patch 8.0.0342: double free with EXITFREE and setting 'ttytype'

Problem:    Double free when compiled with EXITFREE and setting 'ttytype'.
Solution:   Avoid setting P_ALLOCED on 'ttytype'. (Dominique Pelle,
            closes #1461)

src/buffer.c

@@ -888,8 +888,13 @@ init_changedtick(buf_T *buf)
 	di->di_tv.v_type = VAR_NUMBER;
 	di->di_tv.v_lock = VAR_FIXED;
 	di->di_tv.vval.v_number = 0;
-	dict_add(buf->b_vars, di);
-	buf->b_changedtick = &di->di_tv.vval.v_number;
+	if (dict_add(buf->b_vars, di) == OK)
+	    buf->b_changedtick = &di->di_tv.vval.v_number;
+	else
+	{
+	    vim_free(di);
+	    buf->b_changedtick = &buf->b_ct_val;
+	}
     }
     else
 #endif

src/edit.c

@@ -3583,7 +3583,11 @@ ins_compl_addleader(int c)
 {
 #ifdef FEAT_MBYTE
     int		cc;
+#endif
 
+    if (stop_arrow() == FAIL)
+	return;
+#ifdef FEAT_MBYTE
     if (has_mbyte && (cc = (*mb_char2len)(c)) > 1)
     {
 	char_u	buf[MB_MAXBYTES + 1];

src/option.c

@@ -3775,7 +3775,7 @@ free_all_options(void)
 	if (options[i].indir == PV_NONE)
 	{
 	    /* global option: free value and default value. */
-	    if (options[i].flags & P_ALLOCED && options[i].var != NULL)
+	    if ((options[i].flags & P_ALLOCED) && options[i].var != NULL)
 		free_string_option(*(char_u **)options[i].var);
 	    if (options[i].flags & P_DEF_ALLOCED)
 		free_string_option(options[i].def_val[VI_DEFAULT]);
@@ -5929,8 +5929,14 @@ did_set_string_option(
 	else if (set_termname(T_NAME) == FAIL)
 	    errmsg = (char_u *)N_("E522: Not found in termcap");
 	else
+	{
 	    /* Screen colors may have changed. */
 	    redraw_later_clear();
+
+	    /* Both 'term' and 'ttytype' point to T_NAME, only set the
+	     * P_ALLOCED flag on 'term'. */
+	    opt_idx = findoption((char_u *)"term");
+	}
     }
 
     /* 'backupcopy' */

src/search.c

@@ -4357,6 +4357,10 @@ current_quote(
     /* Correct cursor when 'selection' is exclusive */
     if (VIsual_active)
     {
+	/* this only works within one line */
+	if (VIsual.lnum != curwin->w_cursor.lnum)
+	    return FALSE;
+
 	vis_bef_curs = lt(VIsual, curwin->w_cursor);
 	if (*p_sel == 'e' && vis_bef_curs)
 	    dec_cursor();

src/testdir/test_options.vim

@@ -235,3 +235,22 @@ func Test_set_errors()
   call assert_fails("set showbreak=\x01", 'E595:')
   call assert_fails('set t_foo=', 'E846:')
 endfunc
+
+func Test_set_ttytype()
+  if !has('gui_running') && has('unix')
+    " Setting 'ttytype' used to cause a double-free when exiting vim and
+    " when vim is compiled with -DEXITFREE.
+    set ttytype=ansi
+    call assert_equal('ansi', &ttytype)
+    call assert_equal(&ttytype, &term)
+    set ttytype=xterm
+    call assert_equal('xterm', &ttytype)
+    call assert_equal(&ttytype, &term)
+    " FIXME: "set ttytype=" gives E522 instead of E529
+    " in travis on some builds. Why? Commented out this test for now.
+    " call assert_fails('set ttytype=', 'E529:')
+    call assert_fails('set ttytype=xxx', 'E522:')
+    set ttytype&
+    call assert_equal(&ttytype, &term)
+  endif
+endfunc

src/testdir/test_popup.vim

@@ -531,4 +531,24 @@ func Test_completion_respect_bs_option()
   bw!
 endfunc
 
+func CompleteUndo() abort
+  call complete(1, g:months)
+  return ''
+endfunc
+
+func Test_completion_can_undo()
+  inoremap <Right> <c-r>=CompleteUndo()<cr>
+  set completeopt+=noinsert,noselect
+
+  new
+  call feedkeys("a\<Right>a\<Esc>", 'xt')
+  call assert_equal('a', getline(1))
+  undo
+  call assert_equal('', getline(1))
+
+  bwipe!
+  set completeopt&
+  iunmap <Right>
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

src/testdir/test_recover.vim

@@ -7,6 +7,10 @@ func Test_recover_root_dir()
   call assert_fails('recover', 'E305:')
   close!
 
+  if has('win32')
+    " can write in / directory on MS-Windows
+    set dir=/notexist/
+  endif
   call assert_fails('split Xtest', 'E303:')
   set dir&
 endfunc

src/testdir/test_visual.vim

@@ -43,3 +43,10 @@ func Test_Visual_vapo()
   normal vapo
   bwipe!
 endfunc
+
+func Test_Visual_inner_quote()
+  new
+  normal oxX
+  normal vki'
+  bwipe!
+endfunc

src/version.c

@@ -764,6 +764,16 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    342,
+/**/
+    341,
+/**/
+    340,
+/**/
+    339,
+/**/
+    338,
 /**/
     337,
 /**/