vim-patch:7.4.2006

Problem:    Crash when using tabnext in BufUnload autocmd. (Norio Takagi)
Solution:   First check that the current buffer is the right one. (Hirohito
            Higashi)

https://github.com/vim/vim/commit/30445cb6e94698d212ba866ef3e4022ac625540a

3 files changed, 29 insertions, 9 deletions

diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index d9fdc80c60..fa41f0f382 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -406,9 +406,6 @@ void close_buffer(win_T *win, buf_T *buf, int action, int abort_if_last)
   buf->b_nwindows = nwindows;
 
   buf_freeall(buf, (del_buf ? BFA_DEL : 0) + (wipe_buf ? BFA_WIPE : 0));
-  if (win_valid_any_tab(win) && win->w_buffer == buf) {
-    win->w_buffer = NULL;  // make sure we don't use the buffer now
-  }
 
   /* Autocommands may have deleted the buffer. */
   if (!buf_valid(buf))
@@ -416,11 +413,6 @@ void close_buffer(win_T *win, buf_T *buf, int action, int abort_if_last)
   if (aborting())           /* autocmds may abort script processing */
     return;
 
-  /* Autocommands may have opened or closed windows for this buffer.
-   * Decrement the count for the close we do here. */
-  if (buf->b_nwindows > 0)
-    --buf->b_nwindows;
-
   /*
    * It's possible that autocommands change curbuf to the one being deleted.
    * This might cause the previous curbuf to be deleted unexpectedly.  But
@@ -431,6 +423,16 @@ void close_buffer(win_T *win, buf_T *buf, int action, int abort_if_last)
   if (buf == curbuf && !is_curbuf)
     return;
 
+  if (win_valid_any_tab(win) && win->w_buffer == buf) {
+    win->w_buffer = NULL;  // make sure we don't use the buffer now
+  }
+
+  // Autocommands may have opened or closed windows for this buffer.
+  // Decrement the count for the close we do here.
+  if (buf->b_nwindows > 0) {
+    buf->b_nwindows--;
+  }
+
   /* Change directories when the 'acd' option is set. */
   do_autochdir();
 
diff --git a/src/nvim/testdir/test_autocmd.vim b/src/nvim/testdir/test_autocmd.vim
index 5675697dc4..8ead589871 100644
--- a/src/nvim/testdir/test_autocmd.vim
+++ b/src/nvim/testdir/test_autocmd.vim
@@ -64,6 +64,24 @@ function Test_bufunload()
   augroup! test_bufunload_group
 endfunc
 
+" SEGV occurs in older versions.  (At least 7.4.2005 or older)
+function Test_autocmd_bufunload_with_tabnext()
+  tabedit
+  tabfirst
+
+  augroup test_autocmd_bufunload_with_tabnext_group
+    autocmd!
+    autocmd BufUnload <buffer> tabnext
+  augroup END
+
+  quit
+  call assert_equal(2, tabpagenr('$'))
+
+  augroup! test_autocmd_bufunload_with_tabnext_group
+  tablast
+  quit
+endfunc
+
 func s:AddAnAutocmd()
   augroup vimBarTest
     au BufReadCmd * echo 'hello'
diff --git a/src/nvim/version.c b/src/nvim/version.c
index 19062be730..f644b9f39b 100644
--- a/src/nvim/version.c
+++ b/src/nvim/version.c
@@ -434,7 +434,7 @@ static int included_patches[] = {
   // 2009,
   // 2008,
   2007,
-  // 2006,
+  2006,
   2005,
   // 2004 NA
   // 2003 NA