# HG changeset patch
# User Neil <nyamatongwe@gmail.com>
# Date 1489619799 -39600
# Node ID a78e38849624fca65cd615da3f976d22db03a48b
# Parent  e8364d5495d60b675717c68f97cc527ab3fc95ee
Fix use-after-free in fold tags when top line folded then new top line inserted.
In SparseVector, string inserted at start then NULL inserted at start.

diff -r e8364d5495d6 -r a78e38849624 doc/ScintillaHistory.html
--- a/doc/ScintillaHistory.html	Sat Mar 11 10:41:32 2017 +1100
+++ b/doc/ScintillaHistory.html	Thu Mar 16 10:16:39 2017 +1100
@@ -555,6 +555,9 @@
 	For IMEs, do not clear selected text when there is no composition text to show.
 	</li>
 	<li>
+	Fix to crash with fold tags where line inserted at start.
+	</li>
+	<li>
 	Fix to stream selection mode when moving caret up or down.
 	<a href="http://sourceforge.net/p/scintilla/bugs/1905/">Bug #1905</a>.
 	</li>
diff -r e8364d5495d6 -r a78e38849624 src/SparseVector.h
--- a/src/SparseVector.h	Sat Mar 11 10:41:32 2017 +1100
+++ b/src/SparseVector.h	Thu Mar 16 10:16:39 2017 +1100
@@ -100,7 +100,8 @@
 			if (partition == 0) {
 				// Inserting at start of document so ensure 0
 				if (valueCurrent != T()) {
-					ClearValue(0);
+					// Since valueCurrent is needed again, should not ClearValue
+					values->SetValueAt(0, T());
 					starts->InsertPartition(1, 0);
 					values->InsertValue(1, 1, valueCurrent);
 					starts->InsertText(0, insertLength);
diff -r e8364d5495d6 -r a78e38849624 test/unit/testSparseVector.cxx
--- a/test/unit/testSparseVector.cxx	Sat Mar 11 10:41:32 2017 +1100
+++ b/test/unit/testSparseVector.cxx	Thu Mar 16 10:16:39 2017 +1100
@@ -89,6 +89,18 @@
 		st.Check();
 	}
 
+	SECTION("InsertStringAtStartThenInsertSpaceAtStart") {
+		REQUIRE(1 == st.Elements());
+		st.InsertSpace(0, 5);
+		st.SetValueAt(0, "3");
+		REQUIRE(1 == st.Elements());
+		REQUIRE("3----" == Representation(st));
+		st.InsertSpace(0, 1);
+		REQUIRE(2 == st.Elements());
+		REQUIRE("-3----" == Representation(st));
+		st.Check();
+	}
+
 	SECTION("InsertAndDeleteAtEnd") {
 		REQUIRE(1 == st.Elements());
 		st.InsertSpace(0, 5);