updated for version 7.3.715v7.3.715

Problem:    Crash when calling setloclist() in BufUnload autocmd. (Marcin
            Szamotulski)
Solution:   Set w_llist to NULL when it was freed.  Also add a test.
            (Christian Brabandt)

4 files changed, 40 insertions, 10 deletions

diff --git a/src/quickfix.c b/src/quickfix.c
index a1c4fe5c5..fec27fa8b 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -107,7 +107,7 @@ struct efm_S
 };
 
 static int	qf_init_ext __ARGS((qf_info_T *qi, char_u *efile, buf_T *buf, typval_T *tv, char_u *errorformat, int newlist, linenr_T lnumfirst, linenr_T lnumlast, char_u *qf_title));
-static void	qf_new_list __ARGS((qf_info_T *qi, char_u *qf_title));
+static void	qf_new_list __ARGS((qf_info_T *qi, char_u *qf_title, win_T *wp));
 static void	ll_free_all __ARGS((qf_info_T **pqi));
 static int	qf_add_entry __ARGS((qf_info_T *qi, qfline_T **prevp, char_u *dir, char_u *fname, int bufnum, char_u *mesg, long lnum, int col, int vis_col, char_u *pattern, int nr, int type, int valid));
 static qf_info_T *ll_new_list __ARGS((void));
@@ -266,7 +266,7 @@ qf_init_ext(qi, efile, buf, tv, errorformat, newlist, lnumfirst, lnumlast,
 
     if (newlist || qi->qf_curlist == qi->qf_listcount)
 	/* make place for a new list */
-	qf_new_list(qi, qf_title);
+	qf_new_list(qi, qf_title, curwin);
     else if (qi->qf_lists[qi->qf_curlist].qf_count > 0)
 	/* Adding to existing list, find last entry. */
 	for (qfprev = qi->qf_lists[qi->qf_curlist].qf_start;
@@ -885,9 +885,10 @@ qf_init_end:
  * Prepare for adding a new quickfix list.
  */
     static void
-qf_new_list(qi, qf_title)
+qf_new_list(qi, qf_title, wp)
     qf_info_T	*qi;
     char_u	*qf_title;
+    win_T	*wp;
 {
     int		i;
 
@@ -897,7 +898,11 @@ qf_new_list(qi, qf_title)
      * way with ":grep'.
      */
     while (qi->qf_listcount > qi->qf_curlist + 1)
+    {
+	if (wp != NULL && wp->w_llist == qi)
+	    wp->w_llist = NULL;
 	qf_free(qi, --qi->qf_listcount);
+    }
 
     /*
      * When the stack is full, remove to oldest entry
@@ -905,6 +910,8 @@ qf_new_list(qi, qf_title)
      */
     if (qi->qf_listcount == LISTCOUNT)
     {
+	if (wp != NULL && wp->w_llist == qi)
+	    wp->w_llist = NULL;
 	qf_free(qi, 0);
 	for (i = 1; i < LISTCOUNT; ++i)
 	    qi->qf_lists[i - 1] = qi->qf_lists[i];
@@ -3181,7 +3188,7 @@ ex_vimgrep(eap)
 	 eap->cmdidx != CMD_vimgrepadd && eap->cmdidx != CMD_lvimgrepadd)
 					|| qi->qf_curlist == qi->qf_listcount)
 	/* make place for a new list */
-	qf_new_list(qi, *eap->cmdlinep);
+	qf_new_list(qi, *eap->cmdlinep, curwin);
     else if (qi->qf_lists[qi->qf_curlist].qf_count > 0)
 	/* Adding to existing list, find last entry. */
 	for (prevp = qi->qf_lists[qi->qf_curlist].qf_start;
@@ -3747,7 +3754,7 @@ set_errorlist(wp, list, action, title)
 
     if (action == ' ' || qi->qf_curlist == qi->qf_listcount)
 	/* make place for a new list */
-	qf_new_list(qi, title);
+	qf_new_list(qi, title, wp);
     else if (action == 'a' && qi->qf_lists[qi->qf_curlist].qf_count > 0)
 	/* Adding to existing list, find last entry. */
 	for (prevp = qi->qf_lists[qi->qf_curlist].qf_start;
@@ -4029,7 +4036,7 @@ ex_helpgrep(eap)
 #endif
 
 	/* create a new quickfix list */
-	qf_new_list(qi, *eap->cmdlinep);
+	qf_new_list(qi, *eap->cmdlinep, wp);
 
 	/* Go through all directories in 'runtimepath' */
 	p = p_rtp;
diff --git a/src/testdir/test49.ok b/src/testdir/test49.ok
index 1842af259..0caef818d 100644
--- a/src/testdir/test49.ok
+++ b/src/testdir/test49.ok
@@ -85,8 +85,10 @@ Results of test49.vim:
 *** Test  83: OK (2835)
 *** Test  84: OK (934782101)
 *** Test  85: OK (198689)
---- Test  86: All tests were run with throwing exceptions on error.
+--- Test  86: No Crash for vimgrep on BufUnload
+*** Test  86: OK (0)
+--- Test  87: All tests were run with throwing exceptions on error.
 	      The $VIMNOERRTHROW control is not configured.
---- Test  86: All tests were run with throwing exceptions on interrupt.
+--- Test  87: All tests were run with throwing exceptions on interrupt.
 	      The $VIMNOINTTHROW control is not configured.
-*** Test  86: OK (50443995)
+*** Test  87: OK (50443995)
diff --git a/src/testdir/test49.vim b/src/testdir/test49.vim
index 5e24e3024..d17ea54b2 100644
--- a/src/testdir/test49.vim
+++ b/src/testdir/test49.vim
@@ -9603,9 +9603,28 @@ delfunction Delete_autocommands
 
 Xcheck 198689
 
+"-------------------------------------------------------------------------------
+" Test 86   setloclist crash						    {{{1
+"
+"	    Executing a setloclist() on BufUnload shouldn't crash Vim
+"-------------------------------------------------------------------------------
+
+func F
+    au BufUnload * :call setloclist(0, [{'bufnr':1, 'lnum':1, 'col':1, 'text': 'tango down'}])
+
+    :lvimgrep /.*/ *
+endfunc
+
+XpathINIT
+
+ExecAsScript F
+
+delfunction F
+Xout  "No Crash for vimgrep on BufUnload"
+Xcheck 0 
 
 "-------------------------------------------------------------------------------
-" Test 86:  $VIMNOERRTHROW and $VIMNOINTTHROW support			    {{{1
+" Test 87:  $VIMNOERRTHROW and $VIMNOINTTHROW support			    {{{1
 "
 "	    It is possible to configure Vim for throwing exceptions on error
 "	    or interrupt, controlled by variables $VIMNOERRTHROW and
diff --git a/src/version.c b/src/version.c
index ecbc7aaa5..6fbe44a90 100644
--- a/src/version.c
+++ b/src/version.c
@@ -726,6 +726,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    715,
+/**/
     714,
 /**/
     713,