patch 9.0.0228: crash when pattern looks below the last line

Problem:    Crash when pattern looks below the last line.
Solution:   Consider invalid lines to be empty. (closes #10938)

diff --git a/src/regexp_bt.c b/src/regexp_bt.c
index e7cb1f2ba34116f5fac70623eba1bf44789fdc40..cf484e0bab35f2e863ffbbf7e16b79d7590db4b8 100644 (file)
--- a/src/regexp_bt.c
+++ b/src/regexp_bt.c
@@ -3439,12 +3439,17 @@ regmatch(
            break;
 
          case RE_VCOL:
-           if (!re_num_cmp((long_u)win_linetabsize(
-                           rex.reg_win == NULL ? curwin : rex.reg_win,
-                           rex.reg_firstlnum + rex.lnum,
-                           rex.line,
-                           (colnr_T)(rex.input - rex.line)) + 1, scan))
-               status = RA_NOMATCH;
+           {
+               win_T       *wp = rex.reg_win == NULL ? curwin : rex.reg_win;
+               linenr_T    lnum = rex.reg_firstlnum + rex.lnum;
+               long_u      vcol = 0;
+
+               if (lnum > 0 && lnum <= wp->w_buffer->b_ml.ml_line_count)
+                   vcol = (long_u)win_linetabsize(wp, lnum, rex.line,
+                                             (colnr_T)(rex.input - rex.line));
+               if (!re_num_cmp(vcol + 1, scan))
+                   status = RA_NOMATCH;
+           }
            break;
 
          case BOW:     // \<word; rex.input points to w

diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index 0dbc6b5019f42d7662162c1b6dac29f93bd24169..f8717f5b1ab3b8e9968a8a22aa263e10ea1a8401 100644 (file)
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -6774,10 +6774,16 @@ nfa_regmatch(
                        result = col > t->state->val * ts;
                    }
                    if (!result)
-                       result = nfa_re_num_cmp(t->state->val, op,
-                               (long_u)win_linetabsize(wp,
-                                               rex.reg_firstlnum + rex.lnum,
-                                               rex.line, col) + 1);
+                   {
+                       linenr_T    lnum = rex.reg_firstlnum + rex.lnum;
+                       long_u      vcol = 0;
+
+                       if (lnum > 0
+                                  && lnum <= wp->w_buffer->b_ml.ml_line_count)
+                           vcol = (long_u)win_linetabsize(wp, lnum,
+                                                               rex.line, col);
+                       result = nfa_re_num_cmp(t->state->val, op, vcol + 1);
+                   }
                    if (result)
                    {
                        add_here = TRUE;

diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
index 1ba7d17a1acf983dc2e9894780a4ac45eed055f8..bc08439d15daefc569d18bf32e0c2c742e1c723b 100644 (file)
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -1129,4 +1129,16 @@ func Test_recursive_substitute_expr()
   delfunc Repl
 endfunc
 
+def Test_compare_columns()
+  # this was using a line below the last line
+  enew
+  setline(1, ['', ''])
+  prop_type_add('name', {highlight: 'ErrorMsg'})
+  prop_add(1, 1, {length: 1, type: 'name'})
+  search('\%#=1\%>.l\n.*\%<2v', 'nW')
+  search('\%#=2\%>.l\n.*\%<2v', 'nW')
+  bwipe!
+  prop_type_delete('name')
+enddef
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 5d69c638dcb6c66ebfb5a6474a6aa928981f02d7..86be34dba2d2700e39b00ffb74b80398dade0942 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -731,6 +731,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    228,
 /**/
     227,
 /**/