# HG changeset patch # User Christian Brabandt # Date 1456137905 -3600 # Node ID 5fed86dac2107269527797d55220fa3c72054b10 # Parent c3a233d90ecaa1e3f632a61265dfbb4a1fb01678 commit https://github.com/vim/vim/commit/23c463a157b4f5585ad85efc9f453ffc09c245c3 Author: Bram Moolenaar Date: Mon Feb 22 11:39:27 2016 +0100 patch 7.4.1386 Problem: When the Job exit callback is invoked, the job may be freed too soon. (Yasuhiro Matsumoto) Solution: Increase refcount. diff --git a/src/eval.c b/src/eval.c --- a/src/eval.c +++ b/src/eval.c @@ -15039,7 +15039,8 @@ job_status(job_T *job) typval_T rettv; int dummy; - /* invoke the exit callback */ + /* invoke the exit callback; make sure the refcount is > 0 */ + ++job->jv_refcount; argv[0].v_type = VAR_JOB; argv[0].vval.v_job = job; argv[1].v_type = VAR_NUMBER; @@ -15047,10 +15048,11 @@ job_status(job_T *job) call_func(job->jv_exit_cb, (int)STRLEN(job->jv_exit_cb), &rettv, 2, argv, 0L, 0L, &dummy, TRUE, NULL); clear_tv(&rettv); + --job->jv_refcount; } if (job->jv_status == JOB_ENDED && job->jv_refcount == 0) { - /* The job already was unreferenced, now that it ended it can be + /* The job was already unreferenced, now that it ended it can be * freed. Careful: caller must not use "job" after this! */ job_free(job); } diff --git a/src/version.c b/src/version.c --- a/src/version.c +++ b/src/version.c @@ -749,6 +749,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 1386, +/**/ 1385, /**/ 1384,