cmd/cue/cmd: fix race

Inroduced with
https://cue-review.googlesource.com/c/cue/+/3401

Change-Id: I043637478595e18ae6075f88e7bc55add7fb636b
Reviewed-on: https://cue-review.googlesource.com/c/cue/+/3443
Reviewed-by: Marcel van Lohuizen <mpvl@golang.org>
diff --git a/cmd/cue/cmd/custom.go b/cmd/cue/cmd/custom.go
index f04dc94..4fb7d92 100644
--- a/cmd/cue/cmd/custom.go
+++ b/cmd/cue/cmd/custom.go
@@ -187,22 +187,24 @@
 				<-d.done
 			}
 			defer close(t.done)
+			// TODO: This can be done concurrently once it is verified that this
+			// code does not look up new strings in the index and that the
+			// full configuration, as used by the tasks, is pre-evaluated.
 			m.Lock()
 			obj := tasks.Lookup(t.name)
-			m.Unlock()
 			// NOTE: ignore the linter warning for the following line:
 			// itask.Context is an internal type and we want to break if any
 			// fields are added.
 			update, err := t.Run(&itask.Context{ctx, stdout, stderr}, obj)
 			if err == nil && update != nil {
-				m.Lock()
 				root, err = root.Fill(update, spec.taskPath(t.name)...)
 
 				if err == nil {
 					tasks = spec.lookupTasks(root)
 				}
-				m.Unlock()
 			}
+			m.Unlock()
+
 			if err != nil {
 				cancel()
 			}
diff --git a/cue/value.go b/cue/value.go
index 14b380e..8b3ebfe 100644
--- a/cue/value.go
+++ b/cue/value.go
@@ -1317,6 +1317,7 @@
 				continue outer
 			}
 		}
+		// TODO: do not modify value, but create a new disjunction.
 		x.values[k] = v
 		k++
 	}
@@ -1340,6 +1341,7 @@
 		v := x.values[0]
 		return mVal{v.val.(evaluated), v.marked}
 	}
+	// TODO: do not modify value, but create a new disjunction.
 	x.values = x.values[:k]
 	return mVal{x, false}
 }