From c067efa696698d455d9a1488c26e0fb5d8cb5bf5 Mon Sep 17 00:00:00 2001
From: Jan Edmund Lazo <jan.lazo@mail.utoronto.ca>
Date: Sun, 20 Oct 2019 20:12:08 -0400
Subject: vim-patch:8.1.2197: ExitPre autocommand may cause accessing freed
 memory

Problem:    ExitPre autocommand may cause accessing freed memory.
Solution:   Check the window pointer is still valid. (closes vim/vim#5093)
https://github.com/vim/vim/commit/34ba06b6e6f94bb46062e6c85dbfdcbb0d255ada
---
 src/nvim/ex_docmd.c            |  8 +++++---
 src/nvim/testdir/test_exit.vim | 22 ++++++++++++++++++++++
 2 files changed, 27 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c
index 0da2cd67d6..ae3fb4fbfb 100644
--- a/src/nvim/ex_docmd.c
+++ b/src/nvim/ex_docmd.c
@@ -6070,9 +6070,11 @@ static bool before_quit_autocmds(win_T *wp, bool quit_all, int forceit)
   if (quit_all
       || (check_more(false, forceit) == OK && only_one_window())) {
     apply_autocmds(EVENT_EXITPRE, NULL, NULL, false, curbuf);
-    // Refuse to quit when locked or when the buffer in the last window is
-    // being closed (can only happen in autocommands).
-    if (curbuf_locked()
+    // Refuse to quit when locked or when the window was closed or the
+    // buffer in the last window is being closed (can only happen in
+    // autocommands).
+    if (!win_valid(wp)
+        || curbuf_locked()
         || (curbuf->b_nwindows == 1 && curbuf->b_locked > 0)) {
       return true;
     }
diff --git a/src/nvim/testdir/test_exit.vim b/src/nvim/testdir/test_exit.vim
index 3797626abf..99a401d4a4 100644
--- a/src/nvim/testdir/test_exit.vim
+++ b/src/nvim/testdir/test_exit.vim
@@ -40,6 +40,7 @@ func Test_exiting()
   endif
   call delete('Xtestout')
 
+  " ExitPre autocommand splits the window, so that it's no longer the last one.
   let after =<< trim [CODE]
     au QuitPre * call writefile(["QuitPre"], "Xtestout", "a")
     au ExitPre * call writefile(["ExitPre"], "Xtestout", "a")
@@ -58,4 +59,25 @@ func Test_exiting()
 	  \ readfile('Xtestout'))
   endif
   call delete('Xtestout')
+
+  " ExitPre autocommand splits and closes the window, so that there is still
+  " one window but it's a different one.
+  let after =<< trim [CODE]
+    au QuitPre * call writefile(["QuitPre"], "Xtestout", "a")
+    au ExitPre * call writefile(["ExitPre"], "Xtestout", "a")
+    augroup nasty
+      au ExitPre * split | only
+    augroup END
+    quit
+    augroup nasty
+      au! ExitPre
+    augroup END
+    quit
+  [CODE]
+
+  if RunVim([], after, '')
+    call assert_equal(['QuitPre', 'ExitPre', 'QuitPre', 'ExitPre'],
+	  \ readfile('Xtestout'))
+  endif
+  call delete('Xtestout')
 endfunc
-- 
cgit