From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 17 Feb 2017 11:04:56 +0000 (+0100)
Subject: patch 8.0.0331: restoring help snapshot accesses freed memory
X-Git-Tag: v8.0.0331
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=343b8c042967da82f2f022afa31f2c97a264c1c8;p=vim

patch 8.0.0331: restoring help snapshot accesses freed memory

Problem:    Restoring help snapshot accesses freed memory. (Dominique Pelle)
Solution:   Don't restore a snapshot when the window closes.
---

diff --git a/src/Makefile b/src/Makefile
index e1443e558..153e526fd 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -2132,6 +2132,7 @@ test_arglist \
 	test_goto \
 	test_gui \
 	test_hardcopy \
+	test_help \
 	test_help_tagjump \
 	test_hide \
 	test_history \
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index 58291ea75..3ff7247c3 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -154,6 +154,7 @@ NEW_TESTS = test_arglist.res \
 	    test_gn.res \
 	    test_gui.res \
 	    test_hardcopy.res \
+	    test_help.res \
 	    test_hide.res \
 	    test_history.res \
 	    test_hlsearch.res \
diff --git a/src/testdir/test_help.vim b/src/testdir/test_help.vim
new file mode 100644
index 000000000..ca095d067
--- /dev/null
+++ b/src/testdir/test_help.vim
@@ -0,0 +1,10 @@
+" Tests for :help
+
+func Test_help_restore_snapshot()
+  help
+  set buftype=
+  help
+  edit x
+  help
+  helpclose
+endfunc
diff --git a/src/version.c b/src/version.c
index 906c30c93..b014e74c9 100644
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    331,
 /**/
     330,
 /**/
diff --git a/src/window.c b/src/window.c
index 6b7bd353a..c9771af58 100644
--- a/src/window.c
+++ b/src/window.c
@@ -6551,7 +6551,7 @@ restore_snapshot(
 
 /*
  * Check if frames "sn" and "fr" have the same layout, same following frames
- * and same children.
+ * and same children.  And the window pointer is valid.
  */
     static int
 check_snapshot_rec(frame_T *sn, frame_T *fr)
@@ -6562,7 +6562,8 @@ check_snapshot_rec(frame_T *sn, frame_T *fr)
 	    || (sn->fr_next != NULL
 		&& check_snapshot_rec(sn->fr_next, fr->fr_next) == FAIL)
 	    || (sn->fr_child != NULL
-		&& check_snapshot_rec(sn->fr_child, fr->fr_child) == FAIL))
+		&& check_snapshot_rec(sn->fr_child, fr->fr_child) == FAIL)
+	    || !win_valid(sn->fr_win))
 	return FAIL;
     return OK;
 }