diff --git a/src/channel.c b/src/channel.c
index 10d9424..28fee0a 100644
--- a/src/channel.c
+++ b/src/channel.c
@@ -888,8 +888,7 @@
 }
 
 /*
- * Remove "node" from the queue that it is in and free it.
- * Also frees the contained callback name.
+ * Remove "node" from the queue that it is in.  Does not free it.
  */
     static void
 remove_cb_node(cbq_T *head, cbq_T *node)
@@ -902,8 +901,6 @@
 	head->cq_prev = node->cq_prev;
     else
 	node->cq_next->cq_prev = node->cq_prev;
-    vim_free(node->cq_callback);
-    vim_free(node);
 }
 
 /*
@@ -1144,8 +1141,12 @@
 	    if (item->cq_seq_nr == seq_nr)
 	    {
 		ch_log(channel, "Invoking one-time callback\n");
-		invoke_callback(channel, item->cq_callback, argv);
+		/* Remove the item from the list first, if the callback
+		 * invokes ch_close() the list will be cleared. */
 		remove_cb_node(head, item);
+		invoke_callback(channel, item->cq_callback, argv);
+		vim_free(item->cq_callback);
+		vim_free(item);
 		done = TRUE;
 		break;
 	    }
@@ -1329,7 +1330,13 @@
 	vim_free(channel_get(channel));
 
     while (cb_head->cq_next != NULL)
-	remove_cb_node(cb_head, cb_head->cq_next);
+    {
+	cbq_T *node = cb_head->cq_next;
+
+	remove_cb_node(cb_head, node);
+	vim_free(node->cq_callback);
+	vim_free(node);
+    }
 
     while (json_head->jq_next != NULL)
     {
diff --git a/src/testdir/test_channel.vim b/src/testdir/test_channel.vim
index 7cc3f14..b6c9860 100644
--- a/src/testdir/test_channel.vim
+++ b/src/testdir/test_channel.vim
@@ -301,6 +301,8 @@
   endtry
 endfunc
 
+""""""""""
+
 let s:unletResponse = ''
 func s:UnletHandler(handle, msg)
   let s:unletResponse = a:msg
@@ -319,6 +321,28 @@
   call s:run_server('s:unlet_handle')
 endfunc
 
+""""""""""
+
+let s:unletResponse = ''
+func s:CloseHandler(handle, msg)
+  let s:unletResponse = a:msg
+  call ch_close(s:channelfd)
+endfunc
+
+" Test that "unlet handle" in a handler doesn't crash Vim.
+func s:close_handle(port)
+  let s:channelfd = ch_open('localhost:' . a:port, s:chopt)
+  call ch_sendexpr(s:channelfd, "test", function('s:CloseHandler'))
+  sleep 10m
+  call assert_equal('what?', s:unletResponse)
+endfunc
+
+func Test_close_handle()
+  call s:run_server('s:close_handle')
+endfunc
+
+""""""""""
+
 func Test_open_fail()
   silent! let ch = ch_open("noserver")
   echo ch
diff --git a/src/version.c b/src/version.c
index 93d381f..688d2c5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,6 +748,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1331,
+/**/
     1330,
 /**/
     1329,