commit b2c8750c4e95f64a8dff912af81e13318b3f6ed6
author Bram Moolenaar <Bram@vim.org> Sat Oct 14 21:15:58 2017 +0200
committer Bram Moolenaar <Bram@vim.org> Sat Oct 14 21:15:58 2017 +0200
tree 55be4c79f21f17a5f97ecad64efefa47c808b41c
parent ac8069bb63c5954c787fe93b7a9265de3c0c6853

patch 8.0.1193: crash when wiping out a buffer after using getbufinfo()

Problem:    Crash when wiping out a buffer after using getbufinfo().
            (Yegappan Lakshmanan)
Solution:   Remove b:changedtick from the buffer variables.

src/buffer.c

diff --git a/src/buffer.c b/src/buffer.c
index 300582b..22effbb 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -837,6 +837,8 @@
     ++buf_free_count;
     free_buffer_stuff(buf, TRUE);
 #ifdef FEAT_EVAL
+    /* b:changedtick uses an item in buf_T, remove it now */
+    dictitem_remove(buf->b_vars, (dictitem_T *)&buf->b_ct_di);
     unref_var_dict(buf->b_vars);
 #endif
 #ifdef FEAT_LUA

src/testdir/test_autocmd.vim

diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index d0564f3..49388a1 100644
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -769,10 +769,14 @@
   bwipe!
   call assert_equal(1, line('$'))
   call assert_equal('', bufname('%'))
-  call assert_equal(1, len(getbufinfo()))
+  let g:bufinfo = getbufinfo()
+  call assert_equal(1, len(g:bufinfo))
 
   call delete('Xxx1')
   call delete('Xxx2')
   %bwipe
   au! BufLeave
+
+  " check that bufinfo doesn't contain a pointer to freed memory
+  call test_garbagecollect_now()
 endfunc

src/version.c

diff --git a/src/version.c b/src/version.c
index d16baeb..fa4d4e7 100644
--- a/src/version.c
+++ b/src/version.c
@@ -762,6 +762,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1193,
+/**/
     1192,
 /**/
     1191,