fix(terminal): return early if there are no invalid rows

Prevent on_lines emitting out-of-bounds line indexes.

2 files changed, 44 insertions, 1 deletions

diff --git a/src/nvim/terminal.c b/src/nvim/terminal.c
index 83ade74db1..e7c2713e10 100644
--- a/src/nvim/terminal.c
+++ b/src/nvim/terminal.c
@@ -1508,6 +1508,13 @@ static void refresh_screen(Terminal *term, buf_T *buf)
   // Terminal height may have decreased before `invalid_end` reflects it.
   term->invalid_end = MIN(term->invalid_end, height);
 
+  // There are no invalid rows.
+  if (term->invalid_start >= term->invalid_end) {
+    term->invalid_start = INT_MAX;
+    term->invalid_end = -1;
+    return;
+  }
+
   for (int r = term->invalid_start, linenr = row_to_linenr(term, r);
        r < term->invalid_end; r++, linenr++) {
     fetch_row(term, r, width);
diff --git a/test/functional/terminal/buffer_spec.lua b/test/functional/terminal/buffer_spec.lua
index 7dcca231ee..f25cfa2039 100644
--- a/test/functional/terminal/buffer_spec.lua
+++ b/test/functional/terminal/buffer_spec.lua
@@ -6,9 +6,11 @@ local poke_eventloop = helpers.poke_eventloop
 local eval, feed_command, source = helpers.eval, helpers.feed_command, helpers.source
 local eq, neq = helpers.eq, helpers.neq
 local write_file = helpers.write_file
-local command= helpers.command
+local command = helpers.command
 local exc_exec = helpers.exc_exec
 local matches = helpers.matches
+local exec_lua = helpers.exec_lua
+local sleep = helpers.sleep
 
 describe(':terminal buffer', function()
   local screen
@@ -328,3 +330,37 @@ describe('No heap-buffer-overflow when', function()
     assert_alive()
   end)
 end)
+
+describe('on_lines does not emit out-of-bounds line indexes when', function()
+  before_each(function()
+    clear()
+    exec_lua([[
+      function _G.register_callback(bufnr)
+        _G.cb_error = ''
+        vim.api.nvim_buf_attach(bufnr, false, {
+          on_lines = function(_, bufnr, _, firstline, _, _)
+            local status, msg = pcall(vim.api.nvim_buf_get_offset, bufnr, firstline)
+            if not status then
+              _G.cb_error = msg
+            end
+          end
+        })
+      end
+    ]])
+  end)
+
+  it('creating a terminal buffer #16394', function()
+    feed_command([[autocmd TermOpen * ++once call v:lua.register_callback(expand("<abuf>"))]])
+    feed_command('terminal')
+    sleep(500)
+    eq('', exec_lua([[return _G.cb_error]]))
+  end)
+
+  it('deleting a terminal buffer #16394', function()
+    feed_command('terminal')
+    sleep(500)
+    feed_command('lua _G.register_callback(0)')
+    feed_command('bdelete!')
+    eq('', exec_lua([[return _G.cb_error]]))
+  end)
+end)