aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-07-26 11:04:33 -04:00
Code

patch 8.2.2472: crash when using command line window in an autocommand

Browse Source 
Problem:    Crash when using command line window in an autocommand.
            (houyunsong)
Solution:   Save and restore au_new_curbuf.
This commit is contained in:
Bram Moolenaar 2021-02-06 17:30:31 +01:00
parent efa1923565
commit aad5f9d79a
3 changed files with 27 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/ex_cmds.c
View File

@ -2710,6 +2710,7 @@ do_ecmd(
*/ */
if (buf != curbuf) if (buf != curbuf)
{ {
bufref_T save_au_new_curbuf;
#ifdef FEAT_CMDWIN #ifdef FEAT_CMDWIN
int save_cmdwin_type = cmdwin_type; int save_cmdwin_type = cmdwin_type;
@ -2728,6 +2729,7 @@ do_ecmd(
*/ */
if (buf->b_fname != NULL) if (buf->b_fname != NULL)
new_name = vim_strsave(buf->b_fname); new_name = vim_strsave(buf->b_fname);
save_au_new_curbuf = au_new_curbuf;
set_bufref(&au_new_curbuf, buf); set_bufref(&au_new_curbuf, buf);
apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf); apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf);
#ifdef FEAT_CMDWIN #ifdef FEAT_CMDWIN
@ -2737,12 +2739,14 @@ do_ecmd(
{ {
// new buffer has been deleted // new buffer has been deleted
delbuf_msg(new_name); // frees new_name delbuf_msg(new_name); // frees new_name
au_new_curbuf = save_au_new_curbuf;
goto theend; goto theend;
} }
#ifdef FEAT_EVAL #ifdef FEAT_EVAL
if (aborting()) // autocmds may abort script processing if (aborting()) // autocmds may abort script processing
{ {
vim_free(new_name); vim_free(new_name);
au_new_curbuf = save_au_new_curbuf;
goto theend; goto theend;
} }
#endif #endif
@ -2778,6 +2782,7 @@ do_ecmd(
if (aborting() && curwin->w_buffer != NULL) if (aborting() && curwin->w_buffer != NULL)
{ {
vim_free(new_name); vim_free(new_name);
au_new_curbuf = save_au_new_curbuf;
goto theend; goto theend;
} }
#endif #endif
@ -2786,6 +2791,7 @@ do_ecmd(
{ {
// new buffer has been deleted // new buffer has been deleted
delbuf_msg(new_name); // frees new_name delbuf_msg(new_name); // frees new_name
au_new_curbuf = save_au_new_curbuf;
goto theend; goto theend;
} }
if (buf == curbuf) // already in new buffer if (buf == curbuf) // already in new buffer
@ -2831,8 +2837,7 @@ do_ecmd(
#endif #endif
} }
vim_free(new_name); vim_free(new_name);
au_new_curbuf.br_buf = NULL; au_new_curbuf = save_au_new_curbuf;
au_new_curbuf.br_buf_free_count = 0;
} }
curwin->w_pcmark.lnum = 1; curwin->w_pcmark.lnum = 1;

19
src/testdir/test_autocmd.vim
View File

@ -2739,9 +2739,9 @@ func Test_autocmd_closes_window()
au BufNew,BufWinLeave * e %e au BufNew,BufWinLeave * e %e
file yyy file yyy
au BufNew,BufWinLeave * ball au BufNew,BufWinLeave * ball
call assert_fails('n xxx', 'E143:') n xxx
bwipe % %bwipe
au! BufNew au! BufNew
au! BufWinLeave au! BufWinLeave
endfunc endfunc
@ -2759,4 +2759,19 @@ func Test_autocmd_quit_psearch()
augroup END augroup END
endfunc endfunc
" Fuzzer found some strange combination that caused a crash.
func Test_autocmd_normal_mess()
augroup aucmd_normal_test
au BufLeave,BufWinLeave,BufHidden,BufUnload,BufDelete,BufWipeout * norm 7q/qc
augroup END
o4
silent! H
e xx
normal G
augroup aucmd_normal_test
au!
augroup END
endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab

2
src/version.c
View File

@ -750,6 +750,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
2472,
/**/ /**/
2471, 2471,
/**/ /**/