patch 9.2.0167: terminal: setting buftype=terminal may cause a crash

Problem:  setting buftype=terminal may cause a crash
          (lacygoill, after v9.2.0127)
Solution: Validate that curwin->w_buffer->b_term is not null

fixes:  #19686
closes: #19676

Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/eval.c b/src/eval.c
index 42719d9e57ad1640af43d2cefdbe791a2aa1b189..7168b19dee02640ac852e7026aff82c8c7071b53 100644 (file)
--- a/src/eval.c
+++ b/src/eval.c
@@ -6984,7 +6984,7 @@ var2fpos(
        if (name[1] == '0')             // "w0": first visible line
        {
 #ifdef FEAT_TERMINAL
-           if (bt_terminal(curwin->w_buffer))
+           if (bt_terminal(curwin->w_buffer) && curwin->w_buffer->b_term != NULL)
                may_move_terminal_to_buffer(curwin->w_buffer->b_term, TRUE);
 #endif
            update_topline();
@@ -6996,7 +6996,7 @@ var2fpos(
        else if (name[1] == '$')        // "w$": last visible line
        {
 #ifdef FEAT_TERMINAL
-           if (bt_terminal(curwin->w_buffer))
+           if (bt_terminal(curwin->w_buffer) && curwin->w_buffer->b_term != NULL)
                may_move_terminal_to_buffer(curwin->w_buffer->b_term, TRUE);
 #endif
            validate_botline();

diff --git a/src/testdir/test_terminal3.vim b/src/testdir/test_terminal3.vim
index 8046f14a5c84f173b9537363a31d44aaded7a76b..c8825917e935e02adc05bcc8ed8327d924af7173 100644 (file)
--- a/src/testdir/test_terminal3.vim
+++ b/src/testdir/test_terminal3.vim
@@ -1203,6 +1203,11 @@ func Test_term_getpos()
   call assert_true(str2nr(result[0]) > 1)
 
   call StopVimInTerminal(buf)
+  " this crashed
+  new
+  setl buftype=terminal
+  call assert_equal(2, line('w0') + line('w$'))
+  bw
 endfunc
 
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index ddf2d64bdb600af1a3a437e8bffbcbae8f1d3f56..74d4b6cd449652a91c01553db61f375a194b616c 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    167,
 /**/
     166,
 /**/