From 7c71db3a58f658b4329b82ab603efa928d17bdbc Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Mon, 22 Jan 2024 20:12:34 +0100
Subject: [PATCH] patch 9.1.0043: ml_get: invalid lnum when :s replaces visual
 selection

Problem:  ml_get: invalid lnum when :s replaces visual selection
          (@ropery)
Solution: substitute may decrement the number of lines in a buffer,
          so validate, that the bottom lines of the visual selection
          stays within the max buffer line

fixes: #13890
closes: #13892

Signed-off-by: Christian Brabandt <cb@256bit.org>
---
 src/regexp.c                | 4 ++++
 src/testdir/test_visual.vim | 8 ++++++++
 src/version.c               | 2 ++
 3 files changed, 14 insertions(+)

diff --git a/src/regexp.c b/src/regexp.c
index c3bc4966c..73552015e 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -1318,6 +1318,10 @@ reg_match_visual(void)
 	    top = curbuf->b_visual.vi_end;
 	    bot = curbuf->b_visual.vi_start;
 	}
+	// a substitue command may have
+	// removed some lines
+	if (bot.lnum > curbuf->b_ml.ml_line_count)
+	    bot.lnum = curbuf->b_ml.ml_line_count;
 	mode = curbuf->b_visual.vi_mode;
 	curswant = curbuf->b_visual.vi_curswant;
     }
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
index 401a3504a..f0d8edcf8 100644
--- a/src/testdir/test_visual.vim
+++ b/src/testdir/test_visual.vim
@@ -1622,4 +1622,12 @@ func Test_visual_drag_out_of_window()
   bwipe!
 endfunc
 
+func Test_visual_substitute_visual()
+  new
+  call setline(1, ['one', 'two', 'three'])
+  call feedkeys("Gk\<C-V>j$:s/\\%V\\_.*\\%V/foobar\<CR>", 'tx')
+  call assert_equal(['one', 'foobar'], getline(1, '$'))
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 094658c3a..783e2ba1b 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    43,
 /**/
     42,
 /**/