patch 8.2.2474: using freed memory when window is closed by autocommand

Problem:    Using freed memory when window is closed by autocommand.
            (houyunsong)
Solution:   Check the window pointer is still valid.

diff --git a/src/quickfix.c b/src/quickfix.c
index 742a1ee71332415f05d36373659b9d07d527190a..910c806f1889be529df1d309aa1e28d600517eb3 100644 (file)
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -2603,6 +2603,8 @@ qflist_valid(win_T *wp, int_u qf_id)
 
     if (wp != NULL)
     {
+       if (!win_valid(wp))
+           return FALSE;
        qi = GET_LOC_LIST(wp);      // Location list
        if (qi == NULL)
            return FALSE;

diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index 15d237ee1d3ebddf0b28d82ad722095b8c67001b..e07731d6e5a61d935fba66e61e4efb66c677f7f7 100644 (file)
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -2783,4 +2783,18 @@ func Test_autocmd_closing_cmdwin()
   only
 endfunc
 
+func Test_autocmd_vimgrep()
+  augroup aucmd_vimgrep
+    au QuickfixCmdPre,BufNew,BufDelete,BufReadCmd * sb
+    au QuickfixCmdPre,BufNew,BufDelete,BufReadCmd * q9\0
+  augroup END
+  " TODO: if this is executed directly valgrind reports errors
+  call assert_fails('lv?a?\1f', 'E926:')
+
+  augroup aucmd_vimgrep
+    au!
+  augroup END
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 254aafdb8ebd1c788312355b4c4f267d386909cb..12a5de8564f0a94fb886b32dc4c6c4f604e3c613 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2474,
 /**/
     2473,
 /**/