updated for version 7.3.390v7.3.390v7-3-390

Problem:    Using NULL buffer pointer in a window.
Solution:   Check for w_buffer being NULL in more places. (Bjorn Winckler)

4 files changed, 18 insertions, 7 deletions

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index e81b4a2b..519655be 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -3390,6 +3390,13 @@ do_ecmd(fnum, ffname, sfname, eap, newlnum, flags, oldwin)
 				      (flags & ECMD_HIDE) ? 0 : DOBUF_UNLOAD);
 
 #ifdef FEAT_AUTOCMD
+		/* Autocommands may open a new window and leave oldwin open
+		 * which leads to crashes since the above call sets
+		 * oldwin->w_buffer to NULL. */
+		if (curwin != oldwin && oldwin != aucmd_win
+			     && win_valid(oldwin) && oldwin->w_buffer == NULL)
+		    win_close(oldwin, FALSE);
+
 # ifdef FEAT_EVAL
 		if (aborting())	    /* autocmds may abort script processing */
 		{
diff --git a/src/quickfix.c b/src/quickfix.c
index 0502392c..a2935bea 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -2675,7 +2675,7 @@ qf_fill_buffer(qi)
 bt_quickfix(buf)
     buf_T	*buf;
 {
-    return (buf->b_p_bt[0] == 'q');
+    return buf != NULL && buf->b_p_bt[0] == 'q';
 }
 
 /*
@@ -2686,8 +2686,8 @@ bt_quickfix(buf)
 bt_nofile(buf)
     buf_T	*buf;
 {
-    return (buf->b_p_bt[0] == 'n' && buf->b_p_bt[2] == 'f')
-	    || buf->b_p_bt[0] == 'a';
+    return buf != NULL && ((buf->b_p_bt[0] == 'n' && buf->b_p_bt[2] == 'f')
+	    || buf->b_p_bt[0] == 'a');
 }
 
 /*
@@ -2697,7 +2697,7 @@ bt_nofile(buf)
 bt_dontwrite(buf)
     buf_T	*buf;
 {
-    return (buf->b_p_bt[0] == 'n');
+    return buf != NULL && buf->b_p_bt[0] == 'n';
 }
 
     int
diff --git a/src/version.c b/src/version.c
index 5aaf8948..1deb08f3 100644
--- a/src/version.c
+++ b/src/version.c
@@ -715,6 +715,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    390,
+/**/
     389,
 /**/
     388,
diff --git a/src/window.c b/src/window.c
index 6b803f59..80c69a1e 100644
--- a/src/window.c
+++ b/src/window.c
@@ -2170,7 +2170,7 @@ win_close(win, free_buf)
 
     /* When closing the help window, try restoring a snapshot after closing
      * the window.  Otherwise clear the snapshot, it's now invalid. */
-    if (win->w_buffer->b_help)
+    if (win->w_buffer != NULL && win->w_buffer->b_help)
 	help_window = TRUE;
     else
 	clear_snapshot(curtab, SNAP_HELP_IDX);
@@ -2214,13 +2214,15 @@ win_close(win, free_buf)
 
 #ifdef FEAT_SYN_HL
     /* Free independent synblock before the buffer is freed. */
-    reset_synblock(win);
+    if (win->w_buffer != NULL)
+	reset_synblock(win);
 #endif
 
     /*
      * Close the link to the buffer.
      */
-    close_buffer(win, win->w_buffer, free_buf ? DOBUF_UNLOAD : 0);
+    if (win->w_buffer != NULL)
+	close_buffer(win, win->w_buffer, free_buf ? DOBUF_UNLOAD : 0);
 
     /* Autocommands may have closed the window already, or closed the only
      * other window or moved to another tab page. */