vim-patch:8.2.5126: substitute may overrun destination buffer

Problem:    Substitute may overrun destination buffer.
Solution:   Disallow switching buffers in a substitute expression.

d6211a52ab

Co-authored-by: Bram Moolenaar <Bram@vim.org>

src/nvim/ex_docmd.c

@@ -5249,9 +5249,9 @@ void do_exedit(exarg_T *eap, win_T *old_curwin)
                   old_curwin == NULL ? curwin : NULL);
   } else if ((eap->cmdidx != CMD_split && eap->cmdidx != CMD_vsplit)
              || *eap->arg != NUL) {
-    // Can't edit another file when "curbuf->b_ro_locked" is set.  Only ":edit"
+    // Can't edit another file when "textlock" or "curbuf->b_ro_locked" is set.
-    // can bring us here, others are stopped earlier.
+    // Only ":edit" or ":script" can bring us here, others are stopped earlier.
-    if (*eap->arg != NUL && curbuf_locked()) {
+    if (*eap->arg != NUL && text_or_buf_locked()) {
       return;
     }
     n = readonlymode;

src/nvim/testdir/test_substitute.vim

@@ -1076,6 +1076,19 @@ func Test_sub_open_cmdline_win()
   call delete('Xresult')
 endfunc
 
+" This was editing a script file from the expression
+func Test_sub_edit_scriptfile()
+  new
+  norm o0000000000000000000000000000000000000000000000000000
+  func EditScript()
+    silent! scr! Xfile
+  endfunc
+  s/\%')/\=EditScript()
+
+  delfunc EditScript
+  bwipe!
+endfunc
+
 " Test for the 2-letter and 3-letter :substitute commands
 func Test_substitute_short_cmd()
   new