neovim

commit 36d143e70722848855107ff05ab3997857b0c388
parent 8af9f8ab5ecd59df52aed9019e8ecc9f8101ee7d
Author: zeertzjq <zeertzjq@outlook.com>
Date:   Tue,  8 Apr 2025 11:09:56 +0800

vim-patch:9.1.1253: abort when closing window with attached quickfix data

Problem:  If win_close() is called with a window that has quickfix stack
          attached to it, the corresponding quickfix buffer will be
          closed and freed after the buffer was already closed. At that
          time curwin->w_buffer points to NULL, which the CHECK_CURBUF
          will catch and abort if ABORT_ON_ERROR is defined
Solution: in wipe_qf_buffer() temporarily point curwin->w_buffer back to
          curbuf, the window will be closed anyhow, so it shouldn't
          matter that curbuf->b_nwindows isn't incremented.

closes: vim/vim#16993
closes: vim/vim#16985

https://github.com/vim/vim/commit/ce80c59bfd3c0087a354ee549639ca60fa192fba

Co-authored-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>

Diffstat:
M
src/nvim/quickfix.c
 | 
14
++++++++++++++
M
test/old/testdir/test_quickfix.vim
 | 
8
++++++++

2 files changed, 22 insertions(+), 0 deletions(-)
diff --git a/src/nvim/quickfix.c b/src/nvim/quickfix.c
@@ -1745,10 +1745,24 @@ static void wipe_qf_buffer(qf_info_T *qi)
 
   buf_T *const qfbuf = buflist_findnr(qi->qf_bufnr);
   if (qfbuf != NULL && qfbuf->b_nwindows == 0) {
+    bool buf_was_null = false;
+    // can happen when curwin is going to be closed e.g. curwin->w_buffer
+    // was already closed in win_close(), and we are now closing the
+    // window related location list buffer from win_free_mem()
+    // but close_buffer() calls CHECK_CURBUF() macro and requires
+    // curwin->w_buffer == curbuf
+    if (curwin->w_buffer == NULL) {
+      curwin->w_buffer = curbuf;
+      buf_was_null = true;
+    }
+
     // If the quickfix buffer is not loaded in any window, then
     // wipe the buffer.
     close_buffer(NULL, qfbuf, DOBUF_WIPE, false, false);
     qi->qf_bufnr = INVALID_QFBUFNR;
+    if (buf_was_null) {
+      curwin->w_buffer = NULL;
+    }
   }
 }
 
diff --git a/test/old/testdir/test_quickfix.vim b/test/old/testdir/test_quickfix.vim
@@ -6596,4 +6596,12 @@ func Test_hardlink_fname()
   call Xtest_hardlink_fname('l')
 endfunc
 
+func Test_quickfix_close_buffer_crash()
+  new
+  lexpr 'test' | lopen
+  wincmd k
+  lclose
+  wincmd q
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab