patch 7.4.2006

Problem:    Crash when using tabnext in BufUnload autocmd. (Norio Takagi)
Solution:   First check that the current buffer is the right one. (Hirohito
            Higashi)

src/buffer.c

@@ -459,14 +459,6 @@ aucmd_abort:
 #endif
 
     buf_freeall(buf, (del_buf ? BFA_DEL : 0) + (wipe_buf ? BFA_WIPE : 0));
-    if (
-#ifdef FEAT_WINDOWS
-	win_valid(win) &&
-#else
-	win != NULL &&
-#endif
-			  win->w_buffer == buf)
-	win->w_buffer = NULL;  /* make sure we don't use the buffer now */
 
 #ifdef FEAT_AUTOCMD
     /* Autocommands may have deleted the buffer. */
@@ -477,11 +469,6 @@ aucmd_abort:
 	return;
 # endif
 
-    /* Autocommands may have opened or closed windows for this buffer.
-     * Decrement the count for the close we do here. */
-    if (buf->b_nwindows > 0)
-	--buf->b_nwindows;
-
     /*
      * It's possible that autocommands change curbuf to the one being deleted.
      * This might cause the previous curbuf to be deleted unexpectedly.  But
@@ -491,6 +478,20 @@ aucmd_abort:
      */
     if (buf == curbuf && !is_curbuf)
 	return;
+
+    if (
+#ifdef FEAT_WINDOWS
+	win_valid(win) &&
+#else
+	win != NULL &&
+#endif
+			  win->w_buffer == buf)
+	win->w_buffer = NULL;  /* make sure we don't use the buffer now */
+
+    /* Autocommands may have opened or closed windows for this buffer.
+     * Decrement the count for the close we do here. */
+    if (buf->b_nwindows > 0)
+	--buf->b_nwindows;
 #endif
 
     /* Change directories when the 'acd' option is set. */

src/eval.c

@@ -11397,6 +11397,10 @@ f_evalcmd(typval_T *argvars, typval_T *rettv)
 	redir_evalcmd = save_redir_evalcmd;
 	if (redir_evalcmd)
 	    redir_evalcmd_ga = save_ga;
+
+	/* "silent reg" or "silent echo x" leaves msg_col somewhere in the
+	 * line.  Put it back in the first column. */
+	msg_col = 0;
     }
 }
 
@@ -12044,6 +12048,7 @@ filter_map_one(typval_T *tv, typval_T *expr, int map, int *remp)
 {
     typval_T	rettv;
     typval_T	argv[3];
+    char_u	buf[NUMBUFLEN];
     char_u	*s;
     int		retval = FAIL;
     int		dummy;
@@ -12051,9 +12056,9 @@ filter_map_one(typval_T *tv, typval_T *expr, int map, int *remp)
     copy_tv(tv, &vimvars[VV_VAL].vv_tv);
     argv[0] = vimvars[VV_KEY].vv_tv;
     argv[1] = vimvars[VV_VAL].vv_tv;
-    s = expr->vval.v_string;
     if (expr->v_type == VAR_FUNC)
     {
+	s = expr->vval.v_string;
 	if (call_func(s, (int)STRLEN(s),
 		    &rettv, 2, argv, 0L, 0L, &dummy, TRUE, NULL, NULL) == FAIL)
 	    goto theend;
@@ -12070,6 +12075,9 @@ filter_map_one(typval_T *tv, typval_T *expr, int map, int *remp)
     }
     else
     {
+	s = get_tv_string_buf_chk(expr, buf);
+	if (s == NULL)
+	    goto theend;
 	s = skipwhite(s);
 	if (eval1(&s, &rettv, TRUE) == FAIL)
 	    goto theend;

src/ex_docmd.c

@@ -9455,11 +9455,13 @@ ex_redir(exarg_T *eap)
     char_u	*fname;
     char_u	*arg = eap->arg;
 
+#ifdef FEAT_EVAL
     if (redir_evalcmd)
     {
 	EMSG(_("E930: Cannot use :redir inside evalcmd()"));
 	return;
     }
+#endif
 
     if (STRICMP(eap->arg, "END") == 0)
 	close_redir();

src/screen.c

@@ -422,7 +422,7 @@ redraw_after_callback(void)
 	; /* do nothing */
     else if (State & CMDLINE)
 	redrawcmdline();
-    else if ((State & NORMAL) || (State & INSERT))
+    else if (State & (NORMAL | INSERT))
     {
 	update_screen(0);
 	setcursor();
@@ -486,8 +486,6 @@ update_curbuf(int type)
 }
 
 /*
- * update_screen()
- *
  * Based on the current value of curwin->w_topline, transfer a screenfull
  * of stuff from Filemem to ScreenLines[], and update curwin->w_botline.
  */
@@ -499,6 +497,10 @@ update_screen(int type)
 #if defined(FEAT_SEARCH_EXTRA) || defined(FEAT_CLIPBOARD)
     int		did_one;
 #endif
+#ifdef FEAT_GUI
+    int		gui_cursor_col;
+    int		gui_cursor_row;
+#endif
 
     /* Don't do anything if the screen structures are (not yet) valid. */
     if (!screen_valid(TRUE))
@@ -696,7 +698,11 @@ update_screen(int type)
 		 * scrolling may make it difficult to redraw the text under
 		 * it. */
 		if (gui.in_use)
+		{
+		    gui_cursor_col = gui.cursor_col;
+		    gui_cursor_row = gui.cursor_row;
 		    gui_undraw_cursor();
+		}
 #endif
 	    }
 #endif
@@ -752,7 +758,15 @@ update_screen(int type)
     {
 	out_flush();	/* required before updating the cursor */
 	if (did_one)
+	{
+	    /* Put the GUI position where the cursor was, gui_update_cursor()
+	     * uses that. */
+	    gui.col = gui_cursor_col;
+	    gui.row = gui_cursor_row;
 	    gui_update_cursor(FALSE, FALSE);
+	    screen_cur_col = gui.col;
+	    screen_cur_row = gui.row;
+	}
 	gui_update_scrollbars(FALSE);
     }
 #endif

src/testdir/test_autocmd.vim

@@ -60,3 +60,21 @@ function Test_bufunload()
 
   augroup! test_bufunload_group
 endfunc
+
+" SEGV occurs in older versions.  (At least 7.4.2005 or older)
+function Test_autocmd_bufunload_with_tabnext()
+  tabedit
+  tabfirst
+
+  augroup test_autocmd_bufunload_with_tabnext_group
+    autocmd!
+    autocmd BufUnload <buffer> tabnext
+  augroup END
+
+  quit
+  call assert_equal(2, tabpagenr('$'))
+
+  augroup! test_autocmd_bufunload_with_tabnext_group
+  tablast
+  quit
+endfunc

src/testdir/test_filter_map.vim

@@ -5,10 +5,12 @@ func Test_filter_map_list_expr_string()
   " filter()
   call assert_equal([2, 3, 4], filter([1, 2, 3, 4], 'v:val > 1'))
   call assert_equal([3, 4], filter([1, 2, 3, 4], 'v:key > 1'))
+  call assert_equal([], filter([1, 2, 3, 4], 0))
 
   " map()
   call assert_equal([2, 4, 6, 8], map([1, 2, 3, 4], 'v:val * 2'))
   call assert_equal([0, 2, 4, 6], map([1, 2, 3, 4], 'v:key * 2'))
+  call assert_equal([9, 9, 9, 9], map([1, 2, 3, 4], 9))
 endfunc
 
 " dict with expression string
@@ -18,10 +20,12 @@ func Test_filter_map_dict_expr_string()
   " filter()
   call assert_equal({"bar": 2, "baz": 3}, filter(copy(dict), 'v:val > 1'))
   call assert_equal({"foo": 1, "baz": 3}, filter(copy(dict), 'v:key > "bar"'))
+  call assert_equal({}, filter(copy(dict), 0))
 
   " map()
   call assert_equal({"foo": 2, "bar": 4, "baz": 6}, map(copy(dict), 'v:val * 2'))
   call assert_equal({"foo": "f", "bar": "b", "baz": "b"}, map(copy(dict), 'v:key[0]'))
+  call assert_equal({"foo": 9, "bar": 9, "baz": 9}, map(copy(dict), 9))
 endfunc
 
 " list with funcref

src/version.c

@@ -758,6 +758,18 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2006,
+/**/
+    2005,
+/**/
+    2004,
+/**/
+    2003,
+/**/
+    2002,
+/**/
+    2001,
 /**/
     2000,
 /**/