From ae3205aa55741152b0143dbd7d637b35f576793e Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 15 Jan 2023 20:49:00 +0000
Subject: [PATCH] patch 9.0.1205: crash when handling class that extends
 another class

Problem:    Crash when handling class that extends another class with more
            than one object members.
Solution:   Correct pointer computations. (closes #11824)
---
 src/testdir/test_vim9_class.vim | 20 ++++++++++++++++++++
 src/version.c                   |  2 ++
 src/vim9class.c                 |  9 +++++----
 3 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/src/testdir/test_vim9_class.vim b/src/testdir/test_vim9_class.vim
index 83717eb5d35d14..85f47a88be8416 100644
--- a/src/testdir/test_vim9_class.vim
+++ b/src/testdir/test_vim9_class.vim
@@ -1081,6 +1081,26 @@ def Test_class_extends()
       var c = Child.new()
   END
   v9.CheckScriptFailure(lines, 'E1325: Method not found on class "Child": new(')
+
+  # base class with more than one object member
+  lines =<< trim END
+      vim9script
+
+      class Result
+        this.success: bool
+        this.value: any = null
+      endclass
+
+      class Success extends Result
+        def new(this.value = v:none)
+          this.success = true
+        enddef
+      endclass
+
+      var v = Success.new('asdf')
+      assert_equal("object of Success {success: true, value: 'asdf'}", string(v))
+  END
+  v9.CheckScriptSuccess(lines)
 enddef
 
 def Test_class_import()
diff --git a/src/version.c b/src/version.c
index 95b92e4a8dd4ca..6baed862d1bfde 100644
--- a/src/version.c
+++ b/src/version.c
@@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1205,
 /**/
     1204,
 /**/
diff --git a/src/vim9class.c b/src/vim9class.c
index 8dcd92b6ebd7c7..1ead953eb02b87 100644
--- a/src/vim9class.c
+++ b/src/vim9class.c
@@ -182,10 +182,11 @@ add_members_to_class(
     for (int i = 0; i < parent_count; ++i)
     {
 	// parent members need to be copied
-	*members[i] = parent_members[i];
-	members[i]->ocm_name = vim_strsave(members[i]->ocm_name);
-	if (members[i]->ocm_init != NULL)
-	    members[i]->ocm_init = vim_strsave(members[i]->ocm_init);
+	ocmember_T	*m = *members + i;
+	*m = parent_members[i];
+	m->ocm_name = vim_strsave(m->ocm_name);
+	if (m->ocm_init != NULL)
+	    m->ocm_init = vim_strsave(m->ocm_init);
     }
     if (gap->ga_len > 0)
 	// new members are moved