source-file and some other commands can recurse back into cmdq_continue,

which could potentially free the currently running command, so we need
to take a reference to it in cmdq_continue_one.

Fixes problem reported by Theo Buehler.

3 files changed, 17 insertions, 6 deletions

diff --git a/cfg.c b/cfg.c
index d45573ea..801056db 100644
--- a/cfg.c
+++ b/cfg.c
@@ -129,7 +129,10 @@ load_cfg(const char *path, struct cmd_q *cmdq, int quiet)
 static void
 cfg_default_done(__unused struct cmd_q *cmdq)
 {
-	if (--cfg_references != 0)
+	log_debug("%s: %u references%s", __func__, cfg_references,
+	    cfg_finished ? " (finished)" : "");
+
+	if (cfg_finished || --cfg_references != 0)
 		return;
 	cfg_finished = 1;
 
diff --git a/cmd-queue.c b/cmd-queue.c
index 8b28dd65..bafff1d6 100644
--- a/cmd-queue.c
+++ b/cmd-queue.c
@@ -55,6 +55,8 @@ cmdq_new(struct client *c)
 int
 cmdq_free(struct cmd_q *cmdq)
 {
+	log_debug("cmdq %p free: %u references", cmdq, cmdq->references);
+
 	if (--cmdq->references != 0) {
 		if (cmdq->flags & CMD_Q_DEAD)
 			return (1);
@@ -186,6 +188,7 @@ cmdq_append(struct cmd_q *cmdq, struct cmd_list *cmdlist, struct mouse_event *m)
 static enum cmd_retval
 cmdq_continue_one(struct cmd_q *cmdq)
 {
+	struct cmd_list		*cmdlist = cmdq->item->cmdlist;
 	struct cmd		*cmd = cmdq->cmd;
 	enum cmd_retval		 retval;
 	char			*tmp;
@@ -193,6 +196,8 @@ cmdq_continue_one(struct cmd_q *cmdq)
 	const char		*name;
 	struct cmd_find_state	*fsp, fs;
 
+	cmdlist->references++;
+
 	tmp = cmd_print(cmd);
 	log_debug("cmdq %p: %s", cmdq, tmp);
 	free(tmp);
@@ -225,10 +230,12 @@ cmdq_continue_one(struct cmd_q *cmdq)
 
 end:
 	cmdq_guard(cmdq, "end", flags);
+	cmd_list_free(cmdlist);
 	return (retval);
 
 error:
 	cmdq_guard(cmdq, "error", flags);
+	cmd_list_free(cmdlist);
 	return (CMD_RETURN_ERROR);
 }
 
@@ -244,8 +251,7 @@ cmdq_continue(struct cmd_q *cmdq)
 	cmdq->references++;
 	notify_disable();
 
-	log_debug("continuing cmdq %p: flags %#x, client %p", cmdq, cmdq->flags,
-	    c);
+	log_debug("continuing cmdq %p: flags %#x (%p)", cmdq, cmdq->flags, c);
 
 	empty = TAILQ_EMPTY(&cmdq->queue);
 	if (empty)
@@ -282,6 +288,7 @@ cmdq_continue(struct cmd_q *cmdq)
 	} while (cmdq->item != NULL);
 
 empty:
+	log_debug("cmdq %p empty", cmdq);
 	if (cmdq->client_exit > 0)
 		cmdq->client->flags |= CLIENT_EXIT;
 	if (cmdq->emptyfn != NULL)
diff --git a/cmd-source-file.c b/cmd-source-file.c
index 0f299ddf..336a79e6 100644
--- a/cmd-source-file.c
+++ b/cmd-source-file.c
@@ -68,6 +68,8 @@ cmd_source_file_exec(struct cmd *self, struct cmd_q *cmdq)
 		return (CMD_RETURN_NORMAL);
 	}
 
+	log_debug("%s: cmdq %p, parent %p", __func__, cmdq1, cmdq);
+
 	cmdq->references++;
 	cfg_references++;
 
@@ -80,16 +82,15 @@ cmd_source_file_done(struct cmd_q *cmdq1)
 {
 	struct cmd_q	*cmdq = cmdq1->data;
 
+	log_debug("%s: cmdq %p, parent %p", __func__, cmdq1, cmdq);
+
 	if (cmdq1->client_exit >= 0)
 		cmdq->client_exit = cmdq1->client_exit;
-
 	cmdq_free(cmdq1);
 
 	cfg_references--;
-
 	if (cmdq_free(cmdq))
 		return;
-
 	if (cfg_references == 0)
 		cfg_print_causes(cmdq);
 	cmdq_continue(cmdq);