commit d58862d18f091d3c14fa3647e724ef7eea1ecefa
author zeertzjq <zeertzjq@outlook.com> Tue Apr 12 11:32:48 2022 +0100
committer Bram Moolenaar <Bram@vim.org> Tue Apr 12 11:32:48 2022 +0100
tree 0f40cd55732b3a0f0f14ae4e935e5ed93b83b9d8
parent 11a57dfd16a47f248fe949344bd5db3f12b9bd32

patch 8.2.4739: accessing freed memory after WinScrolled autocmd event

Problem:    Accessing freed memory after WinScrolled autocmd event.
Solution:   Check the window pointer is still valid. (closes #10156)
            Remove the argument from may_trigger_winscrolled().

src/edit.c

diff --git a/src/edit.c b/src/edit.c
index fad2a7b..c28c1f9 100644
--- a/src/edit.c
+++ b/src/edit.c
@@ -1528,7 +1528,7 @@
     }
 
     if (ready)
-	may_trigger_winscrolled(curwin);
+	may_trigger_winscrolled();
 
     // Trigger SafeState if nothing is pending.
     may_trigger_safestate(ready

src/gui.c

diff --git a/src/gui.c b/src/gui.c
index 23694d1..f2f541e 100644
--- a/src/gui.c
+++ b/src/gui.c
@@ -5238,7 +5238,7 @@
     }
 
     if (!finish_op)
-	may_trigger_winscrolled(curwin);
+	may_trigger_winscrolled();
 
 # ifdef FEAT_CONCEAL
     if (conceal_update_lines

src/main.c

diff --git a/src/main.c b/src/main.c
index fe3571b..036ab0a 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1342,7 +1342,7 @@
 	    validate_cursor();
 
 	    if (!finish_op)
-		may_trigger_winscrolled(curwin);
+		may_trigger_winscrolled();
 
 	    // If nothing is pending and we are going to wait for the user to
 	    // type a character, trigger SafeState.

src/proto/window.pro

diff --git a/src/proto/window.pro b/src/proto/window.pro
index 589dd09..9625942 100644
--- a/src/proto/window.pro
+++ b/src/proto/window.pro
@@ -17,7 +17,7 @@
 void close_windows(buf_T *buf, int keep_curwin);
 int one_window(void);
 int win_close(win_T *win, int free_buf);
-void may_trigger_winscrolled(win_T *wp);
+void may_trigger_winscrolled(void);
 void win_close_othertab(win_T *win, int free_buf, tabpage_T *tp);
 void win_free_all(void);
 win_T *winframe_remove(win_T *win, int *dirp, tabpage_T *tp);

src/testdir/test_autocmd.vim

diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index 9af79d8..724d073 100644
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
Binary files differ

src/version.c

diff --git a/src/version.c b/src/version.c
index 27de4e5..84c669b 100644
--- a/src/version.c
+++ b/src/version.c
@@ -747,6 +747,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    4739,
+/**/
     4738,
 /**/
     4737,

src/window.c

diff --git a/src/window.c b/src/window.c
index 1eab3dc..c9526a1 100644
--- a/src/window.c
+++ b/src/window.c
@@ -2784,9 +2784,13 @@
     recursive = FALSE;
 }
 
+/*
+ * Trigger WinScrolled for "curwin" if needed.
+ */
     void
-may_trigger_winscrolled(win_T *wp)
+may_trigger_winscrolled(void)
 {
+    win_T	    *wp = curwin;
     static int	    recursive = FALSE;
     char_u	    winid[NUMBUFLEN];
 
@@ -2804,10 +2808,14 @@
 	apply_autocmds(EVENT_WINSCROLLED, winid, winid, FALSE, wp->w_buffer);
 	recursive = FALSE;
 
-	wp->w_last_topline = wp->w_topline;
-	wp->w_last_leftcol = wp->w_leftcol;
-	wp->w_last_width = wp->w_width;
-	wp->w_last_height = wp->w_height;
+	// an autocmd may close the window, "wp" may be invalid now
+	if (win_valid_any_tab(wp))
+	{
+	    wp->w_last_topline = wp->w_topline;
+	    wp->w_last_leftcol = wp->w_leftcol;
+	    wp->w_last_width = wp->w_width;
+	    wp->w_last_height = wp->w_height;
+	}
     }
 }