patch 9.1.0116: win_split_ins may not check available roomv9.1.0116

Problem:  win_split_ins has no check for E36 when moving an existing
          window
Solution: check for room and fix the issues in f_win_splitmove()
          (Sean Dewar)

win_split_ins has no check for E36 when moving an existing window,
allowing for layouts with many overlapping zero-sized windows to be
created (which may also cause drawing issues with tablines and such).
f_win_splitmove also has some bugs.

So check for room and fix the issues in f_win_splitmove. Handle failure
in the two relevant win_split_ins callers by restoring the original
layout, and factor the common logic into win_splitmove.

Don't check for room when opening an autocommand window, as it's a
temporary window that's rarely interacted with or drawn anyhow, and is
rather important for some autocommands.

Issues fixed in f_win_splitmove:
- Error if splitting is disallowed.
- Fix heap-use-after-frees if autocommands fired from switching to "targetwin"
  close "wp" or "oldwin".
- Fix splitting the wrong window if autocommands fired from switching to
  "targetwin" switch to a different window.
- Ensure -1 is returned for all errors.

Also handle allocation failure a bit earlier in make_snapshot (callers,
except win_splitmove, don't really care if a snapshot can't be made, so
just ignore the return value).

Note: Test_smoothscroll_in_zero_width_window failed after these changes with
E36, as it was using the previous behaviour to create a zero-width window.
I've fixed the test such that it fails with UBSAN as expected when v9.0.1367 is
reverted (and simplified it too).

related: #14042

Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

1 files changed, 22 insertions, 48 deletions

diff --git a/src/evalwindow.c b/src/evalwindow.c
index 7d035d53b0..5016eb4588 100644
--- a/src/evalwindow.c
+++ b/src/evalwindow.c
@@ -953,59 +953,17 @@ f_win_screenpos(typval_T *argvars, typval_T *rettv)
 }
 
 /*
- * Move the window wp into a new split of targetwin in a given direction
- */
-    static void
-win_move_into_split(win_T *wp, win_T *targetwin, int size, int flags)
-{
-    int	    dir;
-    int	    height = wp->w_height;
-    win_T   *oldwin = curwin;
-
-    if (wp == targetwin)
-	return;
-
-    // Jump to the target window
-    if (curwin != targetwin)
-	win_goto(targetwin);
-
-    // Remove the old window and frame from the tree of frames
-    (void)winframe_remove(wp, &dir, NULL);
-    win_remove(wp, NULL);
-    last_status(FALSE);	    // may need to remove last status line
-    (void)win_comp_pos();   // recompute window positions
-
-    // Split a window on the desired side and put the old window there
-    (void)win_split_ins(size, flags, wp, dir);
-
-    // If splitting horizontally, try to preserve height
-    if (size == 0 && !(flags & WSP_VERT))
-    {
-	win_setheight_win(height, wp);
-	if (p_ea)
-	    win_equal(wp, TRUE, 'v');
-    }
-
-#if defined(FEAT_GUI)
-    // When 'guioptions' includes 'L' or 'R' may have to remove or add
-    // scrollbars.  Have to update them anyway.
-    gui_may_update_scrollbars();
-#endif
-
-    if (oldwin != curwin)
-	win_goto(oldwin);
-}
-
-/*
  * "win_splitmove()" function
  */
     void
 f_win_splitmove(typval_T *argvars, typval_T *rettv)
 {
-    win_T   *wp;
-    win_T   *targetwin;
+    win_T   *wp, *targetwin;
+    win_T   *oldwin = curwin;
     int     flags = 0, size = 0;
 
+    rettv->vval.v_number = -1;
+
     if (in_vim9script()
 	    && (check_for_number_arg(argvars, 0) == FAIL
 		|| check_for_number_arg(argvars, 1) == FAIL
@@ -1020,7 +978,6 @@ f_win_splitmove(typval_T *argvars, typval_T *rettv)
 	    || win_valid_popup(wp) || win_valid_popup(targetwin))
     {
 	emsg(_(e_invalid_window_number));
-	rettv->vval.v_number = -1;
 	return;
     }
 
@@ -1040,7 +997,24 @@ f_win_splitmove(typval_T *argvars, typval_T *rettv)
 	size = (int)dict_get_number(d, "size");
     }
 
-    win_move_into_split(wp, targetwin, size, flags);
+    // Check if we can split the target before we bother switching windows.
+    if (check_split_disallowed(targetwin) == FAIL)
+	return;
+
+    if (curwin != targetwin)
+	win_goto(targetwin);
+
+    // Autocommands may have sent us elsewhere or closed "wp" or "oldwin".
+    if (curwin == targetwin && win_valid(wp))
+    {
+	if (win_splitmove(wp, size, flags) == OK)
+	    rettv->vval.v_number = 0;
+    }
+    else
+	emsg(_(e_autocommands_caused_command_to_abort));
+
+    if (oldwin != curwin && win_valid(oldwin))
+	win_goto(oldwin);
 }
 
 /*