Repository: neovim
Issue: Crash when dict watcher accesses window buffer info when closing window with bufhidden=unload
Labels: has:repro,has:backtrace,bug-crash

### Neovim version (nvim -v)

v0.9.0-dev-510+g0887ad1cb

### Vim (not Nvim) behaves the same?

N/A

### Operating system/version

Arch Linux

### Terminal name/version

kitty 0.26.5

### $TERM environment variable

xterm-kitty

### Installation

build from repo

### How to reproduce the issue

1. Run `nvim --clean`
2. Source the following file:
```vim
new
set bufhidden=unload
call dictwatcheradd(b:, 'changedtick', {-> tabpagebuflist()})
close
```

### Expected behavior

No crash

### Actual behavior

Crash
```
**/src/nvim/eval/funcs.c:8450:63: runtime error: member access within null pointer of type 'buf_T' (aka 'struct file_buffer')
    #0 0x5591f47870a9 in f_tabpagebuflist **/src/nvim/eval/funcs.c:8450:63
    #1 0x5591f46ed3ea in call_internal_func **/src/nvim/eval/funcs.c:242:3
    #2 0x5591f47f548d in call_func **/src/nvim/eval/userfunc.c:1621:15
    #3 0x5591f47f25b5 in get_func_tv **/src/nvim/eval/userfunc.c:494:11
    #4 0x5591f4664c03 in eval_func **/src/nvim/eval.c:2244:13
    #5 0x5591f465b79c in eval7 **/src/nvim/eval.c:3118:15
    #6 0x5591f4656ecb in eval6 **/src/nvim/eval.c:2783:7
    #7 0x5591f46545e2 in eval5 **/src/nvim/eval.c:2618:7
    #8 0x5591f4653020 in eval4 **/src/nvim/eval.c:2520:7
    #9 0x5591f4652542 in eval3 **/src/nvim/eval.c:2451:7
    #10 0x5591f4602bd2 in eval2 **/src/nvim/eval.c:2394:7
    #11 0x5591f45f2b04 in eval1 **/src/nvim/eval.c:2332:7
    #12 0x5591f47fbf80 in call_user_func **/src/nvim/eval/userfunc.c:1113:11
    #13 0x5591f4807082 in call_user_func_check **/src/nvim/eval/userfunc.c:1254:5
    #14 0x5591f47f5041 in call_func **/src/nvim/eval/userfunc.c:1612:17
    #15 0x5591f461e955 in callback_call **/src/nvim/eval.c:5617:10
    #16 0x5591f47bfafa in tv_dict_watcher_notify **/src/nvim/eval/typval.c:1796:3
    #17 0x5591f43f734a in buf_set_changedtick **/src/nvim/buffer.h:104:5
    #18 0x5591f43f734a in buf_inc_changedtick **/src/nvim/buffer.h:135:3
    #19 0x5591f43f734a in unchanged **/src/nvim/change.c:554:5
    #20 0x5591f43ac3cd in buf_clear_file **/src/nvim/buffer.c:719:3
    #21 0x5591f43a268f in close_buffer **/src/nvim/buffer.c:706:5
    #22 0x5591f5978efe in win_close_buffer **/src/nvim/window.c:2644:5
    #23 0x5591f592dd82 in win_close **/src/nvim/window.c:2796:3
    #24 0x5591f492a2a5 in ex_win_close **/src/nvim/ex_docmd.c:4654:5
    #25 0x5591f4937417 in ex_close **/src/nvim/ex_docmd.c:4594:7
    #26 0x5591f4912daf in execute_cmd0 **/src/nvim/ex_docmd.c:1621:7
    #27 0x5591f48ef144 in do_one_cmd **/src/nvim/ex_docmd.c:2278:7
    #28 0x5591f48dfaae in do_cmdline **/src/nvim/ex_docmd.c:579:20
    #29 0x5591f5313046 in do_source **/src/nvim/runtime.c:2057:5
    #30 0x5591f530e71d in cmd_source **/src/nvim/runtime.c:1639:14
    #31 0x5591f530e29d in ex_source **/src/nvim/runtime.c:1647:3
    #32 0x5591f4912daf in execute_cmd0 **/src/nvim/ex_docmd.c:1621:7
    #33 0x5591f48ef144 in do_one_cmd **/src/nvim/ex_docmd.c:2278:7
    #34 0x5591f48dfaae in do_cmdline **/src/nvim/ex_docmd.c:579:20
    #35 0x5591f4f83b6b in nv_colon **/src/nvim/normal.c:3213:20
    #36 0x5591f4f6fda5 in normal_execute **/src/nvim/normal.c:1180:3
    #37 0x5591f5580ac7 in state_enter **/src/nvim/state.c:99:26
    #38 0x5591f4f538a0 in normal_enter **/src/nvim/normal.c:477:3
    #39 0x5591f4c60070 in main **/src/nvim/main.c:595:3
    #40 0x7f912f13628f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #41 0x7f912f136349 in __libc_start_main (/usr/lib/libc.so.6+0x23349) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #42 0x5591f3fdad44 in _start /build/glibc/src/glibc/csu/../sysdeps/x86_64/start.S:115

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior **/src/nvim/eval/funcs.c:8450:63 in 
```