fix: disallow removing extmarks in on_lines callbacks (#23219)

fix(extmarks): disallow removing extmarks in on_lines callbacks

decor_redraw_start (which runs before decor_providers_invoke_lines) gets
references for the extmarks on a specific line. If these extmarks are
deleted in on_lines callbacks then this results in a heap-use-after-free
error.

Fixes #22801

1 files changed, 18 insertions, 1 deletions

diff --git a/test/functional/ui/decorations_spec.lua b/test/functional/ui/decorations_spec.lua
index 80e5b6230e..5792c9703d 100644
--- a/test/functional/ui/decorations_spec.lua
+++ b/test/functional/ui/decorations_spec.lua
@@ -122,7 +122,7 @@ describe('decorations providers', function()
     ]]}
     check_trace {
       { "start", 5 };
-      { "buf", 1 };
+      { "buf", 1, 5 };
       { "win", 1000, 1, 0, 8 };
       { "line", 1000, 1, 6 };
       { "end", 5 };
@@ -565,6 +565,23 @@ describe('decorations providers', function()
                                               |
     ]])
   end)
+
+  it('does not allow removing extmarks during on_line callbacks', function()
+    exec_lua([[
+      eok = true
+    ]])
+    setup_provider([[
+      local function on_do(kind, winid, bufnr, topline, botline_guess)
+        if kind == 'line' then
+          api.nvim_buf_set_extmark(bufnr, ns1, 1, -1, { sign_text = 'X' })
+          eok = pcall(api.nvim_buf_clear_namespace, bufnr, ns1, 0, -1)
+        end
+      end
+    ]])
+    exec_lua([[
+      assert(eok == false)
+    ]])
+  end)
 end)
 
 describe('extmark decorations', function()