patch 7.4.2309

Problem:    Crash when doing tabnext in a BufUnload autocmd. (Dominique Pelle)
Solution:   When detecting that the tab page changed, don't just abort but
            delete the window where w_buffer is NULL.

diff --git a/src/testdir/test_tabpage.vim b/src/testdir/test_tabpage.vim
index f1c41e967b324748055ba7329a13a93204673522..7bdea0b18638f595b5327aa0a6fdb44a2912f2bb 100644 (file)
--- a/src/testdir/test_tabpage.vim
+++ b/src/testdir/test_tabpage.vim
@@ -218,4 +218,18 @@ function Test_tabpage_with_tab_modifier()
   bw!
 endfunction
 
+func Test_tabnext_on_buf_unload()
+  " This once caused a crash
+  new
+  tabedit
+  tabfirst
+  au BufUnload <buffer> tabnext
+  q
+
+  while tabpagenr('$') > 1
+    quit
+  endwhile
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index f5af1156d1ce22183121e9c2fb3e6c3f609f00b9..5fd33ecfa6c4eb173f5d6a2a6e67150ed814b801 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2309,
 /**/
     2308,
 /**/

diff --git a/src/window.c b/src/window.c
index e62cd30962e3794655a64e1164d8fbfc6db9a961..2f3ec8c623dad2e70733d106ee4e487e1fdffd73 100644 (file)
--- a/src/window.c
+++ b/src/window.c
@@ -2379,7 +2379,7 @@ win_close(win_T *win, int free_buf)
 #endif
        close_buffer(win, win->w_buffer, free_buf ? DOBUF_UNLOAD : 0, TRUE);
 #ifdef FEAT_AUTOCMD
-       if (win_valid(win))
+       if (win_valid_any_tab(win))
            win->w_closing = FALSE;
 #endif
        /* Make sure curbuf is valid. It can become invalid if 'bufhidden' is
@@ -2399,9 +2399,18 @@ win_close(win_T *win, int free_buf)
        getout(0);
     }
 
-    /* Autocommands may have closed the window already, or closed the only
-     * other window or moved to another tab page. */
-    else if (!win_valid(win) || last_window() || curtab != prev_curtab
+    /* Autocommands may have moved to another tab page. */
+    if (curtab != prev_curtab && win_valid_any_tab(win)
+                                                     && win->w_buffer == NULL)
+    {
+       /* Need to close the window anyway, since the buffer is NULL. */
+       win_close_othertab(win, FALSE, prev_curtab);
+       return FAIL;
+    }
+
+    /* Autocommands may have closed the window already or closed the only
+     * other window. */
+    if (!win_valid(win) || last_window()
            || close_last_window_tabpage(win, free_buf, prev_curtab))
        return FAIL;
 
@@ -2492,12 +2501,15 @@ win_close_othertab(win_T *win, int free_buf, tabpage_T *tp)
     int                free_tp = FALSE;
 
 #ifdef FEAT_AUTOCMD
-    if (win->w_closing || win->w_buffer->b_closing)
+    /* Get here with win->w_buffer == NULL when win_close() detects the tab
+     * page changed. */
+    if (win->w_closing || (win->w_buffer != NULL && win->w_buffer->b_closing))
        return; /* window is already being closed */
 #endif
 
-    /* Close the link to the buffer. */
-    close_buffer(win, win->w_buffer, free_buf ? DOBUF_UNLOAD : 0, FALSE);
+    if (win->w_buffer != NULL)
+       /* Close the link to the buffer. */
+       close_buffer(win, win->w_buffer, free_buf ? DOBUF_UNLOAD : 0, FALSE);
 
     /* Careful: Autocommands may have closed the tab page or made it the
      * current tab page.  */