vim-patch:8.2.2207: illegal memory access if popup menu items are changed (#21028)

Problem:    Illegal memory access if popup menu items are changed while the
            menu is visible. (Tomáš Janoušek)
Solution:   Make a copy of the text. (closes vim/vim#7537)

https://github.com/vim/vim/commit/38455a921395a56690790c8c1d28c1c43ca04c8a

Co-authored-by: Bram Moolenaar <Bram@vim.org>

2 files changed, 169 insertions, 0 deletions

diff --git a/test/functional/ui/highlight_spec.lua b/test/functional/ui/highlight_spec.lua
index 504a38d591..173d422334 100644
--- a/test/functional/ui/highlight_spec.lua
+++ b/test/functional/ui/highlight_spec.lua
@@ -1048,6 +1048,7 @@ describe('CursorLine and CursorLineNr highlights', function()
     ]])
   end)
 
+  -- oldtest: Test_cursorline_after_yank()
   it('always updated. vim-patch:8.1.0849', function()
     local screen = Screen.new(50,5)
     screen:set_default_attr_ids({
@@ -1081,6 +1082,7 @@ describe('CursorLine and CursorLineNr highlights', function()
     ]])
   end)
 
+  -- oldtest: Test_cursorline_with_visualmode()
   it('with visual area. vim-patch:8.1.1001', function()
     local screen = Screen.new(50,5)
     screen:set_default_attr_ids({
@@ -1108,6 +1110,7 @@ describe('CursorLine and CursorLineNr highlights', function()
     ]])
   end)
 
+  -- oldtest: Test_cursorline_callback()
   it('is updated if cursor is moved up from timer vim-patch:8.2.4591', function()
     local screen = Screen.new(50, 8)
     screen:set_default_attr_ids({
@@ -1237,6 +1240,7 @@ describe('CursorLine and CursorLineNr highlights', function()
     })
   end)
 
+  -- oldtest: Test_diff_with_cursorline_number()
   it('CursorLineNr shows correctly just below filler lines', function()
     local screen = Screen.new(50,12)
     screen:set_default_attr_ids({
@@ -1357,6 +1361,7 @@ describe('CursorColumn highlight', function()
     ]])
   end)
 
+  -- oldtest: Test_cursorcolumn_callback()
   it('is updated if cursor is moved from timer', function()
     exec([[
       call setline(1, ['aaaaa', 'bbbbb', 'ccccc', 'ddddd'])
@@ -1412,6 +1417,7 @@ describe('ColorColumn highlight', function()
     screen:attach()
   end)
 
+  -- oldtest: Test_colorcolumn()
   it('when entering a buffer vim-patch:8.1.2073', function()
     exec([[
       set nohidden
@@ -1443,6 +1449,7 @@ describe('ColorColumn highlight', function()
     ]])
   end)
 
+  -- oldtest: Test_colorcolumn_bri()
   it("in 'breakindent' vim-patch:8.2.1689", function()
     exec([[
       call setline(1, 'The quick brown fox jumped over the lazy dogs')
@@ -1467,6 +1474,7 @@ describe('ColorColumn highlight', function()
     ]])
   end)
 
+  -- oldtest: Test_colorcolumn_sbr()
   it("in 'showbreak' vim-patch:8.2.1689", function()
     exec([[
       call setline(1, 'The quick brown fox jumped over the lazy dogs')
@@ -1686,6 +1694,7 @@ describe("'number' and 'relativenumber' highlight", function()
     ]])
   end)
 
+  -- oldtest: Test_relativenumber_callback()
   it('relative number highlight is updated if cursor is moved from timer', function()
     local screen = Screen.new(50, 8)
     screen:set_default_attr_ids({
diff --git a/test/functional/ui/popupmenu_spec.lua b/test/functional/ui/popupmenu_spec.lua
index 33e201eb68..e43eef4dfd 100644
--- a/test/functional/ui/popupmenu_spec.lua
+++ b/test/functional/ui/popupmenu_spec.lua
@@ -967,6 +967,7 @@ describe('builtin popupmenu', function()
       [4] = {bold = true, reverse = true},
       [5] = {bold = true, foreground = Screen.colors.SeaGreen},
       [6] = {foreground = Screen.colors.Grey100, background = Screen.colors.Red},
+      [7] = {background = Screen.colors.Yellow},  -- Search
     })
   end)
 
@@ -3037,6 +3038,165 @@ describe('builtin popupmenu', function()
     eq(false, screen.options.mousemoveevent)
     eq('bar', meths.get_var('menustr'))
   end)
+
+  -- oldtest: Test_popup_command()
+  it(':popup command', function()
+    exec([[
+      menu Test.Foo Foo
+      call assert_fails('popup Test.Foo', 'E336:')
+      call assert_fails('popup Test.Foo.X', 'E327:')
+      call assert_fails('popup Foo', 'E337:')
+      unmenu Test.Foo
+    ]])
+    eq({}, meths.get_vvar('errors'))
+
+    exec([[
+      func ChangeMenu()
+        aunmenu PopUp.&Paste
+        nnoremenu 1.40 PopUp.&Paste :echomsg "pasted"<CR>
+        echomsg 'changed'
+        return "\<Ignore>"
+      endfunc
+
+      let lines =<< trim END
+        one two three four five
+        and one two Xthree four five
+        one more two three four five
+      END
+      call setline(1, lines)
+
+      aunmenu *
+      source $VIMRUNTIME/menu.vim
+    ]])
+    feed('/X<CR>:popup PopUp<CR>')
+    screen:expect([[
+      one two three four five         |
+      and one two {7:^X}three four five    |
+      one more tw{n: Undo             }   |
+      {1:~          }{n:                  }{1:   }|
+      {1:~          }{n: Paste            }{1:   }|
+      {1:~          }{n:                  }{1:   }|
+      {1:~          }{n: Select Word      }{1:   }|
+      {1:~          }{n: Select Sentence  }{1:   }|
+      {1:~          }{n: Select Paragraph }{1:   }|
+      {1:~          }{n: Select Line      }{1:   }|
+      {1:~          }{n: Select Block     }{1:   }|
+      {1:~          }{n: Select All       }{1:   }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      :popup PopUp                    |
+    ]])
+
+    -- go to the Paste entry in the menu
+    feed('jj')
+    screen:expect([[
+      one two three four five         |
+      and one two {7:^X}three four five    |
+      one more tw{n: Undo             }   |
+      {1:~          }{n:                  }{1:   }|
+      {1:~          }{s: Paste            }{1:   }|
+      {1:~          }{n:                  }{1:   }|
+      {1:~          }{n: Select Word      }{1:   }|
+      {1:~          }{n: Select Sentence  }{1:   }|
+      {1:~          }{n: Select Paragraph }{1:   }|
+      {1:~          }{n: Select Line      }{1:   }|
+      {1:~          }{n: Select Block     }{1:   }|
+      {1:~          }{n: Select All       }{1:   }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      :popup PopUp                    |
+    ]])
+
+    -- Select a word
+    feed('j')
+    screen:expect([[
+      one two three four five         |
+      and one two {7:^X}three four five    |
+      one more tw{n: Undo             }   |
+      {1:~          }{n:                  }{1:   }|
+      {1:~          }{n: Paste            }{1:   }|
+      {1:~          }{n:                  }{1:   }|
+      {1:~          }{s: Select Word      }{1:   }|
+      {1:~          }{n: Select Sentence  }{1:   }|
+      {1:~          }{n: Select Paragraph }{1:   }|
+      {1:~          }{n: Select Line      }{1:   }|
+      {1:~          }{n: Select Block     }{1:   }|
+      {1:~          }{n: Select All       }{1:   }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      :popup PopUp                    |
+    ]])
+
+    feed('<Esc>')
+
+    -- Set an <expr> mapping to change a menu entry while it's displayed.
+    -- The text should not change but the command does.
+    -- Also verify that "changed" shows up, which means the mapping triggered.
+    command('nnoremap <expr> <F2> ChangeMenu()')
+    feed('/X<CR>:popup PopUp<CR><F2>')
+    screen:expect([[
+      one two three four five         |
+      and one two {7:^X}three four five    |
+      one more tw{n: Undo             }   |
+      {1:~          }{n:                  }{1:   }|
+      {1:~          }{n: Paste            }{1:   }|
+      {1:~          }{n:                  }{1:   }|
+      {1:~          }{n: Select Word      }{1:   }|
+      {1:~          }{n: Select Sentence  }{1:   }|
+      {1:~          }{n: Select Paragraph }{1:   }|
+      {1:~          }{n: Select Line      }{1:   }|
+      {1:~          }{n: Select Block     }{1:   }|
+      {1:~          }{n: Select All       }{1:   }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      changed                         |
+    ]])
+
+    -- Select the Paste entry, executes the changed menu item.
+    feed('jj<CR>')
+    screen:expect([[
+      one two three four five         |
+      and one two {7:^X}three four five    |
+      one more two three four five    |
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      {1:~                               }|
+      pasted                          |
+    ]])
+  end)
 end)
 
 describe('builtin popupmenu with ui/ext_multigrid', function()