[patch] crash on buffer close

[Christian Brabandt]

Hi Bram,
consider this script:

#v+
~$ cat vim_crash_buffer.vim
sp +enew
set bufhidden=wipe
autocmd BufWinLeave <buffer> wincmd p
1b!
~$ vim -u NONE -U NONE -N -i NONE  -c 'so vim_crash_buffer.vim'
Vim: Caught deadly signal SEGV
~$
#v-

This is a rather silly example, but the NrrwRgn plugin accidentally did 
this and so crashed Vim.

Because it crashed my precious Vim session I was pretty sad and so I 
wrote a patch killing this vicious bug. ;)

regards,
Christian

-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

diff --git a/src/buffer.c b/src/buffer.c
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -1365,6 +1365,7 @@
     buf_T      *prevbuf;
     int                unload = (action == DOBUF_UNLOAD || action == DOBUF_DEL
                                                     || action == DOBUF_WIPE);
+    win_T       *prev_win;
 
     setpcmark();
     if (!cmdmod.keepalt)
@@ -1402,22 +1403,32 @@
        if (buf_valid(prevbuf))
 #endif
        {
+           prev_win = curwin;
            if (prevbuf == curbuf)
                u_sync(FALSE);
            close_buffer(prevbuf == curwin->w_buffer ? curwin : NULL, prevbuf,
                    unload ? action : (action == DOBUF_GOTO
                        && !P_HID(prevbuf)
                        && !bufIsChanged(prevbuf)) ? DOBUF_UNLOAD : 0, FALSE);
+           if (curwin !=  prev_win && win_valid(prev_win))
+             /* autocommands changed curwin, Grr! */
+             curwin = prev_win;
        }
     }
 #ifdef FEAT_AUTOCMD
     /* An autocommand may have deleted "buf", already entered it (e.g., when
      * it did ":bunload") or aborted the script processing! */
-# ifdef FEAT_EVAL
-    if (buf_valid(buf) && buf != curbuf && !aborting())
-# else
-    if (buf_valid(buf) && buf != curbuf)
-# endif
+    if ((buf_valid(buf) && buf != curbuf
+#ifdef FEAT_EVAL
+           && !aborting()
+#endif
+#ifdef FEAT_WINDOWS
+       ) || curwin->w_buffer == NUL
+
+    /* if curwin->w_buffer is null,
+     * enter_buffer() will make it valid again */
+#endif
+       )
 #endif
        enter_buffer(buf);
 }