patch 8.0.1193: crash when wiping out a buffer after using getbufinfo()

Problem:    Crash when wiping out a buffer after using getbufinfo().
            (Yegappan Lakshmanan)
Solution:   Remove b:changedtick from the buffer variables.

diff --git a/src/buffer.c b/src/buffer.c
index 300582bd0ec50077f5604e0f332131fd99463c07..22effbb81f57fb38030d7bc6077a72826ed88e08 100644 (file)
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -837,6 +837,8 @@ free_buffer(buf_T *buf)
     ++buf_free_count;
     free_buffer_stuff(buf, TRUE);
 #ifdef FEAT_EVAL
+    /* b:changedtick uses an item in buf_T, remove it now */
+    dictitem_remove(buf->b_vars, (dictitem_T *)&buf->b_ct_di);
     unref_var_dict(buf->b_vars);
 #endif
 #ifdef FEAT_LUA

diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index d0564f386601d5867e2ba65acded6b86c0f10588..49388a1a7a51a33a8cc90eadf5f57f93ac1f361d 100644 (file)
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -769,10 +769,14 @@ func Test_BufLeave_Wipe()
   bwipe!
   call assert_equal(1, line('$'))
   call assert_equal('', bufname('%'))
-  call assert_equal(1, len(getbufinfo()))
+  let g:bufinfo = getbufinfo()
+  call assert_equal(1, len(g:bufinfo))
 
   call delete('Xxx1')
   call delete('Xxx2')
   %bwipe
   au! BufLeave
+
+  " check that bufinfo doesn't contain a pointer to freed memory
+  call test_garbagecollect_now()
 endfunc

diff --git a/src/version.c b/src/version.c
index d16baeb27e9f56e16e09771661e4a99e2c536859..fa4d4e76a5bd3b23e2abc9d11e4da416374165c9 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -761,6 +761,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1193,
 /**/
     1192,
 /**/