neovim

commit de950f827236e2c7447bd776c2509faa39c27b63
parent 17da1ad8f44fe6b02969233b142d5bb2da98dd85
Author: luukvbaal <luukvbaal@gmail.com>
Date:   Thu,  4 Sep 2025 01:28:23 +0200

fix(window): avoid referencing cmdline_win after it is closed #35617

Solution:  A window marked for ext_cmdline usage is still referenced
           after it is already closed and freed.
Solution:  Unset cmdline_win when the window is closed.
Diffstat:
M
src/nvim/window.c
 | 
4
++++
M
test/functional/lua/ui_event_spec.lua
 | 
7
+++++++

2 files changed, 11 insertions(+), 0 deletions(-)
diff --git a/src/nvim/window.c b/src/nvim/window.c
@@ -3138,6 +3138,10 @@ static win_T *win_free_mem(win_T *win, int *dirp, tabpage_T *tp)
   if (win == win_tp->tp_curwin) {
     win_tp->tp_curwin = wp;
   }
+  // Avoid executing cmdline_win logic after it is closed.
+  if (win == cmdline_win) {
+    cmdline_win = NULL;
+  }
 
   return wp;
 }
diff --git a/test/functional/lua/ui_event_spec.lua b/test/functional/lua/ui_event_spec.lua
@@ -390,6 +390,13 @@ describe('vim.ui_attach', function()
       9              bufname(        {12: }        |
       Excommand:call bufadd^(                  |
     ]])
+    -- No crash after _cmdline_offset window is closed #35584.
+    exec_lua(function()
+      vim.ui_detach(_G.ns)
+      vim.api.nvim_win_close(_G.win, true)
+    end)
+    feed('<Esc>:<Tab>')
+    n.assert_alive()
   end)
 end)