# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1631366103 -7200
# Node ID 5ef74c37a9a1de4b2c26e42c6fd16de8a612361c
# Parent  2a8f80b85fe712454ad40207117a100d9002a01f
patch 8.2.3426: crash when deleting a listener in a listener callback

Commit: https://github.com/vim/vim/commit/4b4b1b84eee70b74fa3bb57624533c65bafd8428
Author: Bram Moolenaar <Bram@vim.org>
Date:   Sat Sep 11 15:06:44 2021 +0200

    patch 8.2.3426: crash when deleting a listener in a listener callback

    Problem:    Crash when deleting a listener in a listener callback. (Naohiro
                Ono)
    Solution:   Mark the listener and delete it later.

diff --git a/src/change.c b/src/change.c
--- a/src/change.c
+++ b/src/change.c
@@ -293,6 +293,18 @@ f_listener_flush(typval_T *argvars, typv
     invoke_listeners(buf);
 }
 
+
+    static void
+remove_listener(buf_T *buf, listener_T *lnr, listener_T *prev)
+{
+    if (prev != NULL)
+	prev->lr_next = lnr->lr_next;
+    else
+	buf->b_listener = lnr->lr_next;
+    free_callback(&lnr->lr_callback);
+    vim_free(lnr);
+}
+
 /*
  * listener_remove() function
  */
@@ -317,12 +329,13 @@ f_listener_remove(typval_T *argvars, typ
 	    next = lnr->lr_next;
 	    if (lnr->lr_id == id)
 	    {
-		if (prev != NULL)
-		    prev->lr_next = lnr->lr_next;
-		else
-		    buf->b_listener = lnr->lr_next;
-		free_callback(&lnr->lr_callback);
-		vim_free(lnr);
+		if (textwinlock > 0)
+		{
+		    // in invoke_listeners(), clear ID and delete later
+		    lnr->lr_id = 0;
+		    return;
+		}
+		remove_listener(buf, lnr, prev);
 		rettv->vval.v_number = 1;
 		return;
 	    }
@@ -357,6 +370,7 @@ invoke_listeners(buf_T *buf)
     linenr_T	added = 0;
     int		save_updating_screen = updating_screen;
     static int	recursive = FALSE;
+    listener_T	*next;
 
     if (buf->b_recorded_changes == NULL  // nothing changed
 	    || buf->b_listener == NULL   // no listeners
@@ -400,6 +414,18 @@ invoke_listeners(buf_T *buf)
 	clear_tv(&rettv);
     }
 
+    // If f_listener_remove() was called may have to remove a listener now.
+    for (lnr = buf->b_listener; lnr != NULL; lnr = next)
+    {
+	listener_T	*prev = NULL;
+
+	next = lnr->lr_next;
+	if (lnr->lr_id == 0)
+	    remove_listener(buf, lnr, prev);
+	else
+	    prev = lnr;
+    }
+
     --textwinlock;
     list_unref(buf->b_recorded_changes);
     buf->b_recorded_changes = NULL;
diff --git a/src/testdir/test_listener.vim b/src/testdir/test_listener.vim
--- a/src/testdir/test_listener.vim
+++ b/src/testdir/test_listener.vim
@@ -370,4 +370,22 @@ func Test_col_after_deletion_moved_cur()
   delfunc Listener
 endfunc
 
+func Test_remove_listener_in_callback()
+  new
+  let s:ID = listener_add('Listener')
+  func Listener(...)
+    call listener_remove(s:ID)
+    let g:listener_called = 'yes'
+  endfunc
+  call setline(1, ['foo'])
+  call feedkeys("lD", 'xt')
+  call listener_flush()
+  call assert_equal('yes', g:listener_called)
+
+  bwipe!
+  delfunc Listener
+  unlet g:listener_called
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -756,6 +756,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    3426,
+/**/
     3425,
 /**/
     3424,