channels: delay free so that libuv can cleanup handles

add test for a crash this caused

src/nvim/channel.c

@@ -245,7 +245,8 @@ void channel_incref(Channel *channel)
 void channel_decref(Channel *channel)
 {
   if (!(--channel->refcount)) {
-    multiqueue_put(main_loop.fast_events, free_channel_event, 1, channel);
+    // delay free, so that libuv is done with the handles
+    multiqueue_put(main_loop.events, free_channel_event, 1, channel);
   }
 }
 
@@ -286,12 +287,15 @@ static void channel_destroy_early(Channel *chan)
   if ((chan->id != --next_chan_id)) {
     abort();
   }
+  pmap_del(uint64_t)(channels, chan->id);
+  chan->id = 0;
 
   if ((--chan->refcount != 0)) {
     abort();
   }
 
-  free_channel_event((void **)&chan);
+  // uv will keep a reference to handles until next loop tick, so delay free
+  multiqueue_put(main_loop.events, free_channel_event, 1, chan);
 }
 
 

test/functional/core/job_spec.lua

@@ -640,6 +640,21 @@ describe('jobs', function()
     ok(string.find(err, "E475: Invalid argument: job cannot have both 'pty' and 'rpc' options set") ~= nil)
   end)
 
+  it('does not crash when repeatedly failing to start shell', function()
+    source([[
+      set shell=nosuchshell
+      func! DoIt()
+        call jobstart('true')
+        call jobstart('true')
+      endfunc
+    ]])
+    -- The crash only triggered if both jobs are cleaned up on the same event
+    -- loop tick. This is also prevented by try-block, so feed must be used.
+    feed_command("call DoIt()")
+    feed('<cr>') -- press RETURN
+    eq(2,eval('1+1'))
+  end)
+
   it('jobstop() kills entire process tree #6530', function()
     command('set shell& shellcmdflag& shellquote& shellpipe& shellredir& shellxquote&')