patch 8.0.0297: double free on exit when using a closure

Problem:    Double free on exit when using a closure. (James McCoy)
Solution:   Split free_al_functions in two parts. (closes #1428)

runtime/doc/term.txt

@@ -1,4 +1,4 @@
-*term.txt*      For Vim version 8.0.  Last change: 2017 Jan 27
+*term.txt*      For Vim version 8.0.  Last change: 2017 Feb 02
 
 
 		  VIM REFERENCE MANUAL    by Bram Moolenaar
@@ -95,7 +95,12 @@ terminal when entering "raw" mode and 't_BD' when leaving "raw" mode.  The
 terminal is then expected to put 't_PS' before pasted text and 't_PE' after
 pasted text.  This way Vim can separate text that is pasted from characters
 that are typed.  The pasted text is handled like when the middle mouse button
-is used.
+is used, it is inserted literally and not interpreted as commands.
+
+When the cursor is in the first column, the pasted text will be inserted
+before it.  Otherwise the pasted text is appended after the cursor position.
+This means one cannot paste after the first column.  Unfortunately Vim does
+not have a way to tell where the mouse pointer was.
 
 Note that in some situations Vim will not recognize the bracketed paste and
 you will get the raw text.  In other situations Vim will only get the first

src/ex_docmd.c

@@ -11790,7 +11790,7 @@ ses_arglist(
 		    s = buf;
 		}
 	    }
-	    if (fputs("argadd ", fd) < 0
+	    if (fputs("$argadd ", fd) < 0
 		    || ses_put_fname(fd, s, flagp) == FAIL
 		    || put_eol(fd) == FAIL)
 	    {

src/normal.c

@@ -9079,8 +9079,13 @@ nv_edit(cmdarg_T *cap)
 		    beginline(BL_WHITE|BL_FIX);
 		break;
 
+	    case K_PS:	/* Bracketed paste works like "a"ppend, unless the
+			   cursor is in the first column, then it inserts. */
+		if (curwin->w_cursor.col == 0)
+		    break;
+		/*FALLTHROUGH*/
+
 	    case 'a':	/* "a"ppend is like "i"nsert on the next character. */
-	    case K_PS:	/* bracketed paste works like "a"ppend */
 #ifdef FEAT_VIRTUALEDIT
 		/* increment coladd when in virtual space, increment the
 		 * column otherwise, also to append after an unprintable char */

src/structs.h

@@ -1337,6 +1337,7 @@ typedef struct
     int		uf_varargs;	/* variable nr of arguments */
     int		uf_flags;
     int		uf_calls;	/* nr of active calls */
+    int		uf_cleared;	/* func_clear() was already called */
     garray_T	uf_args;	/* arguments */
     garray_T	uf_lines;	/* function lines */
 #ifdef FEAT_PROFILE

src/testdir/runtest.vim

@@ -57,6 +57,9 @@ else
   set encoding=latin1
 endif
 
+" Avoid stopping at the "hit enter" prompt
+set nomore
+
 " Output all messages in English.
 lang mess C
 
@@ -168,7 +171,6 @@ let s:flaky = [
       \ ]
 
 " Locate Test_ functions and execute them.
-set nomore
 redir @q
 silent function /^Test_
 redir END

src/testdir/test_mksession.vim

@@ -110,4 +110,16 @@ func Test_mksession_winheight()
   call delete('Xtest_mks.out')
 endfunc
 
+func Test_mksession_arglist()
+  argdel *
+  next file1 file2 file3 file4
+  mksession! Xtest_mks.out
+  source Xtest_mks.out
+  call assert_equal(['file1', 'file2', 'file3', 'file4'], argv())
+
+  call delete('Xtest_mks.out')
+  argdel *
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

src/testdir/test_paste.vim

@@ -8,18 +8,36 @@ set term=xterm
 
 func Test_paste_normal_mode()
   new
+  " In first column text is inserted
   call setline(1, ['a', 'b', 'c'])
-  2
+  call cursor(2, 1)
   call feedkeys("\<Esc>[200~foo\<CR>bar\<Esc>[201~", 'xt')
-  call assert_equal('bfoo', getline(2))
-  call assert_equal('bar', getline(3))
+  call assert_equal('foo', getline(2))
+  call assert_equal('barb', getline(3))
   call assert_equal('c', getline(4))
 
+  " When repeating text is appended
   normal .
   call assert_equal('barfoo', getline(3))
-  call assert_equal('bar', getline(4))
+  call assert_equal('barb', getline(4))
   call assert_equal('c', getline(5))
   bwipe!
+
+  " In second column text is appended
+  call setline(1, ['a', 'bbb', 'c'])
+  call cursor(2, 2)
+  call feedkeys("\<Esc>[200~foo\<CR>bar\<Esc>[201~", 'xt')
+  call assert_equal('bbfoo', getline(2))
+  call assert_equal('barb', getline(3))
+  call assert_equal('c', getline(4))
+
+  " In last column text is appended
+  call setline(1, ['a', 'bbb', 'c'])
+  call cursor(2, 3)
+  call feedkeys("\<Esc>[200~foo\<CR>bar\<Esc>[201~", 'xt')
+  call assert_equal('bbbfoo', getline(2))
+  call assert_equal('bar', getline(3))
+  call assert_equal('c', getline(4))
 endfunc
 
 func Test_paste_insert_mode()

src/userfunc.c

@@ -1075,12 +1075,17 @@ func_remove(ufunc_T *fp)
 }
 
 /*
- * Free a function and remove it from the list of functions.
+ * Free all things that a function contains.  Does not free the function
+ * itself, use func_free() for that.
  * When "force" is TRUE we are exiting.
  */
     static void
-func_free(ufunc_T *fp, int force)
+func_clear(ufunc_T *fp, int force)
 {
+    if (fp->uf_cleared)
+	return;
+    fp->uf_cleared = TRUE;
+
     /* clear this function */
     ga_clear_strings(&(fp->uf_args));
     ga_clear_strings(&(fp->uf_lines));
@@ -1089,16 +1094,35 @@ func_free(ufunc_T *fp, int force)
     vim_free(fp->uf_tml_total);
     vim_free(fp->uf_tml_self);
 #endif
+    funccal_unref(fp->uf_scoped, fp, force);
+}
+
+/*
+ * Free a function and remove it from the list of functions.  Does not free
+ * what a function contains, call func_clear() first.
+ */
+    static void
+func_free(ufunc_T *fp)
+{
     /* only remove it when not done already, otherwise we would remove a newer
      * version of the function */
     if ((fp->uf_flags & (FC_DELETED | FC_REMOVED)) == 0)
 	func_remove(fp);
 
-    funccal_unref(fp->uf_scoped, fp, force);
-
     vim_free(fp);
 }
 
+/*
+ * Free all things that a function contains and free the function itself.
+ * When "force" is TRUE we are exiting.
+ */
+    static void
+func_clear_free(ufunc_T *fp, int force)
+{
+    func_clear(fp, force);
+    func_free(fp);
+}
+
 /*
  * There are two kinds of function names:
  * 1. ordinary names, function defined with :function
@@ -1120,10 +1144,40 @@ free_all_functions(void)
     hashitem_T	*hi;
     ufunc_T	*fp;
     long_u	skipped = 0;
-    long_u	todo;
+    long_u	todo = 1;
+    long_u	used;
 
-    /* Need to start all over every time, because func_free() may change the
-     * hash table. */
+    /* First clear what the functions contain.  Since this may lower the
+     * reference count of a function, it may also free a function and change
+     * the hash table. Restart if that happens. */
+    while (todo > 0)
+    {
+	todo = func_hashtab.ht_used;
+	for (hi = func_hashtab.ht_array; todo > 0; ++hi)
+	    if (!HASHITEM_EMPTY(hi))
+	    {
+		/* Only free functions that are not refcounted, those are
+		 * supposed to be freed when no longer referenced. */
+		fp = HI2UF(hi);
+		if (func_name_refcount(fp->uf_name))
+		    ++skipped;
+		else
+		{
+		    used = func_hashtab.ht_used;
+		    func_clear(fp, TRUE);
+		    if (used != func_hashtab.ht_used)
+		    {
+			skipped = 0;
+			break;
+		    }
+		}
+		--todo;
+	    }
+    }
+
+    /* Now actually free the functions.  Need to start all over every time,
+     * because func_free() may change the hash table. */
+    skipped = 0;
     while (func_hashtab.ht_used > skipped)
     {
 	todo = func_hashtab.ht_used;
@@ -1138,7 +1192,7 @@ free_all_functions(void)
 		    ++skipped;
 		else
 		{
-		    func_free(fp, TRUE);
+		    func_free(fp);
 		    skipped = 0;
 		    break;
 		}
@@ -1356,7 +1410,7 @@ call_func(
 		    if (--fp->uf_calls <= 0 && fp->uf_refcount <= 0)
 			/* Function was unreferenced while being used, free it
 			 * now. */
-			func_free(fp, FALSE);
+			func_clear_free(fp, FALSE);
 		    if (did_save_redo)
 			restoreRedobuff();
 		    restore_search_patterns();
@@ -2756,7 +2810,7 @@ ex_delfunction(exarg_T *eap)
 		fp->uf_flags |= FC_DELETED;
 	    }
 	    else
-		func_free(fp, FALSE);
+		func_clear_free(fp, FALSE);
 	}
     }
 }
@@ -2785,7 +2839,7 @@ func_unref(char_u *name)
 	/* Only delete it when it's not being used.  Otherwise it's done
 	 * when "uf_calls" becomes zero. */
 	if (fp->uf_calls == 0)
-	    func_free(fp, FALSE);
+	    func_clear_free(fp, FALSE);
     }
 }
 
@@ -2801,7 +2855,7 @@ func_ptr_unref(ufunc_T *fp)
 	/* Only delete it when it's not being used.  Otherwise it's done
 	 * when "uf_calls" becomes zero. */
 	if (fp->uf_calls == 0)
-	    func_free(fp, FALSE);
+	    func_clear_free(fp, FALSE);
     }
 }
 

src/version.c

@@ -764,6 +764,14 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    297,
+/**/
+    296,
+/**/
+    295,
+/**/
+    294,
 /**/
     293,
 /**/