changeset 12630:560adb3eed8b v8.0.1193

patch 8.0.1193: crash when wiping out a buffer after using getbufinfo() commit https://github.com/vim/vim/commit/b2c8750c4e95f64a8dff912af81e13318b3f6ed6 Author: Bram Moolenaar <Bram@vim.org> Date: Sat Oct 14 21:15:58 2017 +0200 patch 8.0.1193: crash when wiping out a buffer after using getbufinfo() Problem: Crash when wiping out a buffer after using getbufinfo(). (Yegappan Lakshmanan) Solution: Remove b:changedtick from the buffer variables.
author Christian Brabandt <cb@256bit.org>
date Sat, 14 Oct 2017 21:30:05 +0200
parents 32a337b59f6e
children 3e8f6b06e414
files src/buffer.c src/testdir/test_autocmd.vim src/version.c
diffstat 3 files changed, 9 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -837,6 +837,8 @@ free_buffer(buf_T *buf)
     ++buf_free_count;
     free_buffer_stuff(buf, TRUE);
 #ifdef FEAT_EVAL
+    /* b:changedtick uses an item in buf_T, remove it now */
+    dictitem_remove(buf->b_vars, (dictitem_T *)&buf->b_ct_di);
     unref_var_dict(buf->b_vars);
 #endif
 #ifdef FEAT_LUA
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -769,10 +769,14 @@ func Test_BufLeave_Wipe()
   bwipe!
   call assert_equal(1, line('$'))
   call assert_equal('', bufname('%'))
-  call assert_equal(1, len(getbufinfo()))
+  let g:bufinfo = getbufinfo()
+  call assert_equal(1, len(g:bufinfo))
 
   call delete('Xxx1')
   call delete('Xxx2')
   %bwipe
   au! BufLeave
+
+  " check that bufinfo doesn't contain a pointer to freed memory
+  call test_garbagecollect_now()
 endfunc
--- a/src/version.c
+++ b/src/version.c
@@ -762,6 +762,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1193,
+/**/
     1192,
 /**/
     1191,