From b2c8750c4e95f64a8dff912af81e13318b3f6ed6 Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Sat, 14 Oct 2017 21:15:58 +0200 Subject: patch 8.0.1193: crash when wiping out a buffer after using getbufinfo() Problem: Crash when wiping out a buffer after using getbufinfo(). (Yegappan Lakshmanan) Solution: Remove b:changedtick from the buffer variables. --- src/buffer.c | 2 ++ src/testdir/test_autocmd.vim | 6 +++++- src/version.c | 2 ++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/src/buffer.c b/src/buffer.c index 300582bd0..22effbb81 100644 --- a/src/buffer.c +++ b/src/buffer.c @@ -837,6 +837,8 @@ free_buffer(buf_T *buf) ++buf_free_count; free_buffer_stuff(buf, TRUE); #ifdef FEAT_EVAL + /* b:changedtick uses an item in buf_T, remove it now */ + dictitem_remove(buf->b_vars, (dictitem_T *)&buf->b_ct_di); unref_var_dict(buf->b_vars); #endif #ifdef FEAT_LUA diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim index d0564f386..49388a1a7 100644 --- a/src/testdir/test_autocmd.vim +++ b/src/testdir/test_autocmd.vim @@ -769,10 +769,14 @@ func Test_BufLeave_Wipe() bwipe! call assert_equal(1, line('$')) call assert_equal('', bufname('%')) - call assert_equal(1, len(getbufinfo())) + let g:bufinfo = getbufinfo() + call assert_equal(1, len(g:bufinfo)) call delete('Xxx1') call delete('Xxx2') %bwipe au! BufLeave + + " check that bufinfo doesn't contain a pointer to freed memory + call test_garbagecollect_now() endfunc diff --git a/src/version.c b/src/version.c index d16baeb27..fa4d4e76a 100644 --- a/src/version.c +++ b/src/version.c @@ -761,6 +761,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 1193, /**/ 1192, /**/ -- cgit v1.2.1