mirror of
https://github.com/neovim/neovim.git
synced 2026-08-02 20:23:54 +08:00
6f370f34f2
Problem: Closing a floating window from a non-current tab frees its grid without removing it from the compositor's `layers` table, so the next `ui_comp_put_grid()` walks a dangling pointer (UAF). Solution: Call `ui_comp_remove_grid()` (and `ui_call_win_close()` for multigrid UIs) before `win_free_mem()`, matching `win_close()` since PR #21551.