memory: Free buffers after freeing variables

Avoids use-after-free crashes when compiling with -DEXITFREE.

1 files changed, 14 insertions, 12 deletions

diff --git a/src/nvim/memory.c b/src/nvim/memory.c
index 51e0dd926e..4861299956 100644
--- a/src/nvim/memory.c
+++ b/src/nvim/memory.c
@@ -625,18 +625,6 @@ void free_all_mem(void)
   /* Destroy all windows.  Must come before freeing buffers. */
   win_free_all();
 
-  /* Free all buffers.  Reset 'autochdir' to avoid accessing things that
-   * were freed already. */
-  p_acd = false;
-  for (buf = firstbuf; buf != NULL; ) {
-    bufref_T bufref;
-    set_bufref(&bufref, buf);
-    nextbuf = buf->b_next;
-    close_buffer(NULL, buf, DOBUF_WIPE, false);
-    // Didn't work, try next one.
-    buf = bufref_valid(&bufref) ? nextbuf : firstbuf;
-  }
-
   free_cmdline_buf();
 
   /* Clear registers. */
@@ -660,6 +648,20 @@ void free_all_mem(void)
 
   eval_clear();
 
+  // Free all buffers.  Reset 'autochdir' to avoid accessing things that
+  // were freed already.
+  // Must be after eval_clear to avoid it trying to access b:changedtick after 
+  // freeing it.
+  p_acd = false;
+  for (buf = firstbuf; buf != NULL; ) {
+    bufref_T bufref;
+    set_bufref(&bufref, buf);
+    nextbuf = buf->b_next;
+    close_buffer(NULL, buf, DOBUF_WIPE, false);
+    // Didn't work, try next one.
+    buf = bufref_valid(&bufref) ? nextbuf : firstbuf;
+  }
+
   /* screenlines (can't display anything now!) */
   free_screenlines();