From a787a314900ecf98c759a82030ac28992896cc88 Mon Sep 17 00:00:00 2001 From: Barrett Ruth <62671086+barrettruth@users.noreply.github.com> Date: Mon, 20 Jul 2026 02:48:36 -0500 Subject: [PATCH] fix(window): avoid UAF in `close_windows` (#40853) --- src/nvim/window.c | 2 +- test/functional/api/buffer_spec.lua | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/src/nvim/window.c b/src/nvim/window.c index 2dce5215b9..1851928d47 100644 --- a/src/nvim/window.c +++ b/src/nvim/window.c @@ -2617,7 +2617,7 @@ void close_windows(buf_T *buf, bool keep_curwin) } if (!win_close_othertab(wp, false, tp, false)) { // If closing the window fails give up, to avoid looping forever. - break; + goto theend; } // Start all over, the tab page may be closed and diff --git a/test/functional/api/buffer_spec.lua b/test/functional/api/buffer_spec.lua index 4750bcb4fd..ab7e3683cb 100644 --- a/test/functional/api/buffer_spec.lua +++ b/test/functional/api/buffer_spec.lua @@ -2503,6 +2503,20 @@ describe('api/buf', function() ok(not api.nvim_buf_is_loaded(b)) ok(api.nvim_buf_is_valid(b)) end) + + it('does not crash if WinClosed closes the next tabpage #40852', function() + exec_lua(function() + vim.cmd.tabnew() + vim.api.nvim_create_autocmd('WinClosed', { + callback = function() + pcall(vim.api.nvim_win_close, 0, true) + end, + }) + local bufs = vim.api.nvim_list_bufs() + vim.api.nvim_buf_delete(bufs[#bufs - 1], { force = true }) + end) + assert_alive() + end) end) describe('nvim_buf_get_mark', function()