patch 8.1.2076: crash when trying to put a terminal in a popup window

Problem:    Crash when trying to put a terminal buffer in a popup window.
Solution:   Check for NULL buffer.  Do not allow putting a terminal in a popup
            window.

runtime/doc/popup.txt

@@ -1,4 +1,4 @@
-*popup.txt*  For Vim version 8.1.  Last change: 2019 Sep 08
+*popup.txt*  For Vim version 8.1.  Last change: 2019 Sep 25
 
 
 		  VIM REFERENCE MANUAL    by Bram Moolenaar
@@ -137,9 +137,7 @@ Options can be set on the window with `setwinvar()`, e.g.: >
 	call setwinvar(winid, '&wrap', 0)
 And options can be set on the buffer with `setbufvar()`, e.g.: >
 	call setbufvar(winbufnr(winid), '&filetype', 'java')
-Note that this does not trigger autocommands.  Use `win_execute()` if you do
-need them.
-
+You can also use `win_execute()` with a ":setlocal" command.
 
 
 ==============================================================================
@@ -540,6 +538,10 @@ properties.  It is in one of four forms:
 			dictionary with a "col" entry, see below:
 			|popup-props|.
 
+If you want to create a new buffer yourself use |bufadd()| and pass the buffer
+number to popup_create().
+It is not possible to use the buffer of a terminal window. *E278*
+
 The second argument of |popup_create()| is a dictionary with options:
 	line		Screen line where to position the popup.  Can use a
 			number or "cursor", "cursor+1" or "cursor-1" to use

src/libvterm/src/termscreen.c

@@ -75,6 +75,8 @@ static ScreenCell *getcell(const VTermScreen *screen, int row, int col)
     return NULL;
   if(col < 0 || col >= screen->cols)
     return NULL;
+  if (screen->buffer == NULL)
+    return NULL;
   return screen->buffer + (screen->cols * row) + col;
 }
 

src/popupwin.c

@@ -1638,6 +1638,11 @@ popup_create(typval_T *argvars, typval_T *rettv, create_type_T type)
 		semsg(_(e_nobufnr), argvars[0].vval.v_number);
 		return NULL;
 	    }
+	    if (buf->b_term != NULL)
+	    {
+		emsg(_("E278: Cannot put a terminal buffer in a popup window"));
+		return NULL;
+	    }
 	}
 	else if (!(argvars[0].v_type == VAR_STRING
 			&& argvars[0].vval.v_string != NULL)

src/terminal.c

@@ -3347,6 +3347,8 @@ term_update_window(win_T *wp)
 	    newcols = MIN(newcols, twp->w_width);
 	}
     }
+    if (newrows == 99999 || newcols == 99999)
+	return; // safety exit
     newrows = rows == 0 ? newrows : minsize ? MAX(rows, newrows) : rows;
     newcols = cols == 0 ? newcols : minsize ? MAX(cols, newcols) : cols;
 

src/testdir/test_popupwin.vim

@@ -1992,6 +1992,12 @@ func Test_popupwin_with_buffer()
   call delete('XsomeFile')
 endfunc
 
+func Test_popupwin_terminal_buffer()
+  let ptybuf = term_start(&shell, #{hidden: 1})
+  call assert_fails('let winnr = popup_create(ptybuf, #{})', 'E278:')
+  exe 'bwipe! ' .. ptybuf
+endfunc
+
 func Test_popupwin_with_buffer_and_filter()
   new Xwithfilter
   call setline(1, range(100))

src/version.c

@@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2076,
 /**/
     2075,
 /**/