patch 9.0.0228: crash when pattern looks below the last line

Problem:    Crash when pattern looks below the last line.
Solution:   Consider invalid lines to be empty. (closes #10938)

src/regexp_bt.c

@@ -3439,12 +3439,17 @@ regmatch(
 	    break;
 
 	  case RE_VCOL:
-	    if (!re_num_cmp((long_u)win_linetabsize(
-			    rex.reg_win == NULL ? curwin : rex.reg_win,
-			    rex.reg_firstlnum + rex.lnum,
-			    rex.line,
-			    (colnr_T)(rex.input - rex.line)) + 1, scan))
+	    {
+		win_T	    *wp = rex.reg_win == NULL ? curwin : rex.reg_win;
+		linenr_T    lnum = rex.reg_firstlnum + rex.lnum;
+		long_u	    vcol = 0;
+
+		if (lnum > 0 && lnum <= wp->w_buffer->b_ml.ml_line_count)
+		    vcol = (long_u)win_linetabsize(wp, lnum, rex.line,
+					      (colnr_T)(rex.input - rex.line));
+		if (!re_num_cmp(vcol + 1, scan))
 		    status = RA_NOMATCH;
+	    }
 	    break;
 
 	  case BOW:	// \<word; rex.input points to w

src/regexp_nfa.c

@@ -6774,10 +6774,16 @@ nfa_regmatch(
 			result = col > t->state->val * ts;
 		    }
 		    if (!result)
-			result = nfa_re_num_cmp(t->state->val, op,
-				(long_u)win_linetabsize(wp,
-						rex.reg_firstlnum + rex.lnum,
-						rex.line, col) + 1);
+		    {
+			linenr_T    lnum = rex.reg_firstlnum + rex.lnum;
+			long_u	    vcol = 0;
+
+			if (lnum > 0
+				   && lnum <= wp->w_buffer->b_ml.ml_line_count)
+			    vcol = (long_u)win_linetabsize(wp, lnum,
+								rex.line, col);
+			result = nfa_re_num_cmp(t->state->val, op, vcol + 1);
+		    }
 		    if (result)
 		    {
 			add_here = TRUE;

src/testdir/test_regexp_latin.vim

@@ -1129,4 +1129,16 @@ func Test_recursive_substitute_expr()
   delfunc Repl
 endfunc
 
+def Test_compare_columns()
+  # this was using a line below the last line
+  enew
+  setline(1, ['', ''])
+  prop_type_add('name', {highlight: 'ErrorMsg'})
+  prop_add(1, 1, {length: 1, type: 'name'})
+  search('\%#=1\%>.l\n.*\%<2v', 'nW')
+  search('\%#=2\%>.l\n.*\%<2v', 'nW')
+  bwipe!
+  prop_type_delete('name')
+enddef
+
 " vim: shiftwidth=2 sts=2 expandtab

src/version.c

@@ -731,6 +731,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    228,
 /**/
     227,
 /**/