[binutils-gdb] Fix crash from eval_op_objc_msgcall

[Tom Tromey]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9603180dd2b1d0831aa983ed4ab09d5760fac08b

commit 9603180dd2b1d0831aa983ed4ab09d5760fac08b
Author: Tom Tromey <tromey@adacore.com>
Date:   Fri Nov 14 13:40:22 2025 -0700

    Fix crash from eval_op_objc_msgcall
    
    Trying to evaluate an Objective-C message call will cause gdb to
    crash.  This happens because this code was not correctly updated when
    call_function_by_hand was changed to accept an array_view, and the
    trailing NULL pointer was no longer required.
    
    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=33628

Diff:
---
 gdb/eval.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/gdb/eval.c b/gdb/eval.c
index 5455164dc63..5d1907f837e 100644
--- a/gdb/eval.c
+++ b/gdb/eval.c
@@ -1909,8 +1909,7 @@ eval_binop_assign_modify (struct type *expect_type, struct expression *exp,
   return value_assign (arg1, arg2);
 }
 
-/* Note that ARGS needs 2 empty slots up front and must end with a
-   null pointer.  */
+/* Note that ARGS needs 2 empty slots up front.  */
 static struct value *
 eval_op_objc_msgcall (struct type *expect_type, struct expression *exp,
 		      enum noside noside, CORE_ADDR selector,
@@ -2240,17 +2239,16 @@ objc_msgcall_operation::evaluate (struct type *expect_type,
   else
     sub_no_side = noside;
   std::vector<operation_up> &args = std::get<2> (m_storage);
-  value **argvec = XALLOCAVEC (struct value *, args.size () + 3);
+  value **argvec = XALLOCAVEC (struct value *, args.size () + 2);
   argvec[0] = nullptr;
   argvec[1] = nullptr;
   for (int i = 0; i < args.size (); ++i)
     argvec[i + 2] = args[i]->evaluate_with_coercion (exp, sub_no_side);
-  argvec[args.size () + 2] = nullptr;
 
   return eval_op_objc_msgcall (expect_type, exp, noside, std::
 			       get<0> (m_storage), target,
 			       gdb::make_array_view (argvec,
-						     args.size () + 3));
+						     args.size () + 2));
 }
 
 value *