From 26fe0d56912e42c2b16a61b2480e19ba569aee98 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 10 Sep 2016 14:27:30 +0200
Subject: [PATCH 1/3] patch 7.4.2359 Problem:    Memory leak in timer_start().
 Solution:   Check the right field to be NULL.

---
 src/evalfunc.c              | 2 +-
 src/testdir/test_timers.vim | 8 ++++----
 src/version.c               | 2 ++
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/evalfunc.c b/src/evalfunc.c
index 906fa39afc..7dd5c2a4d2 100644
--- a/src/evalfunc.c
+++ b/src/evalfunc.c
@@ -12429,7 +12429,7 @@ f_timer_start(typval_T *argvars, typval_T *rettv)
 	free_callback(callback, partial);
     else
     {
-	if (timer->tr_partial == NULL)
+	if (partial == NULL)
 	    timer->tr_callback = vim_strsave(callback);
 	else
 	    /* pointer into the partial */
diff --git a/src/testdir/test_timers.vim b/src/testdir/test_timers.vim
index 07c6876eee..ebc6665808 100644
--- a/src/testdir/test_timers.vim
+++ b/src/testdir/test_timers.vim
@@ -48,12 +48,12 @@ endfunc
 
 func Test_with_partial_callback()
   let g:val = 0
-  let s:meow = {}
-  function s:meow.bite(...)
-    let g:val += 1
+  let meow = {'one': 1}
+  function meow.bite(...)
+    let g:val += self.one
   endfunction
 
-  call timer_start(50, s:meow.bite)
+  call timer_start(50, meow.bite)
   let slept = WaitFor('g:val == 1')
   call assert_equal(1, g:val)
   if has('reltime')
diff --git a/src/version.c b/src/version.c
index 0767d4afd1..65757ab9de 100644
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2359,
 /**/
     2358,
 /**/

From 80c3fd7c559c7d329d57afe10db9bfb0adf10e46 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 10 Sep 2016 15:52:55 +0200
Subject: [PATCH 2/3] patch 7.4.2360 Problem:    Invalid memory access when
 formatting. (Dominique Pelle) Solution:   Make sure cursor line and column
 are associated.

---
 src/misc1.c   | 10 ++++++++--
 src/version.c |  2 ++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/misc1.c b/src/misc1.c
index 99f963ce09..79014cf294 100644
--- a/src/misc1.c
+++ b/src/misc1.c
@@ -6097,7 +6097,7 @@ cin_isterminated(
  * When a line ends in a comma we continue looking in the next line.
  * "sp" points to a string with the line.  When looking at other lines it must
  * be restored to the line.  When it's NULL fetch lines here.
- * "lnum" is where we start looking.
+ * "first_lnum" is where we start looking.
  * "min_lnum" is the line before which we will not be looking.
  */
     static int
@@ -6108,6 +6108,7 @@ cin_isfuncdecl(
 {
     char_u	*s;
     linenr_T	lnum = first_lnum;
+    linenr_T	save_lnum = curwin->w_cursor.lnum;
     int		retval = FALSE;
     pos_T	*trypos;
     int		just_started = TRUE;
@@ -6117,15 +6118,20 @@ cin_isfuncdecl(
     else
 	s = *sp;
 
+    curwin->w_cursor.lnum = lnum;
     if (find_last_paren(s, '(', ')')
 	&& (trypos = find_match_paren(curbuf->b_ind_maxparen)) != NULL)
     {
 	lnum = trypos->lnum;
 	if (lnum < min_lnum)
+	{
+	    curwin->w_cursor.lnum = save_lnum;
 	    return FALSE;
+	}
 
 	s = ml_get(lnum);
     }
+    curwin->w_cursor.lnum = save_lnum;
 
     /* Ignore line starting with #. */
     if (cin_ispreproc(s))
@@ -6681,7 +6687,7 @@ find_start_brace(void)	    /* XXX */
     static pos_T *
 find_match_paren(int ind_maxparen)	/* XXX */
 {
- return find_match_char('(', ind_maxparen);
+    return find_match_char('(', ind_maxparen);
 }
 
     static pos_T *
diff --git a/src/version.c b/src/version.c
index 65757ab9de..a71647b908 100644
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2360,
 /**/
     2359,
 /**/

From ee39ef0b93d31763d05e54ba99801e3f1a254c0d Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 10 Sep 2016 19:17:42 +0200
Subject: [PATCH 3/3] patch 7.4.2361 Problem:    Checking for last_timer_id to
 overflow is not reliable. (Ozaki             Kiichi) Solution:   Check for
 the number not going up.

---
 src/ex_cmds2.c | 3 ++-
 src/version.c  | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c
index 8df67536c5..b8d8dca9e0 100644
--- a/src/ex_cmds2.c
+++ b/src/ex_cmds2.c
@@ -1143,10 +1143,11 @@ free_timer(timer_T *timer)
 create_timer(long msec, int repeat)
 {
     timer_T	*timer = (timer_T *)alloc_clear(sizeof(timer_T));
+    long	prev_id = last_timer_id;
 
     if (timer == NULL)
 	return NULL;
-    if (++last_timer_id < 0)
+    if (++last_timer_id <= prev_id)
 	/* Overflow!  Might cause duplicates... */
 	last_timer_id = 0;
     timer->tr_id = last_timer_id;
diff --git a/src/version.c b/src/version.c
index a71647b908..9a6851e556 100644
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2361,
 /**/
     2360,
 /**/