From 1c9d7270a85a185e3d0fabcc22344d1319012ef3 Mon Sep 17 00:00:00 2001
From: oni-link <knil.ino@gmail.com>
Date: Fri, 2 Sep 2016 01:51:23 +0200
Subject: eval.c: Garbage collection frees dictionary before job cleanup

Removing a job too early from the joblist gives garbage collection the
chance to also remove the job dictionary.

Can be triggered with ASAN while waiting 'updatetime'ms (~5 seconds)
before closing the terminal window opened with:

    nvim -u NONE +'call termopen("true",{})'
---
 src/nvim/eval.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/nvim/eval.c b/src/nvim/eval.c
index 211419f7a6..c373d3e8ef 100644
--- a/src/nvim/eval.c
+++ b/src/nvim/eval.c
@@ -21768,6 +21768,9 @@ static inline bool common_job_start(TerminalJobData *data, typval_T *rettv)
     return false;
   }
 
+  data->id = next_chan_id++;
+  pmap_put(uint64_t)(jobs, data->id, data);
+
   data->refcount++;
   char *cmd = xstrdup(proc->argv[0]);
   if (!process_spawn(proc)) {
@@ -21782,7 +21785,6 @@ static inline bool common_job_start(TerminalJobData *data, typval_T *rettv)
   }
   xfree(cmd);
 
-  data->id = next_chan_id++;
 
   if (data->rpc) {
     // the rpc channel takes over the in and out streams
@@ -21799,7 +21801,6 @@ static inline bool common_job_start(TerminalJobData *data, typval_T *rettv)
     rstream_init(proc->err, 0);
     rstream_start(proc->err, on_job_stderr, data);
   }
-  pmap_put(uint64_t)(jobs, data->id, data);
   rettv->vval.v_number = data->id;
   return true;
 }
@@ -21821,6 +21822,7 @@ static inline void free_term_job_data_event(void **argv)
     dict_unref(data->self);
   }
   queue_free(data->events);
+  pmap_del(uint64_t)(jobs, data->id);
   xfree(data);
 }
 
@@ -21927,7 +21929,6 @@ static void on_process_exit(Process *proc, int status, void *d)
 
   process_job_event(data, data->on_exit, "exit", NULL, 0, status);
 
-  pmap_del(uint64_t)(jobs, data->id);
   term_job_data_decref(data);
 }
 
-- 
cgit 


From f8a8a569081a8b8eadb74d040179dca9fb85af60 Mon Sep 17 00:00:00 2001
From: oni-link <knil.ino@gmail.com>
Date: Fri, 2 Sep 2016 01:57:49 +0200
Subject: eval.c: Fix memory leak for detached pty job

---
 src/nvim/eval.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'src')

diff --git a/src/nvim/eval.c b/src/nvim/eval.c
index c373d3e8ef..ce04739ee4 100644
--- a/src/nvim/eval.c
+++ b/src/nvim/eval.c
@@ -21765,6 +21765,9 @@ static inline bool common_job_start(TerminalJobData *data, typval_T *rettv)
   Process *proc = (Process *)&data->proc;
   if (proc->type == kProcessTypePty && proc->detach) {
     EMSG2(_(e_invarg2), "terminal/pty job cannot be detached");
+    xfree(data->proc.pty.term_name);
+    shell_free_argv(proc->argv);
+    free_term_job_data_event((void **)&data);
     return false;
   }
 
-- 
cgit