fix(buffer): don't allow changedtick watcher to delete buffer (#36764)

zeertzjq · github-actions[bot] · commit 9fb49aacde6e · 2025-12-01T01:47:44.000Z
(cherry picked from commit 14d65da)
diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
@@ -4160,9 +4160,11 @@ void buf_set_changedtick(buf_T *const buf, const varnumber_T changedtick)
   buf->changedtick_di.di_tv.vval.v_number = changedtick;
 
   if (tv_dict_is_watched(buf->b_vars)) {
+    buf->b_locked++;
     tv_dict_watcher_notify(buf->b_vars,
                            (char *)buf->changedtick_di.di_key,
                            &buf->changedtick_di.di_tv,
                            &old_val);
+    buf->b_locked--;
   }
 }
diff --git a/test/functional/ex_cmds/dict_notifications_spec.lua b/test/functional/ex_cmds/dict_notifications_spec.lua
@@ -428,6 +428,11 @@ describe('Vimscript dictionary notifications', function()
     command([[call dictwatcherdel(b:, 'changedtick', 'OnTickChanged')]])
     insert('t')
     assert_alive()
+
+    command([[call dictwatcheradd(b:, 'changedtick', {-> execute('bwipe!')})]])
+    insert('t')
+    eq('E937: Attempt to delete a buffer that is in use: [No Name]', api.nvim_get_vvar('errmsg'))
+    assert_alive()
   end)
 
   it('does not cause use-after-free when unletting from callback', function()

Original file line number	Diff line number	Diff line change
`@@ -4160,9 +4160,11 @@ void buf_set_changedtick(buf_T *const buf, const varnumber_T changedtick)`
`4160`	`4160`	`buf->changedtick_di.di_tv.vval.v_number = changedtick;`
`4161`	`4161`
`4162`	`4162`	`if (tv_dict_is_watched(buf->b_vars)) {`
	`4163`	`+ buf->b_locked++;`
`4163`	`4164`	`tv_dict_watcher_notify(buf->b_vars,`
`4164`	`4165`	`(char *)buf->changedtick_di.di_key,`
`4165`	`4166`	`&buf->changedtick_di.di_tv,`
`4166`	`4167`	`&old_val);`
	`4168`	`+ buf->b_locked--;`
`4167`	`4169`	`}`
`4168`	`4170`	`}`