patch 7.4.2006

Problem:    Crash when using tabnext in BufUnload autocmd. (Norio Takagi)
Solution:   First check that the current buffer is the right one. (Hirohito
            Higashi)

src/buffer.c

@@ -459,14 +459,6 @@ aucmd_abort:
 #endif
 
     buf_freeall(buf, (del_buf ? BFA_DEL : 0) + (wipe_buf ? BFA_WIPE : 0));
-    if (
-#ifdef FEAT_WINDOWS
-	win_valid(win) &&
-#else
-	win != NULL &&
-#endif
-			  win->w_buffer == buf)
-	win->w_buffer = NULL;  /* make sure we don't use the buffer now */
 
 #ifdef FEAT_AUTOCMD
     /* Autocommands may have deleted the buffer. */
@@ -477,11 +469,6 @@ aucmd_abort:
 	return;
 # endif
 
-    /* Autocommands may have opened or closed windows for this buffer.
-     * Decrement the count for the close we do here. */
-    if (buf->b_nwindows > 0)
-	--buf->b_nwindows;
-
     /*
      * It's possible that autocommands change curbuf to the one being deleted.
      * This might cause the previous curbuf to be deleted unexpectedly.  But
@@ -491,6 +478,20 @@ aucmd_abort:
      */
     if (buf == curbuf && !is_curbuf)
 	return;
+
+    if (
+#ifdef FEAT_WINDOWS
+	win_valid(win) &&
+#else
+	win != NULL &&
+#endif
+			  win->w_buffer == buf)
+	win->w_buffer = NULL;  /* make sure we don't use the buffer now */
+
+    /* Autocommands may have opened or closed windows for this buffer.
+     * Decrement the count for the close we do here. */
+    if (buf->b_nwindows > 0)
+	--buf->b_nwindows;
 #endif
 
     /* Change directories when the 'acd' option is set. */

src/testdir/test_autocmd.vim

@@ -60,3 +60,21 @@ function Test_bufunload()
 
   augroup! test_bufunload_group
 endfunc
+
+" SEGV occurs in older versions.  (At least 7.4.2005 or older)
+function Test_autocmd_bufunload_with_tabnext()
+  tabedit
+  tabfirst
+
+  augroup test_autocmd_bufunload_with_tabnext_group
+    autocmd!
+    autocmd BufUnload <buffer> tabnext
+  augroup END
+
+  quit
+  call assert_equal(2, tabpagenr('$'))
+
+  augroup! test_autocmd_bufunload_with_tabnext_group
+  tablast
+  quit
+endfunc

src/version.c

@@ -758,6 +758,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2006,
 /**/
     2005,
 /**/