Hi,

This is a day 1 bug. I am attaching a patch with the fix and a
test for this.

- Yegappan


On Wed, Jul 26, 2017 at 10:27 PM, Dominique Pellé
<[email protected]> wrote:
> Dominique Pellé wrote:
>
>> Hi
>>
>> Vim-8.0.779 (and older) built with -DEXITFREE crashes in
>> quickfix.c when doing:
>>
>> $ vim -u NONE -c'lh[' -clop -c'e#' -c'lh[' -cqa
>> ** Error in `./vim': double free or corruption (!prev): 0x00000000010db700 
>> ***
>
> I see that it also crashes with use of free memory
> even when built without -DEXITFREE, when using
> a slightly different command:
>
> $ vim -u NONE -c'lh[' -clop -c'e#' -c'lh[' -cbw'
> Vim: Caught deadly signal SEGV
>
> Vim: Finished.
>
> Regards
> Dominique
>

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.
diff --git a/src/buffer.c b/src/buffer.c
index 4dbb9e91b..ba73b7d60 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -5669,6 +5669,15 @@ bt_terminal(buf_T *buf)
 }
 
 /*
+ * Return TRUE if "buf" is a help buffer.
+ */
+    int
+bt_help(buf_T *buf)
+{
+    return buf != NULL && buf->b_help;
+}
+
+/*
  * Return TRUE if "buf" is a "nofile", "acwrite" or "terminal" buffer.
  * This means the buffer name is not a file name.
  */
diff --git a/src/proto/buffer.pro b/src/proto/buffer.pro
index e9a37dec8..a67107536 100644
--- a/src/proto/buffer.pro
+++ b/src/proto/buffer.pro
@@ -55,6 +55,7 @@ int read_viminfo_bufferlist(vir_T *virp, int writing);
 void write_viminfo_bufferlist(FILE *fp);
 int bt_quickfix(buf_T *buf);
 int bt_terminal(buf_T *buf);
+int bt_help(buf_T *buf);
 int bt_nofile(buf_T *buf);
 int bt_dontwrite(buf_T *buf);
 int bt_dontwrite_msg(buf_T *buf);
diff --git a/src/quickfix.c b/src/quickfix.c
index c34e34d1c..eeffba282 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -2109,7 +2109,7 @@ qf_jump(
            wp = NULL;
        else
            FOR_ALL_WINDOWS(wp)
-               if (wp->w_buffer != NULL && wp->w_buffer->b_help)
+               if (bt_help(wp->w_buffer))
                    break;
        if (wp != NULL && wp->w_buffer->b_nwindows > 0)
            win_enter(wp, TRUE);
@@ -5343,10 +5343,14 @@ ex_helpgrep(exarg_T *eap)
 
     if (eap->cmdidx == CMD_lhelpgrep)
     {
-       /* Find an existing help window */
-       FOR_ALL_WINDOWS(wp)
-           if (wp->w_buffer != NULL && wp->w_buffer->b_help)
-               break;
+       /* If the current window is a help window, then use it */
+       if (bt_help(curwin->w_buffer))
+           wp = curwin;
+       else
+           /* Find an existing help window */
+           FOR_ALL_WINDOWS(wp)
+               if (bt_help(wp->w_buffer))
+                   break;
 
        if (wp == NULL)     /* Help window not found */
            qi = NULL;
diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 7b344eaad..41e502154 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -2287,3 +2287,17 @@ func Test_changedtick()
     call Xchangedtick_tests('c')
     call Xchangedtick_tests('l')
 endfunc
+
+" Open multiple help windows using ":lhelpgrep
+" This test used to crash Vim
+func Test_Multi_LL_Help()
+    new | only
+    lhelpgrep window
+    lopen
+    e#
+    lhelpgrep buffer
+    call assert_equal(3, winnr('$'))
+    call assert_true(len(getloclist(1)) != 0)
+    call assert_true(len(getloclist(2)) != 0)
+    new | only
+endfunc

Raspunde prin e-mail lui