patch 9.1.1253: abort when closing window with attached quickfix data
Problem: If win_close() is called with a window that has quickfix stack
attached to it, the corresponding quickfix buffer will be
closed and freed after the buffer was already closed. At that
time curwin->w_buffer points to NULL, which the CHECK_CURBUF
will catch and abort if ABORT_ON_ERROR is defined
Solution: in wipe_qf_buffer() temporarily point curwin->w_buffer back to
curbuf, the window will be closed anyhow, so it shouldn't
matter that curbuf->b_nwindows isn't incremented.
closes: #16993
closes: #16985
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/quickfix.c b/src/quickfix.c
index 30353c5..11bfa82 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -2035,10 +2035,24 @@
qfbuf = buflist_findnr(qi->qf_bufnr);
if (qfbuf != NULL && qfbuf->b_nwindows == 0)
{
+ int buf_was_null = FALSE;
+ // can happen when curwin is going to be closed e.g. curwin->w_buffer
+ // was already closed in win_close(), and we are now closing the
+ // window related location list buffer from win_free_mem()
+ // but close_buffer() calls CHECK_CURBUF() macro and requires
+ // curwin->w_buffer == curbuf
+ if (curwin->w_buffer == NULL)
+ {
+ curwin->w_buffer = curbuf;
+ buf_was_null = TRUE;
+ }
+
// If the quickfix buffer is not loaded in any window, then
// wipe the buffer.
close_buffer(NULL, qfbuf, DOBUF_WIPE, FALSE, FALSE);
qi->qf_bufnr = INVALID_QFBUFNR;
+ if (buf_was_null)
+ curwin->w_buffer = NULL;
}
}
diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index c382e68..03fbbee 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -6718,4 +6718,12 @@
call Xtest_hardlink_fname('l')
endfunc
+func Test_quickfix_close_buffer_crash()
+ new
+ lexpr 'test' | lopen
+ wincmd k
+ lclose
+ wincmd q
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index cceb83c..d11c4ac 100644
--- a/src/version.c
+++ b/src/version.c
@@ -705,6 +705,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 1253,
+/**/
1252,
/**/
1251,