patch 8.1.0652: freeing memory for balloon eval too early

Problem:    Freeing memory for balloon eval too early.
Solution:   Store the pointer in BalloonEval and free it later. (Yasuhiro
            Matsumoto, closes #3725)

diff --git a/src/beval.h b/src/beval.h
index 49ba05b2ecff6f7ed10c52036ae7ad7f9d842539..21900c5ad4e8d4cbf1f8fb72ba638344eafcc499 100644 (file)
--- a/src/beval.h
+++ b/src/beval.h
@@ -76,6 +76,9 @@ typedef struct BalloonEvalStruct
     int                        *vts;           // vartabstop setting for this buffer
 #endif
     char_u             *msg;
+#ifdef FEAT_GUI_W32
+    void               *tofree;
+#endif
 } BalloonEval;
 
 #define EVAL_OFFSET_X 15 /* displacement of beval topleft corner from pointer */

diff --git a/src/gui_w32.c b/src/gui_w32.c
index c919243161751bb8e8ddc4e8bae61a2c96b99d76..ad10e97644e2bd6e8614cb35cb116193eb94335d 100644 (file)
--- a/src/gui_w32.c
+++ b/src/gui_w32.c
@@ -8787,7 +8787,6 @@ make_tooltipw(BalloonEval *beval, char *text, POINT pt)
 {
     TOOLINFOW  *pti;
     int                ToolInfoSize;
-    WCHAR      *tofree = NULL;
 
     if (multiline_balloon_available() == TRUE)
        ToolInfoSize = sizeof(TOOLINFOW_NEW);
@@ -8817,8 +8816,8 @@ make_tooltipw(BalloonEval *beval, char *text, POINT pt)
        RECT rect;
        TOOLINFOW_NEW *ptin = (TOOLINFOW_NEW *)pti;
        pti->lpszText = LPSTR_TEXTCALLBACKW;
-       tofree = enc_to_utf16((char_u*)text, NULL);
-       ptin->lParam = (LPARAM)tofree;
+       beval->tofree = enc_to_utf16((char_u*)text, NULL);
+       ptin->lParam = (LPARAM)beval->tofree;
        // switch multiline tooltips on
        if (GetClientRect(s_textArea, &rect))
            SendMessageW(beval->balloon, TTM_SETMAXTIPWIDTH, 0,
@@ -8827,8 +8826,8 @@ make_tooltipw(BalloonEval *beval, char *text, POINT pt)
     else
     {
        // do this old way
-       tofree = enc_to_utf16((char_u*)text, NULL);
-       pti->lpszText = tofree;
+       beval->tofree = enc_to_utf16((char_u*)text, NULL);
+       pti->lpszText = (LPWSTR)beval->tofree;
     }
 
     // Limit ballooneval bounding rect to CursorPos neighbourhood.
@@ -8851,8 +8850,6 @@ make_tooltipw(BalloonEval *beval, char *text, POINT pt)
     mouse_event(MOUSEEVENTF_MOVE, 2, 2, 0, 0);
     mouse_event(MOUSEEVENTF_MOVE, (DWORD)-1, (DWORD)-1, 0, 0);
     vim_free(pti);
-    if (tofree != NULL)
-       vim_free(tofree);
 }
 #endif
 
@@ -8898,7 +8895,8 @@ make_tooltip(BalloonEval *beval, char *text, POINT pt)
        RECT rect;
        TOOLINFO_NEW *ptin = (TOOLINFO_NEW *)pti;
        pti->lpszText = LPSTR_TEXTCALLBACK;
-       ptin->lParam = (LPARAM)text;
+       beval->tofree = vim_strsave((char_u*)text);
+       ptin->lParam = (LPARAM)beval->tofree;
        if (GetClientRect(s_textArea, &rect)) /* switch multiline tooltips on */
            SendMessage(beval->balloon, TTM_SETMAXTIPWIDTH, 0,
                    (LPARAM)rect.right);
@@ -9106,9 +9104,9 @@ TrackUserActivity(UINT uMsg)
 gui_mch_destroy_beval_area(BalloonEval *beval)
 {
 #ifdef FEAT_VARTABS
-    if (beval->vts)
-       vim_free(beval->vts);
+    vim_free(beval->vts);
 #endif
+    vim_free(beval->tofree);
     vim_free(beval);
 }
 #endif /* FEAT_BEVAL_GUI */

diff --git a/src/version.c b/src/version.c
index 3082c0d12ef86b4d24af09e565cbf4536defe5b6..1579dec60d3288b1854459ba976a9ec27434f951 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -799,6 +799,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    652,
 /**/
     651,
 /**/