patch 9.1.2087: Crash when using :tabonly in BufUnload

Problem:  Crash when using :tabonly in BufUnload.
Solution: Set curbuf when setting curwin->w_buffer. Don't wipe out a
          buffer if there are no other buffers. Don't decrement
          b_nwindows if it was 0 before buf_freeall() (zeertzjq).

fixes:  #19088#issuecomment-3710172769
closes: #19186

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
zeertzjq
2026-01-16 18:25:29 +00:00
committed by Christian Brabandt
parent a1895b67b7
commit fa64f92f6a
4 changed files with 51 additions and 3 deletions
+7 -3
View File
@@ -776,14 +776,18 @@ aucmd_abort:
// Autocommands may have opened or closed windows for this buffer.
// Decrement the count for the close we do here.
if (buf->b_nwindows > 0)
// Don't decrement b_nwindows if the buffer wasn't displayed in any window
// before calling buf_freeall(),
if (nwindows > 0 && buf->b_nwindows > 0)
--buf->b_nwindows;
/*
* Remove the buffer from the list.
* Do not wipe out the buffer if it is used in a window.
* Do not wipe out the buffer if it is used in a window, or if autocommands
* wiped out all other buffers.
*/
if (wipe_buf && buf->b_nwindows <= 0)
if (wipe_buf && buf->b_nwindows <= 0
&& (buf->b_prev != NULL || buf->b_next != NULL))
{
tabpage_T *tp;
win_T *wp;