patch 8.1.2418: bufnr('$') is wrong after recycling popup buffer

Problem:    bufnr('$') is wrong after recycling popup buffer.
Solution:   Sort the buffer list by buffer number. (closes #5335)
diff --git a/src/buffer.c b/src/buffer.c
index 4f38f91..b4992dd 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -2093,6 +2093,25 @@
 	    // buffer number grows rapidly.
 	    --buf_reuse.ga_len;
 	    buf->b_fnum = ((int *)buf_reuse.ga_data)[buf_reuse.ga_len];
+
+	    // Move buffer to the right place in the buffer list.
+	    while (buf->b_prev != NULL && buf->b_fnum < buf->b_prev->b_fnum)
+	    {
+		buf_T	*prev = buf->b_prev;
+
+		prev->b_next = buf->b_next;
+		if (prev->b_next != NULL)
+		    prev->b_next->b_prev = prev;
+		buf->b_next = prev;
+		buf->b_prev = prev->b_prev;
+		if (buf->b_prev != NULL)
+		    buf->b_prev->b_next = buf;
+		prev->b_prev = buf;
+		if (lastbuf == buf)
+		    lastbuf = prev;
+		if (firstbuf == prev)
+		    firstbuf = buf;
+	    }
 	}
 	else
 	    buf->b_fnum = top_file_num++;
diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
index dc22743..5d7f46f 100644
--- a/src/testdir/test_popupwin.vim
+++ b/src/testdir/test_popupwin.vim
@@ -3168,4 +3168,21 @@
   call delete('XtestPopupSign')
 endfunc
 
+func Test_popupwin_bufnr()
+  let popwin = popup_create(['blah'], #{})
+  let popbuf = winbufnr(popwin)
+  split asdfasdf
+  let newbuf = bufnr()
+  call assert_true(newbuf > popbuf, 'New buffer number is higher')
+  call assert_equal(newbuf, bufnr('$'))
+  call popup_clear()
+  let popwin = popup_create(['blah'], #{})
+  " reuses previous buffer number
+  call assert_equal(popbuf, winbufnr(popwin))
+  call assert_equal(newbuf, bufnr('$'))
+
+  call popup_clear()
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2
diff --git a/src/version.c b/src/version.c
index 0956f87..ecdcb9c 100644
--- a/src/version.c
+++ b/src/version.c
@@ -743,6 +743,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    2418,
+/**/
     2417,
 /**/
     2416,