From 8595f0298a19bd30a8719a9d5d3e149c3a479c9f Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Tue, 5 Jul 2022 17:33:23 +0800
Subject: [PATCH 1/3] vim-patch:8.1.0342: crash when a callback deletes a
 window that is being used

Problem:    Crash when a callback deletes a window that is being used.
Solution:   Do not unload a buffer that is being displayed while redrawing the
            screen. Also avoid invoking callbacks while redrawing.
            (closes vim/vim#2107)
https://github.com/vim/vim/commit/94f01956a583223dafe24135489d0ab1100ab0ad

Omit parse_queued_messages(): N/A.
Cherry-pick a break statement from patch 8.1.0425.

(cherry picked from commit 65cbe0cc35c07a929152b86e78717efa4ba155da)
---
 src/nvim/buffer.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index 85f79deb2f..e3f923a2c0 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -93,7 +93,6 @@
 #endif
 
 static char *e_auabort = N_("E855: Autocommands caused command to abort");
-static char *e_buflocked = N_("E937: Attempt to delete a buffer that is in use");
 
 // Number of times free_buffer() was called.
 static int buf_free_count = 0;
@@ -401,6 +400,27 @@ bool buf_valid(buf_T *buf)
   return false;
 }
 
+/// Return true when buffer "buf" can be unloaded.
+/// Give an error message and return false when the buffer is locked or the
+/// screen is being redrawn and the buffer is in a window.
+static bool can_unload_buffer(buf_T *buf)
+{
+  bool can_unload = !buf->b_locked;
+
+  if (can_unload && updating_screen) {
+    FOR_ALL_WINDOWS_IN_TAB(wp, curtab) {
+      if (wp->w_buffer == buf) {
+        can_unload = false;
+        break;
+      }
+    }
+  }
+  if (!can_unload) {
+    emsg(_("E937: Attempt to delete a buffer that is in use"));
+  }
+  return can_unload;
+}
+
 /// Close the link to a buffer.
 ///
 /// @param win    If not NULL, set b_last_cursor.
@@ -458,8 +478,7 @@ bool close_buffer(win_T *win, buf_T *buf, int action, bool abort_if_last, bool i
 
   // Disallow deleting the buffer when it is locked (already being closed or
   // halfway a command that relies on it). Unloading is allowed.
-  if (buf->b_locked > 0 && (del_buf || wipe_buf)) {
-    emsg(_(e_buflocked));
+  if ((del_buf || wipe_buf) && !can_unload_buffer(buf)) {
     return false;
   }
 
@@ -1206,8 +1225,7 @@ int do_buffer(int action, int start, int dir, int count, int forceit)
   if (unload) {
     int forward;
     bufref_T bufref;
-    if (buf->b_locked) {
-      emsg(_(e_buflocked));
+    if (!can_unload_buffer(buf)) {
       return FAIL;
     }
     set_bufref(&bufref, buf);

From 7ba968ef3b542222db1c712a133b5c8ffcea48db Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Sat, 15 Oct 2022 16:10:56 +0800
Subject: [PATCH 2/3] vim-patch:9.0.0614: SpellFileMissing autocmd may delete
 buffer

Problem:    SpellFileMissing autocmd may delete buffer.
Solution:   Disallow deleting the current buffer to avoid using freed memory.
https://github.com/vim/vim/commit/ef976323e770315b5fca544efb6b2faa25674d15
(cherry picked from commit 6bc2d6b66b683faedded01128af8ad98b7130fef)
---
 src/nvim/buffer.c                       |  6 +++++-
 src/nvim/spell.c                        |  6 ++++++
 src/nvim/testdir/test_autocmd.vim       | 10 ++++++++++
 test/functional/autocmd/termxx_spec.lua |  4 +++-
 4 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index e3f923a2c0..29b00bad2a 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -93,6 +93,8 @@
 #endif
 
 static char *e_auabort = N_("E855: Autocommands caused command to abort");
+static char e_attempt_to_delete_buffer_that_is_in_use_str[]
+  = N_("E937: Attempt to delete a buffer that is in use: %s");
 
 // Number of times free_buffer() was called.
 static int buf_free_count = 0;
@@ -416,7 +418,9 @@ static bool can_unload_buffer(buf_T *buf)
     }
   }
   if (!can_unload) {
-    emsg(_("E937: Attempt to delete a buffer that is in use"));
+    char *fname = buf->b_fname != NULL ? buf->b_fname : buf->b_ffname;
+    semsg(_(e_attempt_to_delete_buffer_that_is_in_use_str),
+          fname != NULL ? fname : "[No Name]");
   }
   return can_unload;
 }
diff --git a/src/nvim/spell.c b/src/nvim/spell.c
index 7d2b58ff46..69c2b027bc 100644
--- a/src/nvim/spell.c
+++ b/src/nvim/spell.c
@@ -1511,6 +1511,10 @@ static void spell_load_lang(char_u *lang)
   sl.sl_slang = NULL;
   sl.sl_nobreak = false;
 
+  // Disallow deleting the current buffer.  Autocommands can do weird things
+  // and cause "lang" to be freed.
+  curbuf->b_locked++;
+
   // We may retry when no spell file is found for the language, an
   // autocommand may load it then.
   for (int round = 1; round <= 2; round++) {
@@ -1553,6 +1557,8 @@ static void spell_load_lang(char_u *lang)
     STRCPY(fname_enc + strlen(fname_enc) - 3, "add.spl");
     do_in_runtimepath((char *)fname_enc, DIP_ALL, spell_load_cb, &sl);
   }
+
+  curbuf->b_locked--;
 }
 
 // Return the encoding used for spell checking: Use 'encoding', except that we
diff --git a/src/nvim/testdir/test_autocmd.vim b/src/nvim/testdir/test_autocmd.vim
index d766256d4b..c1eb7bea50 100644
--- a/src/nvim/testdir/test_autocmd.vim
+++ b/src/nvim/testdir/test_autocmd.vim
@@ -2745,6 +2745,16 @@ func Test_FileType_spell()
   setglobal spellfile=
 endfunc
 
+" this was wiping out the current buffer and using freed memory
+func Test_SpellFileMissing_bwipe()
+  next 0
+  au SpellFileMissing 0 bwipe
+  call assert_fails('set spell spelllang=0', 'E937:')
+
+  au! SpellFileMissing
+  bwipe
+endfunc
+
 " Test closing a window or editing another buffer from a FileChangedRO handler
 " in a readonly buffer
 func Test_FileChangedRO_winclose()
diff --git a/test/functional/autocmd/termxx_spec.lua b/test/functional/autocmd/termxx_spec.lua
index 859c2ebf44..a38f9cb0ac 100644
--- a/test/functional/autocmd/termxx_spec.lua
+++ b/test/functional/autocmd/termxx_spec.lua
@@ -5,6 +5,7 @@ local clear, command, nvim, testprg =
   helpers.clear, helpers.command, helpers.nvim, helpers.testprg
 local eval, eq, neq, retry =
   helpers.eval, helpers.eq, helpers.neq, helpers.retry
+local matches = helpers.matches
 local ok = helpers.ok
 local feed = helpers.feed
 local pcall_err = helpers.pcall_err
@@ -22,7 +23,8 @@ describe('autocmd TermClose', function()
   local function test_termclose_delete_own_buf()
     command('autocmd TermClose * bdelete!')
     command('terminal')
-    eq('Vim(bdelete):E937: Attempt to delete a buffer that is in use', pcall_err(command, 'bdelete!'))
+    matches('^Vim%(bdelete%):E937: Attempt to delete a buffer that is in use: term://',
+            pcall_err(command, 'bdelete!'))
     assert_alive()
   end
 

From 89fbffff130224f19e9b174ca8e274e23839a9ca Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Sat, 15 Oct 2022 16:17:07 +0800
Subject: [PATCH 3/3] vim-patch:9.0.0616: spell test fails because error
 message changed

Problem:    Spell test fails because error message changed.
Solution:   Adjust expected error message.
https://github.com/vim/vim/commit/371951d0c34d4f44b50ad8bc8d30a4ef7effade6
(cherry picked from commit a9452cf3d5e2904ff355daf660e8e56bcb2433eb)
---
 src/nvim/testdir/test_spell.vim | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nvim/testdir/test_spell.vim b/src/nvim/testdir/test_spell.vim
index 8ab8204b10..e421d21de1 100644
--- a/src/nvim/testdir/test_spell.vim
+++ b/src/nvim/testdir/test_spell.vim
@@ -147,7 +147,7 @@ func Test_spell_file_missing()
   augroup TestSpellFileMissing
     autocmd! SpellFileMissing * bwipe
   augroup END
-  call assert_fails('set spell spelllang=ab_cd', 'E797:')
+  call assert_fails('set spell spelllang=ab_cd', 'E937:')
 
   " clean up
   augroup TestSpellFileMissing