Repository: neovim
Issue: Segfault when new window is created inside WinLeave event callback
Labels: has:backtrace,bug-crash,floatwin,events

### Problem

If new window is created in WinLeave event callback when closing current tab page, neovim segfaults with the following stack trace:

```
Program received signal SIGSEGV, Segmentation fault.
0x0000559beb72f584 in frame2win (frp=0x0) at /home/apollo1321/neovim/src/nvim/window.c:3474
3474      while (frp->fr_win == NULL) {
(gdb) bt
#0  0x0000559beb72f584 in frame2win (frp=0x0) at /home/apollo1321/neovim/src/nvim/window.c:3474
#1  0x0000559beb72ec33 in winframe_find_altwin (win=0x559becc7d780, dirp=0x7ffe293b5048, tp=0x559becb5c7b0, altfr=0x7ffe293b4f98) at /home/apollo1321/neovim/src/nvim/window.c:3211
#2  0x0000559beb72e9f6 in winframe_remove (win=0x559becc7d780, dirp=0x7ffe293b5048, tp=0x559becb5c7b0, unflat_altfr=0x0) at /home/apollo1321/neovim/src/nvim/window.c:3148
#3  0x0000559beb72e94d in win_free_mem (win=0x559becc7d780, dirp=0x7ffe293b5048, tp=0x559becb5c7b0) at /home/apollo1321/neovim/src/nvim/window.c:3072
#4  0x0000559beb72e8ac in win_close_othertab (win=0x559becc7d780, free_buf=0, tp=0x559becb5c7b0) at /home/apollo1321/neovim/src/nvim/window.c:3050
#5  0x0000559beb72d9ec in close_last_window_tabpage (win=0x559becc7d780, free_buf=false, prev_curtab=0x559becb5c7b0) at /home/apollo1321/neovim/src/nvim/window.c:2609
#6  0x0000559beb72dd9b in win_close (win=0x559becc7d780, free_buf=false, force=false) at /home/apollo1321/neovim/src/nvim/window.c:2711
#7  0x0000559beb4d1a03 in ex_quit (eap=0x7ffe293b5280) at /home/apollo1321/neovim/src/nvim/ex_docmd.c:4776
#8  0x0000559beb4c9970 in execute_cmd0 (retv=0x7ffe293b5238, eap=0x7ffe293b5280, errormsg=0x7ffe293b5250, preview=false) at /home/apollo1321/neovim/src/nvim/ex_docmd.c:1714
#9  0x0000559beb4cb829 in do_one_cmd (cmdlinep=0x7ffe293b54a0, flags=0, cstack=0x7ffe293b55b0, fgetline=0x559beb4e47c7 <getexline>, cookie=0x0) at /home/apollo1321/neovim/src/nvim/ex_docmd.c:2358
#10 0x0000559beb4c730b in do_cmdline (cmdline=0x0, fgetline=0x559beb4e47c7 <getexline>, cookie=0x0, flags=0) at /home/apollo1321/neovim/src/nvim/ex_docmd.c:667
#11 0x0000559beb5ce4ab in nv_colon (cap=0x7ffe293b5c20) at /home/apollo1321/neovim/src/nvim/normal.c:3191
#12 0x0000559beb5c9f0e in normal_execute (state=0x7ffe293b5bb0, key=58) at /home/apollo1321/neovim/src/nvim/normal.c:1243
#13 0x0000559beb6a98c5 in state_enter (s=0x7ffe293b5bb0) at /home/apollo1321/neovim/src/nvim/state.c:102
#14 0x0000559beb5c806d in normal_enter (cmdwin=false, noexmode=false) at /home/apollo1321/neovim/src/nvim/normal.c:521
#15 0x0000559beb56b798 in main (argc=2, argv=0x7ffe293b5fb8) at /home/apollo1321/neovim/src/nvim/main.c:660
```

Related to https://github.com/nvim-treesitter/nvim-treesitter-context/issues/522

### Steps to reproduce

```
cat > init.lua << EOF 
vim.api.nvim_create_autocmd({ "WinLeave" }, {
  callback = function()
    local buf = vim.api.nvim_create_buf(false, true)
    vim.api.nvim_open_win(buf, false, {
      win = 0,
      relative = "win",
      row = 10,
      col = 2,
      width = 12,
      height = 3,
      border = "single",
    })
  end
})
EOF

nvim --clean -c "source init.lua"

:tab split
:q
```


### Expected behavior

No segfault

### Nvim version (nvim -v)

v0.11.0-dev-29ded8895

### Vim (not Nvim) behaves the same?

N/A

### Operating system/version

Linux 6.8.0-48-generic

### Terminal name/version

iterm 2, 3.5.3

### $TERM environment variable

xterm-256color

### Installation

build from repo