1280 		if (tv1->vval.v_list != NULL && tv2->vval.v_list != NULL)
1281 		    list_extend(tv1->vval.v_list, tv2->vval.v_list, NULL);
1282 		return OK;
1283 
1284 	    case VAR_NUMBER:
1285 	    case VAR_STRING:
1286 		if (tv2->v_type == VAR_LIST)
1287 		    break;
1288 		if (vim_strchr((char_u *)"+-*/%", *op) != NULL)
1289 		{
1290 		    // nr += nr , nr -= nr , nr *=nr , nr /= nr , nr %= nr
1291 		    n = tv_get_number(tv1);
1292 #ifdef FEAT_FLOAT
1293 		    if (tv2->v_type == VAR_FLOAT)
1294 		    {
1295 			float_T f = n;
1296 
1297 			if (*op == '%')
1298 			    break;
1299 			switch (*op)
1300 			{
1301 			    case '+': f += tv2->vval.v_float; break;
1302 			    case '-': f -= tv2->vval.v_float; break;
1303 			    case '*': f *= tv2->vval.v_float; break;
1304 			    case '/': f /= tv2->vval.v_float; break;
1305 			}
1306 			clear_tv(tv1);
1307 			tv1->v_type = VAR_FLOAT;
1308 			tv1->vval.v_float = f;
1309 		    }
1310 		    else
1311 #endif
1312 		    {
1313 			switch (*op)
1314 			{
1315 			    case '+': n += tv_get_number(tv2); break;
1316 			    case '-': n -= tv_get_number(tv2); break;
1317 			    case '*': n *= tv_get_number(tv2); break;
1318 			    case '/': n = num_divide(n, tv_get_number(tv2)); break;
1319 			    case '%': n = num_modulus(n, tv_get_number(tv2)); break;
1320 			}
1321 			clear_tv(tv1);
1322 			tv1->v_type = VAR_NUMBER;
1323 			tv1->vval.v_number = n;
1324 		    }
1325 		}
1326 		else
1327 		{
1328 		    if (tv2->v_type == VAR_FLOAT)
1329 			break;
1330 
1331 		    // str .= str
1332 		    s = tv_get_string(tv1);
1333 		    s = concat_str(s, tv_get_string_buf(tv2, numbuf));
1334 		    clear_tv(tv1);
1335 		    tv1->v_type = VAR_STRING;
1336 		    tv1->vval.v_string = s;
1337 		}
1338 		return OK;
1339 
1340 	    case VAR_FLOAT:
1341 #ifdef FEAT_FLOAT
1342 		{
1343 		    float_T f;
1344 
1345 		    if (*op == '%' || *op == '.'
1346 				   || (tv2->v_type != VAR_FLOAT
1347 				    && tv2->v_type != VAR_NUMBER
1348 				    && tv2->v_type != VAR_STRING))
1349 			break;
1350 		    if (tv2->v_type == VAR_FLOAT)
1351 			f = tv2->vval.v_float;
1352 		    else
1353 			f = tv_get_number(tv2);
1354 		    switch (*op)
1355 		    {
1356 			case '+': tv1->vval.v_float += f; break;
1357 			case '-': tv1->vval.v_float -= f; break;
1358 			case '*': tv1->vval.v_float *= f; break;
1359 			case '/': tv1->vval.v_float /= f; break;
1360 		    }
1361 		}
1362 #endif
1363 		return OK;
1364 	}
1365     }
1366 
1367     semsg(_(e_letwrong), op);
1368     return FAIL;
1369 }
1370 
1371 /*
1372  * Evaluate the expression used in a ":for var in expr" command.
1373  * "arg" points to "var".
1374  * Set "*errp" to TRUE for an error, FALSE otherwise;
1375  * Return a pointer that holds the info.  Null when there is an error.
1376  */
1377     void *
1378 eval_for_line(
1379     char_u	*arg,
1380     int		*errp,
1381     char_u	**nextcmdp,
1382     int		skip)
1383 {
1384     forinfo_T	*fi;
1385     char_u	*expr;
1386     typval_T	tv;
1387     list_T	*l;
1388 
1389     *errp = TRUE;	// default: there is an error
1390 
1391     fi = ALLOC_CLEAR_ONE(forinfo_T);
1392     if (fi == NULL)
1393 	return NULL;
1394 
1395     expr = skip_var_list(arg, &fi->fi_varcount, &fi->fi_semicolon);
1396     if (expr == NULL)
1397 	return fi;
1398 
1399     expr = skipwhite(expr);
1400     if (expr[0] != 'i' || expr[1] != 'n' || !VIM_ISWHITE(expr[2]))
1401     {
1402 	emsg(_("E690: Missing \"in\" after :for"));
1403 	return fi;
1404     }
1405 
1406     if (skip)
1407 	++emsg_skip;
1408     if (eval0(skipwhite(expr + 2), &tv, nextcmdp, !skip) == OK)
1409     {
1410 	*errp = FALSE;
1411 	if (!skip)
1412 	{
1413 	    if (tv.v_type == VAR_LIST)
1414 	    {
1415 		l = tv.vval.v_list;
1416 		if (l == NULL)
1417 		{
1418 		    // a null list is like an empty list: do nothing
1419 		    clear_tv(&tv);
1420 		}
1421 		else
1422 		{
1423 		    // No need to increment the refcount, it's already set for
1424 		    // the list being used in "tv".
1425 		    fi->fi_list = l;
1426 		    list_add_watch(l, &fi->fi_lw);
1427 		    fi->fi_lw.lw_item = l->lv_first;
1428 		}
1429 	    }
1430 	    else if (tv.v_type == VAR_BLOB)
1431 	    {
1432 		fi->fi_bi = 0;
1433 		if (tv.vval.v_blob != NULL)
1434 		{
1435 		    typval_T btv;
1436 
1437 		    // Make a copy, so that the iteration still works when the
1438 		    // blob is changed.
1439 		    blob_copy(&tv, &btv);
1440 		    fi->fi_blob = btv.vval.v_blob;
1441 		}
1442 		clear_tv(&tv);
1443 	    }
1444 	    else
1445 	    {
1446 		emsg(_(e_listreq));
1447 		clear_tv(&tv);
1448 	    }
1449 	}
1450     }
1451     if (skip)
1452 	--emsg_skip;
1453 
1454     return fi;
1455 }
1456 
1457 /*
1458  * Use the first item in a ":for" list.  Advance to the next.
1459  * Assign the values to the variable (list).  "arg" points to the first one.
1460  * Return TRUE when a valid item was found, FALSE when at end of list or
1461  * something wrong.
1462  */
1463     int
1464 next_for_item(void *fi_void, char_u *arg)
1465 {
1466     forinfo_T	*fi = (forinfo_T *)fi_void;
1467     int		result;
1468     listitem_T	*item;
1469 
1470     if (fi->fi_blob != NULL)
1471     {
1472 	typval_T	tv;
1473 
1474 	if (fi->fi_bi >= blob_len(fi->fi_blob))
1475 	    return FALSE;
1476 	tv.v_type = VAR_NUMBER;
1477 	tv.v_lock = VAR_FIXED;
1478 	tv.vval.v_number = blob_get(fi->fi_blob, fi->fi_bi);
1479 	++fi->fi_bi;
1480 	return ex_let_vars(arg, &tv, TRUE, fi->fi_semicolon,
1481 					   fi->fi_varcount, FALSE, NULL) == OK;
1482     }
1483 
1484     item = fi->fi_lw.lw_item;
1485     if (item == NULL)
1486 	result = FALSE;
1487     else
1488     {
1489 	fi->fi_lw.lw_item = item->li_next;
1490 	result = (ex_let_vars(arg, &item->li_tv, TRUE, fi->fi_semicolon,
1491 					  fi->fi_varcount, FALSE, NULL) == OK);
1492     }
1493     return result;
1494 }
1495 
1496 /*
1497  * Free the structure used to store info used by ":for".
1498  */
1499     void
1500 free_for_info(void *fi_void)
1501 {
1502     forinfo_T    *fi = (forinfo_T *)fi_void;
1503 
1504     if (fi != NULL && fi->fi_list != NULL)
1505     {
1506 	list_rem_watch(fi->fi_list, &fi->fi_lw);
1507 	list_unref(fi->fi_list);
1508     }
1509     if (fi != NULL && fi->fi_blob != NULL)
1510 	blob_unref(fi->fi_blob);
1511     vim_free(fi);
1512 }
1513 
1514     void
1515 set_context_for_expression(
1516     expand_T	*xp,
1517     char_u	*arg,
1518     cmdidx_T	cmdidx)
1519 {
1520     int		got_eq = FALSE;
1521     int		c;
1522     char_u	*p;
1523 
1524     if (cmdidx == CMD_let || cmdidx == CMD_const)
1525     {
1526 	xp->xp_context = EXPAND_USER_VARS;
1527 	if (vim_strpbrk(arg, (char_u *)"\"'+-*/%.=!?~|&$([<>,#") == NULL)
1528 	{
1529 	    // ":let var1 var2 ...": find last space.
1530 	    for (p = arg + STRLEN(arg); p >= arg; )
1531 	    {
1532 		xp->xp_pattern = p;
1533 		MB_PTR_BACK(arg, p);
1534 		if (VIM_ISWHITE(*p))
1535 		    break;
1536 	    }
1537 	    return;
1538 	}
1539     }
1540     else
1541 	xp->xp_context = cmdidx == CMD_call ? EXPAND_FUNCTIONS
1542 							  : EXPAND_EXPRESSION;
1543     while ((xp->xp_pattern = vim_strpbrk(arg,
1544 				  (char_u *)"\"'+-*/%.=!?~|&$([<>,#")) != NULL)
1545     {
1546 	c = *xp->xp_pattern;
1547 	if (c == '&')
1548 	{
1549 	    c = xp->xp_pattern[1];
1550 	    if (c == '&')
1551 	    {
1552 		++xp->xp_pattern;
1553 		xp->xp_context = cmdidx != CMD_let || got_eq
1554 					 ? EXPAND_EXPRESSION : EXPAND_NOTHING;
1555 	    }
1556 	    else if (c != ' ')
1557 	    {
1558 		xp->xp_context = EXPAND_SETTINGS;
1559 		if ((c == 'l' || c == 'g') && xp->xp_pattern[2] == ':')
1560 		    xp->xp_pattern += 2;
1561 
1562 	    }
1563 	}
1564 	else if (c == '$')
1565 	{
1566 	    // environment variable
1567 	    xp->xp_context = EXPAND_ENV_VARS;
1568 	}
1569 	else if (c == '=')
1570 	{
1571 	    got_eq = TRUE;
1572 	    xp->xp_context = EXPAND_EXPRESSION;
1573 	}
1574 	else if (c == '#'
1575 		&& xp->xp_context == EXPAND_EXPRESSION)
1576 	{
1577 	    // Autoload function/variable contains '#'.
1578 	    break;
1579 	}
1580 	else if ((c == '<' || c == '#')
1581 		&& xp->xp_context == EXPAND_FUNCTIONS
1582 		&& vim_strchr(xp->xp_pattern, '(') == NULL)
1583 	{
1584 	    // Function name can start with "<SNR>" and contain '#'.
1585 	    break;
1586 	}
1587 	else if (cmdidx != CMD_let || got_eq)
1588 	{
1589 	    if (c == '"')	    // string
1590 	    {
1591 		while ((c = *++xp->xp_pattern) != NUL && c != '"')
1592 		    if (c == '\\' && xp->xp_pattern[1] != NUL)
1593 			++xp->xp_pattern;
1594 		xp->xp_context = EXPAND_NOTHING;
1595 	    }
1596 	    else if (c == '\'')	    // literal string
1597 	    {
1598 		// Trick: '' is like stopping and starting a literal string.
1599 		while ((c = *++xp->xp_pattern) != NUL && c != '\'')
1600 		    /* skip */ ;
1601 		xp->xp_context = EXPAND_NOTHING;
1602 	    }
1603 	    else if (c == '|')
1604 	    {
1605 		if (xp->xp_pattern[1] == '|')
1606 		{
1607 		    ++xp->xp_pattern;
1608 		    xp->xp_context = EXPAND_EXPRESSION;
1609 		}
1610 		else
1611 		    xp->xp_context = EXPAND_COMMANDS;
1612 	    }
1613 	    else
1614 		xp->xp_context = EXPAND_EXPRESSION;
1615 	}
1616 	else
1617 	    // Doesn't look like something valid, expand as an expression
1618 	    // anyway.
1619 	    xp->xp_context = EXPAND_EXPRESSION;
1620 	arg = xp->xp_pattern;
1621 	if (*arg != NUL)
1622 	    while ((c = *++arg) != NUL && (c == ' ' || c == '\t'))
1623 		/* skip */ ;
1624     }
1625     xp->xp_pattern = arg;
1626 }
1627 
1628 /*
1629  * Return TRUE if "pat" matches "text".
1630  * Does not use 'cpo' and always uses 'magic'.
1631  */
1632     int
1633 pattern_match(char_u *pat, char_u *text, int ic)
1634 {
1635     int		matches = FALSE;
1636     char_u	*save_cpo;
1637     regmatch_T	regmatch;
1638 
1639     // avoid 'l' flag in 'cpoptions'
1640     save_cpo = p_cpo;
1641     p_cpo = (char_u *)"";
1642     regmatch.regprog = vim_regcomp(pat, RE_MAGIC + RE_STRING);
1643     if (regmatch.regprog != NULL)
1644     {
1645 	regmatch.rm_ic = ic;
1646 	matches = vim_regexec_nl(&regmatch, text, (colnr_T)0);
1647 	vim_regfree(regmatch.regprog);
1648     }
1649     p_cpo = save_cpo;
1650     return matches;
1651 }
1652 
1653 /*
1654  * Handle a name followed by "(".  Both for just "name(arg)" and for
1655  * "expr->name(arg)".
1656  * Returns OK or FAIL.
1657  */
1658     static int
1659 eval_func(
1660 	char_u	    **arg,	// points to "(", will be advanced
1661 	char_u	    *name,
1662 	int	    name_len,
1663 	typval_T    *rettv,
1664 	int	    evaluate,
1665 	typval_T    *basetv)	// "expr" for "expr->name(arg)"
1666 {
1667     char_u	*s = name;
1668     int		len = name_len;
1669     partial_T	*partial;
1670     int		ret = OK;
1671 
1672     if (!evaluate)
1673 	check_vars(s, len);
1674 
1675     // If "s" is the name of a variable of type VAR_FUNC
1676     // use its contents.
1677     s = deref_func_name(s, &len, &partial, !evaluate);
1678 
1679     // Need to make a copy, in case evaluating the arguments makes
1680     // the name invalid.
1681     s = vim_strsave(s);
1682     if (s == NULL)
1683 	ret = FAIL;
1684     else
1685     {
1686 	funcexe_T funcexe;
1687 
1688 	// Invoke the function.
1689 	vim_memset(&funcexe, 0, sizeof(funcexe));
1690 	funcexe.firstline = curwin->w_cursor.lnum;
1691 	funcexe.lastline = curwin->w_cursor.lnum;
1692 	funcexe.evaluate = evaluate;
1693 	funcexe.partial = partial;
1694 	funcexe.basetv = basetv;
1695 	ret = get_func_tv(s, len, rettv, arg, &funcexe);
1696     }
1697     vim_free(s);
1698 
1699     // If evaluate is FALSE rettv->v_type was not set in
1700     // get_func_tv, but it's needed in handle_subscript() to parse
1701     // what follows. So set it here.
1702     if (rettv->v_type == VAR_UNKNOWN && !evaluate && **arg == '(')
1703     {
1704 	rettv->vval.v_string = NULL;
1705 	rettv->v_type = VAR_FUNC;
1706     }
1707 
1708     // Stop the expression evaluation when immediately
1709     // aborting on error, or when an interrupt occurred or
1710     // an exception was thrown but not caught.
1711     if (evaluate && aborting())
1712     {
1713 	if (ret == OK)
1714 	    clear_tv(rettv);
1715 	ret = FAIL;
1716     }
1717     return ret;
1718 }
1719 
1720 /*
1721  * The "evaluate" argument: When FALSE, the argument is only parsed but not
1722  * executed.  The function may return OK, but the rettv will be of type
1723  * VAR_UNKNOWN.  The function still returns FAIL for a syntax error.
1724  */
1725 
1726 /*
1727  * Handle zero level expression.
1728  * This calls eval1() and handles error message and nextcmd.
1729  * Put the result in "rettv" when returning OK and "evaluate" is TRUE.
1730  * Note: "rettv.v_lock" is not set.
1731  * Return OK or FAIL.
1732  */
1733     int
1734 eval0(
1735     char_u	*arg,
1736     typval_T	*rettv,
1737     char_u	**nextcmd,
1738     int		evaluate)
1739 {
1740     int		ret;
1741     char_u	*p;
1742     int		did_emsg_before = did_emsg;
1743     int		called_emsg_before = called_emsg;
1744 
1745     p = skipwhite(arg);
1746     ret = eval1(&p, rettv, evaluate);
1747     if (ret == FAIL || !ends_excmd(*p))
1748     {
1749 	if (ret != FAIL)
1750 	    clear_tv(rettv);
1751 	/*
1752 	 * Report the invalid expression unless the expression evaluation has
1753 	 * been cancelled due to an aborting error, an interrupt, or an
1754 	 * exception, or we already gave a more specific error.
1755 	 * Also check called_emsg for when using assert_fails().
1756 	 */
1757 	if (!aborting() && did_emsg == did_emsg_before
1758 					  && called_emsg == called_emsg_before)
1759 	    semsg(_(e_invexpr2), arg);
1760 	ret = FAIL;
1761     }
1762     if (nextcmd != NULL)
1763 	*nextcmd = check_nextcmd(p);
1764 
1765     return ret;
1766 }
1767 
1768 /*
1769  * Handle top level expression:
1770  *	expr2 ? expr1 : expr1
1771  *
1772  * "arg" must point to the first non-white of the expression.
1773  * "arg" is advanced to the next non-white after the recognized expression.
1774  *
1775  * Note: "rettv.v_lock" is not set.
1776  *
1777  * Return OK or FAIL.
1778  */
1779     int
1780 eval1(char_u **arg, typval_T *rettv, int evaluate)
1781 {
1782     int		result;
1783     typval_T	var2;
1784 
1785     /*
1786      * Get the first variable.
1787      */
1788     if (eval2(arg, rettv, evaluate) == FAIL)
1789 	return FAIL;
1790 
1791     if ((*arg)[0] == '?')
1792     {
1793 	result = FALSE;
1794 	if (evaluate)
1795 	{
1796 	    int		error = FALSE;
1797 
1798 	    if (tv_get_number_chk(rettv, &error) != 0)
1799 		result = TRUE;
1800 	    clear_tv(rettv);
1801 	    if (error)
1802 		return FAIL;
1803 	}
1804 
1805 	/*
1806 	 * Get the second variable.
1807 	 */
1808 	*arg = skipwhite(*arg + 1);
1809 	if (eval1(arg, rettv, evaluate && result) == FAIL) // recursive!
1810 	    return FAIL;
1811 
1812 	/*
1813 	 * Check for the ":".
1814 	 */
1815 	if ((*arg)[0] != ':')
1816 	{
1817 	    emsg(_("E109: Missing ':' after '?'"));
1818 	    if (evaluate && result)
1819 		clear_tv(rettv);
1820 	    return FAIL;
1821 	}
1822 
1823 	/*
1824 	 * Get the third variable.
1825 	 */
1826 	*arg = skipwhite(*arg + 1);
1827 	if (eval1(arg, &var2, evaluate && !result) == FAIL) // recursive!
1828 	{
1829 	    if (evaluate && result)
1830 		clear_tv(rettv);
1831 	    return FAIL;
1832 	}
1833 	if (evaluate && !result)
1834 	    *rettv = var2;
1835     }
1836 
1837     return OK;
1838 }
1839 
1840 /*
1841  * Handle first level expression:
1842  *	expr2 || expr2 || expr2	    logical OR
1843  *
1844  * "arg" must point to the first non-white of the expression.
1845  * "arg" is advanced to the next non-white after the recognized expression.
1846  *
1847  * Return OK or FAIL.
1848  */
1849     static int
1850 eval2(char_u **arg, typval_T *rettv, int evaluate)
1851 {
1852     typval_T	var2;
1853     long	result;
1854     int		first;
1855     int		error = FALSE;
1856 
1857     /*
1858      * Get the first variable.
1859      */
1860     if (eval3(arg, rettv, evaluate) == FAIL)
1861 	return FAIL;
1862 
1863     /*
1864      * Repeat until there is no following "||".
1865      */
1866     first = TRUE;
1867     result = FALSE;
1868     while ((*arg)[0] == '|' && (*arg)[1] == '|')
1869     {
1870 	if (evaluate && first)
1871 	{
1872 	    if (tv_get_number_chk(rettv, &error) != 0)
1873 		result = TRUE;
1874 	    clear_tv(rettv);
1875 	    if (error)
1876 		return FAIL;
1877 	    first = FALSE;
1878 	}
1879 
1880 	/*
1881 	 * Get the second variable.
1882 	 */
1883 	*arg = skipwhite(*arg + 2);
1884 	if (eval3(arg, &var2, evaluate && !result) == FAIL)
1885 	    return FAIL;
1886 
1887 	/*
1888 	 * Compute the result.
1889 	 */
1890 	if (evaluate && !result)
1891 	{
1892 	    if (tv_get_number_chk(&var2, &error) != 0)
1893 		result = TRUE;
1894 	    clear_tv(&var2);
1895 	    if (error)
1896 		return FAIL;
1897 	}
1898 	if (evaluate)
1899 	{
1900 	    rettv->v_type = VAR_NUMBER;
1901 	    rettv->vval.v_number = result;
1902 	}
1903     }
1904 
1905     return OK;
1906 }
1907 
1908 /*
1909  * Handle second level expression:
1910  *	expr3 && expr3 && expr3	    logical AND
1911  *
1912  * "arg" must point to the first non-white of the expression.
1913  * "arg" is advanced to the next non-white after the recognized expression.
1914  *
1915  * Return OK or FAIL.
1916  */
1917     static int
1918 eval3(char_u **arg, typval_T *rettv, int evaluate)
1919 {
1920     typval_T	var2;
1921     long	result;
1922     int		first;
1923     int		error = FALSE;
1924 
1925     /*
1926      * Get the first variable.
1927      */
1928     if (eval4(arg, rettv, evaluate) == FAIL)
1929 	return FAIL;
1930 
1931     /*
1932      * Repeat until there is no following "&&".
1933      */
1934     first = TRUE;
1935     result = TRUE;
1936     while ((*arg)[0] == '&' && (*arg)[1] == '&')
1937     {
1938 	if (evaluate && first)
1939 	{
1940 	    if (tv_get_number_chk(rettv, &error) == 0)
1941 		result = FALSE;
1942 	    clear_tv(rettv);
1943 	    if (error)
1944 		return FAIL;
1945 	    first = FALSE;
1946 	}
1947 
1948 	/*
1949 	 * Get the second variable.
1950 	 */
1951 	*arg = skipwhite(*arg + 2);
1952 	if (eval4(arg, &var2, evaluate && result) == FAIL)
1953 	    return FAIL;
1954 
1955 	/*
1956 	 * Compute the result.
1957 	 */
1958 	if (evaluate && result)
1959 	{
1960 	    if (tv_get_number_chk(&var2, &error) == 0)
1961 		result = FALSE;
1962 	    clear_tv(&var2);
1963 	    if (error)
1964 		return FAIL;
1965 	}
1966 	if (evaluate)
1967 	{
1968 	    rettv->v_type = VAR_NUMBER;
1969 	    rettv->vval.v_number = result;
1970 	}
1971     }
1972 
1973     return OK;
1974 }
1975 
1976 /*
1977  * Handle third level expression:
1978  *	var1 == var2
1979  *	var1 =~ var2
1980  *	var1 != var2
1981  *	var1 !~ var2
1982  *	var1 > var2
1983  *	var1 >= var2
1984  *	var1 < var2
1985  *	var1 <= var2
1986  *	var1 is var2
1987  *	var1 isnot var2
1988  *
1989  * "arg" must point to the first non-white of the expression.
1990  * "arg" is advanced to the next non-white after the recognized expression.
1991  *
1992  * Return OK or FAIL.
1993  */
1994     static int
1995 eval4(char_u **arg, typval_T *rettv, int evaluate)
1996 {
1997     typval_T	var2;
1998     char_u	*p;
1999     int		i;
2000     exptype_T	type = EXPR_UNKNOWN;
2001     int		len = 2;
2002     int		ic;
2003 
2004     /*
2005      * Get the first variable.
2006      */
2007     if (eval5(arg, rettv, evaluate) == FAIL)
2008 	return FAIL;
2009 
2010     p = *arg;
2011     switch (p[0])
2012     {
2013 	case '=':   if (p[1] == '=')
2014 			type = EXPR_EQUAL;
2015 		    else if (p[1] == '~')
2016 			type = EXPR_MATCH;
2017 		    break;
2018 	case '!':   if (p[1] == '=')
2019 			type = EXPR_NEQUAL;
2020 		    else if (p[1] == '~')
2021 			type = EXPR_NOMATCH;
2022 		    break;
2023 	case '>':   if (p[1] != '=')
2024 		    {
2025 			type = EXPR_GREATER;
2026 			len = 1;
2027 		    }
2028 		    else
2029 			type = EXPR_GEQUAL;
2030 		    break;
2031 	case '<':   if (p[1] != '=')
2032 		    {
2033 			type = EXPR_SMALLER;
2034 			len = 1;
2035 		    }
2036 		    else
2037 			type = EXPR_SEQUAL;
2038 		    break;
2039 	case 'i':   if (p[1] == 's')
2040 		    {
2041 			if (p[2] == 'n' && p[3] == 'o' && p[4] == 't')
2042 			    len = 5;
2043 			i = p[len];
2044 			if (!isalnum(i) && i != '_')
2045 			    type = len == 2 ? EXPR_IS : EXPR_ISNOT;
2046 		    }
2047 		    break;
2048     }
2049 
2050     /*
2051      * If there is a comparative operator, use it.
2052      */
2053     if (type != EXPR_UNKNOWN)
2054     {
2055 	// extra question mark appended: ignore case
2056 	if (p[len] == '?')
2057 	{
2058 	    ic = TRUE;
2059 	    ++len;
2060 	}
2061 	// extra '#' appended: match case
2062 	else if (p[len] == '#')
2063 	{
2064 	    ic = FALSE;
2065 	    ++len;
2066 	}
2067 	// nothing appended: use 'ignorecase'
2068 	else
2069 	    ic = p_ic;
2070 
2071 	/*
2072 	 * Get the second variable.
2073 	 */
2074 	*arg = skipwhite(p + len);
2075 	if (eval5(arg, &var2, evaluate) == FAIL)
2076 	{
2077 	    clear_tv(rettv);
2078 	    return FAIL;
2079 	}
2080 	if (evaluate)
2081 	{
2082 	    int ret = typval_compare(rettv, &var2, type, ic);
2083 
2084 	    clear_tv(&var2);
2085 	    return ret;
2086 	}
2087     }
2088 
2089     return OK;
2090 }
2091 
2092 /*
2093  * Handle fourth level expression:
2094  *	+	number addition
2095  *	-	number subtraction
2096  *	.	string concatenation (if script version is 1)
2097  *	..	string concatenation
2098  *
2099  * "arg" must point to the first non-white of the expression.
2100  * "arg" is advanced to the next non-white after the recognized expression.
2101  *
2102  * Return OK or FAIL.
2103  */
2104     static int
2105 eval5(char_u **arg, typval_T *rettv, int evaluate)
2106 {
2107     typval_T	var2;
2108     typval_T	var3;
2109     int		op;
2110     varnumber_T	n1, n2;
2111 #ifdef FEAT_FLOAT
2112     float_T	f1 = 0, f2 = 0;
2113 #endif
2114     char_u	*s1, *s2;
2115     char_u	buf1[NUMBUFLEN], buf2[NUMBUFLEN];
2116     char_u	*p;
2117     int		concat;
2118 
2119     /*
2120      * Get the first variable.
2121      */
2122     if (eval6(arg, rettv, evaluate, FALSE) == FAIL)
2123 	return FAIL;
2124 
2125     /*
2126      * Repeat computing, until no '+', '-' or '.' is following.
2127      */
2128     for (;;)
2129     {
2130 	// "." is only string concatenation when scriptversion is 1
2131 	op = **arg;
2132 	concat = op == '.'
2133 			&& (*(*arg + 1) == '.' || current_sctx.sc_version < 2);
2134 	if (op != '+' && op != '-' && !concat)
2135 	    break;
2136 
2137 	if ((op != '+' || (rettv->v_type != VAR_LIST
2138 						 && rettv->v_type != VAR_BLOB))
2139 #ifdef FEAT_FLOAT
2140 		&& (op == '.' || rettv->v_type != VAR_FLOAT)
2141 #endif
2142 		)
2143 	{
2144 	    // For "list + ...", an illegal use of the first operand as
2145 	    // a number cannot be determined before evaluating the 2nd
2146 	    // operand: if this is also a list, all is ok.
2147 	    // For "something . ...", "something - ..." or "non-list + ...",
2148 	    // we know that the first operand needs to be a string or number
2149 	    // without evaluating the 2nd operand.  So check before to avoid
2150 	    // side effects after an error.
2151 	    if (evaluate && tv_get_string_chk(rettv) == NULL)
2152 	    {
2153 		clear_tv(rettv);
2154 		return FAIL;
2155 	    }
2156 	}
2157 
2158 	/*
2159 	 * Get the second variable.
2160 	 */
2161 	if (op == '.' && *(*arg + 1) == '.')  // .. string concatenation
2162 	    ++*arg;
2163 	*arg = skipwhite(*arg + 1);
2164 	if (eval6(arg, &var2, evaluate, op == '.') == FAIL)
2165 	{
2166 	    clear_tv(rettv);
2167 	    return FAIL;
2168 	}
2169 
2170 	if (evaluate)
2171 	{
2172 	    /*
2173 	     * Compute the result.
2174 	     */
2175 	    if (op == '.')
2176 	    {
2177 		s1 = tv_get_string_buf(rettv, buf1);	// already checked
2178 		s2 = tv_get_string_buf_chk(&var2, buf2);
2179 		if (s2 == NULL)		// type error ?
2180 		{
2181 		    clear_tv(rettv);
2182 		    clear_tv(&var2);
2183 		    return FAIL;
2184 		}
2185 		p = concat_str(s1, s2);
2186 		clear_tv(rettv);
2187 		rettv->v_type = VAR_STRING;
2188 		rettv->vval.v_string = p;
2189 	    }
2190 	    else if (op == '+' && rettv->v_type == VAR_BLOB
2191 						   && var2.v_type == VAR_BLOB)
2192 	    {
2193 		blob_T  *b1 = rettv->vval.v_blob;
2194 		blob_T  *b2 = var2.vval.v_blob;
2195 		blob_T	*b = blob_alloc();
2196 		int	i;
2197 
2198 		if (b != NULL)
2199 		{
2200 		    for (i = 0; i < blob_len(b1); i++)
2201 			ga_append(&b->bv_ga, blob_get(b1, i));
2202 		    for (i = 0; i < blob_len(b2); i++)
2203 			ga_append(&b->bv_ga, blob_get(b2, i));
2204 
2205 		    clear_tv(rettv);
2206 		    rettv_blob_set(rettv, b);
2207 		}
2208 	    }
2209 	    else if (op == '+' && rettv->v_type == VAR_LIST
2210 						   && var2.v_type == VAR_LIST)
2211 	    {
2212 		// concatenate Lists
2213 		if (list_concat(rettv->vval.v_list, var2.vval.v_list,
2214 							       &var3) == FAIL)
2215 		{
2216 		    clear_tv(rettv);
2217 		    clear_tv(&var2);
2218 		    return FAIL;
2219 		}
2220 		clear_tv(rettv);
2221 		*rettv = var3;
2222 	    }
2223 	    else
2224 	    {
2225 		int	    error = FALSE;
2226 
2227 #ifdef FEAT_FLOAT
2228 		if (rettv->v_type == VAR_FLOAT)
2229 		{
2230 		    f1 = rettv->vval.v_float;
2231 		    n1 = 0;
2232 		}
2233 		else
2234 #endif
2235 		{
2236 		    n1 = tv_get_number_chk(rettv, &error);
2237 		    if (error)
2238 		    {
2239 			// This can only happen for "list + non-list".  For
2240 			// "non-list + ..." or "something - ...", we returned
2241 			// before evaluating the 2nd operand.
2242 			clear_tv(rettv);
2243 			return FAIL;
2244 		    }
2245 #ifdef FEAT_FLOAT
2246 		    if (var2.v_type == VAR_FLOAT)
2247 			f1 = n1;
2248 #endif
2249 		}
2250 #ifdef FEAT_FLOAT
2251 		if (var2.v_type == VAR_FLOAT)
2252 		{
2253 		    f2 = var2.vval.v_float;
2254 		    n2 = 0;
2255 		}
2256 		else
2257 #endif
2258 		{
2259 		    n2 = tv_get_number_chk(&var2, &error);
2260 		    if (error)
2261 		    {
2262 			clear_tv(rettv);
2263 			clear_tv(&var2);
2264 			return FAIL;
2265 		    }
2266 #ifdef FEAT_FLOAT
2267 		    if (rettv->v_type == VAR_FLOAT)
2268 			f2 = n2;
2269 #endif
2270 		}
2271 		clear_tv(rettv);
2272 
2273 #ifdef FEAT_FLOAT
2274 		// If there is a float on either side the result is a float.
2275 		if (rettv->v_type == VAR_FLOAT || var2.v_type == VAR_FLOAT)
2276 		{
2277 		    if (op == '+')
2278 			f1 = f1 + f2;
2279 		    else
2280 			f1 = f1 - f2;
2281 		    rettv->v_type = VAR_FLOAT;
2282 		    rettv->vval.v_float = f1;
2283 		}
2284 		else
2285 #endif
2286 		{
2287 		    if (op == '+')
2288 			n1 = n1 + n2;
2289 		    else
2290 			n1 = n1 - n2;
2291 		    rettv->v_type = VAR_NUMBER;
2292 		    rettv->vval.v_number = n1;
2293 		}
2294 	    }
2295 	    clear_tv(&var2);
2296 	}
2297     }
2298     return OK;
2299 }
2300 
2301 /*
2302  * Handle fifth level expression:
2303  *	*	number multiplication
2304  *	/	number division
2305  *	%	number modulo
2306  *
2307  * "arg" must point to the first non-white of the expression.
2308  * "arg" is advanced to the next non-white after the recognized expression.
2309  *
2310  * Return OK or FAIL.
2311  */
2312     static int
2313 eval6(
2314     char_u	**arg,
2315     typval_T	*rettv,
2316     int		evaluate,
2317     int		want_string)  // after "." operator
2318 {
2319     typval_T	var2;
2320     int		op;
2321     varnumber_T	n1, n2;
2322 #ifdef FEAT_FLOAT
2323     int		use_float = FALSE;
2324     float_T	f1 = 0, f2 = 0;
2325 #endif
2326     int		error = FALSE;
2327 
2328     /*
2329      * Get the first variable.
2330      */
2331     if (eval7(arg, rettv, evaluate, want_string) == FAIL)
2332 	return FAIL;
2333 
2334     /*
2335      * Repeat computing, until no '*', '/' or '%' is following.
2336      */
2337     for (;;)
2338     {
2339 	op = **arg;
2340 	if (op != '*' && op != '/' && op != '%')
2341 	    break;
2342 
2343 	if (evaluate)
2344 	{
2345 #ifdef FEAT_FLOAT
2346 	    if (rettv->v_type == VAR_FLOAT)
2347 	    {
2348 		f1 = rettv->vval.v_float;
2349 		use_float = TRUE;
2350 		n1 = 0;
2351 	    }
2352 	    else
2353 #endif
2354 		n1 = tv_get_number_chk(rettv, &error);
2355 	    clear_tv(rettv);
2356 	    if (error)
2357 		return FAIL;
2358 	}
2359 	else
2360 	    n1 = 0;
2361 
2362 	/*
2363 	 * Get the second variable.
2364 	 */
2365 	*arg = skipwhite(*arg + 1);
2366 	if (eval7(arg, &var2, evaluate, FALSE) == FAIL)
2367 	    return FAIL;
2368 
2369 	if (evaluate)
2370 	{
2371 #ifdef FEAT_FLOAT
2372 	    if (var2.v_type == VAR_FLOAT)
2373 	    {
2374 		if (!use_float)
2375 		{
2376 		    f1 = n1;
2377 		    use_float = TRUE;
2378 		}
2379 		f2 = var2.vval.v_float;
2380 		n2 = 0;
2381 	    }
2382 	    else
2383 #endif
2384 	    {
2385 		n2 = tv_get_number_chk(&var2, &error);
2386 		clear_tv(&var2);
2387 		if (error)
2388 		    return FAIL;
2389 #ifdef FEAT_FLOAT
2390 		if (use_float)
2391 		    f2 = n2;
2392 #endif
2393 	    }
2394 
2395 	    /*
2396 	     * Compute the result.
2397 	     * When either side is a float the result is a float.
2398 	     */
2399 #ifdef FEAT_FLOAT
2400 	    if (use_float)
2401 	    {
2402 		if (op == '*')
2403 		    f1 = f1 * f2;
2404 		else if (op == '/')
2405 		{
2406 # ifdef VMS
2407 		    // VMS crashes on divide by zero, work around it
2408 		    if (f2 == 0.0)
2409 		    {
2410 			if (f1 == 0)
2411 			    f1 = -1 * __F_FLT_MAX - 1L;   // similar to NaN
2412 			else if (f1 < 0)
2413 			    f1 = -1 * __F_FLT_MAX;
2414 			else
2415 			    f1 = __F_FLT_MAX;
2416 		    }
2417 		    else
2418 			f1 = f1 / f2;
2419 # else
2420 		    // We rely on the floating point library to handle divide
2421 		    // by zero to result in "inf" and not a crash.
2422 		    f1 = f1 / f2;
2423 # endif
2424 		}
2425 		else
2426 		{
2427 		    emsg(_("E804: Cannot use '%' with Float"));
2428 		    return FAIL;
2429 		}
2430 		rettv->v_type = VAR_FLOAT;
2431 		rettv->vval.v_float = f1;
2432 	    }
2433 	    else
2434 #endif
2435 	    {
2436 		if (op == '*')
2437 		    n1 = n1 * n2;
2438 		else if (op == '/')
2439 		    n1 = num_divide(n1, n2);
2440 		else
2441 		    n1 = num_modulus(n1, n2);
2442 
2443 		rettv->v_type = VAR_NUMBER;
2444 		rettv->vval.v_number = n1;
2445 	    }
2446 	}
2447     }
2448 
2449     return OK;
2450 }
2451 
2452 /*
2453  * Handle sixth level expression:
2454  *  number		number constant
2455  *  0zFFFFFFFF		Blob constant
2456  *  "string"		string constant
2457  *  'string'		literal string constant
2458  *  &option-name	option value
2459  *  @r			register contents
2460  *  identifier		variable value
2461  *  function()		function call
2462  *  $VAR		environment variable
2463  *  (expression)	nested expression
2464  *  [expr, expr]	List
2465  *  {key: val, key: val}   Dictionary
2466  *  #{key: val, key: val}  Dictionary with literal keys
2467  *
2468  *  Also handle:
2469  *  ! in front		logical NOT
2470  *  - in front		unary minus
2471  *  + in front		unary plus (ignored)
2472  *  trailing []		subscript in String or List
2473  *  trailing .name	entry in Dictionary
2474  *  trailing ->name()	method call
2475  *
2476  * "arg" must point to the first non-white of the expression.
2477  * "arg" is advanced to the next non-white after the recognized expression.
2478  *
2479  * Return OK or FAIL.
2480  */
2481     static int
2482 eval7(
2483     char_u	**arg,
2484     typval_T	*rettv,
2485     int		evaluate,
2486     int		want_string UNUSED)	// after "." operator
2487 {
2488     varnumber_T	n;
2489     int		len;
2490     char_u	*s;
2491     char_u	*start_leader, *end_leader;
2492     int		ret = OK;
2493     char_u	*alias;
2494 
2495     /*
2496      * Initialise variable so that clear_tv() can't mistake this for a
2497      * string and free a string that isn't there.
2498      */
2499     rettv->v_type = VAR_UNKNOWN;
2500 
2501     /*
2502      * Skip '!', '-' and '+' characters.  They are handled later.
2503      */
2504     start_leader = *arg;
2505     while (**arg == '!' || **arg == '-' || **arg == '+')
2506 	*arg = skipwhite(*arg + 1);
2507     end_leader = *arg;
2508 
2509     if (**arg == '.' && (!isdigit(*(*arg + 1))
2510 #ifdef FEAT_FLOAT
2511 	    || current_sctx.sc_version < 2
2512 #endif
2513 	    ))
2514     {
2515 	semsg(_(e_invexpr2), *arg);
2516 	++*arg;
2517 	return FAIL;
2518     }
2519 
2520     switch (**arg)
2521     {
2522     /*
2523      * Number constant.
2524      */
2525     case '0':
2526     case '1':
2527     case '2':
2528     case '3':
2529     case '4':
2530     case '5':
2531     case '6':
2532     case '7':
2533     case '8':
2534     case '9':
2535     case '.':
2536 	{
2537 #ifdef FEAT_FLOAT
2538 		char_u *p;
2539 		int    get_float = FALSE;
2540 
2541 		// We accept a float when the format matches
2542 		// "[0-9]\+\.[0-9]\+\([eE][+-]\?[0-9]\+\)\?".  This is very
2543 		// strict to avoid backwards compatibility problems.
2544 		// With script version 2 and later the leading digit can be
2545 		// omitted.
2546 		// Don't look for a float after the "." operator, so that
2547 		// ":let vers = 1.2.3" doesn't fail.
2548 		if (**arg == '.')
2549 		    p = *arg;
2550 		else
2551 		    p = skipdigits(*arg + 1);
2552 		if (!want_string && p[0] == '.' && vim_isdigit(p[1]))
2553 		{
2554 		    get_float = TRUE;
2555 		    p = skipdigits(p + 2);
2556 		    if (*p == 'e' || *p == 'E')
2557 		    {
2558 			++p;
2559 			if (*p == '-' || *p == '+')
2560 			    ++p;
2561 			if (!vim_isdigit(*p))
2562 			    get_float = FALSE;
2563 			else
2564 			    p = skipdigits(p + 1);
2565 		    }
2566 		    if (ASCII_ISALPHA(*p) || *p == '.')
2567 			get_float = FALSE;
2568 		}
2569 		if (get_float)
2570 		{
2571 		    float_T	f;
2572 
2573 		    *arg += string2float(*arg, &f);
2574 		    if (evaluate)
2575 		    {
2576 			rettv->v_type = VAR_FLOAT;
2577 			rettv->vval.v_float = f;
2578 		    }
2579 		}
2580 		else
2581 #endif
2582 		if (**arg == '0' && ((*arg)[1] == 'z' || (*arg)[1] == 'Z'))
2583 		{
2584 		    char_u  *bp;
2585 		    blob_T  *blob = NULL;  // init for gcc
2586 
2587 		    // Blob constant: 0z0123456789abcdef
2588 		    if (evaluate)
2589 			blob = blob_alloc();
2590 		    for (bp = *arg + 2; vim_isxdigit(bp[0]); bp += 2)
2591 		    {
2592 			if (!vim_isxdigit(bp[1]))
2593 			{
2594 			    if (blob != NULL)
2595 			    {
2596 				emsg(_("E973: Blob literal should have an even number of hex characters"));
2597 				ga_clear(&blob->bv_ga);
2598 				VIM_CLEAR(blob);
2599 			    }
2600 			    ret = FAIL;
2601 			    break;
2602 			}
2603 			if (blob != NULL)
2604 			    ga_append(&blob->bv_ga,
2605 					 (hex2nr(*bp) << 4) + hex2nr(*(bp+1)));
2606 			if (bp[2] == '.' && vim_isxdigit(bp[3]))
2607 			    ++bp;
2608 		    }
2609 		    if (blob != NULL)
2610 			rettv_blob_set(rettv, blob);
2611 		    *arg = bp;
2612 		}
2613 		else
2614 		{
2615 		    // decimal, hex or octal number
2616 		    vim_str2nr(*arg, NULL, &len, current_sctx.sc_version >= 4
2617 				  ? STR2NR_NO_OCT + STR2NR_QUOTE
2618 				  : STR2NR_ALL, &n, NULL, 0, TRUE);
2619 		    if (len == 0)
2620 		    {
2621 			semsg(_(e_invexpr2), *arg);
2622 			ret = FAIL;
2623 			break;
2624 		    }
2625 		    *arg += len;
2626 		    if (evaluate)
2627 		    {
2628 			rettv->v_type = VAR_NUMBER;
2629 			rettv->vval.v_number = n;
2630 		    }
2631 		}
2632 		break;
2633 	}
2634 
2635     /*
2636      * String constant: "string".
2637      */
2638     case '"':	ret = get_string_tv(arg, rettv, evaluate);
2639 		break;
2640 
2641     /*
2642      * Literal string constant: 'str''ing'.
2643      */
2644     case '\'':	ret = get_lit_string_tv(arg, rettv, evaluate);
2645 		break;
2646 
2647     /*
2648      * List: [expr, expr]
2649      */
2650     case '[':	ret = get_list_tv(arg, rettv, evaluate);
2651 		break;
2652 
2653     /*
2654      * Dictionary: #{key: val, key: val}
2655      */
2656     case '#':	if ((*arg)[1] == '{')
2657 		{
2658 		    ++*arg;
2659 		    ret = eval_dict(arg, rettv, evaluate, TRUE);
2660 		}
2661 		else
2662 		    ret = NOTDONE;
2663 		break;
2664 
2665     /*
2666      * Lambda: {arg, arg -> expr}
2667      * Dictionary: {'key': val, 'key': val}
2668      */
2669     case '{':	ret = get_lambda_tv(arg, rettv, evaluate);
2670 		if (ret == NOTDONE)
2671 		    ret = eval_dict(arg, rettv, evaluate, FALSE);
2672 		break;
2673 
2674     /*
2675      * Option value: &name
2676      */
2677     case '&':	ret = get_option_tv(arg, rettv, evaluate);
2678 		break;
2679 
2680     /*
2681      * Environment variable: $VAR.
2682      */
2683     case '$':	ret = get_env_tv(arg, rettv, evaluate);
2684 		break;
2685 
2686     /*
2687      * Register contents: @r.
2688      */
2689     case '@':	++*arg;
2690 		if (evaluate)
2691 		{
2692 		    rettv->v_type = VAR_STRING;
2693 		    rettv->vval.v_string = get_reg_contents(**arg,
2694 							    GREG_EXPR_SRC);
2695 		}
2696 		if (**arg != NUL)
2697 		    ++*arg;
2698 		break;
2699 
2700     /*
2701      * nested expression: (expression).
2702      */
2703     case '(':	*arg = skipwhite(*arg + 1);
2704 		ret = eval1(arg, rettv, evaluate);	// recursive!
2705 		if (**arg == ')')
2706 		    ++*arg;
2707 		else if (ret == OK)
2708 		{
2709 		    emsg(_("E110: Missing ')'"));
2710 		    clear_tv(rettv);
2711 		    ret = FAIL;
2712 		}
2713 		break;
2714 
2715     default:	ret = NOTDONE;
2716 		break;
2717     }
2718 
2719     if (ret == NOTDONE)
2720     {
2721 	/*
2722 	 * Must be a variable or function name.
2723 	 * Can also be a curly-braces kind of name: {expr}.
2724 	 */
2725 	s = *arg;
2726 	len = get_name_len(arg, &alias, evaluate, TRUE);
2727 	if (alias != NULL)
2728 	    s = alias;
2729 
2730 	if (len <= 0)
2731 	    ret = FAIL;
2732 	else
2733 	{
2734 	    if (**arg == '(')		// recursive!
2735 		ret = eval_func(arg, s, len, rettv, evaluate, NULL);
2736 	    else if (evaluate)
2737 		ret = get_var_tv(s, len, rettv, NULL, TRUE, FALSE);
2738 	    else
2739 	    {
2740 		check_vars(s, len);
2741 		ret = OK;
2742 	    }
2743 	}
2744 	vim_free(alias);
2745     }
2746 
2747     *arg = skipwhite(*arg);
2748 
2749     // Handle following '[', '(' and '.' for expr[expr], expr.name,
2750     // expr(expr), expr->name(expr)
2751     if (ret == OK)
2752 	ret = handle_subscript(arg, rettv, evaluate, TRUE,
2753 						    start_leader, &end_leader);
2754 
2755     /*
2756      * Apply logical NOT and unary '-', from right to left, ignore '+'.
2757      */
2758     if (ret == OK && evaluate && end_leader > start_leader)
2759 	ret = eval7_leader(rettv, start_leader, &end_leader);
2760     return ret;
2761 }
2762 
2763 /*
2764  * Apply the leading "!" and "-" before an eval7 expression to "rettv".
2765  * Adjusts "end_leaderp" until it is at "start_leader".
2766  */
2767     static int
2768 eval7_leader(typval_T *rettv, char_u *start_leader, char_u **end_leaderp)
2769 {
2770     char_u	*end_leader = *end_leaderp;
2771     int		ret = OK;
2772     int		error = FALSE;
2773     varnumber_T val = 0;
2774 #ifdef FEAT_FLOAT
2775     float_T	    f = 0.0;
2776 
2777     if (rettv->v_type == VAR_FLOAT)
2778 	f = rettv->vval.v_float;
2779     else
2780 #endif
2781 	val = tv_get_number_chk(rettv, &error);
2782     if (error)
2783     {
2784 	clear_tv(rettv);
2785 	ret = FAIL;
2786     }
2787     else
2788     {
2789 	while (end_leader > start_leader)
2790 	{
2791 	    --end_leader;
2792 	    if (*end_leader == '!')
2793 	    {
2794 #ifdef FEAT_FLOAT
2795 		if (rettv->v_type == VAR_FLOAT)
2796 		    f = !f;
2797 		else
2798 #endif
2799 		    val = !val;
2800 	    }
2801 	    else if (*end_leader == '-')
2802 	    {
2803 #ifdef FEAT_FLOAT
2804 		if (rettv->v_type == VAR_FLOAT)
2805 		    f = -f;
2806 		else
2807 #endif
2808 		    val = -val;
2809 	    }
2810 	}
2811 #ifdef FEAT_FLOAT
2812 	if (rettv->v_type == VAR_FLOAT)
2813 	{
2814 	    clear_tv(rettv);
2815 	    rettv->vval.v_float = f;
2816 	}
2817 	else
2818 #endif
2819 	{
2820 	    clear_tv(rettv);
2821 	    rettv->v_type = VAR_NUMBER;
2822 	    rettv->vval.v_number = val;
2823 	}
2824     }
2825     *end_leaderp = end_leader;
2826     return ret;
2827 }
2828 
2829 /*
2830  * Call the function referred to in "rettv".
2831  */
2832     static int
2833 call_func_rettv(
2834 	char_u	    **arg,
2835 	typval_T    *rettv,
2836 	int	    evaluate,
2837 	dict_T	    *selfdict,
2838 	typval_T    *basetv)
2839 {
2840     partial_T	*pt = NULL;
2841     funcexe_T	funcexe;
2842     typval_T	functv;
2843     char_u	*s;
2844     int		ret;
2845 
2846     // need to copy the funcref so that we can clear rettv
2847     if (evaluate)
2848     {
2849 	functv = *rettv;
2850 	rettv->v_type = VAR_UNKNOWN;
2851 
2852 	// Invoke the function.  Recursive!
2853 	if (functv.v_type == VAR_PARTIAL)
2854 	{
2855 	    pt = functv.vval.v_partial;
2856 	    s = partial_name(pt);
2857 	}
2858 	else
2859 	    s = functv.vval.v_string;
2860     }
2861     else
2862 	s = (char_u *)"";
2863 
2864     vim_memset(&funcexe, 0, sizeof(funcexe));
2865     funcexe.firstline = curwin->w_cursor.lnum;
2866     funcexe.lastline = curwin->w_cursor.lnum;
2867     funcexe.evaluate = evaluate;
2868     funcexe.partial = pt;
2869     funcexe.selfdict = selfdict;
2870     funcexe.basetv = basetv;
2871     ret = get_func_tv(s, -1, rettv, arg, &funcexe);
2872 
2873     // Clear the funcref afterwards, so that deleting it while
2874     // evaluating the arguments is possible (see test55).
2875     if (evaluate)
2876 	clear_tv(&functv);
2877 
2878     return ret;
2879 }
2880 
2881 /*
2882  * Evaluate "->method()".
2883  * "*arg" points to the '-'.
2884  * Returns FAIL or OK. "*arg" is advanced to after the ')'.
2885  */
2886     static int
2887 eval_lambda(
2888     char_u	**arg,
2889     typval_T	*rettv,
2890     int		evaluate,
2891     int		verbose)	// give error messages
2892 {
2893     typval_T	base = *rettv;
2894     int		ret;
2895 
2896     // Skip over the ->.
2897     *arg += 2;
2898     rettv->v_type = VAR_UNKNOWN;
2899 
2900     ret = get_lambda_tv(arg, rettv, evaluate);
2901     if (ret != OK)
2902 	return FAIL;
2903     else if (**arg != '(')
2904     {
2905 	if (verbose)
2906 	{
2907 	    if (*skipwhite(*arg) == '(')
2908 		semsg(_(e_nowhitespace));
2909 	    else
2910 		semsg(_(e_missingparen), "lambda");
2911 	}
2912 	clear_tv(rettv);
2913 	ret = FAIL;
2914     }
2915     else
2916 	ret = call_func_rettv(arg, rettv, evaluate, NULL, &base);
2917 
2918     // Clear the funcref afterwards, so that deleting it while
2919     // evaluating the arguments is possible (see test55).
2920     if (evaluate)
2921 	clear_tv(&base);
2922 
2923     return ret;
2924 }
2925 
2926 /*
2927  * Evaluate "->method()".
2928  * "*arg" points to the '-'.
2929  * Returns FAIL or OK. "*arg" is advanced to after the ')'.
2930  */
2931     static int
2932 eval_method(
2933     char_u	**arg,
2934     typval_T	*rettv,
2935     int		evaluate,
2936     int		verbose)	// give error messages
2937 {
2938     char_u	*name;
2939     long	len;
2940     char_u	*alias;
2941     typval_T	base = *rettv;
2942     int		ret;
2943 
2944     // Skip over the ->.
2945     *arg += 2;
2946     rettv->v_type = VAR_UNKNOWN;
2947 
2948     name = *arg;
2949     len = get_name_len(arg, &alias, evaluate, TRUE);
2950     if (alias != NULL)
2951 	name = alias;
2952 
2953     if (len <= 0)
2954     {
2955 	if (verbose)
2956 	    emsg(_("E260: Missing name after ->"));
2957 	ret = FAIL;
2958     }
2959     else
2960     {
2961 	if (**arg != '(')
2962 	{
2963 	    if (verbose)
2964 		semsg(_(e_missingparen), name);
2965 	    ret = FAIL;
2966 	}
2967 	else if (VIM_ISWHITE((*arg)[-1]))
2968 	{
2969 	    if (verbose)
2970 		semsg(_(e_nowhitespace));
2971 	    ret = FAIL;
2972 	}
2973 	else
2974 	    ret = eval_func(arg, name, len, rettv, evaluate, &base);
2975     }
2976 
2977     // Clear the funcref afterwards, so that deleting it while
2978     // evaluating the arguments is possible (see test55).
2979     if (evaluate)
2980 	clear_tv(&base);
2981 
2982     return ret;
2983 }
2984 
2985 /*
2986  * Evaluate an "[expr]" or "[expr:expr]" index.  Also "dict.key".
2987  * "*arg" points to the '[' or '.'.
2988  * Returns FAIL or OK. "*arg" is advanced to after the ']'.
2989  */
2990     static int
2991 eval_index(
2992     char_u	**arg,
2993     typval_T	*rettv,
2994     int		evaluate,
2995     int		verbose)	// give error messages
2996 {
2997     int		empty1 = FALSE, empty2 = FALSE;
2998     typval_T	var1, var2;
2999     long	i;
3000     long	n1, n2 = 0;
3001     long	len = -1;
3002     int		range = FALSE;
3003     char_u	*s;
3004     char_u	*key = NULL;
3005 
3006     switch (rettv->v_type)
3007     {
3008 	case VAR_FUNC:
3009 	case VAR_PARTIAL:
3010 	    if (verbose)
3011 		emsg(_("E695: Cannot index a Funcref"));
3012 	    return FAIL;
3013 	case VAR_FLOAT:
3014 #ifdef FEAT_FLOAT
3015 	    if (verbose)
3016 		emsg(_(e_float_as_string));
3017 	    return FAIL;
3018 #endif
3019 	case VAR_BOOL:
3020 	case VAR_SPECIAL:
3021 	case VAR_JOB:
3022 	case VAR_CHANNEL:
3023 	    if (verbose)
3024 		emsg(_("E909: Cannot index a special variable"));
3025 	    return FAIL;
3026 	case VAR_UNKNOWN:
3027 	    if (evaluate)
3028 		return FAIL;
3029 	    // FALLTHROUGH
3030 
3031 	case VAR_STRING:
3032 	case VAR_NUMBER:
3033 	case VAR_LIST:
3034 	case VAR_DICT:
3035 	case VAR_BLOB:
3036 	    break;
3037     }
3038 
3039     init_tv(&var1);
3040     init_tv(&var2);
3041     if (**arg == '.')
3042     {
3043 	/*
3044 	 * dict.name
3045 	 */
3046 	key = *arg + 1;
3047 	for (len = 0; ASCII_ISALNUM(key[len]) || key[len] == '_'; ++len)
3048 	    ;
3049 	if (len == 0)
3050 	    return FAIL;
3051 	*arg = skipwhite(key + len);
3052     }
3053     else
3054     {
3055 	/*
3056 	 * something[idx]
3057 	 *
3058 	 * Get the (first) variable from inside the [].
3059 	 */
3060 	*arg = skipwhite(*arg + 1);
3061 	if (**arg == ':')
3062 	    empty1 = TRUE;
3063 	else if (eval1(arg, &var1, evaluate) == FAIL)	// recursive!
3064 	    return FAIL;
3065 	else if (evaluate && tv_get_string_chk(&var1) == NULL)
3066 	{
3067 	    // not a number or string
3068 	    clear_tv(&var1);
3069 	    return FAIL;
3070 	}
3071 
3072 	/*
3073 	 * Get the second variable from inside the [:].
3074 	 */
3075 	if (**arg == ':')
3076 	{
3077 	    range = TRUE;
3078 	    *arg = skipwhite(*arg + 1);
3079 	    if (**arg == ']')
3080 		empty2 = TRUE;
3081 	    else if (eval1(arg, &var2, evaluate) == FAIL)	// recursive!
3082 	    {
3083 		if (!empty1)
3084 		    clear_tv(&var1);
3085 		return FAIL;
3086 	    }
3087 	    else if (evaluate && tv_get_string_chk(&var2) == NULL)
3088 	    {
3089 		// not a number or string
3090 		if (!empty1)
3091 		    clear_tv(&var1);
3092 		clear_tv(&var2);
3093 		return FAIL;
3094 	    }
3095 	}
3096 
3097 	// Check for the ']'.
3098 	if (**arg != ']')
3099 	{
3100 	    if (verbose)
3101 		emsg(_(e_missbrac));
3102 	    clear_tv(&var1);
3103 	    if (range)
3104 		clear_tv(&var2);
3105 	    return FAIL;
3106 	}
3107 	*arg = skipwhite(*arg + 1);	// skip the ']'
3108     }
3109 
3110     if (evaluate)
3111     {
3112 	n1 = 0;
3113 	if (!empty1 && rettv->v_type != VAR_DICT)
3114 	{
3115 	    n1 = tv_get_number(&var1);
3116 	    clear_tv(&var1);
3117 	}
3118 	if (range)
3119 	{
3120 	    if (empty2)
3121 		n2 = -1;
3122 	    else
3123 	    {
3124 		n2 = tv_get_number(&var2);
3125 		clear_tv(&var2);
3126 	    }
3127 	}
3128 
3129 	switch (rettv->v_type)
3130 	{
3131 	    case VAR_UNKNOWN:
3132 	    case VAR_FUNC:
3133 	    case VAR_PARTIAL:
3134 	    case VAR_FLOAT:
3135 	    case VAR_BOOL:
3136 	    case VAR_SPECIAL:
3137 	    case VAR_JOB:
3138 	    case VAR_CHANNEL:
3139 		break; // not evaluating, skipping over subscript
3140 
3141 	    case VAR_NUMBER:
3142 	    case VAR_STRING:
3143 		s = tv_get_string(rettv);
3144 		len = (long)STRLEN(s);
3145 		if (range)
3146 		{
3147 		    // The resulting variable is a substring.  If the indexes
3148 		    // are out of range the result is empty.
3149 		    if (n1 < 0)
3150 		    {
3151 			n1 = len + n1;
3152 			if (n1 < 0)
3153 			    n1 = 0;
3154 		    }
3155 		    if (n2 < 0)
3156 			n2 = len + n2;
3157 		    else if (n2 >= len)
3158 			n2 = len;
3159 		    if (n1 >= len || n2 < 0 || n1 > n2)
3160 			s = NULL;
3161 		    else
3162 			s = vim_strnsave(s + n1, (int)(n2 - n1 + 1));
3163 		}
3164 		else
3165 		{
3166 		    // The resulting variable is a string of a single
3167 		    // character.  If the index is too big or negative the
3168 		    // result is empty.
3169 		    if (n1 >= len || n1 < 0)
3170 			s = NULL;
3171 		    else
3172 			s = vim_strnsave(s + n1, 1);
3173 		}
3174 		clear_tv(rettv);
3175 		rettv->v_type = VAR_STRING;
3176 		rettv->vval.v_string = s;
3177 		break;
3178 
3179 	    case VAR_BLOB:
3180 		len = blob_len(rettv->vval.v_blob);
3181 		if (range)
3182 		{
3183 		    // The resulting variable is a sub-blob.  If the indexes
3184 		    // are out of range the result is empty.
3185 		    if (n1 < 0)
3186 		    {
3187 			n1 = len + n1;
3188 			if (n1 < 0)
3189 			    n1 = 0;
3190 		    }
3191 		    if (n2 < 0)
3192 			n2 = len + n2;
3193 		    else if (n2 >= len)
3194 			n2 = len - 1;
3195 		    if (n1 >= len || n2 < 0 || n1 > n2)
3196 		    {
3197 			clear_tv(rettv);
3198 			rettv->v_type = VAR_BLOB;
3199 			rettv->vval.v_blob = NULL;
3200 		    }
3201 		    else
3202 		    {
3203 			blob_T  *blob = blob_alloc();
3204 
3205 			if (blob != NULL)
3206 			{
3207 			    if (ga_grow(&blob->bv_ga, n2 - n1 + 1) == FAIL)
3208 			    {
3209 				blob_free(blob);
3210 				return FAIL;
3211 			    }
3212 			    blob->bv_ga.ga_len = n2 - n1 + 1;
3213 			    for (i = n1; i <= n2; i++)
3214 				blob_set(blob, i - n1,
3215 					      blob_get(rettv->vval.v_blob, i));
3216 
3217 			    clear_tv(rettv);
3218 			    rettv_blob_set(rettv, blob);
3219 			}
3220 		    }
3221 		}
3222 		else
3223 		{
3224 		    // The resulting variable is a byte value.
3225 		    // If the index is too big or negative that is an error.
3226 		    if (n1 < 0)
3227 			n1 = len + n1;
3228 		    if (n1 < len && n1 >= 0)
3229 		    {
3230 			int v = blob_get(rettv->vval.v_blob, n1);
3231 
3232 			clear_tv(rettv);
3233 			rettv->v_type = VAR_NUMBER;
3234 			rettv->vval.v_number = v;
3235 		    }
3236 		    else
3237 			semsg(_(e_blobidx), n1);
3238 		}
3239 		break;
3240 
3241 	    case VAR_LIST:
3242 		len = list_len(rettv->vval.v_list);
3243 		if (n1 < 0)
3244 		    n1 = len + n1;
3245 		if (!empty1 && (n1 < 0 || n1 >= len))
3246 		{
3247 		    // For a range we allow invalid values and return an empty
3248 		    // list.  A list index out of range is an error.
3249 		    if (!range)
3250 		    {
3251 			if (verbose)
3252 			    semsg(_(e_listidx), n1);
3253 			return FAIL;
3254 		    }
3255 		    n1 = len;
3256 		}
3257 		if (range)
3258 		{
3259 		    list_T	*l;
3260 		    listitem_T	*item;
3261 
3262 		    if (n2 < 0)
3263 			n2 = len + n2;
3264 		    else if (n2 >= len)
3265 			n2 = len - 1;
3266 		    if (!empty2 && (n2 < 0 || n2 + 1 < n1))
3267 			n2 = -1;
3268 		    l = list_alloc();
3269 		    if (l == NULL)
3270 			return FAIL;
3271 		    for (item = list_find(rettv->vval.v_list, n1);
3272 							       n1 <= n2; ++n1)
3273 		    {
3274 			if (list_append_tv(l, &item->li_tv) == FAIL)
3275 			{
3276 			    list_free(l);
3277 			    return FAIL;
3278 			}
3279 			item = item->li_next;
3280 		    }
3281 		    clear_tv(rettv);
3282 		    rettv_list_set(rettv, l);
3283 		}
3284 		else
3285 		{
3286 		    copy_tv(&list_find(rettv->vval.v_list, n1)->li_tv, &var1);
3287 		    clear_tv(rettv);
3288 		    *rettv = var1;
3289 		}
3290 		break;
3291 
3292 	    case VAR_DICT:
3293 		if (range)
3294 		{
3295 		    if (verbose)
3296 			emsg(_(e_dictrange));
3297 		    if (len == -1)
3298 			clear_tv(&var1);
3299 		    return FAIL;
3300 		}
3301 		{
3302 		    dictitem_T	*item;
3303 
3304 		    if (len == -1)
3305 		    {
3306 			key = tv_get_string_chk(&var1);
3307 			if (key == NULL)
3308 			{
3309 			    clear_tv(&var1);
3310 			    return FAIL;
3311 			}
3312 		    }
3313 
3314 		    item = dict_find(rettv->vval.v_dict, key, (int)len);
3315 
3316 		    if (item == NULL && verbose)
3317 			semsg(_(e_dictkey), key);
3318 		    if (len == -1)
3319 			clear_tv(&var1);
3320 		    if (item == NULL)
3321 			return FAIL;
3322 
3323 		    copy_tv(&item->di_tv, &var1);
3324 		    clear_tv(rettv);
3325 		    *rettv = var1;
3326 		}
3327 		break;
3328 	}
3329     }
3330 
3331     return OK;
3332 }
3333 
3334 /*
3335  * Get an option value.
3336  * "arg" points to the '&' or '+' before the option name.
3337  * "arg" is advanced to character after the option name.
3338  * Return OK or FAIL.
3339  */
3340     int
3341 get_option_tv(
3342     char_u	**arg,
3343     typval_T	*rettv,	// when NULL, only check if option exists
3344     int		evaluate)
3345 {
3346     char_u	*option_end;
3347     long	numval;
3348     char_u	*stringval;
3349     int		opt_type;
3350     int		c;
3351     int		working = (**arg == '+');    // has("+option")
3352     int		ret = OK;
3353     int		opt_flags;
3354 
3355     /*
3356      * Isolate the option name and find its value.
3357      */
3358     option_end = find_option_end(arg, &opt_flags);
3359     if (option_end == NULL)
3360     {
3361 	if (rettv != NULL)
3362 	    semsg(_("E112: Option name missing: %s"), *arg);
3363 	return FAIL;
3364     }
3365 
3366     if (!evaluate)
3367     {
3368 	*arg = option_end;
3369 	return OK;
3370     }
3371 
3372     c = *option_end;
3373     *option_end = NUL;
3374     opt_type = get_option_value(*arg, &numval,
3375 			       rettv == NULL ? NULL : &stringval, opt_flags);
3376 
3377     if (opt_type == -3)			// invalid name
3378     {
3379 	if (rettv != NULL)
3380 	    semsg(_("E113: Unknown option: %s"), *arg);
3381 	ret = FAIL;
3382     }
3383     else if (rettv != NULL)
3384     {
3385 	if (opt_type == -2)		// hidden string option
3386 	{
3387 	    rettv->v_type = VAR_STRING;
3388 	    rettv->vval.v_string = NULL;
3389 	}
3390 	else if (opt_type == -1)	// hidden number option
3391 	{
3392 	    rettv->v_type = VAR_NUMBER;
3393 	    rettv->vval.v_number = 0;
3394 	}
3395 	else if (opt_type == 1)		// number option
3396 	{
3397 	    rettv->v_type = VAR_NUMBER;
3398 	    rettv->vval.v_number = numval;
3399 	}
3400 	else				// string option
3401 	{
3402 	    rettv->v_type = VAR_STRING;
3403 	    rettv->vval.v_string = stringval;
3404 	}
3405     }
3406     else if (working && (opt_type == -2 || opt_type == -1))
3407 	ret = FAIL;
3408 
3409     *option_end = c;		    // put back for error messages
3410     *arg = option_end;
3411 
3412     return ret;
3413 }
3414 
3415 /*
3416  * Allocate a variable for a string constant.
3417  * Return OK or FAIL.
3418  */
3419     static int
3420 get_string_tv(char_u **arg, typval_T *rettv, int evaluate)
3421 {
3422     char_u	*p;
3423     char_u	*name;
3424     int		extra = 0;
3425 
3426     /*
3427      * Find the end of the string, skipping backslashed characters.
3428      */
3429     for (p = *arg + 1; *p != NUL && *p != '"'; MB_PTR_ADV(p))
3430     {
3431 	if (*p == '\\' && p[1] != NUL)
3432 	{
3433 	    ++p;
3434 	    // A "\<x>" form occupies at least 4 characters, and produces up
3435 	    // to 6 characters: reserve space for 2 extra
3436 	    if (*p == '<')
3437 		extra += 2;
3438 	}
3439     }
3440 
3441     if (*p != '"')
3442     {
3443 	semsg(_("E114: Missing quote: %s"), *arg);
3444 	return FAIL;
3445     }
3446 
3447     // If only parsing, set *arg and return here
3448     if (!evaluate)
3449     {
3450 	*arg = p + 1;
3451 	return OK;
3452     }
3453 
3454     /*
3455      * Copy the string into allocated memory, handling backslashed
3456      * characters.
3457      */
3458     name = alloc(p - *arg + extra);
3459     if (name == NULL)
3460 	return FAIL;
3461     rettv->v_type = VAR_STRING;
3462     rettv->vval.v_string = name;
3463 
3464     for (p = *arg + 1; *p != NUL && *p != '"'; )
3465     {
3466 	if (*p == '\\')
3467 	{
3468 	    switch (*++p)
3469 	    {
3470 		case 'b': *name++ = BS; ++p; break;
3471 		case 'e': *name++ = ESC; ++p; break;
3472 		case 'f': *name++ = FF; ++p; break;
3473 		case 'n': *name++ = NL; ++p; break;
3474 		case 'r': *name++ = CAR; ++p; break;
3475 		case 't': *name++ = TAB; ++p; break;
3476 
3477 		case 'X': // hex: "\x1", "\x12"
3478 		case 'x':
3479 		case 'u': // Unicode: "\u0023"
3480 		case 'U':
3481 			  if (vim_isxdigit(p[1]))
3482 			  {
3483 			      int	n, nr;
3484 			      int	c = toupper(*p);
3485 
3486 			      if (c == 'X')
3487 				  n = 2;
3488 			      else if (*p == 'u')
3489 				  n = 4;
3490 			      else
3491 				  n = 8;
3492 			      nr = 0;
3493 			      while (--n >= 0 && vim_isxdigit(p[1]))
3494 			      {
3495 				  ++p;
3496 				  nr = (nr << 4) + hex2nr(*p);
3497 			      }
3498 			      ++p;
3499 			      // For "\u" store the number according to
3500 			      // 'encoding'.
3501 			      if (c != 'X')
3502 				  name += (*mb_char2bytes)(nr, name);
3503 			      else
3504 				  *name++ = nr;
3505 			  }
3506 			  break;
3507 
3508 			  // octal: "\1", "\12", "\123"
3509 		case '0':
3510 		case '1':
3511 		case '2':
3512 		case '3':
3513 		case '4':
3514 		case '5':
3515 		case '6':
3516 		case '7': *name = *p++ - '0';
3517 			  if (*p >= '0' && *p <= '7')
3518 			  {
3519 			      *name = (*name << 3) + *p++ - '0';
3520 			      if (*p >= '0' && *p <= '7')
3521 				  *name = (*name << 3) + *p++ - '0';
3522 			  }
3523 			  ++name;
3524 			  break;
3525 
3526 			    // Special key, e.g.: "\<C-W>"
3527 		case '<': extra = trans_special(&p, name, TRUE, TRUE,
3528 								   TRUE, NULL);
3529 			  if (extra != 0)
3530 			  {
3531 			      name += extra;
3532 			      break;
3533 			  }
3534 			  // FALLTHROUGH
3535 
3536 		default:  MB_COPY_CHAR(p, name);
3537 			  break;
3538 	    }
3539 	}
3540 	else
3541 	    MB_COPY_CHAR(p, name);
3542 
3543     }
3544     *name = NUL;
3545     if (*p != NUL) // just in case
3546 	++p;
3547     *arg = p;
3548 
3549     return OK;
3550 }
3551 
3552 /*
3553  * Allocate a variable for a 'str''ing' constant.
3554  * Return OK or FAIL.
3555  */
3556     static int
3557 get_lit_string_tv(char_u **arg, typval_T *rettv, int evaluate)
3558 {
3559     char_u	*p;
3560     char_u	*str;
3561     int		reduce = 0;
3562 
3563     /*
3564      * Find the end of the string, skipping ''.
3565      */
3566     for (p = *arg + 1; *p != NUL; MB_PTR_ADV(p))
3567     {
3568 	if (*p == '\'')
3569 	{
3570 	    if (p[1] != '\'')
3571 		break;
3572 	    ++reduce;
3573 	    ++p;
3574 	}
3575     }
3576 
3577     if (*p != '\'')
3578     {
3579 	semsg(_("E115: Missing quote: %s"), *arg);
3580 	return FAIL;
3581     }
3582 
3583     // If only parsing return after setting "*arg"
3584     if (!evaluate)
3585     {
3586 	*arg = p + 1;
3587 	return OK;
3588     }
3589 
3590     /*
3591      * Copy the string into allocated memory, handling '' to ' reduction.
3592      */
3593     str = alloc((p - *arg) - reduce);
3594     if (str == NULL)
3595 	return FAIL;
3596     rettv->v_type = VAR_STRING;
3597     rettv->vval.v_string = str;
3598 
3599     for (p = *arg + 1; *p != NUL; )
3600     {
3601 	if (*p == '\'')
3602 	{
3603 	    if (p[1] != '\'')
3604 		break;
3605 	    ++p;
3606 	}
3607 	MB_COPY_CHAR(p, str);
3608     }
3609     *str = NUL;
3610     *arg = p + 1;
3611 
3612     return OK;
3613 }
3614 
3615 /*
3616  * Return the function name of the partial.
3617  */
3618     char_u *
3619 partial_name(partial_T *pt)
3620 {
3621     if (pt->pt_name != NULL)
3622 	return pt->pt_name;
3623     return pt->pt_func->uf_name;
3624 }
3625 
3626     static void
3627 partial_free(partial_T *pt)
3628 {
3629     int i;
3630 
3631     for (i = 0; i < pt->pt_argc; ++i)
3632 	clear_tv(&pt->pt_argv[i]);
3633     vim_free(pt->pt_argv);
3634     dict_unref(pt->pt_dict);
3635     if (pt->pt_name != NULL)
3636     {
3637 	func_unref(pt->pt_name);
3638 	vim_free(pt->pt_name);
3639     }
3640     else
3641 	func_ptr_unref(pt->pt_func);
3642     vim_free(pt);
3643 }
3644 
3645 /*
3646  * Unreference a closure: decrement the reference count and free it when it
3647  * becomes zero.
3648  */
3649     void
3650 partial_unref(partial_T *pt)
3651 {
3652     if (pt != NULL && --pt->pt_refcount <= 0)
3653 	partial_free(pt);
3654 }
3655 
3656 static int tv_equal_recurse_limit;
3657 
3658     static int
3659 func_equal(
3660     typval_T *tv1,
3661     typval_T *tv2,
3662     int	     ic)	    // ignore case
3663 {
3664     char_u	*s1, *s2;
3665     dict_T	*d1, *d2;
3666     int		a1, a2;
3667     int		i;
3668 
3669     // empty and NULL function name considered the same
3670     s1 = tv1->v_type == VAR_FUNC ? tv1->vval.v_string
3671 					   : partial_name(tv1->vval.v_partial);
3672     if (s1 != NULL && *s1 == NUL)
3673 	s1 = NULL;
3674     s2 = tv2->v_type == VAR_FUNC ? tv2->vval.v_string
3675 					   : partial_name(tv2->vval.v_partial);
3676     if (s2 != NULL && *s2 == NUL)
3677 	s2 = NULL;
3678     if (s1 == NULL || s2 == NULL)
3679     {
3680 	if (s1 != s2)
3681 	    return FALSE;
3682     }
3683     else if (STRCMP(s1, s2) != 0)
3684 	return FALSE;
3685 
3686     // empty dict and NULL dict is different
3687     d1 = tv1->v_type == VAR_FUNC ? NULL : tv1->vval.v_partial->pt_dict;
3688     d2 = tv2->v_type == VAR_FUNC ? NULL : tv2->vval.v_partial->pt_dict;
3689     if (d1 == NULL || d2 == NULL)
3690     {
3691 	if (d1 != d2)
3692 	    return FALSE;
3693     }
3694     else if (!dict_equal(d1, d2, ic, TRUE))
3695 	return FALSE;
3696 
3697     // empty list and no list considered the same
3698     a1 = tv1->v_type == VAR_FUNC ? 0 : tv1->vval.v_partial->pt_argc;
3699     a2 = tv2->v_type == VAR_FUNC ? 0 : tv2->vval.v_partial->pt_argc;
3700     if (a1 != a2)
3701 	return FALSE;
3702     for (i = 0; i < a1; ++i)
3703 	if (!tv_equal(tv1->vval.v_partial->pt_argv + i,
3704 		      tv2->vval.v_partial->pt_argv + i, ic, TRUE))
3705 	    return FALSE;
3706 
3707     return TRUE;
3708 }
3709 
3710 /*
3711  * Return TRUE if "tv1" and "tv2" have the same value.
3712  * Compares the items just like "==" would compare them, but strings and
3713  * numbers are different.  Floats and numbers are also different.
3714  */
3715     int
3716 tv_equal(
3717     typval_T *tv1,
3718     typval_T *tv2,
3719     int	     ic,	    // ignore case
3720     int	     recursive)	    // TRUE when used recursively
3721 {
3722     char_u	buf1[NUMBUFLEN], buf2[NUMBUFLEN];
3723     char_u	*s1, *s2;
3724     static int  recursive_cnt = 0;	    // catch recursive loops
3725     int		r;
3726 
3727     // Catch lists and dicts that have an endless loop by limiting
3728     // recursiveness to a limit.  We guess they are equal then.
3729     // A fixed limit has the problem of still taking an awful long time.
3730     // Reduce the limit every time running into it. That should work fine for
3731     // deeply linked structures that are not recursively linked and catch
3732     // recursiveness quickly.
3733     if (!recursive)
3734 	tv_equal_recurse_limit = 1000;
3735     if (recursive_cnt >= tv_equal_recurse_limit)
3736     {
3737 	--tv_equal_recurse_limit;
3738 	return TRUE;
3739     }
3740 
3741     // For VAR_FUNC and VAR_PARTIAL compare the function name, bound dict and
3742     // arguments.
3743     if ((tv1->v_type == VAR_FUNC
3744 		|| (tv1->v_type == VAR_PARTIAL && tv1->vval.v_partial != NULL))
3745 	    && (tv2->v_type == VAR_FUNC
3746 		|| (tv2->v_type == VAR_PARTIAL && tv2->vval.v_partial != NULL)))
3747     {
3748 	++recursive_cnt;
3749 	r = func_equal(tv1, tv2, ic);
3750 	--recursive_cnt;
3751 	return r;
3752     }
3753 
3754     if (tv1->v_type != tv2->v_type)
3755 	return FALSE;
3756 
3757     switch (tv1->v_type)
3758     {
3759 	case VAR_LIST:
3760 	    ++recursive_cnt;
3761 	    r = list_equal(tv1->vval.v_list, tv2->vval.v_list, ic, TRUE);
3762 	    --recursive_cnt;
3763 	    return r;
3764 
3765 	case VAR_DICT:
3766 	    ++recursive_cnt;
3767 	    r = dict_equal(tv1->vval.v_dict, tv2->vval.v_dict, ic, TRUE);
3768 	    --recursive_cnt;
3769 	    return r;
3770 
3771 	case VAR_BLOB:
3772 	    return blob_equal(tv1->vval.v_blob, tv2->vval.v_blob);
3773 
3774 	case VAR_NUMBER:
3775 	    return tv1->vval.v_number == tv2->vval.v_number;
3776 
3777 	case VAR_STRING:
3778 	    s1 = tv_get_string_buf(tv1, buf1);
3779 	    s2 = tv_get_string_buf(tv2, buf2);
3780 	    return ((ic ? MB_STRICMP(s1, s2) : STRCMP(s1, s2)) == 0);
3781 
3782 	case VAR_BOOL:
3783 	case VAR_SPECIAL:
3784 	    return tv1->vval.v_number == tv2->vval.v_number;
3785 
3786 	case VAR_FLOAT:
3787 #ifdef FEAT_FLOAT
3788 	    return tv1->vval.v_float == tv2->vval.v_float;
3789 #endif
3790 	case VAR_JOB:
3791 #ifdef FEAT_JOB_CHANNEL
3792 	    return tv1->vval.v_job == tv2->vval.v_job;
3793 #endif
3794 	case VAR_CHANNEL:
3795 #ifdef FEAT_JOB_CHANNEL
3796 	    return tv1->vval.v_channel == tv2->vval.v_channel;
3797 #endif
3798 	case VAR_FUNC:
3799 	case VAR_PARTIAL:
3800 	case VAR_UNKNOWN:
3801 	    break;
3802     }
3803 
3804     // VAR_UNKNOWN can be the result of a invalid expression, let's say it
3805     // does not equal anything, not even itself.
3806     return FALSE;
3807 }
3808 
3809 /*
3810  * Return the next (unique) copy ID.
3811  * Used for serializing nested structures.
3812  */
3813     int
3814 get_copyID(void)
3815 {
3816     current_copyID += COPYID_INC;
3817     return current_copyID;
3818 }
3819 
3820 /*
3821  * Garbage collection for lists and dictionaries.
3822  *
3823  * We use reference counts to be able to free most items right away when they
3824  * are no longer used.  But for composite items it's possible that it becomes
3825  * unused while the reference count is > 0: When there is a recursive
3826  * reference.  Example:
3827  *	:let l = [1, 2, 3]
3828  *	:let d = {9: l}
3829  *	:let l[1] = d
3830  *
3831  * Since this is quite unusual we handle this with garbage collection: every
3832  * once in a while find out which lists and dicts are not referenced from any
3833  * variable.
3834  *
3835  * Here is a good reference text about garbage collection (refers to Python
3836  * but it applies to all reference-counting mechanisms):
3837  *	http://python.ca/nas/python/gc/
3838  */
3839 
3840 /*
3841  * Do garbage collection for lists and dicts.
3842  * When "testing" is TRUE this is called from test_garbagecollect_now().
3843  * Return TRUE if some memory was freed.
3844  */
3845     int
3846 garbage_collect(int testing)
3847 {
3848     int		copyID;
3849     int		abort = FALSE;
3850     buf_T	*buf;
3851     win_T	*wp;
3852     int		did_free = FALSE;
3853     tabpage_T	*tp;
3854 
3855     if (!testing)
3856     {
3857 	// Only do this once.
3858 	want_garbage_collect = FALSE;
3859 	may_garbage_collect = FALSE;
3860 	garbage_collect_at_exit = FALSE;
3861     }
3862 
3863     // The execution stack can grow big, limit the size.
3864     if (exestack.ga_maxlen - exestack.ga_len > 500)
3865     {
3866 	size_t	new_len;
3867 	char_u	*pp;
3868 	int	n;
3869 
3870 	// Keep 150% of the current size, with a minimum of the growth size.
3871 	n = exestack.ga_len / 2;
3872 	if (n < exestack.ga_growsize)
3873 	    n = exestack.ga_growsize;
3874 
3875 	// Don't make it bigger though.
3876 	if (exestack.ga_len + n < exestack.ga_maxlen)
3877 	{
3878 	    new_len = exestack.ga_itemsize * (exestack.ga_len + n);
3879 	    pp = vim_realloc(exestack.ga_data, new_len);
3880 	    if (pp == NULL)
3881 		return FAIL;
3882 	    exestack.ga_maxlen = exestack.ga_len + n;
3883 	    exestack.ga_data = pp;
3884 	}
3885     }
3886 
3887     // We advance by two because we add one for items referenced through
3888     // previous_funccal.
3889     copyID = get_copyID();
3890 
3891     /*
3892      * 1. Go through all accessible variables and mark all lists and dicts
3893      *    with copyID.
3894      */
3895 
3896     // Don't free variables in the previous_funccal list unless they are only
3897     // referenced through previous_funccal.  This must be first, because if
3898     // the item is referenced elsewhere the funccal must not be freed.
3899     abort = abort || set_ref_in_previous_funccal(copyID);
3900 
3901     // script-local variables
3902     abort = abort || garbage_collect_scriptvars(copyID);
3903 
3904     // buffer-local variables
3905     FOR_ALL_BUFFERS(buf)
3906 	abort = abort || set_ref_in_item(&buf->b_bufvar.di_tv, copyID,
3907 								  NULL, NULL);
3908 
3909     // window-local variables
3910     FOR_ALL_TAB_WINDOWS(tp, wp)
3911 	abort = abort || set_ref_in_item(&wp->w_winvar.di_tv, copyID,
3912 								  NULL, NULL);
3913     if (aucmd_win != NULL)
3914 	abort = abort || set_ref_in_item(&aucmd_win->w_winvar.di_tv, copyID,
3915 								  NULL, NULL);
3916 #ifdef FEAT_PROP_POPUP
3917     for (wp = first_popupwin; wp != NULL; wp = wp->w_next)
3918 	abort = abort || set_ref_in_item(&wp->w_winvar.di_tv, copyID,
3919 								  NULL, NULL);
3920     FOR_ALL_TABPAGES(tp)
3921 	for (wp = tp->tp_first_popupwin; wp != NULL; wp = wp->w_next)
3922 		abort = abort || set_ref_in_item(&wp->w_winvar.di_tv, copyID,
3923 								  NULL, NULL);
3924 #endif
3925 
3926     // tabpage-local variables
3927     FOR_ALL_TABPAGES(tp)
3928 	abort = abort || set_ref_in_item(&tp->tp_winvar.di_tv, copyID,
3929 								  NULL, NULL);
3930     // global variables
3931     abort = abort || garbage_collect_globvars(copyID);
3932 
3933     // function-local variables
3934     abort = abort || set_ref_in_call_stack(copyID);
3935 
3936     // named functions (matters for closures)
3937     abort = abort || set_ref_in_functions(copyID);
3938 
3939     // function call arguments, if v:testing is set.
3940     abort = abort || set_ref_in_func_args(copyID);
3941 
3942     // v: vars
3943     abort = abort || garbage_collect_vimvars(copyID);
3944 
3945     // callbacks in buffers
3946     abort = abort || set_ref_in_buffers(copyID);
3947 
3948 #ifdef FEAT_LUA
3949     abort = abort || set_ref_in_lua(copyID);
3950 #endif
3951 
3952 #ifdef FEAT_PYTHON
3953     abort = abort || set_ref_in_python(copyID);
3954 #endif
3955 
3956 #ifdef FEAT_PYTHON3
3957     abort = abort || set_ref_in_python3(copyID);
3958 #endif
3959 
3960 #ifdef FEAT_JOB_CHANNEL
3961     abort = abort || set_ref_in_channel(copyID);
3962     abort = abort || set_ref_in_job(copyID);
3963 #endif
3964 #ifdef FEAT_NETBEANS_INTG
3965     abort = abort || set_ref_in_nb_channel(copyID);
3966 #endif
3967 
3968 #ifdef FEAT_TIMERS
3969     abort = abort || set_ref_in_timer(copyID);
3970 #endif
3971 
3972 #ifdef FEAT_QUICKFIX
3973     abort = abort || set_ref_in_quickfix(copyID);
3974 #endif
3975 
3976 #ifdef FEAT_TERMINAL
3977     abort = abort || set_ref_in_term(copyID);
3978 #endif
3979 
3980 #ifdef FEAT_PROP_POPUP
3981     abort = abort || set_ref_in_popups(copyID);
3982 #endif
3983 
3984     if (!abort)
3985     {
3986 	/*
3987 	 * 2. Free lists and dictionaries that are not referenced.
3988 	 */
3989 	did_free = free_unref_items(copyID);
3990 
3991 	/*
3992 	 * 3. Check if any funccal can be freed now.
3993 	 *    This may call us back recursively.
3994 	 */
3995 	free_unref_funccal(copyID, testing);
3996     }
3997     else if (p_verbose > 0)
3998     {
3999 	verb_msg(_("Not enough memory to set references, garbage collection aborted!"));
4000     }
4001 
4002     return did_free;
4003 }
4004 
4005 /*
4006  * Free lists, dictionaries, channels and jobs that are no longer referenced.
4007  */
4008     static int
4009 free_unref_items(int copyID)
4010 {
4011     int		did_free = FALSE;
4012 
4013     // Let all "free" functions know that we are here.  This means no
4014     // dictionaries, lists, channels or jobs are to be freed, because we will
4015     // do that here.
4016     in_free_unref_items = TRUE;
4017 
4018     /*
4019      * PASS 1: free the contents of the items.  We don't free the items
4020      * themselves yet, so that it is possible to decrement refcount counters
4021      */
4022 
4023     // Go through the list of dicts and free items without the copyID.
4024     did_free |= dict_free_nonref(copyID);
4025 
4026     // Go through the list of lists and free items without the copyID.
4027     did_free |= list_free_nonref(copyID);
4028 
4029 #ifdef FEAT_JOB_CHANNEL
4030     // Go through the list of jobs and free items without the copyID. This
4031     // must happen before doing channels, because jobs refer to channels, but
4032     // the reference from the channel to the job isn't tracked.
4033     did_free |= free_unused_jobs_contents(copyID, COPYID_MASK);
4034 
4035     // Go through the list of channels and free items without the copyID.
4036     did_free |= free_unused_channels_contents(copyID, COPYID_MASK);
4037 #endif
4038 
4039     /*
4040      * PASS 2: free the items themselves.
4041      */
4042     dict_free_items(copyID);
4043     list_free_items(copyID);
4044 
4045 #ifdef FEAT_JOB_CHANNEL
4046     // Go through the list of jobs and free items without the copyID. This
4047     // must happen before doing channels, because jobs refer to channels, but
4048     // the reference from the channel to the job isn't tracked.
4049     free_unused_jobs(copyID, COPYID_MASK);
4050 
4051     // Go through the list of channels and free items without the copyID.
4052     free_unused_channels(copyID, COPYID_MASK);
4053 #endif
4054 
4055     in_free_unref_items = FALSE;
4056 
4057     return did_free;
4058 }
4059 
4060 /*
4061  * Mark all lists and dicts referenced through hashtab "ht" with "copyID".
4062  * "list_stack" is used to add lists to be marked.  Can be NULL.
4063  *
4064  * Returns TRUE if setting references failed somehow.
4065  */
4066     int
4067 set_ref_in_ht(hashtab_T *ht, int copyID, list_stack_T **list_stack)
4068 {
4069     int		todo;
4070     int		abort = FALSE;
4071     hashitem_T	*hi;
4072     hashtab_T	*cur_ht;
4073     ht_stack_T	*ht_stack = NULL;
4074     ht_stack_T	*tempitem;
4075 
4076     cur_ht = ht;
4077     for (;;)
4078     {
4079 	if (!abort)
4080 	{
4081 	    // Mark each item in the hashtab.  If the item contains a hashtab
4082 	    // it is added to ht_stack, if it contains a list it is added to
4083 	    // list_stack.
4084 	    todo = (int)cur_ht->ht_used;
4085 	    for (hi = cur_ht->ht_array; todo > 0; ++hi)
4086 		if (!HASHITEM_EMPTY(hi))
4087 		{
4088 		    --todo;
4089 		    abort = abort || set_ref_in_item(&HI2DI(hi)->di_tv, copyID,
4090 						       &ht_stack, list_stack);
4091 		}
4092 	}
4093 
4094 	if (ht_stack == NULL)
4095 	    break;
4096 
4097 	// take an item from the stack
4098 	cur_ht = ht_stack->ht;
4099 	tempitem = ht_stack;
4100 	ht_stack = ht_stack->prev;
4101 	free(tempitem);
4102     }
4103 
4104     return abort;
4105 }
4106 
4107 /*
4108  * Mark a dict and its items with "copyID".
4109  * Returns TRUE if setting references failed somehow.
4110  */
4111     int
4112 set_ref_in_dict(dict_T *d, int copyID)
4113 {
4114     if (d != NULL && d->dv_copyID != copyID)
4115     {
4116 	d->dv_copyID = copyID;
4117 	return set_ref_in_ht(&d->dv_hashtab, copyID, NULL);
4118     }
4119     return FALSE;
4120 }
4121 
4122 /*
4123  * Mark a list and its items with "copyID".
4124  * Returns TRUE if setting references failed somehow.
4125  */
4126     int
4127 set_ref_in_list(list_T *ll, int copyID)
4128 {
4129     if (ll != NULL && ll->lv_copyID != copyID)
4130     {
4131 	ll->lv_copyID = copyID;
4132 	return set_ref_in_list_items(ll, copyID, NULL);
4133     }
4134     return FALSE;
4135 }
4136 
4137 /*
4138  * Mark all lists and dicts referenced through list "l" with "copyID".
4139  * "ht_stack" is used to add hashtabs to be marked.  Can be NULL.
4140  *
4141  * Returns TRUE if setting references failed somehow.
4142  */
4143     int
4144 set_ref_in_list_items(list_T *l, int copyID, ht_stack_T **ht_stack)
4145 {
4146     listitem_T	 *li;
4147     int		 abort = FALSE;
4148     list_T	 *cur_l;
4149     list_stack_T *list_stack = NULL;
4150     list_stack_T *tempitem;
4151 
4152     cur_l = l;
4153     for (;;)
4154     {
4155 	if (!abort)
4156 	    // Mark each item in the list.  If the item contains a hashtab
4157 	    // it is added to ht_stack, if it contains a list it is added to
4158 	    // list_stack.
4159 	    for (li = cur_l->lv_first; !abort && li != NULL; li = li->li_next)
4160 		abort = abort || set_ref_in_item(&li->li_tv, copyID,
4161 						       ht_stack, &list_stack);
4162 	if (list_stack == NULL)
4163 	    break;
4164 
4165 	// take an item from the stack
4166 	cur_l = list_stack->list;
4167 	tempitem = list_stack;
4168 	list_stack = list_stack->prev;
4169 	free(tempitem);
4170     }
4171 
4172     return abort;
4173 }
4174 
4175 /*
4176  * Mark all lists and dicts referenced through typval "tv" with "copyID".
4177  * "list_stack" is used to add lists to be marked.  Can be NULL.
4178  * "ht_stack" is used to add hashtabs to be marked.  Can be NULL.
4179  *
4180  * Returns TRUE if setting references failed somehow.
4181  */
4182     int
4183 set_ref_in_item(
4184     typval_T	    *tv,
4185     int		    copyID,
4186     ht_stack_T	    **ht_stack,
4187     list_stack_T    **list_stack)
4188 {
4189     int		abort = FALSE;
4190 
4191     if (tv->v_type == VAR_DICT)
4192     {
4193 	dict_T	*dd = tv->vval.v_dict;
4194 
4195 	if (dd != NULL && dd->dv_copyID != copyID)
4196 	{
4197 	    // Didn't see this dict yet.
4198 	    dd->dv_copyID = copyID;
4199 	    if (ht_stack == NULL)
4200 	    {
4201 		abort = set_ref_in_ht(&dd->dv_hashtab, copyID, list_stack);
4202 	    }
4203 	    else
4204 	    {
4205 		ht_stack_T *newitem = (ht_stack_T*)malloc(sizeof(ht_stack_T));
4206 		if (newitem == NULL)
4207 		    abort = TRUE;
4208 		else
4209 		{
4210 		    newitem->ht = &dd->dv_hashtab;
4211 		    newitem->prev = *ht_stack;
4212 		    *ht_stack = newitem;
4213 		}
4214 	    }
4215 	}
4216     }
4217     else if (tv->v_type == VAR_LIST)
4218     {
4219 	list_T	*ll = tv->vval.v_list;
4220 
4221 	if (ll != NULL && ll->lv_copyID != copyID)
4222 	{
4223 	    // Didn't see this list yet.
4224 	    ll->lv_copyID = copyID;
4225 	    if (list_stack == NULL)
4226 	    {
4227 		abort = set_ref_in_list_items(ll, copyID, ht_stack);
4228 	    }
4229 	    else
4230 	    {
4231 		list_stack_T *newitem = (list_stack_T*)malloc(
4232 							sizeof(list_stack_T));
4233 		if (newitem == NULL)
4234 		    abort = TRUE;
4235 		else
4236 		{
4237 		    newitem->list = ll;
4238 		    newitem->prev = *list_stack;
4239 		    *list_stack = newitem;
4240 		}
4241 	    }
4242 	}
4243     }
4244     else if (tv->v_type == VAR_FUNC)
4245     {
4246 	abort = set_ref_in_func(tv->vval.v_string, NULL, copyID);
4247     }
4248     else if (tv->v_type == VAR_PARTIAL)
4249     {
4250 	partial_T	*pt = tv->vval.v_partial;
4251 	int		i;
4252 
4253 	// A partial does not have a copyID, because it cannot contain itself.
4254 	if (pt != NULL)
4255 	{
4256 	    abort = set_ref_in_func(pt->pt_name, pt->pt_func, copyID);
4257 
4258 	    if (pt->pt_dict != NULL)
4259 	    {
4260 		typval_T dtv;
4261 
4262 		dtv.v_type = VAR_DICT;
4263 		dtv.vval.v_dict = pt->pt_dict;
4264 		set_ref_in_item(&dtv, copyID, ht_stack, list_stack);
4265 	    }
4266 
4267 	    for (i = 0; i < pt->pt_argc; ++i)
4268 		abort = abort || set_ref_in_item(&pt->pt_argv[i], copyID,
4269 							ht_stack, list_stack);
4270 	}
4271     }
4272 #ifdef FEAT_JOB_CHANNEL
4273     else if (tv->v_type == VAR_JOB)
4274     {
4275 	job_T	    *job = tv->vval.v_job;
4276 	typval_T    dtv;
4277 
4278 	if (job != NULL && job->jv_copyID != copyID)
4279 	{
4280 	    job->jv_copyID = copyID;
4281 	    if (job->jv_channel != NULL)
4282 	    {
4283 		dtv.v_type = VAR_CHANNEL;
4284 		dtv.vval.v_channel = job->jv_channel;
4285 		set_ref_in_item(&dtv, copyID, ht_stack, list_stack);
4286 	    }
4287 	    if (job->jv_exit_cb.cb_partial != NULL)
4288 	    {
4289 		dtv.v_type = VAR_PARTIAL;
4290 		dtv.vval.v_partial = job->jv_exit_cb.cb_partial;
4291 		set_ref_in_item(&dtv, copyID, ht_stack, list_stack);
4292 	    }
4293 	}
4294     }
4295     else if (tv->v_type == VAR_CHANNEL)
4296     {
4297 	channel_T   *ch =tv->vval.v_channel;
4298 	ch_part_T   part;
4299 	typval_T    dtv;
4300 	jsonq_T	    *jq;
4301 	cbq_T	    *cq;
4302 
4303 	if (ch != NULL && ch->ch_copyID != copyID)
4304 	{
4305 	    ch->ch_copyID = copyID;
4306 	    for (part = PART_SOCK; part < PART_COUNT; ++part)
4307 	    {
4308 		for (jq = ch->ch_part[part].ch_json_head.jq_next; jq != NULL;
4309 							     jq = jq->jq_next)
4310 		    set_ref_in_item(jq->jq_value, copyID, ht_stack, list_stack);
4311 		for (cq = ch->ch_part[part].ch_cb_head.cq_next; cq != NULL;
4312 							     cq = cq->cq_next)
4313 		    if (cq->cq_callback.cb_partial != NULL)
4314 		    {
4315 			dtv.v_type = VAR_PARTIAL;
4316 			dtv.vval.v_partial = cq->cq_callback.cb_partial;
4317 			set_ref_in_item(&dtv, copyID, ht_stack, list_stack);
4318 		    }
4319 		if (ch->ch_part[part].ch_callback.cb_partial != NULL)
4320 		{
4321 		    dtv.v_type = VAR_PARTIAL;
4322 		    dtv.vval.v_partial =
4323 				      ch->ch_part[part].ch_callback.cb_partial;
4324 		    set_ref_in_item(&dtv, copyID, ht_stack, list_stack);
4325 		}
4326 	    }
4327 	    if (ch->ch_callback.cb_partial != NULL)
4328 	    {
4329 		dtv.v_type = VAR_PARTIAL;
4330 		dtv.vval.v_partial = ch->ch_callback.cb_partial;
4331 		set_ref_in_item(&dtv, copyID, ht_stack, list_stack);
4332 	    }
4333 	    if (ch->ch_close_cb.cb_partial != NULL)
4334 	    {
4335 		dtv.v_type = VAR_PARTIAL;
4336 		dtv.vval.v_partial = ch->ch_close_cb.cb_partial;
4337 		set_ref_in_item(&dtv, copyID, ht_stack, list_stack);
4338 	    }
4339 	}
4340     }
4341 #endif
4342     return abort;
4343 }
4344 
4345 /*
4346  * Return a string with the string representation of a variable.
4347  * If the memory is allocated "tofree" is set to it, otherwise NULL.
4348  * "numbuf" is used for a number.
4349  * When "copyID" is not NULL replace recursive lists and dicts with "...".
4350  * When both "echo_style" and "composite_val" are FALSE, put quotes around
4351  * stings as "string()", otherwise does not put quotes around strings, as
4352  * ":echo" displays values.
4353  * When "restore_copyID" is FALSE, repeated items in dictionaries and lists
4354  * are replaced with "...".
4355  * May return NULL.
4356  */
4357     char_u *
4358 echo_string_core(
4359     typval_T	*tv,
4360     char_u	**tofree,
4361     char_u	*numbuf,
4362     int		copyID,
4363     int		echo_style,
4364     int		restore_copyID,
4365     int		composite_val)
4366 {
4367     static int	recurse = 0;
4368     char_u	*r = NULL;
4369 
4370     if (recurse >= DICT_MAXNEST)
4371     {
4372 	if (!did_echo_string_emsg)
4373 	{
4374 	    // Only give this message once for a recursive call to avoid
4375 	    // flooding the user with errors.  And stop iterating over lists
4376 	    // and dicts.
4377 	    did_echo_string_emsg = TRUE;
4378 	    emsg(_("E724: variable nested too deep for displaying"));
4379 	}
4380 	*tofree = NULL;
4381 	return (char_u *)"{E724}";
4382     }
4383     ++recurse;
4384 
4385     switch (tv->v_type)
4386     {
4387 	case VAR_STRING:
4388 	    if (echo_style && !composite_val)
4389 	    {
4390 		*tofree = NULL;
4391 		r = tv->vval.v_string;
4392 		if (r == NULL)
4393 		    r = (char_u *)"";
4394 	    }
4395 	    else
4396 	    {
4397 		*tofree = string_quote(tv->vval.v_string, FALSE);
4398 		r = *tofree;
4399 	    }
4400 	    break;
4401 
4402 	case VAR_FUNC:
4403 	    if (echo_style)
4404 	    {
4405 		*tofree = NULL;
4406 		r = tv->vval.v_string;
4407 	    }
4408 	    else
4409 	    {
4410 		*tofree = string_quote(tv->vval.v_string, TRUE);
4411 		r = *tofree;
4412 	    }
4413 	    break;
4414 
4415 	case VAR_PARTIAL:
4416 	    {
4417 		partial_T   *pt = tv->vval.v_partial;
4418 		char_u	    *fname = string_quote(pt == NULL ? NULL
4419 						    : partial_name(pt), FALSE);
4420 		garray_T    ga;
4421 		int	    i;
4422 		char_u	    *tf;
4423 
4424 		ga_init2(&ga, 1, 100);
4425 		ga_concat(&ga, (char_u *)"function(");
4426 		if (fname != NULL)
4427 		{
4428 		    ga_concat(&ga, fname);
4429 		    vim_free(fname);
4430 		}
4431 		if (pt != NULL && pt->pt_argc > 0)
4432 		{
4433 		    ga_concat(&ga, (char_u *)", [");
4434 		    for (i = 0; i < pt->pt_argc; ++i)
4435 		    {
4436 			if (i > 0)
4437 			    ga_concat(&ga, (char_u *)", ");
4438 			ga_concat(&ga,
4439 			     tv2string(&pt->pt_argv[i], &tf, numbuf, copyID));
4440 			vim_free(tf);
4441 		    }
4442 		    ga_concat(&ga, (char_u *)"]");
4443 		}
4444 		if (pt != NULL && pt->pt_dict != NULL)
4445 		{
4446 		    typval_T dtv;
4447 
4448 		    ga_concat(&ga, (char_u *)", ");
4449 		    dtv.v_type = VAR_DICT;
4450 		    dtv.vval.v_dict = pt->pt_dict;
4451 		    ga_concat(&ga, tv2string(&dtv, &tf, numbuf, copyID));
4452 		    vim_free(tf);
4453 		}
4454 		ga_concat(&ga, (char_u *)")");
4455 
4456 		*tofree = ga.ga_data;
4457 		r = *tofree;
4458 		break;
4459 	    }
4460 
4461 	case VAR_BLOB:
4462 	    r = blob2string(tv->vval.v_blob, tofree, numbuf);
4463 	    break;
4464 
4465 	case VAR_LIST:
4466 	    if (tv->vval.v_list == NULL)
4467 	    {
4468 		*tofree = NULL;
4469 		r = NULL;
4470 	    }
4471 	    else if (copyID != 0 && tv->vval.v_list->lv_copyID == copyID
4472 		    && tv->vval.v_list->lv_len > 0)
4473 	    {
4474 		*tofree = NULL;
4475 		r = (char_u *)"[...]";
4476 	    }
4477 	    else
4478 	    {
4479 		int old_copyID = tv->vval.v_list->lv_copyID;
4480 
4481 		tv->vval.v_list->lv_copyID = copyID;
4482 		*tofree = list2string(tv, copyID, restore_copyID);
4483 		if (restore_copyID)
4484 		    tv->vval.v_list->lv_copyID = old_copyID;
4485 		r = *tofree;
4486 	    }
4487 	    break;
4488 
4489 	case VAR_DICT:
4490 	    if (tv->vval.v_dict == NULL)
4491 	    {
4492 		*tofree = NULL;
4493 		r = NULL;
4494 	    }
4495 	    else if (copyID != 0 && tv->vval.v_dict->dv_copyID == copyID
4496 		    && tv->vval.v_dict->dv_hashtab.ht_used != 0)
4497 	    {
4498 		*tofree = NULL;
4499 		r = (char_u *)"{...}";
4500 	    }
4501 	    else
4502 	    {
4503 		int old_copyID = tv->vval.v_dict->dv_copyID;
4504 		tv->vval.v_dict->dv_copyID = copyID;
4505 		*tofree = dict2string(tv, copyID, restore_copyID);
4506 		if (restore_copyID)
4507 		    tv->vval.v_dict->dv_copyID = old_copyID;
4508 		r = *tofree;
4509 	    }
4510 	    break;
4511 
4512 	case VAR_NUMBER:
4513 	case VAR_UNKNOWN:
4514 	    *tofree = NULL;
4515 	    r = tv_get_string_buf(tv, numbuf);
4516 	    break;
4517 
4518 	case VAR_JOB:
4519 	case VAR_CHANNEL:
4520 	    *tofree = NULL;
4521 	    r = tv_get_string_buf(tv, numbuf);
4522 	    if (composite_val)
4523 	    {
4524 		*tofree = string_quote(r, FALSE);
4525 		r = *tofree;
4526 	    }
4527 	    break;
4528 
4529 	case VAR_FLOAT:
4530 #ifdef FEAT_FLOAT
4531 	    *tofree = NULL;
4532 	    vim_snprintf((char *)numbuf, NUMBUFLEN, "%g", tv->vval.v_float);
4533 	    r = numbuf;
4534 	    break;
4535 #endif
4536 
4537 	case VAR_BOOL:
4538 	case VAR_SPECIAL:
4539 	    *tofree = NULL;
4540 	    r = (char_u *)get_var_special_name(tv->vval.v_number);
4541 	    break;
4542     }
4543 
4544     if (--recurse == 0)
4545 	did_echo_string_emsg = FALSE;
4546     return r;
4547 }
4548 
4549 /*
4550  * Return a string with the string representation of a variable.
4551  * If the memory is allocated "tofree" is set to it, otherwise NULL.
4552  * "numbuf" is used for a number.
4553  * Does not put quotes around strings, as ":echo" displays values.
4554  * When "copyID" is not NULL replace recursive lists and dicts with "...".
4555  * May return NULL.
4556  */
4557     char_u *
4558 echo_string(
4559     typval_T	*tv,
4560     char_u	**tofree,
4561     char_u	*numbuf,
4562     int		copyID)
4563 {
4564     return echo_string_core(tv, tofree, numbuf, copyID, TRUE, FALSE, FALSE);
4565 }
4566 
4567 /*
4568  * Return a string with the string representation of a variable.
4569  * If the memory is allocated "tofree" is set to it, otherwise NULL.
4570  * "numbuf" is used for a number.
4571  * Puts quotes around strings, so that they can be parsed back by eval().
4572  * May return NULL.
4573  */
4574     char_u *
4575 tv2string(
4576     typval_T	*tv,
4577     char_u	**tofree,
4578     char_u	*numbuf,
4579     int		copyID)
4580 {
4581     return echo_string_core(tv, tofree, numbuf, copyID, FALSE, TRUE, FALSE);
4582 }
4583 
4584 /*
4585  * Return string "str" in ' quotes, doubling ' characters.
4586  * If "str" is NULL an empty string is assumed.
4587  * If "function" is TRUE make it function('string').
4588  */
4589     char_u *
4590 string_quote(char_u *str, int function)
4591 {
4592     unsigned	len;
4593     char_u	*p, *r, *s;
4594 
4595     len = (function ? 13 : 3);
4596     if (str != NULL)
4597     {
4598 	len += (unsigned)STRLEN(str);
4599 	for (p = str; *p != NUL; MB_PTR_ADV(p))
4600 	    if (*p == '\'')
4601 		++len;
4602     }
4603     s = r = alloc(len);
4604     if (r != NULL)
4605     {
4606 	if (function)
4607 	{
4608 	    STRCPY(r, "function('");
4609 	    r += 10;
4610 	}
4611 	else
4612 	    *r++ = '\'';
4613 	if (str != NULL)
4614 	    for (p = str; *p != NUL; )
4615 	    {
4616 		if (*p == '\'')
4617 		    *r++ = '\'';
4618 		MB_COPY_CHAR(p, r);
4619 	    }
4620 	*r++ = '\'';
4621 	if (function)
4622 	    *r++ = ')';
4623 	*r++ = NUL;
4624     }
4625     return s;
4626 }
4627 
4628 #if defined(FEAT_FLOAT) || defined(PROTO)
4629 /*
4630  * Convert the string "text" to a floating point number.
4631  * This uses strtod().  setlocale(LC_NUMERIC, "C") has been used to make sure
4632  * this always uses a decimal point.
4633  * Returns the length of the text that was consumed.
4634  */
4635     int
4636 string2float(
4637     char_u	*text,
4638     float_T	*value)	    // result stored here
4639 {
4640     char	*s = (char *)text;
4641     float_T	f;
4642 
4643     // MS-Windows does not deal with "inf" and "nan" properly.
4644     if (STRNICMP(text, "inf", 3) == 0)
4645     {
4646 	*value = INFINITY;
4647 	return 3;
4648     }
4649     if (STRNICMP(text, "-inf", 3) == 0)
4650     {
4651 	*value = -INFINITY;
4652 	return 4;
4653     }
4654     if (STRNICMP(text, "nan", 3) == 0)
4655     {
4656 	*value = NAN;
4657 	return 3;
4658     }
4659     f = strtod(s, &s);
4660     *value = f;
4661     return (int)((char_u *)s - text);
4662 }
4663 #endif
4664 
4665 /*
4666  * Get the value of an environment variable.
4667  * "arg" is pointing to the '$'.  It is advanced to after the name.
4668  * If the environment variable was not set, silently assume it is empty.
4669  * Return FAIL if the name is invalid.
4670  */
4671     static int
4672 get_env_tv(char_u **arg, typval_T *rettv, int evaluate)
4673 {
4674     char_u	*string = NULL;
4675     int		len;
4676     int		cc;
4677     char_u	*name;
4678     int		mustfree = FALSE;
4679 
4680     ++*arg;
4681     name = *arg;
4682     len = get_env_len(arg);
4683     if (evaluate)
4684     {
4685 	if (len == 0)
4686 	    return FAIL; // invalid empty name
4687 
4688 	cc = name[len];
4689 	name[len] = NUL;
4690 	// first try vim_getenv(), fast for normal environment vars
4691 	string = vim_getenv(name, &mustfree);
4692 	if (string != NULL && *string != NUL)
4693 	{
4694 	    if (!mustfree)
4695 		string = vim_strsave(string);
4696 	}
4697 	else
4698 	{
4699 	    if (mustfree)
4700 		vim_free(string);
4701 
4702 	    // next try expanding things like $VIM and ${HOME}
4703 	    string = expand_env_save(name - 1);
4704 	    if (string != NULL && *string == '$')
4705 		VIM_CLEAR(string);
4706 	}
4707 	name[len] = cc;
4708 
4709 	rettv->v_type = VAR_STRING;
4710 	rettv->vval.v_string = string;
4711     }
4712 
4713     return OK;
4714 }
4715 
4716 /*
4717  * Translate a String variable into a position.
4718  * Returns NULL when there is an error.
4719  */
4720     pos_T *
4721 var2fpos(
4722     typval_T	*varp,
4723     int		dollar_lnum,	// TRUE when $ is last line
4724     int		*fnum)		// set to fnum for '0, 'A, etc.
4725 {
4726     char_u		*name;
4727     static pos_T	pos;
4728     pos_T		*pp;
4729 
4730     // Argument can be [lnum, col, coladd].
4731     if (varp->v_type == VAR_LIST)
4732     {
4733 	list_T		*l;
4734 	int		len;
4735 	int		error = FALSE;
4736 	listitem_T	*li;
4737 
4738 	l = varp->vval.v_list;
4739 	if (l == NULL)
4740 	    return NULL;
4741 
4742 	// Get the line number
4743 	pos.lnum = list_find_nr(l, 0L, &error);
4744 	if (error || pos.lnum <= 0 || pos.lnum > curbuf->b_ml.ml_line_count)
4745 	    return NULL;	// invalid line number
4746 
4747 	// Get the column number
4748 	pos.col = list_find_nr(l, 1L, &error);
4749 	if (error)
4750 	    return NULL;
4751 	len = (long)STRLEN(ml_get(pos.lnum));
4752 
4753 	// We accept "$" for the column number: last column.
4754 	li = list_find(l, 1L);
4755 	if (li != NULL && li->li_tv.v_type == VAR_STRING
4756 		&& li->li_tv.vval.v_string != NULL
4757 		&& STRCMP(li->li_tv.vval.v_string, "$") == 0)
4758 	    pos.col = len + 1;
4759 
4760 	// Accept a position up to the NUL after the line.
4761 	if (pos.col == 0 || (int)pos.col > len + 1)
4762 	    return NULL;	// invalid column number
4763 	--pos.col;
4764 
4765 	// Get the virtual offset.  Defaults to zero.
4766 	pos.coladd = list_find_nr(l, 2L, &error);
4767 	if (error)
4768 	    pos.coladd = 0;
4769 
4770 	return &pos;
4771     }
4772 
4773     name = tv_get_string_chk(varp);
4774     if (name == NULL)
4775 	return NULL;
4776     if (name[0] == '.')				// cursor
4777 	return &curwin->w_cursor;
4778     if (name[0] == 'v' && name[1] == NUL)	// Visual start
4779     {
4780 	if (VIsual_active)
4781 	    return &VIsual;
4782 	return &curwin->w_cursor;
4783     }
4784     if (name[0] == '\'')			// mark
4785     {
4786 	pp = getmark_buf_fnum(curbuf, name[1], FALSE, fnum);
4787 	if (pp == NULL || pp == (pos_T *)-1 || pp->lnum <= 0)
4788 	    return NULL;
4789 	return pp;
4790     }
4791 
4792     pos.coladd = 0;
4793 
4794     if (name[0] == 'w' && dollar_lnum)
4795     {
4796 	pos.col = 0;
4797 	if (name[1] == '0')		// "w0": first visible line
4798 	{
4799 	    update_topline();
4800 	    // In silent Ex mode topline is zero, but that's not a valid line
4801 	    // number; use one instead.
4802 	    pos.lnum = curwin->w_topline > 0 ? curwin->w_topline : 1;
4803 	    return &pos;
4804 	}
4805 	else if (name[1] == '$')	// "w$": last visible line
4806 	{
4807 	    validate_botline();
4808 	    // In silent Ex mode botline is zero, return zero then.
4809 	    pos.lnum = curwin->w_botline > 0 ? curwin->w_botline - 1 : 0;
4810 	    return &pos;
4811 	}
4812     }
4813     else if (name[0] == '$')		// last column or line
4814     {
4815 	if (dollar_lnum)
4816 	{
4817 	    pos.lnum = curbuf->b_ml.ml_line_count;
4818 	    pos.col = 0;
4819 	}
4820 	else
4821 	{
4822 	    pos.lnum = curwin->w_cursor.lnum;
4823 	    pos.col = (colnr_T)STRLEN(ml_get_curline());
4824 	}
4825 	return &pos;
4826     }
4827     return NULL;
4828 }
4829 
4830 /*
4831  * Convert list in "arg" into a position and optional file number.
4832  * When "fnump" is NULL there is no file number, only 3 items.
4833  * Note that the column is passed on as-is, the caller may want to decrement
4834  * it to use 1 for the first column.
4835  * Return FAIL when conversion is not possible, doesn't check the position for
4836  * validity.
4837  */
4838     int
4839 list2fpos(
4840     typval_T	*arg,
4841     pos_T	*posp,
4842     int		*fnump,
4843     colnr_T	*curswantp)
4844 {
4845     list_T	*l = arg->vval.v_list;
4846     long	i = 0;
4847     long	n;
4848 
4849     // List must be: [fnum, lnum, col, coladd, curswant], where "fnum" is only
4850     // there when "fnump" isn't NULL; "coladd" and "curswant" are optional.
4851     if (arg->v_type != VAR_LIST
4852 	    || l == NULL
4853 	    || l->lv_len < (fnump == NULL ? 2 : 3)
4854 	    || l->lv_len > (fnump == NULL ? 4 : 5))
4855 	return FAIL;
4856 
4857     if (fnump != NULL)
4858     {
4859 	n = list_find_nr(l, i++, NULL);	// fnum
4860 	if (n < 0)
4861 	    return FAIL;
4862 	if (n == 0)
4863 	    n = curbuf->b_fnum;		// current buffer
4864 	*fnump = n;
4865     }
4866 
4867     n = list_find_nr(l, i++, NULL);	// lnum
4868     if (n < 0)
4869 	return FAIL;
4870     posp->lnum = n;
4871 
4872     n = list_find_nr(l, i++, NULL);	// col
4873     if (n < 0)
4874 	return FAIL;
4875     posp->col = n;
4876 
4877     n = list_find_nr(l, i, NULL);	// off
4878     if (n < 0)
4879 	posp->coladd = 0;
4880     else
4881 	posp->coladd = n;
4882 
4883     if (curswantp != NULL)
4884 	*curswantp = list_find_nr(l, i + 1, NULL);  // curswant
4885 
4886     return OK;
4887 }
4888 
4889 /*
4890  * Get the length of an environment variable name.
4891  * Advance "arg" to the first character after the name.
4892  * Return 0 for error.
4893  */
4894     int
4895 get_env_len(char_u **arg)
4896 {
4897     char_u	*p;
4898     int		len;
4899 
4900     for (p = *arg; vim_isIDc(*p); ++p)
4901 	;
4902     if (p == *arg)	    // no name found
4903 	return 0;
4904 
4905     len = (int)(p - *arg);
4906     *arg = p;
4907     return len;
4908 }
4909 
4910 /*
4911  * Get the length of the name of a function or internal variable.
4912  * "arg" is advanced to the first non-white character after the name.
4913  * Return 0 if something is wrong.
4914  */
4915     int
4916 get_id_len(char_u **arg)
4917 {
4918     char_u	*p;
4919     int		len;
4920 
4921     // Find the end of the name.
4922     for (p = *arg; eval_isnamec(*p); ++p)
4923     {
4924 	if (*p == ':')
4925 	{
4926 	    // "s:" is start of "s:var", but "n:" is not and can be used in
4927 	    // slice "[n:]".  Also "xx:" is not a namespace.
4928 	    len = (int)(p - *arg);
4929 	    if ((len == 1 && vim_strchr(NAMESPACE_CHAR, **arg) == NULL)
4930 		    || len > 1)
4931 		break;
4932 	}
4933     }
4934     if (p == *arg)	    // no name found
4935 	return 0;
4936 
4937     len = (int)(p - *arg);
4938     *arg = skipwhite(p);
4939 
4940     return len;
4941 }
4942 
4943 /*
4944  * Get the length of the name of a variable or function.
4945  * Only the name is recognized, does not handle ".key" or "[idx]".
4946  * "arg" is advanced to the first non-white character after the name.
4947  * Return -1 if curly braces expansion failed.
4948  * Return 0 if something else is wrong.
4949  * If the name contains 'magic' {}'s, expand them and return the
4950  * expanded name in an allocated string via 'alias' - caller must free.
4951  */
4952     int
4953 get_name_len(
4954     char_u	**arg,
4955     char_u	**alias,
4956     int		evaluate,
4957     int		verbose)
4958 {
4959     int		len;
4960     char_u	*p;
4961     char_u	*expr_start;
4962     char_u	*expr_end;
4963 
4964     *alias = NULL;  // default to no alias
4965 
4966     if ((*arg)[0] == K_SPECIAL && (*arg)[1] == KS_EXTRA
4967 						  && (*arg)[2] == (int)KE_SNR)
4968     {
4969 	// hard coded <SNR>, already translated
4970 	*arg += 3;
4971 	return get_id_len(arg) + 3;
4972     }
4973     len = eval_fname_script(*arg);
4974     if (len > 0)
4975     {
4976 	// literal "<SID>", "s:" or "<SNR>"
4977 	*arg += len;
4978     }
4979 
4980     /*
4981      * Find the end of the name; check for {} construction.
4982      */
4983     p = find_name_end(*arg, &expr_start, &expr_end,
4984 					       len > 0 ? 0 : FNE_CHECK_START);
4985     if (expr_start != NULL)
4986     {
4987 	char_u	*temp_string;
4988 
4989 	if (!evaluate)
4990 	{
4991 	    len += (int)(p - *arg);
4992 	    *arg = skipwhite(p);
4993 	    return len;
4994 	}
4995 
4996 	/*
4997 	 * Include any <SID> etc in the expanded string:
4998 	 * Thus the -len here.
4999 	 */
5000 	temp_string = make_expanded_name(*arg - len, expr_start, expr_end, p);
5001 	if (temp_string == NULL)
5002 	    return -1;
5003 	*alias = temp_string;
5004 	*arg = skipwhite(p);
5005 	return (int)STRLEN(temp_string);
5006     }
5007 
5008     len += get_id_len(arg);
5009     // Only give an error when there is something, otherwise it will be
5010     // reported at a higher level.
5011     if (len == 0 && verbose && **arg != NUL)
5012 	semsg(_(e_invexpr2), *arg);
5013 
5014     return len;
5015 }
5016 
5017 /*
5018  * Find the end of a variable or function name, taking care of magic braces.
5019  * If "expr_start" is not NULL then "expr_start" and "expr_end" are set to the
5020  * start and end of the first magic braces item.
5021  * "flags" can have FNE_INCL_BR and FNE_CHECK_START.
5022  * Return a pointer to just after the name.  Equal to "arg" if there is no
5023  * valid name.
5024  */
5025     char_u *
5026 find_name_end(
5027     char_u	*arg,
5028     char_u	**expr_start,
5029     char_u	**expr_end,
5030     int		flags)
5031 {
5032     int		mb_nest = 0;
5033     int		br_nest = 0;
5034     char_u	*p;
5035     int		len;
5036 
5037     if (expr_start != NULL)
5038     {
5039 	*expr_start = NULL;
5040 	*expr_end = NULL;
5041     }
5042 
5043     // Quick check for valid starting character.
5044     if ((flags & FNE_CHECK_START) && !eval_isnamec1(*arg) && *arg != '{')
5045 	return arg;
5046 
5047     for (p = arg; *p != NUL
5048 		    && (eval_isnamec(*p)
5049 			|| *p == '{'
5050 			|| ((flags & FNE_INCL_BR) && (*p == '[' || *p == '.'))
5051 			|| mb_nest != 0
5052 			|| br_nest != 0); MB_PTR_ADV(p))
5053     {
5054 	if (*p == '\'')
5055 	{
5056 	    // skip over 'string' to avoid counting [ and ] inside it.
5057 	    for (p = p + 1; *p != NUL && *p != '\''; MB_PTR_ADV(p))
5058 		;
5059 	    if (*p == NUL)
5060 		break;
5061 	}
5062 	else if (*p == '"')
5063 	{
5064 	    // skip over "str\"ing" to avoid counting [ and ] inside it.
5065 	    for (p = p + 1; *p != NUL && *p != '"'; MB_PTR_ADV(p))
5066 		if (*p == '\\' && p[1] != NUL)
5067 		    ++p;
5068 	    if (*p == NUL)
5069 		break;
5070 	}
5071 	else if (br_nest == 0 && mb_nest == 0 && *p == ':')
5072 	{
5073 	    // "s:" is start of "s:var", but "n:" is not and can be used in
5074 	    // slice "[n:]".  Also "xx:" is not a namespace. But {ns}: is.
5075 	    len = (int)(p - arg);
5076 	    if ((len == 1 && vim_strchr(NAMESPACE_CHAR, *arg) == NULL)
5077 		    || (len > 1 && p[-1] != '}'))
5078 		break;
5079 	}
5080 
5081 	if (mb_nest == 0)
5082 	{
5083 	    if (*p == '[')
5084 		++br_nest;
5085 	    else if (*p == ']')
5086 		--br_nest;
5087 	}
5088 
5089 	if (br_nest == 0)
5090 	{
5091 	    if (*p == '{')
5092 	    {
5093 		mb_nest++;
5094 		if (expr_start != NULL && *expr_start == NULL)
5095 		    *expr_start = p;
5096 	    }
5097 	    else if (*p == '}')
5098 	    {
5099 		mb_nest--;
5100 		if (expr_start != NULL && mb_nest == 0 && *expr_end == NULL)
5101 		    *expr_end = p;
5102 	    }
5103 	}
5104     }
5105 
5106     return p;
5107 }
5108 
5109 /*
5110  * Expands out the 'magic' {}'s in a variable/function name.
5111  * Note that this can call itself recursively, to deal with
5112  * constructs like foo{bar}{baz}{bam}
5113  * The four pointer arguments point to "foo{expre}ss{ion}bar"
5114  *			"in_start"      ^
5115  *			"expr_start"	   ^
5116  *			"expr_end"		 ^
5117  *			"in_end"			    ^
5118  *
5119  * Returns a new allocated string, which the caller must free.
5120  * Returns NULL for failure.
5121  */
5122     static char_u *
5123 make_expanded_name(
5124     char_u	*in_start,
5125     char_u	*expr_start,
5126     char_u	*expr_end,
5127     char_u	*in_end)
5128 {
5129     char_u	c1;
5130     char_u	*retval = NULL;
5131     char_u	*temp_result;
5132     char_u	*nextcmd = NULL;
5133 
5134     if (expr_end == NULL || in_end == NULL)
5135 	return NULL;
5136     *expr_start	= NUL;
5137     *expr_end = NUL;
5138     c1 = *in_end;
5139     *in_end = NUL;
5140 
5141     temp_result = eval_to_string(expr_start + 1, &nextcmd, FALSE);
5142     if (temp_result != NULL && nextcmd == NULL)
5143     {
5144 	retval = alloc(STRLEN(temp_result) + (expr_start - in_start)
5145 						   + (in_end - expr_end) + 1);
5146 	if (retval != NULL)
5147 	{
5148 	    STRCPY(retval, in_start);
5149 	    STRCAT(retval, temp_result);
5150 	    STRCAT(retval, expr_end + 1);
5151 	}
5152     }
5153     vim_free(temp_result);
5154 
5155     *in_end = c1;		// put char back for error messages
5156     *expr_start = '{';
5157     *expr_end = '}';
5158 
5159     if (retval != NULL)
5160     {
5161 	temp_result = find_name_end(retval, &expr_start, &expr_end, 0);
5162 	if (expr_start != NULL)
5163 	{
5164 	    // Further expansion!
5165 	    temp_result = make_expanded_name(retval, expr_start,
5166 						       expr_end, temp_result);
5167 	    vim_free(retval);
5168 	    retval = temp_result;
5169 	}
5170     }
5171 
5172     return retval;
5173 }
5174 
5175 /*
5176  * Return TRUE if character "c" can be used in a variable or function name.
5177  * Does not include '{' or '}' for magic braces.
5178  */
5179     int
5180 eval_isnamec(int c)
5181 {
5182     return (ASCII_ISALNUM(c) || c == '_' || c == ':' || c == AUTOLOAD_CHAR);
5183 }
5184 
5185 /*
5186  * Return TRUE if character "c" can be used as the first character in a
5187  * variable or function name (excluding '{' and '}').
5188  */
5189     int
5190 eval_isnamec1(int c)
5191 {
5192     return (ASCII_ISALPHA(c) || c == '_');
5193 }
5194 
5195 /*
5196  * Handle:
5197  * - expr[expr], expr[expr:expr] subscript
5198  * - ".name" lookup
5199  * - function call with Funcref variable: func(expr)
5200  * - method call: var->method()
5201  *
5202  * Can all be combined in any order: dict.func(expr)[idx]['func'](expr)->len()
5203  */
5204     int
5205 handle_subscript(
5206     char_u	**arg,
5207     typval_T	*rettv,
5208     int		evaluate,	// do more than finding the end
5209     int		verbose,	// give error messages
5210     char_u	*start_leader,	// start of '!' and '-' prefixes
5211     char_u	**end_leaderp)  // end of '!' and '-' prefixes
5212 {
5213     int		ret = OK;
5214     dict_T	*selfdict = NULL;
5215 
5216     // "." is ".name" lookup when we found a dict or when evaluating and
5217     // scriptversion is at least 2, where string concatenation is "..".
5218     while (ret == OK
5219 	    && (((**arg == '['
5220 		    || (**arg == '.' && (rettv->v_type == VAR_DICT
5221 			|| (!evaluate
5222 			    && (*arg)[1] != '.'
5223 			    && current_sctx.sc_version >= 2)))
5224 		    || (**arg == '(' && (!evaluate || rettv->v_type == VAR_FUNC
5225 					    || rettv->v_type == VAR_PARTIAL)))
5226 		&& !VIM_ISWHITE(*(*arg - 1)))
5227 	    || (**arg == '-' && (*arg)[1] == '>')))
5228     {
5229 	if (**arg == '(')
5230 	{
5231 	    ret = call_func_rettv(arg, rettv, evaluate, selfdict, NULL);
5232 
5233 	    // Stop the expression evaluation when immediately aborting on
5234 	    // error, or when an interrupt occurred or an exception was thrown
5235 	    // but not caught.
5236 	    if (aborting())
5237 	    {
5238 		if (ret == OK)
5239 		    clear_tv(rettv);
5240 		ret = FAIL;
5241 	    }
5242 	    dict_unref(selfdict);
5243 	    selfdict = NULL;
5244 	}
5245 	else if (**arg == '-')
5246 	{
5247 	    // Expression "-1.0->method()" applies the leader "-" before
5248 	    // applying ->.
5249 	    if (evaluate && *end_leaderp > start_leader)
5250 		ret = eval7_leader(rettv, start_leader, end_leaderp);
5251 	    if (ret == OK)
5252 	    {
5253 		if ((*arg)[2] == '{')
5254 		    // expr->{lambda}()
5255 		    ret = eval_lambda(arg, rettv, evaluate, verbose);
5256 		else
5257 		    // expr->name()
5258 		    ret = eval_method(arg, rettv, evaluate, verbose);
5259 	    }
5260 	}
5261 	else // **arg == '[' || **arg == '.'
5262 	{
5263 	    dict_unref(selfdict);
5264 	    if (rettv->v_type == VAR_DICT)
5265 	    {
5266 		selfdict = rettv->vval.v_dict;
5267 		if (selfdict != NULL)
5268 		    ++selfdict->dv_refcount;
5269 	    }
5270 	    else
5271 		selfdict = NULL;
5272 	    if (eval_index(arg, rettv, evaluate, verbose) == FAIL)
5273 	    {
5274 		clear_tv(rettv);
5275 		ret = FAIL;
5276 	    }
5277 	}
5278     }
5279 
5280     // Turn "dict.Func" into a partial for "Func" bound to "dict".
5281     // Don't do this when "Func" is already a partial that was bound
5282     // explicitly (pt_auto is FALSE).
5283     if (selfdict != NULL
5284 	    && (rettv->v_type == VAR_FUNC
5285 		|| (rettv->v_type == VAR_PARTIAL
5286 		    && (rettv->vval.v_partial->pt_auto
5287 			|| rettv->vval.v_partial->pt_dict == NULL))))
5288 	selfdict = make_partial(selfdict, rettv);
5289 
5290     dict_unref(selfdict);
5291     return ret;
5292 }
5293 
5294 /*
5295  * Allocate memory for a variable type-value, and make it empty (0 or NULL
5296  * value).
5297  */
5298     typval_T *
5299 alloc_tv(void)
5300 {
5301     return ALLOC_CLEAR_ONE(typval_T);
5302 }
5303 
5304 /*
5305  * Allocate memory for a variable type-value, and assign a string to it.
5306  * The string "s" must have been allocated, it is consumed.
5307  * Return NULL for out of memory, the variable otherwise.
5308  */
5309     typval_T *
5310 alloc_string_tv(char_u *s)
5311 {
5312     typval_T	*rettv;
5313 
5314     rettv = alloc_tv();
5315     if (rettv != NULL)
5316     {
5317 	rettv->v_type = VAR_STRING;
5318 	rettv->vval.v_string = s;
5319     }
5320     else
5321 	vim_free(s);
5322     return rettv;
5323 }
5324 
5325 /*
5326  * Free the memory for a variable type-value.
5327  */
5328     void
5329 free_tv(typval_T *varp)
5330 {
5331     if (varp != NULL)
5332     {
5333 	switch (varp->v_type)
5334 	{
5335 	    case VAR_FUNC:
5336 		func_unref(varp->vval.v_string);
5337 		// FALLTHROUGH
5338 	    case VAR_STRING:
5339 		vim_free(varp->vval.v_string);
5340 		break;
5341 	    case VAR_PARTIAL:
5342 		partial_unref(varp->vval.v_partial);
5343 		break;
5344 	    case VAR_BLOB:
5345 		blob_unref(varp->vval.v_blob);
5346 		break;
5347 	    case VAR_LIST:
5348 		list_unref(varp->vval.v_list);
5349 		break;
5350 	    case VAR_DICT:
5351 		dict_unref(varp->vval.v_dict);
5352 		break;
5353 	    case VAR_JOB:
5354 #ifdef FEAT_JOB_CHANNEL
5355 		job_unref(varp->vval.v_job);
5356 		break;
5357 #endif
5358 	    case VAR_CHANNEL:
5359 #ifdef FEAT_JOB_CHANNEL
5360 		channel_unref(varp->vval.v_channel);
5361 		break;
5362 #endif
5363 	    case VAR_NUMBER:
5364 	    case VAR_FLOAT:
5365 	    case VAR_UNKNOWN:
5366 	    case VAR_BOOL:
5367 	    case VAR_SPECIAL:
5368 		break;
5369 	}
5370 	vim_free(varp);
5371     }
5372 }
5373 
5374 /*
5375  * Free the memory for a variable value and set the value to NULL or 0.
5376  */
5377     void
5378 clear_tv(typval_T *varp)
5379 {
5380     if (varp != NULL)
5381     {
5382 	switch (varp->v_type)
5383 	{
5384 	    case VAR_FUNC:
5385 		func_unref(varp->vval.v_string);
5386 		// FALLTHROUGH
5387 	    case VAR_STRING:
5388 		VIM_CLEAR(varp->vval.v_string);
5389 		break;
5390 	    case VAR_PARTIAL:
5391 		partial_unref(varp->vval.v_partial);
5392 		varp->vval.v_partial = NULL;
5393 		break;
5394 	    case VAR_BLOB:
5395 		blob_unref(varp->vval.v_blob);
5396 		varp->vval.v_blob = NULL;
5397 		break;
5398 	    case VAR_LIST:
5399 		list_unref(varp->vval.v_list);
5400 		varp->vval.v_list = NULL;
5401 		break;
5402 	    case VAR_DICT:
5403 		dict_unref(varp->vval.v_dict);
5404 		varp->vval.v_dict = NULL;
5405 		break;
5406 	    case VAR_NUMBER:
5407 	    case VAR_BOOL:
5408 	    case VAR_SPECIAL:
5409 		varp->vval.v_number = 0;
5410 		break;
5411 	    case VAR_FLOAT:
5412 #ifdef FEAT_FLOAT
5413 		varp->vval.v_float = 0.0;
5414 		break;
5415 #endif
5416 	    case VAR_JOB:
5417 #ifdef FEAT_JOB_CHANNEL
5418 		job_unref(varp->vval.v_job);
5419 		varp->vval.v_job = NULL;
5420 #endif
5421 		break;
5422 	    case VAR_CHANNEL:
5423 #ifdef FEAT_JOB_CHANNEL
5424 		channel_unref(varp->vval.v_channel);
5425 		varp->vval.v_channel = NULL;
5426 #endif
5427 	    case VAR_UNKNOWN:
5428 		break;
5429 	}
5430 	varp->v_lock = 0;
5431     }
5432 }
5433 
5434 /*
5435  * Set the value of a variable to NULL without freeing items.
5436  */
5437     void
5438 init_tv(typval_T *varp)
5439 {
5440     if (varp != NULL)
5441 	vim_memset(varp, 0, sizeof(typval_T));
5442 }
5443 
5444 /*
5445  * Get the number value of a variable.
5446  * If it is a String variable, uses vim_str2nr().
5447  * For incompatible types, return 0.
5448  * tv_get_number_chk() is similar to tv_get_number(), but informs the
5449  * caller of incompatible types: it sets *denote to TRUE if "denote"
5450  * is not NULL or returns -1 otherwise.
5451  */
5452     varnumber_T
5453 tv_get_number(typval_T *varp)
5454 {
5455     int		error = FALSE;
5456 
5457     return tv_get_number_chk(varp, &error);	// return 0L on error
5458 }
5459 
5460     varnumber_T
5461 tv_get_number_chk(typval_T *varp, int *denote)
5462 {
5463     varnumber_T	n = 0L;
5464 
5465     switch (varp->v_type)
5466     {
5467 	case VAR_NUMBER:
5468 	    return varp->vval.v_number;
5469 	case VAR_FLOAT:
5470 #ifdef FEAT_FLOAT
5471 	    emsg(_("E805: Using a Float as a Number"));
5472 	    break;
5473 #endif
5474 	case VAR_FUNC:
5475 	case VAR_PARTIAL:
5476 	    emsg(_("E703: Using a Funcref as a Number"));
5477 	    break;
5478 	case VAR_STRING:
5479 	    if (varp->vval.v_string != NULL)
5480 		vim_str2nr(varp->vval.v_string, NULL, NULL,
5481 					    STR2NR_ALL, &n, NULL, 0, FALSE);
5482 	    return n;
5483 	case VAR_LIST:
5484 	    emsg(_("E745: Using a List as a Number"));
5485 	    break;
5486 	case VAR_DICT:
5487 	    emsg(_("E728: Using a Dictionary as a Number"));
5488 	    break;
5489 	case VAR_BOOL:
5490 	case VAR_SPECIAL:
5491 	    return varp->vval.v_number == VVAL_TRUE ? 1 : 0;
5492 	case VAR_JOB:
5493 #ifdef FEAT_JOB_CHANNEL
5494 	    emsg(_("E910: Using a Job as a Number"));
5495 	    break;
5496 #endif
5497 	case VAR_CHANNEL:
5498 #ifdef FEAT_JOB_CHANNEL
5499 	    emsg(_("E913: Using a Channel as a Number"));
5500 	    break;
5501 #endif
5502 	case VAR_BLOB:
5503 	    emsg(_("E974: Using a Blob as a Number"));
5504 	    break;
5505 	case VAR_UNKNOWN:
5506 	    internal_error("tv_get_number(UNKNOWN)");
5507 	    break;
5508     }
5509     if (denote == NULL)		// useful for values that must be unsigned
5510 	n = -1;
5511     else
5512 	*denote = TRUE;
5513     return n;
5514 }
5515 
5516 #ifdef FEAT_FLOAT
5517     float_T
5518 tv_get_float(typval_T *varp)
5519 {
5520     switch (varp->v_type)
5521     {
5522 	case VAR_NUMBER:
5523 	    return (float_T)(varp->vval.v_number);
5524 	case VAR_FLOAT:
5525 	    return varp->vval.v_float;
5526 	case VAR_FUNC:
5527 	case VAR_PARTIAL:
5528 	    emsg(_("E891: Using a Funcref as a Float"));
5529 	    break;
5530 	case VAR_STRING:
5531 	    emsg(_("E892: Using a String as a Float"));
5532 	    break;
5533 	case VAR_LIST:
5534 	    emsg(_("E893: Using a List as a Float"));
5535 	    break;
5536 	case VAR_DICT:
5537 	    emsg(_("E894: Using a Dictionary as a Float"));
5538 	    break;
5539 	case VAR_BOOL:
5540 	    emsg(_("E362: Using a boolean value as a Float"));
5541 	    break;
5542 	case VAR_SPECIAL:
5543 	    emsg(_("E907: Using a special value as a Float"));
5544 	    break;
5545 	case VAR_JOB:
5546 # ifdef FEAT_JOB_CHANNEL
5547 	    emsg(_("E911: Using a Job as a Float"));
5548 	    break;
5549 # endif
5550 	case VAR_CHANNEL:
5551 # ifdef FEAT_JOB_CHANNEL
5552 	    emsg(_("E914: Using a Channel as a Float"));
5553 	    break;
5554 # endif
5555 	case VAR_BLOB:
5556 	    emsg(_("E975: Using a Blob as a Float"));
5557 	    break;
5558 	case VAR_UNKNOWN:
5559 	    internal_error("tv_get_float(UNKNOWN)");
5560 	    break;
5561     }
5562     return 0;
5563 }
5564 #endif
5565 
5566 /*
5567  * Get the string value of a variable.
5568  * If it is a Number variable, the number is converted into a string.
5569  * tv_get_string() uses a single, static buffer.  YOU CAN ONLY USE IT ONCE!
5570  * tv_get_string_buf() uses a given buffer.
5571  * If the String variable has never been set, return an empty string.
5572  * Never returns NULL;
5573  * tv_get_string_chk() and tv_get_string_buf_chk() are similar, but return
5574  * NULL on error.
5575  */
5576     char_u *
5577 tv_get_string(typval_T *varp)
5578 {
5579     static char_u   mybuf[NUMBUFLEN];
5580 
5581     return tv_get_string_buf(varp, mybuf);
5582 }
5583 
5584     char_u *
5585 tv_get_string_buf(typval_T *varp, char_u *buf)
5586 {
5587     char_u	*res =  tv_get_string_buf_chk(varp, buf);
5588 
5589     return res != NULL ? res : (char_u *)"";
5590 }
5591 
5592 /*
5593  * Careful: This uses a single, static buffer.  YOU CAN ONLY USE IT ONCE!
5594  */
5595     char_u *
5596 tv_get_string_chk(typval_T *varp)
5597 {
5598     static char_u   mybuf[NUMBUFLEN];
5599 
5600     return tv_get_string_buf_chk(varp, mybuf);
5601 }
5602 
5603     char_u *
5604 tv_get_string_buf_chk(typval_T *varp, char_u *buf)
5605 {
5606     switch (varp->v_type)
5607     {
5608 	case VAR_NUMBER:
5609 	    vim_snprintf((char *)buf, NUMBUFLEN, "%lld",
5610 					    (long_long_T)varp->vval.v_number);
5611 	    return buf;
5612 	case VAR_FUNC:
5613 	case VAR_PARTIAL:
5614 	    emsg(_("E729: using Funcref as a String"));
5615 	    break;
5616 	case VAR_LIST:
5617 	    emsg(_("E730: using List as a String"));
5618 	    break;
5619 	case VAR_DICT:
5620 	    emsg(_("E731: using Dictionary as a String"));
5621 	    break;
5622 	case VAR_FLOAT:
5623 #ifdef FEAT_FLOAT
5624 	    emsg(_(e_float_as_string));
5625 	    break;
5626 #endif
5627 	case VAR_STRING:
5628 	    if (varp->vval.v_string != NULL)
5629 		return varp->vval.v_string;
5630 	    return (char_u *)"";
5631 	case VAR_BOOL:
5632 	case VAR_SPECIAL:
5633 	    STRCPY(buf, get_var_special_name(varp->vval.v_number));
5634 	    return buf;
5635         case VAR_BLOB:
5636 	    emsg(_("E976: using Blob as a String"));
5637 	    break;
5638 	case VAR_JOB:
5639 #ifdef FEAT_JOB_CHANNEL
5640 	    {
5641 		job_T *job = varp->vval.v_job;
5642 		char  *status;
5643 
5644 		if (job == NULL)
5645 		    return (char_u *)"no process";
5646 		status = job->jv_status == JOB_FAILED ? "fail"
5647 				: job->jv_status >= JOB_ENDED ? "dead"
5648 				: "run";
5649 # ifdef UNIX
5650 		vim_snprintf((char *)buf, NUMBUFLEN,
5651 			    "process %ld %s", (long)job->jv_pid, status);
5652 # elif defined(MSWIN)
5653 		vim_snprintf((char *)buf, NUMBUFLEN,
5654 			    "process %ld %s",
5655 			    (long)job->jv_proc_info.dwProcessId,
5656 			    status);
5657 # else
5658 		// fall-back
5659 		vim_snprintf((char *)buf, NUMBUFLEN, "process ? %s", status);
5660 # endif
5661 		return buf;
5662 	    }
5663 #endif
5664 	    break;
5665 	case VAR_CHANNEL:
5666 #ifdef FEAT_JOB_CHANNEL
5667 	    {
5668 		channel_T *channel = varp->vval.v_channel;
5669 		char      *status = channel_status(channel, -1);
5670 
5671 		if (channel == NULL)
5672 		    vim_snprintf((char *)buf, NUMBUFLEN, "channel %s", status);
5673 		else
5674 		    vim_snprintf((char *)buf, NUMBUFLEN,
5675 				     "channel %d %s", channel->ch_id, status);
5676 		return buf;
5677 	    }
5678 #endif
5679 	    break;
5680 	case VAR_UNKNOWN:
5681 	    emsg(_(e_inval_string));
5682 	    break;
5683     }
5684     return NULL;
5685 }
5686 
5687 /*
5688  * Turn a typeval into a string.  Similar to tv_get_string_buf() but uses
5689  * string() on Dict, List, etc.
5690  */
5691     static char_u *
5692 tv_stringify(typval_T *varp, char_u *buf)
5693 {
5694     if (varp->v_type == VAR_LIST
5695 	    || varp->v_type == VAR_DICT
5696 	    || varp->v_type == VAR_BLOB
5697 	    || varp->v_type == VAR_FUNC
5698 	    || varp->v_type == VAR_PARTIAL
5699 	    || varp->v_type == VAR_FLOAT)
5700     {
5701 	typval_T tmp;
5702 
5703 	f_string(varp, &tmp);
5704 	tv_get_string_buf(&tmp, buf);
5705 	clear_tv(varp);
5706 	*varp = tmp;
5707 	return tmp.vval.v_string;
5708     }
5709     return tv_get_string_buf(varp, buf);
5710 }
5711 
5712 /*
5713  * Return TRUE if typeval "tv" and its value are set to be locked (immutable).
5714  * Also give an error message, using "name" or _("name") when use_gettext is
5715  * TRUE.
5716  */
5717     static int
5718 tv_check_lock(typval_T *tv, char_u *name, int use_gettext)
5719 {
5720     int	lock = 0;
5721 
5722     switch (tv->v_type)
5723     {
5724 	case VAR_BLOB:
5725 	    if (tv->vval.v_blob != NULL)
5726 		lock = tv->vval.v_blob->bv_lock;
5727 	    break;
5728 	case VAR_LIST:
5729 	    if (tv->vval.v_list != NULL)
5730 		lock = tv->vval.v_list->lv_lock;
5731 	    break;
5732 	case VAR_DICT:
5733 	    if (tv->vval.v_dict != NULL)
5734 		lock = tv->vval.v_dict->dv_lock;
5735 	    break;
5736 	default:
5737 	    break;
5738     }
5739     return var_check_lock(tv->v_lock, name, use_gettext)
5740 		    || (lock != 0 && var_check_lock(lock, name, use_gettext));
5741 }
5742 
5743 /*
5744  * Copy the values from typval_T "from" to typval_T "to".
5745  * When needed allocates string or increases reference count.
5746  * Does not make a copy of a list, blob or dict but copies the reference!
5747  * It is OK for "from" and "to" to point to the same item.  This is used to
5748  * make a copy later.
5749  */
5750     void
5751 copy_tv(typval_T *from, typval_T *to)
5752 {
5753     to->v_type = from->v_type;
5754     to->v_lock = 0;
5755     switch (from->v_type)
5756     {
5757 	case VAR_NUMBER:
5758 	case VAR_BOOL:
5759 	case VAR_SPECIAL:
5760 	    to->vval.v_number = from->vval.v_number;
5761 	    break;
5762 	case VAR_FLOAT:
5763 #ifdef FEAT_FLOAT
5764 	    to->vval.v_float = from->vval.v_float;
5765 	    break;
5766 #endif
5767 	case VAR_JOB:
5768 #ifdef FEAT_JOB_CHANNEL
5769 	    to->vval.v_job = from->vval.v_job;
5770 	    if (to->vval.v_job != NULL)
5771 		++to->vval.v_job->jv_refcount;
5772 	    break;
5773 #endif
5774 	case VAR_CHANNEL:
5775 #ifdef FEAT_JOB_CHANNEL
5776 	    to->vval.v_channel = from->vval.v_channel;
5777 	    if (to->vval.v_channel != NULL)
5778 		++to->vval.v_channel->ch_refcount;
5779 	    break;
5780 #endif
5781 	case VAR_STRING:
5782 	case VAR_FUNC:
5783 	    if (from->vval.v_string == NULL)
5784 		to->vval.v_string = NULL;
5785 	    else
5786 	    {
5787 		to->vval.v_string = vim_strsave(from->vval.v_string);
5788 		if (from->v_type == VAR_FUNC)
5789 		    func_ref(to->vval.v_string);
5790 	    }
5791 	    break;
5792 	case VAR_PARTIAL:
5793 	    if (from->vval.v_partial == NULL)
5794 		to->vval.v_partial = NULL;
5795 	    else
5796 	    {
5797 		to->vval.v_partial = from->vval.v_partial;
5798 		++to->vval.v_partial->pt_refcount;
5799 	    }
5800 	    break;
5801 	case VAR_BLOB:
5802 	    if (from->vval.v_blob == NULL)
5803 		to->vval.v_blob = NULL;
5804 	    else
5805 	    {
5806 		to->vval.v_blob = from->vval.v_blob;
5807 		++to->vval.v_blob->bv_refcount;
5808 	    }
5809 	    break;
5810 	case VAR_LIST:
5811 	    if (from->vval.v_list == NULL)
5812 		to->vval.v_list = NULL;
5813 	    else
5814 	    {
5815 		to->vval.v_list = from->vval.v_list;
5816 		++to->vval.v_list->lv_refcount;
5817 	    }
5818 	    break;
5819 	case VAR_DICT:
5820 	    if (from->vval.v_dict == NULL)
5821 		to->vval.v_dict = NULL;
5822 	    else
5823 	    {
5824 		to->vval.v_dict = from->vval.v_dict;
5825 		++to->vval.v_dict->dv_refcount;
5826 	    }
5827 	    break;
5828 	case VAR_UNKNOWN:
5829 	    internal_error("copy_tv(UNKNOWN)");
5830 	    break;
5831     }
5832 }
5833 
5834 /*
5835  * Make a copy of an item.
5836  * Lists and Dictionaries are also copied.  A deep copy if "deep" is set.
5837  * For deepcopy() "copyID" is zero for a full copy or the ID for when a
5838  * reference to an already copied list/dict can be used.
5839  * Returns FAIL or OK.
5840  */
5841     int
5842 item_copy(
5843     typval_T	*from,
5844     typval_T	*to,
5845     int		deep,
5846     int		copyID)
5847 {
5848     static int	recurse = 0;
5849     int		ret = OK;
5850 
5851     if (recurse >= DICT_MAXNEST)
5852     {
5853 	emsg(_("E698: variable nested too deep for making a copy"));
5854 	return FAIL;
5855     }
5856     ++recurse;
5857 
5858     switch (from->v_type)
5859     {
5860 	case VAR_NUMBER:
5861 	case VAR_FLOAT:
5862 	case VAR_STRING:
5863 	case VAR_FUNC:
5864 	case VAR_PARTIAL:
5865 	case VAR_BOOL:
5866 	case VAR_SPECIAL:
5867 	case VAR_JOB:
5868 	case VAR_CHANNEL:
5869 	    copy_tv(from, to);
5870 	    break;
5871 	case VAR_LIST:
5872 	    to->v_type = VAR_LIST;
5873 	    to->v_lock = 0;
5874 	    if (from->vval.v_list == NULL)
5875 		to->vval.v_list = NULL;
5876 	    else if (copyID != 0 && from->vval.v_list->lv_copyID == copyID)
5877 	    {
5878 		// use the copy made earlier
5879 		to->vval.v_list = from->vval.v_list->lv_copylist;
5880 		++to->vval.v_list->lv_refcount;
5881 	    }
5882 	    else
5883 		to->vval.v_list = list_copy(from->vval.v_list, deep, copyID);
5884 	    if (to->vval.v_list == NULL)
5885 		ret = FAIL;
5886 	    break;
5887 	case VAR_BLOB:
5888 	    ret = blob_copy(from, to);
5889 	    break;
5890 	case VAR_DICT:
5891 	    to->v_type = VAR_DICT;
5892 	    to->v_lock = 0;
5893 	    if (from->vval.v_dict == NULL)
5894 		to->vval.v_dict = NULL;
5895 	    else if (copyID != 0 && from->vval.v_dict->dv_copyID == copyID)
5896 	    {
5897 		// use the copy made earlier
5898 		to->vval.v_dict = from->vval.v_dict->dv_copydict;
5899 		++to->vval.v_dict->dv_refcount;
5900 	    }
5901 	    else
5902 		to->vval.v_dict = dict_copy(from->vval.v_dict, deep, copyID);
5903 	    if (to->vval.v_dict == NULL)
5904 		ret = FAIL;
5905 	    break;
5906 	case VAR_UNKNOWN:
5907 	    internal_error("item_copy(UNKNOWN)");
5908 	    ret = FAIL;
5909     }
5910     --recurse;
5911     return ret;
5912 }
5913 
5914 /*
5915  * ":echo expr1 ..."	print each argument separated with a space, add a
5916  *			newline at the end.
5917  * ":echon expr1 ..."	print each argument plain.
5918  */
5919     void
5920 ex_echo(exarg_T *eap)
5921 {
5922     char_u	*arg = eap->arg;
5923     typval_T	rettv;
5924     char_u	*tofree;
5925     char_u	*p;
5926     int		needclr = TRUE;
5927     int		atstart = TRUE;
5928     char_u	numbuf[NUMBUFLEN];
5929     int		did_emsg_before = did_emsg;
5930     int		called_emsg_before = called_emsg;
5931 
5932     if (eap->skip)
5933 	++emsg_skip;
5934     while (*arg != NUL && *arg != '|' && *arg != '\n' && !got_int)
5935     {
5936 	// If eval1() causes an error message the text from the command may
5937 	// still need to be cleared. E.g., "echo 22,44".
5938 	need_clr_eos = needclr;
5939 
5940 	p = arg;
5941 	if (eval1(&arg, &rettv, !eap->skip) == FAIL)
5942 	{
5943 	    /*
5944 	     * Report the invalid expression unless the expression evaluation
5945 	     * has been cancelled due to an aborting error, an interrupt, or an
5946 	     * exception.
5947 	     */
5948 	    if (!aborting() && did_emsg == did_emsg_before
5949 					  && called_emsg == called_emsg_before)
5950 		semsg(_(e_invexpr2), p);
5951 	    need_clr_eos = FALSE;
5952 	    break;
5953 	}
5954 	need_clr_eos = FALSE;
5955 
5956 	if (!eap->skip)
5957 	{
5958 	    if (atstart)
5959 	    {
5960 		atstart = FALSE;
5961 		// Call msg_start() after eval1(), evaluating the expression
5962 		// may cause a message to appear.
5963 		if (eap->cmdidx == CMD_echo)
5964 		{
5965 		    // Mark the saved text as finishing the line, so that what
5966 		    // follows is displayed on a new line when scrolling back
5967 		    // at the more prompt.
5968 		    msg_sb_eol();
5969 		    msg_start();
5970 		}
5971 	    }
5972 	    else if (eap->cmdidx == CMD_echo)
5973 		msg_puts_attr(" ", echo_attr);
5974 	    p = echo_string(&rettv, &tofree, numbuf, get_copyID());
5975 	    if (p != NULL)
5976 		for ( ; *p != NUL && !got_int; ++p)
5977 		{
5978 		    if (*p == '\n' || *p == '\r' || *p == TAB)
5979 		    {
5980 			if (*p != TAB && needclr)
5981 			{
5982 			    // remove any text still there from the command
5983 			    msg_clr_eos();
5984 			    needclr = FALSE;
5985 			}
5986 			msg_putchar_attr(*p, echo_attr);
5987 		    }
5988 		    else
5989 		    {
5990 			if (has_mbyte)
5991 			{
5992 			    int i = (*mb_ptr2len)(p);
5993 
5994 			    (void)msg_outtrans_len_attr(p, i, echo_attr);
5995 			    p += i - 1;
5996 			}
5997 			else
5998 			    (void)msg_outtrans_len_attr(p, 1, echo_attr);
5999 		    }
6000 		}
6001 	    vim_free(tofree);
6002 	}
6003 	clear_tv(&rettv);
6004 	arg = skipwhite(arg);
6005     }
6006     eap->nextcmd = check_nextcmd(arg);
6007 
6008     if (eap->skip)
6009 	--emsg_skip;
6010     else
6011     {
6012 	// remove text that may still be there from the command
6013 	if (needclr)
6014 	    msg_clr_eos();
6015 	if (eap->cmdidx == CMD_echo)
6016 	    msg_end();
6017     }
6018 }
6019 
6020 /*
6021  * ":echohl {name}".
6022  */
6023     void
6024 ex_echohl(exarg_T *eap)
6025 {
6026     echo_attr = syn_name2attr(eap->arg);
6027 }
6028 
6029 /*
6030  * Returns the :echo attribute
6031  */
6032     int
6033 get_echo_attr(void)
6034 {
6035     return echo_attr;
6036 }
6037 
6038 /*
6039  * ":execute expr1 ..."	execute the result of an expression.
6040  * ":echomsg expr1 ..."	Print a message
6041  * ":echoerr expr1 ..."	Print an error
6042  * Each gets spaces around each argument and a newline at the end for
6043  * echo commands
6044  */
6045     void
6046 ex_execute(exarg_T *eap)
6047 {
6048     char_u	*arg = eap->arg;
6049     typval_T	rettv;
6050     int		ret = OK;
6051     char_u	*p;
6052     garray_T	ga;
6053     int		len;
6054     int		save_did_emsg;
6055 
6056     ga_init2(&ga, 1, 80);
6057 
6058     if (eap->skip)
6059 	++emsg_skip;
6060     while (*arg != NUL && *arg != '|' && *arg != '\n')
6061     {
6062 	ret = eval1_emsg(&arg, &rettv, !eap->skip);
6063 	if (ret == FAIL)
6064 	    break;
6065 
6066 	if (!eap->skip)
6067 	{
6068 	    char_u   buf[NUMBUFLEN];
6069 
6070 	    if (eap->cmdidx == CMD_execute)
6071 	    {
6072 		if (rettv.v_type == VAR_CHANNEL || rettv.v_type == VAR_JOB)
6073 		{
6074 		    emsg(_(e_inval_string));
6075 		    p = NULL;
6076 		}
6077 		else
6078 		    p = tv_get_string_buf(&rettv, buf);
6079 	    }
6080 	    else
6081 		p = tv_stringify(&rettv, buf);
6082 	    if (p == NULL)
6083 	    {
6084 		clear_tv(&rettv);
6085 		ret = FAIL;
6086 		break;
6087 	    }
6088 	    len = (int)STRLEN(p);
6089 	    if (ga_grow(&ga, len + 2) == FAIL)
6090 	    {
6091 		clear_tv(&rettv);
6092 		ret = FAIL;
6093 		break;
6094 	    }
6095 	    if (ga.ga_len)
6096 		((char_u *)(ga.ga_data))[ga.ga_len++] = ' ';
6097 	    STRCPY((char_u *)(ga.ga_data) + ga.ga_len, p);
6098 	    ga.ga_len += len;
6099 	}
6100 
6101 	clear_tv(&rettv);
6102 	arg = skipwhite(arg);
6103     }
6104 
6105     if (ret != FAIL && ga.ga_data != NULL)
6106     {
6107 	if (eap->cmdidx == CMD_echomsg || eap->cmdidx == CMD_echoerr)
6108 	{
6109 	    // Mark the already saved text as finishing the line, so that what
6110 	    // follows is displayed on a new line when scrolling back at the
6111 	    // more prompt.
6112 	    msg_sb_eol();
6113 	}
6114 
6115 	if (eap->cmdidx == CMD_echomsg)
6116 	{
6117 	    msg_attr(ga.ga_data, echo_attr);
6118 	    out_flush();
6119 	}
6120 	else if (eap->cmdidx == CMD_echoerr)
6121 	{
6122 	    // We don't want to abort following commands, restore did_emsg.
6123 	    save_did_emsg = did_emsg;
6124 	    emsg(ga.ga_data);
6125 	    if (!force_abort)
6126 		did_emsg = save_did_emsg;
6127 	}
6128 	else if (eap->cmdidx == CMD_execute)
6129 	    do_cmdline((char_u *)ga.ga_data,
6130 		       eap->getline, eap->cookie, DOCMD_NOWAIT|DOCMD_VERBOSE);
6131     }
6132 
6133     ga_clear(&ga);
6134 
6135     if (eap->skip)
6136 	--emsg_skip;
6137 
6138     eap->nextcmd = check_nextcmd(arg);
6139 }
6140 
6141 /*
6142  * Skip over the name of an option: "&option", "&g:option" or "&l:option".
6143  * "arg" points to the "&" or '+' when called, to "option" when returning.
6144  * Returns NULL when no option name found.  Otherwise pointer to the char
6145  * after the option name.
6146  */
6147     char_u *
6148 find_option_end(char_u **arg, int *opt_flags)
6149 {
6150     char_u	*p = *arg;
6151 
6152     ++p;
6153     if (*p == 'g' && p[1] == ':')
6154     {
6155 	*opt_flags = OPT_GLOBAL;
6156 	p += 2;
6157     }
6158     else if (*p == 'l' && p[1] == ':')
6159     {
6160 	*opt_flags = OPT_LOCAL;
6161 	p += 2;
6162     }
6163     else
6164 	*opt_flags = 0;
6165 
6166     if (!ASCII_ISALPHA(*p))
6167 	return NULL;
6168     *arg = p;
6169 
6170     if (p[0] == 't' && p[1] == '_' && p[2] != NUL && p[3] != NUL)
6171 	p += 4;	    // termcap option
6172     else
6173 	while (ASCII_ISALPHA(*p))
6174 	    ++p;
6175     return p;
6176 }
6177 
6178 /*
6179  * Display script name where an item was last set.
6180  * Should only be invoked when 'verbose' is non-zero.
6181  */
6182     void
6183 last_set_msg(sctx_T script_ctx)
6184 {
6185     char_u *p;
6186 
6187     if (script_ctx.sc_sid != 0)
6188     {
6189 	p = home_replace_save(NULL, get_scriptname(script_ctx.sc_sid));
6190 	if (p != NULL)
6191 	{
6192 	    verbose_enter();
6193 	    msg_puts(_("\n\tLast set from "));
6194 	    msg_puts((char *)p);
6195 	    if (script_ctx.sc_lnum > 0)
6196 	    {
6197 		msg_puts(_(line_msg));
6198 		msg_outnum((long)script_ctx.sc_lnum);
6199 	    }
6200 	    verbose_leave();
6201 	    vim_free(p);
6202 	}
6203     }
6204 }
6205 
6206 /*
6207  * Compare "typ1" and "typ2".  Put the result in "typ1".
6208  */
6209     int
6210 typval_compare(
6211     typval_T	*typ1,   // first operand
6212     typval_T	*typ2,   // second operand
6213     exptype_T	type,    // operator
6214     int		ic)      // ignore case
6215 {
6216     int		i;
6217     varnumber_T	n1, n2;
6218     char_u	*s1, *s2;
6219     char_u	buf1[NUMBUFLEN], buf2[NUMBUFLEN];
6220     int		type_is = type == EXPR_IS || type == EXPR_ISNOT;
6221 
6222     if (type_is && typ1->v_type != typ2->v_type)
6223     {
6224 	// For "is" a different type always means FALSE, for "notis"
6225 	// it means TRUE.
6226 	n1 = (type == EXPR_ISNOT);
6227     }
6228     else if (typ1->v_type == VAR_BLOB || typ2->v_type == VAR_BLOB)
6229     {
6230 	if (type_is)
6231 	{
6232 	    n1 = (typ1->v_type == typ2->v_type
6233 			    && typ1->vval.v_blob == typ2->vval.v_blob);
6234 	    if (type == EXPR_ISNOT)
6235 		n1 = !n1;
6236 	}
6237 	else if (typ1->v_type != typ2->v_type
6238 		|| (type != EXPR_EQUAL && type != EXPR_NEQUAL))
6239 	{
6240 	    if (typ1->v_type != typ2->v_type)
6241 		emsg(_("E977: Can only compare Blob with Blob"));
6242 	    else
6243 		emsg(_(e_invalblob));
6244 	    clear_tv(typ1);
6245 	    return FAIL;
6246 	}
6247 	else
6248 	{
6249 	    // Compare two Blobs for being equal or unequal.
6250 	    n1 = blob_equal(typ1->vval.v_blob, typ2->vval.v_blob);
6251 	    if (type == EXPR_NEQUAL)
6252 		n1 = !n1;
6253 	}
6254     }
6255     else if (typ1->v_type == VAR_LIST || typ2->v_type == VAR_LIST)
6256     {
6257 	if (type_is)
6258 	{
6259 	    n1 = (typ1->v_type == typ2->v_type
6260 			    && typ1->vval.v_list == typ2->vval.v_list);
6261 	    if (type == EXPR_ISNOT)
6262 		n1 = !n1;
6263 	}
6264 	else if (typ1->v_type != typ2->v_type
6265 		|| (type != EXPR_EQUAL && type != EXPR_NEQUAL))
6266 	{
6267 	    if (typ1->v_type != typ2->v_type)
6268 		emsg(_("E691: Can only compare List with List"));
6269 	    else
6270 		emsg(_("E692: Invalid operation for List"));
6271 	    clear_tv(typ1);
6272 	    return FAIL;
6273 	}
6274 	else
6275 	{
6276 	    // Compare two Lists for being equal or unequal.
6277 	    n1 = list_equal(typ1->vval.v_list, typ2->vval.v_list,
6278 							    ic, FALSE);
6279 	    if (type == EXPR_NEQUAL)
6280 		n1 = !n1;
6281 	}
6282     }
6283 
6284     else if (typ1->v_type == VAR_DICT || typ2->v_type == VAR_DICT)
6285     {
6286 	if (type_is)
6287 	{
6288 	    n1 = (typ1->v_type == typ2->v_type
6289 			    && typ1->vval.v_dict == typ2->vval.v_dict);
6290 	    if (type == EXPR_ISNOT)
6291 		n1 = !n1;
6292 	}
6293 	else if (typ1->v_type != typ2->v_type
6294 		|| (type != EXPR_EQUAL && type != EXPR_NEQUAL))
6295 	{
6296 	    if (typ1->v_type != typ2->v_type)
6297 		emsg(_("E735: Can only compare Dictionary with Dictionary"));
6298 	    else
6299 		emsg(_("E736: Invalid operation for Dictionary"));
6300 	    clear_tv(typ1);
6301 	    return FAIL;
6302 	}
6303 	else
6304 	{
6305 	    // Compare two Dictionaries for being equal or unequal.
6306 	    n1 = dict_equal(typ1->vval.v_dict, typ2->vval.v_dict,
6307 							    ic, FALSE);
6308 	    if (type == EXPR_NEQUAL)
6309 		n1 = !n1;
6310 	}
6311     }
6312 
6313     else if (typ1->v_type == VAR_FUNC || typ2->v_type == VAR_FUNC
6314 	|| typ1->v_type == VAR_PARTIAL || typ2->v_type == VAR_PARTIAL)
6315     {
6316 	if (type != EXPR_EQUAL && type != EXPR_NEQUAL
6317 		&& type != EXPR_IS && type != EXPR_ISNOT)
6318 	{
6319 	    emsg(_("E694: Invalid operation for Funcrefs"));
6320 	    clear_tv(typ1);
6321 	    return FAIL;
6322 	}
6323 	if ((typ1->v_type == VAR_PARTIAL
6324 					&& typ1->vval.v_partial == NULL)
6325 		|| (typ2->v_type == VAR_PARTIAL
6326 					&& typ2->vval.v_partial == NULL))
6327 	    // when a partial is NULL assume not equal
6328 	    n1 = FALSE;
6329 	else if (type_is)
6330 	{
6331 	    if (typ1->v_type == VAR_FUNC && typ2->v_type == VAR_FUNC)
6332 		// strings are considered the same if their value is
6333 		// the same
6334 		n1 = tv_equal(typ1, typ2, ic, FALSE);
6335 	    else if (typ1->v_type == VAR_PARTIAL
6336 					&& typ2->v_type == VAR_PARTIAL)
6337 		n1 = (typ1->vval.v_partial == typ2->vval.v_partial);
6338 	    else
6339 		n1 = FALSE;
6340 	}
6341 	else
6342 	    n1 = tv_equal(typ1, typ2, ic, FALSE);
6343 	if (type == EXPR_NEQUAL || type == EXPR_ISNOT)
6344 	    n1 = !n1;
6345     }
6346 
6347 #ifdef FEAT_FLOAT
6348     /*
6349 	* If one of the two variables is a float, compare as a float.
6350 	* When using "=~" or "!~", always compare as string.
6351 	*/
6352     else if ((typ1->v_type == VAR_FLOAT || typ2->v_type == VAR_FLOAT)
6353 	    && type != EXPR_MATCH && type != EXPR_NOMATCH)
6354     {
6355 	float_T f1, f2;
6356 
6357 	f1 = tv_get_float(typ1);
6358 	f2 = tv_get_float(typ2);
6359 	n1 = FALSE;
6360 	switch (type)
6361 	{
6362 	    case EXPR_IS:
6363 	    case EXPR_EQUAL:    n1 = (f1 == f2); break;
6364 	    case EXPR_ISNOT:
6365 	    case EXPR_NEQUAL:   n1 = (f1 != f2); break;
6366 	    case EXPR_GREATER:  n1 = (f1 > f2); break;
6367 	    case EXPR_GEQUAL:   n1 = (f1 >= f2); break;
6368 	    case EXPR_SMALLER:  n1 = (f1 < f2); break;
6369 	    case EXPR_SEQUAL:   n1 = (f1 <= f2); break;
6370 	    case EXPR_UNKNOWN:
6371 	    case EXPR_MATCH:
6372 	    case EXPR_NOMATCH:  break;  // avoid gcc warning
6373 	}
6374     }
6375 #endif
6376 
6377     /*
6378      * If one of the two variables is a number, compare as a number.
6379      * When using "=~" or "!~", always compare as string.
6380      */
6381     else if ((typ1->v_type == VAR_NUMBER || typ2->v_type == VAR_NUMBER)
6382 	    && type != EXPR_MATCH && type != EXPR_NOMATCH)
6383     {
6384 	n1 = tv_get_number(typ1);
6385 	n2 = tv_get_number(typ2);
6386 	switch (type)
6387 	{
6388 	    case EXPR_IS:
6389 	    case EXPR_EQUAL:    n1 = (n1 == n2); break;
6390 	    case EXPR_ISNOT:
6391 	    case EXPR_NEQUAL:   n1 = (n1 != n2); break;
6392 	    case EXPR_GREATER:  n1 = (n1 > n2); break;
6393 	    case EXPR_GEQUAL:   n1 = (n1 >= n2); break;
6394 	    case EXPR_SMALLER:  n1 = (n1 < n2); break;
6395 	    case EXPR_SEQUAL:   n1 = (n1 <= n2); break;
6396 	    case EXPR_UNKNOWN:
6397 	    case EXPR_MATCH:
6398 	    case EXPR_NOMATCH:  break;  // avoid gcc warning
6399 	}
6400     }
6401     else
6402     {
6403 	s1 = tv_get_string_buf(typ1, buf1);
6404 	s2 = tv_get_string_buf(typ2, buf2);
6405 	if (type != EXPR_MATCH && type != EXPR_NOMATCH)
6406 	    i = ic ? MB_STRICMP(s1, s2) : STRCMP(s1, s2);
6407 	else
6408 	    i = 0;
6409 	n1 = FALSE;
6410 	switch (type)
6411 	{
6412 	    case EXPR_IS:
6413 	    case EXPR_EQUAL:    n1 = (i == 0); break;
6414 	    case EXPR_ISNOT:
6415 	    case EXPR_NEQUAL:   n1 = (i != 0); break;
6416 	    case EXPR_GREATER:  n1 = (i > 0); break;
6417 	    case EXPR_GEQUAL:   n1 = (i >= 0); break;
6418 	    case EXPR_SMALLER:  n1 = (i < 0); break;
6419 	    case EXPR_SEQUAL:   n1 = (i <= 0); break;
6420 
6421 	    case EXPR_MATCH:
6422 	    case EXPR_NOMATCH:
6423 		    n1 = pattern_match(s2, s1, ic);
6424 		    if (type == EXPR_NOMATCH)
6425 			n1 = !n1;
6426 		    break;
6427 
6428 	    case EXPR_UNKNOWN:  break;  // avoid gcc warning
6429 	}
6430     }
6431     clear_tv(typ1);
6432     typ1->v_type = VAR_NUMBER;
6433     typ1->vval.v_number = n1;
6434 
6435     return OK;
6436 }
6437 
6438     char_u *
6439 typval_tostring(typval_T *arg)
6440 {
6441     char_u	*tofree;
6442     char_u	numbuf[NUMBUFLEN];
6443     char_u	*ret = NULL;
6444 
6445     if (arg == NULL)
6446 	return vim_strsave((char_u *)"(does not exist)");
6447     ret = tv2string(arg, &tofree, numbuf, 0);
6448     // Make a copy if we have a value but it's not in allocated memory.
6449     if (ret != NULL && tofree == NULL)
6450 	ret = vim_strsave(ret);
6451     return ret;
6452 }
6453 
6454 #endif // FEAT_EVAL
6455 
6456 /*
6457  * Perform a substitution on "str" with pattern "pat" and substitute "sub".
6458  * When "sub" is NULL "expr" is used, must be a VAR_FUNC or VAR_PARTIAL.
6459  * "flags" can be "g" to do a global substitute.
6460  * Returns an allocated string, NULL for error.
6461  */
6462     char_u *
6463 do_string_sub(
6464     char_u	*str,
6465     char_u	*pat,
6466     char_u	*sub,
6467     typval_T	*expr,
6468     char_u	*flags)
6469 {
6470     int		sublen;
6471     regmatch_T	regmatch;
6472     int		i;
6473     int		do_all;
6474     char_u	*tail;
6475     char_u	*end;
6476     garray_T	ga;
6477     char_u	*ret;
6478     char_u	*save_cpo;
6479     char_u	*zero_width = NULL;
6480 
6481     // Make 'cpoptions' empty, so that the 'l' flag doesn't work here
6482     save_cpo = p_cpo;
6483     p_cpo = empty_option;
6484 
6485     ga_init2(&ga, 1, 200);
6486 
6487     do_all = (flags[0] == 'g');
6488 
6489     regmatch.rm_ic = p_ic;
6490     regmatch.regprog = vim_regcomp(pat, RE_MAGIC + RE_STRING);
6491     if (regmatch.regprog != NULL)
6492     {
6493 	tail = str;
6494 	end = str + STRLEN(str);
6495 	while (vim_regexec_nl(&regmatch, str, (colnr_T)(tail - str)))
6496 	{
6497 	    // Skip empty match except for first match.
6498 	    if (regmatch.startp[0] == regmatch.endp[0])
6499 	    {
6500 		if (zero_width == regmatch.startp[0])
6501 		{
6502 		    // avoid getting stuck on a match with an empty string
6503 		    i = mb_ptr2len(tail);
6504 		    mch_memmove((char_u *)ga.ga_data + ga.ga_len, tail,
6505 								   (size_t)i);
6506 		    ga.ga_len += i;
6507 		    tail += i;
6508 		    continue;
6509 		}
6510 		zero_width = regmatch.startp[0];
6511 	    }
6512 
6513 	    /*
6514 	     * Get some space for a temporary buffer to do the substitution
6515 	     * into.  It will contain:
6516 	     * - The text up to where the match is.
6517 	     * - The substituted text.
6518 	     * - The text after the match.
6519 	     */
6520 	    sublen = vim_regsub(&regmatch, sub, expr, tail, FALSE, TRUE, FALSE);
6521 	    if (ga_grow(&ga, (int)((end - tail) + sublen -
6522 			    (regmatch.endp[0] - regmatch.startp[0]))) == FAIL)
6523 	    {
6524 		ga_clear(&ga);
6525 		break;
6526 	    }
6527 
6528 	    // copy the text up to where the match is
6529 	    i = (int)(regmatch.startp[0] - tail);
6530 	    mch_memmove((char_u *)ga.ga_data + ga.ga_len, tail, (size_t)i);
6531 	    // add the substituted text
6532 	    (void)vim_regsub(&regmatch, sub, expr, (char_u *)ga.ga_data
6533 					  + ga.ga_len + i, TRUE, TRUE, FALSE);
6534 	    ga.ga_len += i + sublen - 1;
6535 	    tail = regmatch.endp[0];
6536 	    if (*tail == NUL)
6537 		break;
6538 	    if (!do_all)
6539 		break;
6540 	}
6541 
6542 	if (ga.ga_data != NULL)
6543 	    STRCPY((char *)ga.ga_data + ga.ga_len, tail);
6544 
6545 	vim_regfree(regmatch.regprog);
6546     }
6547 
6548     ret = vim_strsave(ga.ga_data == NULL ? str : (char_u *)ga.ga_data);
6549     ga_clear(&ga);
6550     if (p_cpo == empty_option)
6551 	p_cpo = save_cpo;
6552     else
6553 	// Darn, evaluating {sub} expression or {expr} changed the value.
6554 	free_string_option(save_cpo);
6555 
6556     return ret;
6557 }
6558