patch 8.0.0679: using freed memory

Problem:    Using freed memory.
Solution:   Get the parent frame pointer earlier.

nsis/gvim.nsi

@@ -87,7 +87,8 @@ UninstPage instfiles
 Function .onInit
   MessageBox MB_YESNO|MB_ICONQUESTION \
 	"This will install Vim ${VER_MAJOR}.${VER_MINOR} on your computer.$\n Continue?" \
-	/SD IDYES NoAbort
+	/SD IDYES \
+	IDYES NoAbort
 	    Abort ; causes installer to quit.
 	NoAbort:
 

runtime/doc/eval.txt

@@ -1,4 +1,4 @@
-*eval.txt*	For Vim version 8.0.  Last change: 2017 Jun 23
+*eval.txt*	For Vim version 8.0.  Last change: 2017 Jun 25
 
 
 		  VIM REFERENCE MANUAL	  by Bram Moolenaar
@@ -7663,12 +7663,21 @@ synconcealed({lnum}, {col})				*synconcealed()*
 		   is 1, the second item contains the text which will be
 		   displayed in place of the concealed text, depending on the
 		   current setting of 'conceallevel' and 'listchars'.
-		3. The third and final item in the list is a unique number
-		   representing the specific syntax region matched. This
-		   allows detection of the beginning of a new concealable
-		   region if there are two consecutive regions with the same
-		   replacement character.  For an example use see
-		   $VIMRUNTIME/syntax/2html.vim .
+		3. The third and final item in the list is a number
+		   representing the specific syntax region matched in the
+		   line. When the character is not concealed the value is
+		   zero. This allows detection of the beginning of a new
+		   concealable region if there are two consecutive regions
+		   with the same replacement character.  For an example, if
+		   the text is "123456" and both "23" and "45" are concealed
+		   and replace by the character "X", then:
+			call			returns ~
+		   	synconcealed(lnum, 1)   [0, '', 0]
+		   	synconcealed(lnum, 2)   [1, 'X', 1]
+		   	synconcealed(lnum, 3)   [1, 'X', 1]
+		   	synconcealed(lnum, 4)   [1, 'X', 2]
+		   	synconcealed(lnum, 5)   [1, 'X', 2]
+		   	synconcealed(lnum, 6)   [0, '', 0]
 
 
 synstack({lnum}, {col})					*synstack()*
@@ -7933,8 +7942,19 @@ test_override({name}, {val})				*test_override()*
 		name	     effect when {val} is non-zero ~
 		redraw       disable the redrawing() function
 		char_avail   disable the char_avail() function
+		starting     reset the "starting" variable, see below
 		ALL	     clear all overrides ({val} is not used)
 
+		"starting" is to be used when a test should behave like
+		startup was done.  Since the tests are run by sourcing a
+		script the "starting" variable is non-zero. This is usually a
+		good thing (tests run faster), but sometimes changes behavior
+		in a way that the test doesn't work properly.
+		When using: >
+			call test_override('starting', 1)
+< 		The value of "starting" is saved.  It is restored by: >
+			call test_override('starting', 0)
+
 test_settime({expr})					*test_settime()*
 		Set the time Vim uses internally.  Currently only used for
 		timestamps in the history, as they are used in viminfo, and

src/edit.c

@@ -4308,9 +4308,17 @@ ins_compl_get_exp(pos_T *ini)
 	    {
 		ins_buf = curbuf;
 		first_match_pos = *ini;
-		/* So that ^N can match word immediately after cursor */
-		if (ctrl_x_mode == 0)
-		    dec(&first_match_pos);
+		/* Move the cursor back one character so that ^N can match the
+		 * word immediately after the cursor. */
+		if (ctrl_x_mode == 0 && dec(&first_match_pos) < 0)
+		{
+		    /* Move the cursor to after the last character in the
+		     * buffer, so that word at start of buffer is found
+		     * correctly. */
+		    first_match_pos.lnum = ins_buf->b_ml.ml_line_count;
+		    first_match_pos.col =
+				 (colnr_T)STRLEN(ml_get(first_match_pos.lnum));
+		}
 		last_match_pos = first_match_pos;
 		type = 0;
 

src/evalfunc.c

@@ -3191,7 +3191,11 @@ f_feedkeys(typval_T *argvars, typval_T *rettv UNUSED)
 	    ins_typebuf(keys_esc, (remap ? REMAP_YES : REMAP_NONE),
 				  insert ? 0 : typebuf.tb_len, !typed, FALSE);
 	    vim_free(keys_esc);
-	    if (vgetc_busy)
+	    if (vgetc_busy
+#ifdef FEAT_TIMERS
+		    || timer_busy
+#endif
+		    )
 		typebuf_was_filled = TRUE;
 	    if (execute)
 	    {
@@ -12394,6 +12398,7 @@ f_test_override(typval_T *argvars, typval_T *rettv UNUSED)
 {
     char_u *name = (char_u *)"";
     int     val;
+    static int save_starting = -1;
 
     if (argvars[0].v_type != VAR_STRING
 	    || (argvars[1].v_type) != VAR_NUMBER)
@@ -12407,10 +12412,29 @@ f_test_override(typval_T *argvars, typval_T *rettv UNUSED)
 	    disable_redraw_for_testing = val;
 	else if (STRCMP(name, (char_u *)"char_avail") == 0)
 	    disable_char_avail_for_testing = val;
+	else if (STRCMP(name, (char_u *)"starting") == 0)
+	{
+	    if (val)
+	    {
+		if (save_starting < 0)
+		    save_starting = starting;
+		starting = 0;
+	    }
+	    else
+	    {
+		starting = save_starting;
+		save_starting = -1;
+	    }
+	}
 	else if (STRCMP(name, (char_u *)"ALL") == 0)
 	{
 	    disable_char_avail_for_testing = FALSE;
 	    disable_redraw_for_testing = FALSE;
+	    if (save_starting >= 0)
+	    {
+		starting = save_starting;
+		save_starting = -1;
+	    }
 	}
 	else
 	    EMSG2(_(e_invarg2), name);

src/ex_cmds.c

@@ -6835,7 +6835,11 @@ fix_help_buffer(void)
 #ifdef FEAT_AUTOCMD
     /* Set filetype to "help" if still needed. */
     if (STRCMP(curbuf->b_p_ft, "help") != 0)
+    {
+	++curbuf_lock;
 	set_option_value((char_u *)"ft", 0L, (char_u *)"help", OPT_LOCAL);
+	--curbuf_lock;
+    }
 #endif
 
 #ifdef FEAT_SYN_HL

src/ex_cmds2.c

@@ -1209,11 +1209,18 @@ check_due_timer(void)
 	this_due = GET_TIMEDIFF(timer, now);
 	if (this_due <= 1)
 	{
+	    int save_timer_busy = timer_busy;
+	    int save_vgetc_busy = vgetc_busy;
+
+	    timer_busy = timer_busy > 0 || vgetc_busy > 0;
+	    vgetc_busy = 0;
 	    timer->tr_firing = TRUE;
 	    timer_callback(timer);
 	    timer->tr_firing = FALSE;
 	    timer_next = timer->tr_next;
 	    did_one = TRUE;
+	    timer_busy = save_timer_busy;
+	    vgetc_busy = save_vgetc_busy;
 
 	    /* Only fire the timer again if it repeats and stop_timer() wasn't
 	     * called while inside the callback (tr_id == -1). */

src/ex_getln.c

@@ -6878,6 +6878,8 @@ open_cmdwin(void)
 # ifdef FEAT_AUTOCMD
     /* Do execute autocommands for setting the filetype (load syntax). */
     unblock_autocmds();
+    /* But don't allow switching to another buffer. */
+    ++curbuf_lock;
 # endif
 
     /* Showing the prompt may have set need_wait_return, reset it. */
@@ -6893,6 +6895,9 @@ open_cmdwin(void)
 	}
 	set_option_value((char_u *)"ft", 0L, (char_u *)"vim", OPT_LOCAL);
     }
+# ifdef FEAT_AUTOCMD
+    --curbuf_lock;
+# endif
 
     /* Reset 'textwidth' after setting 'filetype' (the Vim filetype plugin
      * sets 'textwidth' to 78). */

src/getchar.c

@@ -467,6 +467,11 @@ flush_buffers(int flush_typeahead)
 	    ;
 	typebuf.tb_off = MAXMAPLEN;
 	typebuf.tb_len = 0;
+#if defined(FEAT_CLIENTSERVER) || defined(FEAT_EVAL)
+	/* Reset the flag that text received from a client or from feedkeys()
+	 * was inserted in the typeahead buffer. */
+	typebuf_was_filled = FALSE;
+#endif
     }
     else		    /* remove mapped characters at the start only */
     {

src/globals.h

@@ -1659,6 +1659,7 @@ EXTERN int  in_free_unref_items INIT(= FALSE);
 
 #ifdef FEAT_TIMERS
 EXTERN int  did_add_timer INIT(= FALSE);
+EXTERN int  timer_busy INIT(= 0);   /* when timer is inside vgetc() then > 0 */
 #endif
 
 #ifdef FEAT_EVAL

src/option.c

@@ -4294,6 +4294,32 @@ set_title_defaults(void)
 }
 #endif
 
+#if defined(FEAT_AUTOCMD) && defined(FEAT_EVAL)
+    static void
+trigger_optionsset_string(
+	int	opt_idx,
+	int	opt_flags,
+	char_u *oldval,
+	char_u *newval)
+{
+    if (oldval != NULL && newval != NULL)
+    {
+	char_u buf_type[7];
+
+	sprintf((char *)buf_type, "%s",
+	    (opt_flags & OPT_LOCAL) ? "local" : "global");
+	set_vim_var_string(VV_OPTION_OLD, oldval, -1);
+	set_vim_var_string(VV_OPTION_NEW, newval, -1);
+	set_vim_var_string(VV_OPTION_TYPE, buf_type, -1);
+	apply_autocmds(EVENT_OPTIONSET,
+		       (char_u *)options[opt_idx].fullname, NULL, FALSE, NULL);
+	reset_v_option_vars();
+    }
+    vim_free(oldval);
+    vim_free(newval);
+}
+#endif
+
 /*
  * Parse 'arg' for option settings.
  *
@@ -4763,6 +4789,7 @@ do_set(
 			char_u	    *origval = NULL;
 #if defined(FEAT_AUTOCMD) && defined(FEAT_EVAL)
 			char_u	    *saved_origval = NULL;
+			char_u	    *saved_newval = NULL;
 #endif
 			unsigned    newlen;
 			int	    comma;
@@ -5114,14 +5141,21 @@ do_set(
 # ifdef FEAT_CRYPT
 				&& options[opt_idx].indir != PV_KEY
 # endif
-							   && origval != NULL)
+					  && origval != NULL && newval != NULL)
+			{
 			    /* origval may be freed by
 			     * did_set_string_option(), make a copy. */
 			    saved_origval = vim_strsave(origval);
+			    /* newval (and varp) may become invalid if the
+			     * buffer is closed by autocommands. */
+			    saved_newval = vim_strsave(newval);
+			}
 #endif
 
 			/* Handle side effects, and set the global value for
-			 * ":set" on local options. */
+			 * ":set" on local options. Note: when setting 'syntax'
+			 * or 'filetype' autocommands may be triggered that can
+			 * cause havoc. */
 			errmsg = did_set_string_option(opt_idx, (char_u **)varp,
 				new_value_alloced, oldval, errbuf, opt_flags);
 
@@ -5130,28 +5164,14 @@ do_set(
 			{
 #if defined(FEAT_AUTOCMD) && defined(FEAT_EVAL)
 			    vim_free(saved_origval);
+			    vim_free(saved_newval);
 #endif
 			    goto skip;
 			}
 #if defined(FEAT_AUTOCMD) && defined(FEAT_EVAL)
-			if (saved_origval != NULL)
-			{
-			    char_u buf_type[7];
-
-			    sprintf((char *)buf_type, "%s",
-				(opt_flags & OPT_LOCAL) ? "local" : "global");
-			    set_vim_var_string(VV_OPTION_NEW,
-							*(char_u **)varp, -1);
-			    set_vim_var_string(VV_OPTION_OLD, saved_origval, -1);
-			    set_vim_var_string(VV_OPTION_TYPE, buf_type, -1);
-			    apply_autocmds(EVENT_OPTIONSET,
-					  (char_u *)options[opt_idx].fullname,
-				NULL, FALSE, NULL);
-			    reset_v_option_vars();
-			    vim_free(saved_origval);
-			}
+			trigger_optionsset_string(opt_idx, opt_flags,
+						  saved_origval, saved_newval);
 #endif
-
 		    }
 		    else	    /* key code option */
 		    {
@@ -5922,6 +5942,7 @@ set_string_option(
     char_u	*oldval;
 #if defined(FEAT_AUTOCMD) && defined(FEAT_EVAL)
     char_u	*saved_oldval = NULL;
+    char_u	*saved_newval = NULL;
 #endif
     char_u	*r = NULL;
 
@@ -5945,26 +5966,19 @@ set_string_option(
 		&& options[opt_idx].indir != PV_KEY
 # endif
 		)
+	{
 	    saved_oldval = vim_strsave(oldval);
+	    saved_newval = vim_strsave(s);
+	}
 #endif
 	if ((r = did_set_string_option(opt_idx, varp, TRUE, oldval, NULL,
 							   opt_flags)) == NULL)
 	    did_set_option(opt_idx, opt_flags, TRUE);
 
-	/* call autocommand after handling side effects */
 #if defined(FEAT_AUTOCMD) && defined(FEAT_EVAL)
-	if (saved_oldval != NULL)
-	{
-	    char_u buf_type[7];
-	    sprintf((char *)buf_type, "%s",
-		(opt_flags & OPT_LOCAL) ? "local" : "global");
-	    set_vim_var_string(VV_OPTION_NEW, *varp, -1);
-	    set_vim_var_string(VV_OPTION_OLD, saved_oldval, -1);
-	    set_vim_var_string(VV_OPTION_TYPE, buf_type, -1);
-	    apply_autocmds(EVENT_OPTIONSET, (char_u *)options[opt_idx].fullname, NULL, FALSE, NULL);
-	    reset_v_option_vars();
-	    vim_free(saved_oldval);
-	}
+	/* call autocommand after handling side effects */
+	trigger_optionsset_string(opt_idx, opt_flags,
+						   saved_oldval, saved_newval);
 #endif
     }
     return r;

src/quickfix.c

@@ -3425,6 +3425,9 @@ qf_fill_buffer(qf_info_T *qi, buf_T *buf, qfline_T *old_last)
 	/* Set the 'filetype' to "qf" each time after filling the buffer.
 	 * This resembles reading a file into a buffer, it's more logical when
 	 * using autocommands. */
+#ifdef FEAT_AUTOCMD
+	++curbuf_lock;
+#endif
 	set_option_value((char_u *)"ft", 0L, (char_u *)"qf", OPT_LOCAL);
 	curbuf->b_p_ma = FALSE;
 
@@ -3435,6 +3438,7 @@ qf_fill_buffer(qf_info_T *qi, buf_T *buf, qfline_T *old_last)
 	apply_autocmds(EVENT_BUFWINENTER, (char_u *)"quickfix", NULL,
 							       FALSE, curbuf);
 	keep_filetype = FALSE;
+	--curbuf_lock;
 #endif
 	/* make sure it will be redrawn */
 	redraw_curbuf_later(NOT_VALID);

src/screen.c

@@ -5502,7 +5502,8 @@ win_line(
 	 * Also highlight the 'colorcolumn' if it is different than
 	 * 'cursorcolumn' */
 	vcol_save_attr = -1;
-	if (draw_state == WL_LINE && !lnum_in_visual_area)
+	if (draw_state == WL_LINE && !lnum_in_visual_area
+		&& search_attr == 0 && area_attr == 0)
 	{
 	    if (wp->w_p_cuc && VCOL_HLC == (long)wp->w_virtcol
 						 && lnum != wp->w_cursor.lnum)

src/syntax.c

@@ -1061,6 +1061,9 @@ syn_start_line(void)
 
     next_match_idx = -1;
     ++current_line_id;
+#ifdef FEAT_CONCEAL
+    next_seqnr = 1;
+#endif
 }
 
 /*
@@ -1857,6 +1860,7 @@ get_syntax_attr(
 #endif
 #ifdef FEAT_CONCEAL
 	current_flags = 0;
+	current_seqnr = 0;
 #endif
 	return 0;
     }
@@ -2346,6 +2350,7 @@ syn_current_attr(
 #endif
 #ifdef FEAT_CONCEAL
     current_flags = 0;
+    current_seqnr = 0;
 #endif
     if (cur_si != NULL)
     {

src/term.c

@@ -1801,9 +1801,8 @@ set_termname(char_u *term)
      * The termcode for the mouse is added as a side effect in option.c.
      */
     {
-	char_u	*p;
+	char_u	*p = (char_u *)"";
 
-	p = (char_u *)"";
 #  ifdef FEAT_MOUSE_XTERM
 	if (use_xterm_like_mouse(term))
 	{
@@ -1944,6 +1943,7 @@ set_termname(char_u *term)
 #  define HMT_PTERM	16
 #  define HMT_URXVT	32
 #  define HMT_SGR	64
+#  define HMT_SGR_REL	128
 static int has_mouse_termcode = 0;
 # endif
 
@@ -1987,6 +1987,8 @@ set_mouse_termcode(
 #   ifdef FEAT_MOUSE_SGR
     if (n == KS_SGR_MOUSE)
 	has_mouse_termcode |= HMT_SGR;
+    else if (n == KS_SGR_MOUSE_RELEASE)
+	has_mouse_termcode |= HMT_SGR_REL;
     else
 #   endif
 	has_mouse_termcode |= HMT_NORMAL;
@@ -2034,6 +2036,8 @@ del_mouse_termcode(
 #   ifdef FEAT_MOUSE_SGR
     if (n == KS_SGR_MOUSE)
 	has_mouse_termcode &= ~HMT_SGR;
+    else if (n == KS_SGR_MOUSE_RELEASE)
+	has_mouse_termcode &= ~HMT_SGR_REL;
     else
 #   endif
 	has_mouse_termcode &= ~HMT_NORMAL;
@@ -3940,7 +3944,7 @@ check_termcode(
     int		offset;
     char_u	key_name[2];
     int		modifiers;
-    char_u	*modifiers_start;
+    char_u	*modifiers_start = NULL;
     int		key;
     int		new_slen;
     int		extra;
@@ -4597,59 +4601,54 @@ check_termcode(
 		|| key_name[0] == KS_SGR_MOUSE
 		|| key_name[0] == KS_SGR_MOUSE_RELEASE)
 	    {
-		for (;;)
-		{
-		    /* URXVT 1015 mouse reporting mode:
-		     * Almost identical to xterm mouse mode, except the values
-		     * are decimal instead of bytes.
-		     *
-		     * \033[%d;%d;%dM
-		     *		  ^-- row
-		     *	       ^----- column
-		     *	    ^-------- code
-		     *
-		     * SGR 1006 mouse reporting mode:
-		     * Almost identical to xterm mouse mode, except the values
-		     * are decimal instead of bytes.
-		     *
-		     * \033[<%d;%d;%dM
-		     *		   ^-- row
-		     *	        ^----- column
-		     *	     ^-------- code
-		     *
-		     * \033[<%d;%d;%dm        : mouse release event
-		     *		   ^-- row
-		     *	        ^----- column
-		     *	     ^-------- code
-		     */
-		    p = modifiers_start;
-		    if (p == NULL)
-			return -1;
+		/* URXVT 1015 mouse reporting mode:
+		 * Almost identical to xterm mouse mode, except the values
+		 * are decimal instead of bytes.
+		 *
+		 * \033[%d;%d;%dM
+		 *		  ^-- row
+		 *	       ^----- column
+		 *	    ^-------- code
+		 *
+		 * SGR 1006 mouse reporting mode:
+		 * Almost identical to xterm mouse mode, except the values
+		 * are decimal instead of bytes.
+		 *
+		 * \033[<%d;%d;%dM
+		 *		   ^-- row
+		 *	        ^----- column
+		 *	     ^-------- code
+		 *
+		 * \033[<%d;%d;%dm        : mouse release event
+		 *		   ^-- row
+		 *	        ^----- column
+		 *	     ^-------- code
+		 */
+		p = modifiers_start;
+		if (p == NULL)
+		    return -1;
 
-		    mouse_code = getdigits(&p);
-		    if (*p++ != ';')
-			return -1;
+		mouse_code = getdigits(&p);
+		if (*p++ != ';')
+		    return -1;
 
-		    /* when mouse reporting is SGR, add 32 to mouse code */
-		    if (key_name[0] == KS_SGR_MOUSE
-					|| key_name[0] == KS_SGR_MOUSE_RELEASE)
-			mouse_code += 32;
+		/* when mouse reporting is SGR, add 32 to mouse code */
+		if (key_name[0] == KS_SGR_MOUSE
+				    || key_name[0] == KS_SGR_MOUSE_RELEASE)
+		    mouse_code += 32;
 
-		    if (key_name[0] == KS_SGR_MOUSE_RELEASE)
-			mouse_code |= MOUSE_RELEASE;
+		if (key_name[0] == KS_SGR_MOUSE_RELEASE)
+		    mouse_code |= MOUSE_RELEASE;
 
-		    mouse_col = getdigits(&p) - 1;
-		    if (*p++ != ';')
-			return -1;
+		mouse_col = getdigits(&p) - 1;
+		if (*p++ != ';')
+		    return -1;
 
-		    mouse_row = getdigits(&p) - 1;
+		mouse_row = getdigits(&p) - 1;
 
-		    /* The modifiers were the mouse coordinates, not the
-		     * modifier keys (alt/shift/ctrl/meta) state. */
-		    modifiers = 0;
-
-		    break;
-		}
+		/* The modifiers were the mouse coordinates, not the
+		 * modifier keys (alt/shift/ctrl/meta) state. */
+		modifiers = 0;
 	    }
 # endif
 

src/testdir/test_listlbr_utf8.vim

@@ -194,6 +194,21 @@ func Test_multibyte_sign_and_colorcolumn()
   call s:close_windows()
 endfunc
 
+func Test_colorcolumn_priority()
+  call s:test_windows('setl cc=4 cuc hls')
+  call setline(1, ["xxyy", ""])
+  norm! gg
+  exe "normal! /xxyy\<CR>"
+  norm! G
+  redraw!
+  let line_attr = s:screen_attr(1, [1, &cc])
+  " Search wins over CursorColumn
+  call assert_equal(line_attr[1], line_attr[0])
+  " Search wins over Colorcolumn
+  call assert_equal(line_attr[2], line_attr[3])
+  call s:close_windows('setl hls&vim')
+endfunc
+
 func Test_illegal_byte_and_breakat()
   call s:test_windows("setl sbr= brk+=<")
   vert resize 18

src/testdir/test_popup.vim

@@ -612,5 +612,19 @@ func Test_complete_func_mess()
   set completefunc=
 endfunc
 
+func Test_complete_CTRLN_startofbuffer()
+  new
+  call setline(1, [ 'organize(cupboard, 3, 2);',
+        \ 'prioritize(bureau, 8, 7);',
+        \ 'realize(bannister, 4, 4);',
+        \ 'moralize(railing, 3,9);'])
+  let expected=['cupboard.organize(3, 2);',
+        \ 'bureau.prioritize(8, 7);',
+        \ 'bannister.realize(4, 4);',
+        \ 'railing.moralize(3,9);']
+  call feedkeys("qai\<c-n>\<c-n>.\<esc>3wdW\<cr>q3@a", 'tx')
+  call assert_equal(expected, getline(1,'$'))
+  bwipe!
+endfunc
 
 " vim: shiftwidth=2 sts=2 expandtab

src/testdir/test_quickfix.vim

@@ -2190,7 +2190,7 @@ endfunc
 func Test_cclose_from_copen()
     augroup QF_Test
 	au!
-	au FileType qf :cclose
+        au FileType qf :call assert_fails(':cclose', 'E788')
     augroup END
     copen
     augroup QF_Test
@@ -2227,3 +2227,19 @@ func Test_Qf_Size()
   call XsizeTests('c')
   call XsizeTests('l')
 endfunc
+
+func Test_cclose_in_autocmd()
+  " Problem is only triggered if "starting" is zero, so that the OptionsSet
+  " event will be triggered.
+  call test_override('starting', 1)
+  augroup QF_Test
+    au!
+    au FileType qf :call assert_fails(':cclose', 'E788')
+  augroup END
+  copen
+  augroup QF_Test
+    au!
+  augroup END
+  augroup! QF_Test
+  call test_override('starting', 0)
+endfunc

src/testdir/test_syntax.vim

@@ -474,24 +474,24 @@ func Test_conceal()
 
   set conceallevel=0
   call assert_equal('123456 ', ScreenLines(2, 7)[0])
-  call assert_equal([[0, ''], [0, ''], [0, ''], [0, ''], [0, ''], [0, '']], map(range(1, 6), 'synconcealed(2, v:val)[0:1]'))
+  call assert_equal([[0, '', 0], [0, '', 0], [0, '', 0], [0, '', 0], [0, '', 0], [0, '', 0]], map(range(1, 6), 'synconcealed(2, v:val)'))
 
   set conceallevel=1
   call assert_equal('1X 6   ', ScreenLines(2, 7)[0])
-  call assert_equal([[0, ''], [1, 'X'], [1, 'X'], [1, ' '], [1, ' '], [0, '']], map(range(1, 6), 'synconcealed(2, v:val)[0:1]'))
+  call assert_equal([[0, '', 0], [1, 'X', 1], [1, 'X', 1], [1, ' ', 2], [1, ' ', 2], [0, '', 0]], map(range(1, 6), 'synconcealed(2, v:val)'))
 
   set conceallevel=1
   set listchars=conceal:Y
-  call assert_equal([[0, ''], [1, 'X'], [1, 'X'], [1, 'Y'], [1, 'Y'], [0, '']], map(range(1, 6), 'synconcealed(2, v:val)[0:1]'))
+  call assert_equal([[0, '', 0], [1, 'X', 1], [1, 'X', 1], [1, 'Y', 2], [1, 'Y', 2], [0, '', 0]], map(range(1, 6), 'synconcealed(2, v:val)'))
   call assert_equal('1XY6   ', ScreenLines(2, 7)[0])
 
   set conceallevel=2
   call assert_match('1X6    ', ScreenLines(2, 7)[0])
-  call assert_equal([[0, ''], [1, 'X'], [1, 'X'], [1, ''], [1, ''], [0, '']], map(range(1, 6), 'synconcealed(2, v:val)[0:1]'))
+  call assert_equal([[0, '', 0], [1, 'X', 1], [1, 'X', 1], [1, '', 2], [1, '', 2], [0, '', 0]], map(range(1, 6), 'synconcealed(2, v:val)'))
 
   set conceallevel=3
   call assert_match('16     ', ScreenLines(2, 7)[0])
-  call assert_equal([[0, ''], [1, ''], [1, ''], [1, ''], [1, ''], [0, '']], map(range(1, 6), 'synconcealed(2, v:val)[0:1]'))
+  call assert_equal([[0, '', 0], [1, '', 1], [1, '', 1], [1, '', 2], [1, '', 2], [0, '', 0]], map(range(1, 6), 'synconcealed(2, v:val)'))
 
   syn clear
   set conceallevel&

src/testdir/test_timers.vim

@@ -172,5 +172,21 @@ func Test_stop_all_in_callback()
   call assert_equal(0, len(info))
 endfunc
 
+func FeedkeysCb(timer)
+  call feedkeys("hello\<CR>", 'nt')
+endfunc
+
+func InputCb(timer)
+  call timer_start(10, 'FeedkeysCb')
+  let g:val = input('?')
+  call Resume()
+endfunc
+
+func Test_input_in_timer()
+  let g:val = ''
+  call timer_start(10, 'InputCb')
+  call Standby(1000)
+  call assert_equal('hello', g:val)
+endfunc
 
 " vim: shiftwidth=2 sts=2 expandtab

src/testdir/test_vimscript.vim

@@ -1379,6 +1379,11 @@ func Test_endfunction_trailing()
     delfunc Xtest
     unlet done
 
+    " trailing line break
+    exe "func Xtest()\necho 'hello'\nendfunc\n"
+    call assert_true(exists('*Xtest'))
+    delfunc Xtest
+
     set verbose=1
     exe "func Xtest()\necho 'hello'\nendfunc \" garbage"
     call assert_notmatch('W22:', split(execute('1messages'), "\n")[0])
@@ -1390,6 +1395,11 @@ func Test_endfunction_trailing()
     call assert_true(exists('*Xtest'))
     delfunc Xtest
     set verbose=0
+
+    function Foo()
+	echo 'hello'
+    endfunction | echo 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+    delfunc Foo
 endfunc
 
 func Test_delfunction_force()

src/testdir/test_window_cmd.vim

@@ -318,6 +318,50 @@ func Test_window_width()
   bw Xa Xb Xc
 endfunc
 
+func Test_equalalways_on_close()
+  set equalalways
+  vsplit
+  windo split
+  split 
+  wincmd J
+  " now we have a frame top-left with two windows, a frame top-right with two
+  " windows and a frame at the bottom, full-width.
+  let height_1 = winheight(1)
+  let height_2 = winheight(2)
+  let height_3 = winheight(3)
+  let height_4 = winheight(4)
+  " closing the bottom window causes all windows to be resized.
+  close
+  call assert_notequal(height_1, winheight(1))
+  call assert_notequal(height_2, winheight(2))
+  call assert_notequal(height_3, winheight(3))
+  call assert_notequal(height_4, winheight(4))
+  call assert_equal(winheight(1), winheight(3))
+  call assert_equal(winheight(2), winheight(4))
+
+  1wincmd w
+  split
+  4wincmd w
+  resize + 5
+  " left column has three windows, equalized heights.
+  " right column has two windows, top one a bit higher
+  let height_1 = winheight(1)
+  let height_2 = winheight(2)
+  let height_4 = winheight(4)
+  let height_5 = winheight(5)
+  3wincmd w
+  " closing window in left column equalizes heights in left column but not in
+  " the right column
+  close
+  call assert_notequal(height_1, winheight(1))
+  call assert_notequal(height_2, winheight(2))
+  call assert_equal(height_4, winheight(3))
+  call assert_equal(height_5, winheight(4))
+
+  only
+  set equalalways&
+endfunc
+
 func Test_window_jump_tag()
   help
   /iccf

src/userfunc.c

@@ -1780,6 +1780,7 @@ theend:
 ex_function(exarg_T *eap)
 {
     char_u	*theline;
+    char_u	*line_to_free = NULL;
     int		j;
     int		c;
     int		saved_did_emsg;
@@ -2093,10 +2094,15 @@ ex_function(exarg_T *eap)
 		line_arg = p + 1;
 	    }
 	}
-	else if (eap->getline == NULL)
-	    theline = getcmdline(':', 0L, indent);
 	else
-	    theline = eap->getline(':', eap->cookie, indent);
+	{
+	    vim_free(line_to_free);
+	    if (eap->getline == NULL)
+		theline = getcmdline(':', 0L, indent);
+	    else
+		theline = eap->getline(':', eap->cookie, indent);
+	    line_to_free = theline;
+	}
 	if (KeyTyped)
 	    lines_left = Rows - 1;
 	if (theline == NULL)
@@ -2130,18 +2136,29 @@ ex_function(exarg_T *eap)
 	    /* Check for "endfunction". */
 	    if (checkforcmd(&p, "endfunction", 4) && nesting-- == 0)
 	    {
+		char_u *nextcmd = NULL;
+
 		if (*p == '|')
-		    /* Another command follows. */
-		    eap->nextcmd = vim_strsave(p + 1);
+		    nextcmd = p + 1;
 		else if (line_arg != NULL && *skipwhite(line_arg) != NUL)
-		    /* Another command follows. */
-		    eap->nextcmd = line_arg;
+		    nextcmd = line_arg;
 		else if (*p != NUL && *p != '"' && p_verbose > 0)
 		    give_warning2(
 			 (char_u *)_("W22: Text found after :endfunction: %s"),
 			 p, TRUE);
-		if (line_arg == NULL)
-		    vim_free(theline);
+		if (nextcmd != NULL)
+		{
+		    /* Another command follows. If the line came from "eap" we
+		     * can simply point into it, otherwise we need to change
+		     * "eap->cmdlinep". */
+		    eap->nextcmd = nextcmd;
+		    if (line_to_free != NULL)
+		    {
+			vim_free(*eap->cmdlinep);
+			*eap->cmdlinep = line_to_free;
+			line_to_free = NULL;
+		    }
+		}
 		break;
 	    }
 
@@ -2212,24 +2229,15 @@ ex_function(exarg_T *eap)
 
 	/* Add the line to the function. */
 	if (ga_grow(&newlines, 1 + sourcing_lnum_off) == FAIL)
-	{
-	    if (line_arg == NULL)
-		vim_free(theline);
 	    goto erret;
-	}
 
 	/* Copy the line to newly allocated memory.  get_one_sourceline()
 	 * allocates 250 bytes per line, this saves 80% on average.  The cost
 	 * is an extra alloc/free. */
 	p = vim_strsave(theline);
-	if (p != NULL)
-	{
-	    if (line_arg == NULL)
-		vim_free(theline);
-	    theline = p;
-	}
-
-	((char_u **)(newlines.ga_data))[newlines.ga_len++] = theline;
+	if (p == NULL)
+	    goto erret;
+	((char_u **)(newlines.ga_data))[newlines.ga_len++] = p;
 
 	/* Add NULL lines for continuation lines, so that the line count is
 	 * equal to the index in the growarray.   */
@@ -2428,6 +2436,7 @@ errret_2:
     ga_clear_strings(&newlines);
 ret_free:
     vim_free(skip_until);
+    vim_free(line_to_free);
     vim_free(fudi.fd_newkey);
     vim_free(name);
     did_emsg |= saved_did_emsg;

src/version.c

@@ -764,6 +764,38 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    679,
+/**/
+    678,
+/**/
+    677,
+/**/
+    676,
+/**/
+    675,
+/**/
+    674,
+/**/
+    673,
+/**/
+    672,
+/**/
+    671,
+/**/
+    670,
+/**/
+    669,
+/**/
+    668,
+/**/
+    667,
+/**/
+    666,
+/**/
+    665,
+/**/
+    664,
 /**/
     663,
 /**/

src/window.c

@@ -2282,6 +2282,7 @@ win_close(win_T *win, int free_buf)
     int		dir;
     int		help_window = FALSE;
     tabpage_T   *prev_curtab = curtab;
+    frame_T	*win_frame = win->w_frame->fr_parent;
 
     if (last_window())
     {
@@ -2459,7 +2460,9 @@ win_close(win_T *win, int free_buf)
 	check_cursor();
     }
     if (p_ea && (*p_ead == 'b' || *p_ead == dir))
-	win_equal(curwin, TRUE, dir);
+	/* If the frame of the closed window contains the new current window,
+	 * only resize that frame.  Otherwise resize all windows. */
+	win_equal(curwin, curwin->w_frame->fr_parent == win_frame, dir);
     else
 	win_comp_pos();
     if (close_curwin)