vim-patch:8.0.0607 (#6879)

Problem:    When creating a bufref, then using :bwipe and :new it might get
            the same memory and bufref_valid() returns true.
Solution:   Add br_fnum to check the buffer number didn't change.

https://github.com/vim/vim/commit/45e5fd135da5710f24a1acc142692f120f8b0b78

7 files changed, 22 insertions, 21 deletions

diff --git a/src/nvim/api/buffer.c b/src/nvim/api/buffer.c
index 5c2e968864..94554bc4c1 100644
--- a/src/nvim/api/buffer.c
+++ b/src/nvim/api/buffer.c
@@ -330,7 +330,7 @@ void nvim_buf_set_lines(uint64_t channel_id,
   }
 
   try_start();
-  bufref_T save_curbuf = { NULL, 0 };
+  bufref_T save_curbuf = { NULL, 0, 0 };
   switch_to_win_for_buf(buf, &save_curwin, &save_curtab, &save_curbuf);
 
   if (u_save((linenr_T)(start - 1), (linenr_T)end) == FAIL) {
diff --git a/src/nvim/api/private/helpers.c b/src/nvim/api/private/helpers.c
index ef789b3ed4..d401ae52a0 100644
--- a/src/nvim/api/private/helpers.c
+++ b/src/nvim/api/private/helpers.c
@@ -961,7 +961,7 @@ static void set_option_value_for(char *key,
 {
   win_T *save_curwin = NULL;
   tabpage_T *save_curtab = NULL;
-  bufref_T save_curbuf =  { NULL, 0 };
+  bufref_T save_curbuf =  { NULL, 0, 0 };
 
   try_start();
   switch (opt_type)
diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index 6abd505ead..0d7df7ef77 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -281,19 +281,22 @@ open_buffer (
 void set_bufref(bufref_T *bufref, buf_T *buf)
 {
   bufref->br_buf = buf;
+  bufref->br_fnum = buf->b_fnum;
   bufref->br_buf_free_count = buf_free_count;
 }
 
-/// Check if "bufref" points to a valid buffer.
-///
+/// Return true if "bufref->br_buf" points to the same buffer as when
+/// set_bufref() was called and it is a valid buffer.
 /// Only goes through the buffer list if buf_free_count changed.
+/// Also checks if b_fnum is still the same, a :bwipe followed by :new might get
+/// the same allocated memory, but it's a different buffer.
 ///
 /// @param bufref Buffer reference to check for.
 bool bufref_valid(bufref_T *bufref)
 {
   return bufref->br_buf_free_count == buf_free_count
     ? true
-    : buf_valid(bufref->br_buf);
+    : buf_valid(bufref->br_buf) && bufref->br_fnum == bufref->br_buf->b_fnum;
 }
 
 /// Check that "buf" points to a valid buffer in the buffer list.
@@ -1753,16 +1756,15 @@ void free_buf_options(buf_T *buf, int free_p_ff)
   clear_string_option(&buf->b_p_bkc);
 }
 
-/*
- * get alternate file n
- * set linenr to lnum or altfpos.lnum if lnum == 0
- *	also set cursor column to altfpos.col if 'startofline' is not set.
- * if (options & GETF_SETMARK) call setpcmark()
- * if (options & GETF_ALT) we are jumping to an alternate file.
- * if (options & GETF_SWITCH) respect 'switchbuf' settings when jumping
- *
- * return FAIL for failure, OK for success
- */
+
+/// Get alternate file "n".
+/// Set linenr to "lnum" or altfpos.lnum if "lnum" == 0.
+/// Also set cursor column to altfpos.col if 'startofline' is not set.
+/// if (options & GETF_SETMARK) call setpcmark()
+/// if (options & GETF_ALT) we are jumping to an alternate file.
+/// if (options & GETF_SWITCH) respect 'switchbuf' settings when jumping
+///
+/// Return FAIL for failure, OK for success.
 int buflist_getfile(int n, linenr_T lnum, int options, int forceit)
 {
   buf_T       *buf;
diff --git a/src/nvim/buffer.h b/src/nvim/buffer.h
index 609567fbcd..faeeed121c 100644
--- a/src/nvim/buffer.h
+++ b/src/nvim/buffer.h
@@ -115,7 +115,7 @@ static inline void buf_set_changedtick(buf_T *const buf,
   do { \
     win_T *save_curwin = NULL; \
     tabpage_T *save_curtab = NULL; \
-    bufref_T save_curbuf = { NULL, 0 }; \
+    bufref_T save_curbuf = { NULL, 0, 0 }; \
     switch_to_win_for_buf(b, &save_curwin, &save_curtab, &save_curbuf); \
     code; \
     restore_win_for_buf(save_curwin, save_curtab, &save_curbuf); \
diff --git a/src/nvim/buffer_defs.h b/src/nvim/buffer_defs.h
index d96b9355f1..c065ce60f1 100644
--- a/src/nvim/buffer_defs.h
+++ b/src/nvim/buffer_defs.h
@@ -12,6 +12,7 @@ typedef struct file_buffer buf_T; // Forward declaration
 // bufref_valid() only needs to check "buf" when the count differs.
 typedef struct {
   buf_T *br_buf;
+  int    br_fnum;
   int    br_buf_free_count;
 } bufref_T;
 
diff --git a/src/nvim/globals.h b/src/nvim/globals.h
index 785c9fade9..0e84900d48 100644
--- a/src/nvim/globals.h
+++ b/src/nvim/globals.h
@@ -568,7 +568,7 @@ EXTERN int keep_filetype INIT(= FALSE);         /* value for did_filetype when
 
 // When deleting the current buffer, another one must be loaded.
 // If we know which one is preferred, au_new_curbuf is set to it.
-EXTERN bufref_T au_new_curbuf INIT(= { NULL, 0 });
+EXTERN bufref_T au_new_curbuf INIT(= { NULL, 0, 0 });
 
 // When deleting a buffer/window and autocmd_busy is TRUE, do not free the
 // buffer/window. but link it in the list starting with
diff --git a/src/nvim/quickfix.c b/src/nvim/quickfix.c
index b6878cbbf4..bd5dfa92cc 100644
--- a/src/nvim/quickfix.c
+++ b/src/nvim/quickfix.c
@@ -191,7 +191,7 @@ typedef struct {
 // Looking up a buffer can be slow if there are many.  Remember the last one
 // to make this a lot faster if there are multiple matches in the same file.
 static char_u *qf_last_bufname = NULL;
-static bufref_T  qf_last_bufref = { NULL, 0 };
+static bufref_T  qf_last_bufref = { NULL, 0, 0 };
 
 /*
  * Read the errorfile "efile" into memory, line by line, building the error
@@ -2330,9 +2330,7 @@ void qf_history(exarg_T *eap)
   }
 }
 
-/*
- * Free error list "idx".
- */
+/// Free all the entries in the error list "idx".
 static void qf_free(qf_info_T *qi, int idx)
 {
   qfline_T    *qfp;