patch 7.4.1331

Problem:    Crash when closing the channel in a callback. (Christian J.
            Robinson)
Solution:   Take the callback out of the list before invoking it.

diff --git a/src/channel.c b/src/channel.c
index 10d94242541aa3aa77127942d3a89a6d03303301..28fee0ac91465f315dd4e7c2cd16f053a2ec8b95 100644 (file)
--- a/src/channel.c
+++ b/src/channel.c
@@ -888,8 +888,7 @@ channel_parse_json(channel_T *channel)
 }
 
 /*
- * Remove "node" from the queue that it is in and free it.
- * Also frees the contained callback name.
+ * Remove "node" from the queue that it is in.  Does not free it.
  */
     static void
 remove_cb_node(cbq_T *head, cbq_T *node)
@@ -902,8 +901,6 @@ remove_cb_node(cbq_T *head, cbq_T *node)
        head->cq_prev = node->cq_prev;
     else
        node->cq_next->cq_prev = node->cq_prev;
-    vim_free(node->cq_callback);
-    vim_free(node);
 }
 
 /*
@@ -1144,8 +1141,12 @@ may_invoke_callback(channel_T *channel)
            if (item->cq_seq_nr == seq_nr)
            {
                ch_log(channel, "Invoking one-time callback\n");
-               invoke_callback(channel, item->cq_callback, argv);
+               /* Remove the item from the list first, if the callback
+                * invokes ch_close() the list will be cleared. */
                remove_cb_node(head, item);
+               invoke_callback(channel, item->cq_callback, argv);
+               vim_free(item->cq_callback);
+               vim_free(item);
                done = TRUE;
                break;
            }
@@ -1329,7 +1330,13 @@ channel_clear(channel_T *channel)
        vim_free(channel_get(channel));
 
     while (cb_head->cq_next != NULL)
-       remove_cb_node(cb_head, cb_head->cq_next);
+    {
+       cbq_T *node = cb_head->cq_next;
+
+       remove_cb_node(cb_head, node);
+       vim_free(node->cq_callback);
+       vim_free(node);
+    }
 
     while (json_head->jq_next != NULL)
     {

diff --git a/src/testdir/test_channel.vim b/src/testdir/test_channel.vim
index 7cc3f146f699bcc67a0375d88218838fc45fb8f2..b6c986006ffec0e1d30febdb5ef55ae65cade1d0 100644 (file)
--- a/src/testdir/test_channel.vim
+++ b/src/testdir/test_channel.vim
@@ -301,6 +301,8 @@ func Test_pipe()
   endtry
 endfunc
 
+""""""""""
+
 let s:unletResponse = ''
 func s:UnletHandler(handle, msg)
   let s:unletResponse = a:msg
@@ -319,6 +321,28 @@ func Test_unlet_handle()
   call s:run_server('s:unlet_handle')
 endfunc
 
+""""""""""
+
+let s:unletResponse = ''
+func s:CloseHandler(handle, msg)
+  let s:unletResponse = a:msg
+  call ch_close(s:channelfd)
+endfunc
+
+" Test that "unlet handle" in a handler doesn't crash Vim.
+func s:close_handle(port)
+  let s:channelfd = ch_open('localhost:' . a:port, s:chopt)
+  call ch_sendexpr(s:channelfd, "test", function('s:CloseHandler'))
+  sleep 10m
+  call assert_equal('what?', s:unletResponse)
+endfunc
+
+func Test_close_handle()
+  call s:run_server('s:close_handle')
+endfunc
+
+""""""""""
+
 func Test_open_fail()
   silent! let ch = ch_open("noserver")
   echo ch

diff --git a/src/version.c b/src/version.c
index 93d381fca54307f819407339e7c4f79bc4153c05..688d2c5d008e551d7aee0461447b3c4430fbefae 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -747,6 +747,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1331,
 /**/
     1330,
 /**/