patch 8.1.2197: ExitPre autocommand may cause accessing freed memory

Problem:    ExitPre autocommand may cause accessing freed memory.
Solution:   Check the window pointer is still valid. (closes #5093)

Author: brammool

src/ex_docmd.c

@@ -4817,9 +4817,9 @@ before_quit_autocmds(win_T *wp, int quit_all, int forceit)
 {
     apply_autocmds(EVENT_QUITPRE, NULL, NULL, FALSE, wp->w_buffer);
 
-    /* Bail out when autocommands closed the window.
-     * Refuse to quit when the buffer in the last window is being closed (can
-     * only happen in autocommands). */
+    // Bail out when autocommands closed the window.
+    // Refuse to quit when the buffer in the last window is being closed (can
+    // only happen in autocommands).
     if (!win_valid(wp)
 	    || curbuf_locked()
 	    || (wp->w_buffer->b_nwindows == 1 && wp->w_buffer->b_locked > 0))
@@ -4828,9 +4828,10 @@ before_quit_autocmds(win_T *wp, int quit_all, int forceit)
     if (quit_all || (check_more(FALSE, forceit) == OK && only_one_window()))
     {
 	apply_autocmds(EVENT_EXITPRE, NULL, NULL, FALSE, curbuf);
-	/* Refuse to quit when locked or when the buffer in the last window is
-	 * being closed (can only happen in autocommands). */
-	if (curbuf_locked()
+	// Refuse to quit when locked or when the window was closed or the
+	// buffer in the last window is being closed (can only happen in
+	// autocommands).
+	if (!win_valid(wp) || curbuf_locked()
 			  || (curbuf->b_nwindows == 1 && curbuf->b_locked > 0))
 	    return TRUE;
     }

src/testdir/test_exit.vim

@@ -40,6 +40,7 @@ func Test_exiting()
   endif
   call delete('Xtestout')
 
+  " ExitPre autocommand splits the window, so that it's no longer the last one.
   let after =<< trim [CODE]
     au QuitPre * call writefile(["QuitPre"], "Xtestout", "a")
     au ExitPre * call writefile(["ExitPre"], "Xtestout", "a")
@@ -58,4 +59,25 @@ func Test_exiting()
 	  \ readfile('Xtestout'))
   endif
   call delete('Xtestout')
+
+  " ExitPre autocommand splits and closes the window, so that there is still
+  " one window but it's a different one.
+  let after =<< trim [CODE]
+    au QuitPre * call writefile(["QuitPre"], "Xtestout", "a")
+    au ExitPre * call writefile(["ExitPre"], "Xtestout", "a")
+    augroup nasty
+      au ExitPre * split | only
+    augroup END
+    quit
+    augroup nasty
+      au! ExitPre
+    augroup END
+    quit
+  [CODE]
+
+  if RunVim([], after, '')
+    call assert_equal(['QuitPre', 'ExitPre', 'QuitPre', 'ExitPre'],
+	  \ readfile('Xtestout'))
+  endif
+  call delete('Xtestout')
 endfunc

src/version.c

@@ -741,6 +741,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2197,
 /**/
     2196,
 /**/