From: Christian Brabandt <cb@256bit.org>
Date: Fri, 28 Mar 2025 18:13:32 +0000 (+0100)
Subject: patch 9.1.1253: abort when closing window with attached quickfix data
X-Git-Tag: v9.1.1253^0
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ce80c59bfd3c0087a354ee549639ca60fa192fba;p=thirdparty%2Fvim.git

patch 9.1.1253: abort when closing window with attached quickfix data

Problem:  If win_close() is called with a window that has quickfix stack
          attached to it, the corresponding quickfix buffer will be
          closed and freed after the buffer was already closed. At that
          time curwin->w_buffer points to NULL, which the CHECK_CURBUF
          will catch and abort if ABORT_ON_ERROR is defined
Solution: in wipe_qf_buffer() temporarily point curwin->w_buffer back to
          curbuf, the window will be closed anyhow, so it shouldn't
          matter that curbuf->b_nwindows isn't incremented.

closes: #16993
closes: #16985

Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/quickfix.c b/src/quickfix.c
index 30353c5424..11bfa82241 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -2035,10 +2035,24 @@ wipe_qf_buffer(qf_info_T *qi)
     qfbuf = buflist_findnr(qi->qf_bufnr);
     if (qfbuf != NULL && qfbuf->b_nwindows == 0)
     {
+	int buf_was_null = FALSE;
+	// can happen when curwin is going to be closed e.g. curwin->w_buffer
+	// was already closed in win_close(), and we are now closing the
+	// window related location list buffer from win_free_mem()
+	// but close_buffer() calls CHECK_CURBUF() macro and requires
+	// curwin->w_buffer == curbuf
+	if (curwin->w_buffer == NULL)
+	{
+	    curwin->w_buffer = curbuf;
+	    buf_was_null = TRUE;
+	}
+
 	// If the quickfix buffer is not loaded in any window, then
 	// wipe the buffer.
 	close_buffer(NULL, qfbuf, DOBUF_WIPE, FALSE, FALSE);
 	qi->qf_bufnr = INVALID_QFBUFNR;
+	if (buf_was_null)
+	    curwin->w_buffer = NULL;
     }
 }
 
diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index c382e68379..03fbbee711 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -6718,4 +6718,12 @@ func Test_hardlink_fname()
   call Xtest_hardlink_fname('l')
 endfunc
 
+func Test_quickfix_close_buffer_crash()
+  new
+  lexpr 'test' | lopen
+  wincmd k
+  lclose
+  wincmd q
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index cceb83cd3b..d11c4acacf 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1253,
 /**/
     1252,
 /**/