patch 8.0.0698: crash on exit when using Python function in timer.v8.0.0698

Problem:    When a timer uses ":pyeval" or another Python command and it
            happens to be triggered while exiting a Crash may happen.
            (Ricky Zhou)
Solution:   Avoid running a Python command after python_end() was called.
            Do not trigger timers while exiting.  (closes #1824)

4 files changed, 17 insertions, 2 deletions

diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c
index 74dae92b5..3efa8ca2e 100644
--- a/src/ex_cmds2.c
+++ b/src/ex_cmds2.c
@@ -1183,6 +1183,7 @@ timer_callback(timer_T *timer)
 /*
  * Call timers that are due.
  * Return the time in msec until the next timer is due.
+ * Returns -1 if there are no pending timers.
  */
     long
 check_due_timer(void)
@@ -1197,6 +1198,10 @@ check_due_timer(void)
 # ifdef WIN3264
     LARGE_INTEGER   fr;
 
+    /* Don't run any timers while exiting. */
+    if (exiting)
+	return next_due;
+
     QueryPerformanceFrequency(&fr);
 # endif
     profile_start(&now);
diff --git a/src/if_python.c b/src/if_python.c
index 6b2ce56ef..a280459db 100644
--- a/src/if_python.c
+++ b/src/if_python.c
@@ -779,6 +779,7 @@ get_exceptions(void)
 
 static int initialised = 0;
 #define PYINITIALISED initialised
+static int python_end_called = FALSE;
 
 #define DESTRUCTOR_FINISH(self) self->ob_type->tp_free((PyObject*)self);
 
@@ -878,6 +879,7 @@ python_end(void)
     if (recurse != 0)
 	return;
 
+    python_end_called = TRUE;
     ++recurse;
 
 #ifdef DYNAMIC_PYTHON
@@ -1040,6 +1042,8 @@ DoPyCommand(const char *cmd, rangeinitializer init_range, runner run, void *arg)
     }
     ++recursive;
 #endif
+    if (python_end_called)
+	return;
 
 #if defined(MACOS) && !defined(MACOS_X_UNIX)
     GetPort(&oldPort);
@@ -1568,7 +1572,7 @@ do_pyeval (char_u *str, typval_T *rettv)
 	    (rangeinitializer) init_range_eval,
 	    (runner) run_eval,
 	    (void *) rettv);
-    switch(rettv->v_type)
+    switch (rettv->v_type)
     {
 	case VAR_DICT: ++rettv->vval.v_dict->dv_refcount; break;
 	case VAR_LIST: ++rettv->vval.v_list->lv_refcount; break;
diff --git a/src/if_python3.c b/src/if_python3.c
index d68ab85a8..6949b02ef 100644
--- a/src/if_python3.c
+++ b/src/if_python3.c
@@ -733,8 +733,8 @@ get_py3_exceptions(void)
 #endif /* DYNAMIC_PYTHON3 */
 
 static int py3initialised = 0;
-
 #define PYINITIALISED py3initialised
+static int python_end_called = FALSE;
 
 #define DESTRUCTOR_FINISH(self) Py_TYPE(self)->tp_free((PyObject*)self)
 
@@ -817,6 +817,7 @@ python3_end(void)
     if (recurse != 0)
 	return;
 
+    python_end_called = TRUE;
     ++recurse;
 
 #ifdef DYNAMIC_PYTHON3
@@ -938,6 +939,9 @@ DoPyCommand(const char *cmd, rangeinitializer init_range, runner run, void *arg)
     PyObject		*cmdbytes;
     PyGILState_STATE	pygilstate;
 
+    if (python_end_called)
+	goto theend;
+
 #if defined(MACOS) && !defined(MACOS_X_UNIX)
     GetPort(&oldPort);
     /* Check if the Python library is available */
diff --git a/src/version.c b/src/version.c
index bd09de5d9..bd4c3e13a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -765,6 +765,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    698,
+/**/
     697,
 /**/
     696,