fix(ui): avoid recursiveness and invalid memory access #28578

Problem:  Calling :redraw from vim.ui_attach() callback results in
          recursive cmdline/message events.
Solution: Avoid recursiveness where possible and replace global "call_buf"
          with separate, temporary buffers for each event so that when a Lua
          callback for one event fires another event, that does not result
          in invalid memory access.

1 files changed, 7 insertions, 4 deletions

diff --git a/src/nvim/generators/gen_api_ui_events.lua b/src/nvim/generators/gen_api_ui_events.lua
index 0808f71daa..516b5ad5ae 100644
--- a/src/nvim/generators/gen_api_ui_events.lua
+++ b/src/nvim/generators/gen_api_ui_events.lua
@@ -31,6 +31,10 @@ local function write_signature(output, ev, prefix, notype)
 end
 
 local function write_arglist(output, ev)
+  if #ev.parameters == 0 then
+    return
+  end
+  output:write('  MAXSIZE_TEMP_ARRAY(args, ' .. #ev.parameters .. ');\n')
   for j = 1, #ev.parameters do
     local param = ev.parameters[j]
     local kind = string.upper(param[1])
@@ -107,14 +111,14 @@ for i = 1, #events do
   end
   ev.since = tonumber(ev.since)
 
+  local args = #ev.parameters > 0 and 'args' or 'noargs'
   if not ev.remote_only then
     if not ev.remote_impl and not ev.noexport then
       remote_output:write('void remote_ui_' .. ev.name)
       write_signature(remote_output, ev, 'RemoteUI *ui')
       remote_output:write('\n{\n')
-      remote_output:write('  Array args = ui->call_buf;\n')
       write_arglist(remote_output, ev)
-      remote_output:write('  push_call(ui, "' .. ev.name .. '", args);\n')
+      remote_output:write('  push_call(ui, "' .. ev.name .. '", ' .. args .. ');\n')
       remote_output:write('}\n\n')
     end
   end
@@ -124,9 +128,8 @@ for i = 1, #events do
     write_signature(call_output, ev, '')
     call_output:write('\n{\n')
     if ev.remote_only then
-      call_output:write('  Array args = call_buf;\n')
       write_arglist(call_output, ev)
-      call_output:write('  ui_call_event("' .. ev.name .. '", args);\n')
+      call_output:write('  ui_call_event("' .. ev.name .. '", ' .. args .. ');\n')
     elseif ev.compositor_impl then
       call_output:write('  ui_comp_' .. ev.name)
       write_signature(call_output, ev, '', true)