patch 8.0.0700: segfault with QuitPre autocommand closes the window

Problem:    Segfault with QuitPre autocommand closes the window. (Marek)
Solution:   Check that the window pointer is still valid. (Christian Brabandt,
            closes #1817)

diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 6ff578e65545eb48ecb2606a5b663cbda3a6dfc7..8f427cfde0f60323ac4acfa15047851d35b60a39 100644 (file)
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -7271,8 +7271,11 @@ ex_quit(exarg_T *eap)
     apply_autocmds(EVENT_QUITPRE, NULL, NULL, FALSE, curbuf);
     /* Refuse to quit when locked or when the buffer in the last window is
      * being closed (can only happen in autocommands). */
-    if (curbuf_locked() || (wp->w_buffer->b_nwindows == 1
-                                               && wp->w_buffer->b_locked > 0))
+    if (curbuf_locked()
+# ifdef FEAT_WINDOWS
+           || !win_valid(wp)
+# endif
+           || (wp->w_buffer->b_nwindows == 1 && wp->w_buffer->b_locked > 0))
        return;
 #endif
 

diff --git a/src/testdir/test_tabpage.vim b/src/testdir/test_tabpage.vim
index c139958df34143d967e0d5312dee499be7cc5593..239b1b965bf3af38a43853ef1df7ef050a980661 100644 (file)
--- a/src/testdir/test_tabpage.vim
+++ b/src/testdir/test_tabpage.vim
@@ -473,5 +473,23 @@ func Test_tabnext_on_buf_unload2()
   endwhile
 endfunc
 
+func Test_close_on_quitpre()
+  " This once caused a crash
+  new
+  only
+  set bufhidden=delete
+  au QuitPre <buffer> close
+  tabnew tab1
+  tabnew tab2
+  1tabn
+  q!
+  call assert_equal(1, tabpagenr())
+  call assert_equal(2, tabpagenr('$'))
+  " clean up
+  while tabpagenr('$') > 1
+    bwipe!
+  endwhile
+  1b
+endfunc
 
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 8cbbbf773fd475c60f2685d8d409128367fddfd7..7c1fb103aebb0d046da3ed84a3cfdab8f176a01b 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    700,
 /**/
     699,
 /**/