vim-patch:8.0.1402: crash with nasty autocommand

Problem:    Crash with nasty autocommand. (gy741, Dominique Pelle)
Solution:   Check that the new current buffer isn't wiped out. (closes vim/vim#2447)

https://github.com/vim/vim/commit/9bca805ec49eb0d2d0d0b2093f418ff425500169

1 files changed, 10 insertions, 5 deletions

diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index a86a908492..8d0738dd29 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -1387,20 +1387,25 @@ void set_curbuf(buf_T *buf, int action)
   /* Don't restart Select mode after switching to another buffer. */
   VIsual_reselect = FALSE;
 
-  /* close_windows() or apply_autocmds() may change curbuf */
+  // close_windows() or apply_autocmds() may change curbuf and wipe out "buf"
   prevbuf = curbuf;
-  bufref_T bufref;
-  set_bufref(&bufref, prevbuf);
+  bufref_T newbufref;
+  bufref_T prevbufref;
+  set_bufref(&prevbufref, prevbuf);
+  set_bufref(&newbufref, buf);
 
+  // Autocommands may delete the curren buffer and/or the buffer we wan to go
+  // to.  In those cases don't close the buffer.
   if (!apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, false, curbuf)
-      || (bufref_valid(&bufref) && !aborting())) {
+      || (bufref_valid(&prevbufref) && bufref_valid(&newbufref)
+          && !aborting())) {
     if (prevbuf == curwin->w_buffer) {
       reset_synblock(curwin);
     }
     if (unload) {
       close_windows(prevbuf, false);
     }
-    if (bufref_valid(&bufref) && !aborting()) {
+    if (bufref_valid(&prevbufref) && !aborting()) {
       win_T  *previouswin = curwin;
       if (prevbuf == curbuf)
         u_sync(FALSE);