commit 0f1563ffee4397f5b379517c41b7c9a977fd2e22
author Bram Moolenaar <Bram@vim.org> Fri Mar 20 21:15:51 2020 +0100
committer Bram Moolenaar <Bram@vim.org> Fri Mar 20 21:15:51 2020 +0100
tree 1a7d2bd202acb3f9f955d9283a6da2c90591da20
parent 9645e2d9fc8a591f1db30383caccf71d40e0810c

patch 8.2.0422: crash when passing popup window to win_splitmove()

Problem:    Crash when passing popup window to win_splitmove(). (john Devin)
Solution:   Disallow moving a popup window. (closes #5816)

src/evalwindow.c

diff --git a/src/evalwindow.c b/src/evalwindow.c
index c7a9f79..534a047 100644
--- a/src/evalwindow.c
+++ b/src/evalwindow.c
@@ -810,7 +810,8 @@
     targetwin = find_win_by_nr_or_id(&argvars[1]);
 
     if (wp == NULL || targetwin == NULL || wp == targetwin
-	    || !win_valid(wp) || !win_valid(targetwin))
+	    || !win_valid(wp) || !win_valid(targetwin)
+	    || win_valid_popup(wp) || win_valid_popup(targetwin))
     {
         emsg(_(e_invalwindow));
 	rettv->vval.v_number = -1;

src/testdir/test_popupwin.vim

diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
index 9cd6e32..478e9d4 100644
--- a/src/testdir/test_popupwin.vim
+++ b/src/testdir/test_popupwin.vim
@@ -3307,4 +3307,16 @@
   set signcolumn&
 endfunc
 
+func Test_popupwin_splitmove()
+  vsplit
+  let win2 = win_getid()
+  let popup_winid = popup_dialog('hello', {})
+  call assert_fails('call win_splitmove(popup_winid, win2)', 'E957:')
+  call assert_fails('call win_splitmove(win2, popup_winid)', 'E957:')
+
+  call popup_clear()
+  bwipe
+endfunc
+
+
 " vim: shiftwidth=2 sts=2

src/version.c

diff --git a/src/version.c b/src/version.c
index 986a29f..a6112ce 100644
--- a/src/version.c
+++ b/src/version.c
@@ -739,6 +739,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    422,
+/**/
     421,
 /**/
     420,