# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1546020906 -3600
# Node ID e3dfd25b0679a4e757fabb12a6622b129c8d62bc
# Parent  79208fd350545269e878671a6e6f15c69b0c08e2
patch 8.1.0652: freeing memory for balloon eval too early

commit https://github.com/vim/vim/commit/6d9e71ad994fd428ecea76741376807cd18308ec
Author: Bram Moolenaar <Bram@vim.org>
Date:   Fri Dec 28 19:13:34 2018 +0100

    patch 8.1.0652: freeing memory for balloon eval too early

    Problem:    Freeing memory for balloon eval too early.
    Solution:   Store the pointer in BalloonEval and free it later. (Yasuhiro
                Matsumoto, closes #3725)

diff --git a/src/beval.h b/src/beval.h
--- a/src/beval.h
+++ b/src/beval.h
@@ -76,6 +76,9 @@ typedef struct BalloonEvalStruct
     int			*vts;		// vartabstop setting for this buffer
 #endif
     char_u		*msg;
+#ifdef FEAT_GUI_W32
+    void		*tofree;
+#endif
 } BalloonEval;
 
 #define EVAL_OFFSET_X 15 /* displacement of beval topleft corner from pointer */
diff --git a/src/gui_w32.c b/src/gui_w32.c
--- a/src/gui_w32.c
+++ b/src/gui_w32.c
@@ -8787,7 +8787,6 @@ make_tooltipw(BalloonEval *beval, char *
 {
     TOOLINFOW	*pti;
     int		ToolInfoSize;
-    WCHAR	*tofree = NULL;
 
     if (multiline_balloon_available() == TRUE)
 	ToolInfoSize = sizeof(TOOLINFOW_NEW);
@@ -8817,8 +8816,8 @@ make_tooltipw(BalloonEval *beval, char *
 	RECT rect;
 	TOOLINFOW_NEW *ptin = (TOOLINFOW_NEW *)pti;
 	pti->lpszText = LPSTR_TEXTCALLBACKW;
-	tofree = enc_to_utf16((char_u*)text, NULL);
-	ptin->lParam = (LPARAM)tofree;
+	beval->tofree = enc_to_utf16((char_u*)text, NULL);
+	ptin->lParam = (LPARAM)beval->tofree;
 	// switch multiline tooltips on
 	if (GetClientRect(s_textArea, &rect))
 	    SendMessageW(beval->balloon, TTM_SETMAXTIPWIDTH, 0,
@@ -8827,8 +8826,8 @@ make_tooltipw(BalloonEval *beval, char *
     else
     {
 	// do this old way
-	tofree = enc_to_utf16((char_u*)text, NULL);
-	pti->lpszText = tofree;
+	beval->tofree = enc_to_utf16((char_u*)text, NULL);
+	pti->lpszText = (LPWSTR)beval->tofree;
     }
 
     // Limit ballooneval bounding rect to CursorPos neighbourhood.
@@ -8851,8 +8850,6 @@ make_tooltipw(BalloonEval *beval, char *
     mouse_event(MOUSEEVENTF_MOVE, 2, 2, 0, 0);
     mouse_event(MOUSEEVENTF_MOVE, (DWORD)-1, (DWORD)-1, 0, 0);
     vim_free(pti);
-    if (tofree != NULL)
-	vim_free(tofree);
 }
 #endif
 
@@ -8898,7 +8895,8 @@ make_tooltip(BalloonEval *beval, char *t
 	RECT rect;
 	TOOLINFO_NEW *ptin = (TOOLINFO_NEW *)pti;
 	pti->lpszText = LPSTR_TEXTCALLBACK;
-	ptin->lParam = (LPARAM)text;
+	beval->tofree = vim_strsave((char_u*)text);
+	ptin->lParam = (LPARAM)beval->tofree;
 	if (GetClientRect(s_textArea, &rect)) /* switch multiline tooltips on */
 	    SendMessage(beval->balloon, TTM_SETMAXTIPWIDTH, 0,
 		    (LPARAM)rect.right);
@@ -9106,9 +9104,9 @@ TrackUserActivity(UINT uMsg)
 gui_mch_destroy_beval_area(BalloonEval *beval)
 {
 #ifdef FEAT_VARTABS
-    if (beval->vts)
-	vim_free(beval->vts);
-#endif
+    vim_free(beval->vts);
+#endif
+    vim_free(beval->tofree);
     vim_free(beval);
 }
 #endif /* FEAT_BEVAL_GUI */
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -800,6 +800,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    652,
+/**/
     651,
 /**/
     650,