# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1660914004 -7200
# Node ID f1c5bd4acbbc9305695acf8280849cc2da7dda35
# Parent  b91c813678d16921bb2218a4b25d62b252ddd82b
patch 9.0.0228: crash when pattern looks below the last line

Commit: https://github.com/vim/vim/commit/13ed494bb5edc5a02d0ed0feabddb68920f88570
Author: Bram Moolenaar <Bram@vim.org>
Date:   Fri Aug 19 13:59:25 2022 +0100

    patch 9.0.0228: crash when pattern looks below the last line

    Problem:    Crash when pattern looks below the last line.
    Solution:   Consider invalid lines to be empty. (closes https://github.com/vim/vim/issues/10938)

diff --git a/src/regexp_bt.c b/src/regexp_bt.c
--- a/src/regexp_bt.c
+++ b/src/regexp_bt.c
@@ -3439,12 +3439,17 @@ regmatch(
 	    break;
 
 	  case RE_VCOL:
-	    if (!re_num_cmp((long_u)win_linetabsize(
-			    rex.reg_win == NULL ? curwin : rex.reg_win,
-			    rex.reg_firstlnum + rex.lnum,
-			    rex.line,
-			    (colnr_T)(rex.input - rex.line)) + 1, scan))
-		status = RA_NOMATCH;
+	    {
+		win_T	    *wp = rex.reg_win == NULL ? curwin : rex.reg_win;
+		linenr_T    lnum = rex.reg_firstlnum + rex.lnum;
+		long_u	    vcol = 0;
+
+		if (lnum > 0 && lnum <= wp->w_buffer->b_ml.ml_line_count)
+		    vcol = (long_u)win_linetabsize(wp, lnum, rex.line,
+					      (colnr_T)(rex.input - rex.line));
+		if (!re_num_cmp(vcol + 1, scan))
+		    status = RA_NOMATCH;
+	    }
 	    break;
 
 	  case BOW:	// \<word; rex.input points to w
diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -6774,10 +6774,16 @@ nfa_regmatch(
 			result = col > t->state->val * ts;
 		    }
 		    if (!result)
-			result = nfa_re_num_cmp(t->state->val, op,
-				(long_u)win_linetabsize(wp,
-						rex.reg_firstlnum + rex.lnum,
-						rex.line, col) + 1);
+		    {
+			linenr_T    lnum = rex.reg_firstlnum + rex.lnum;
+			long_u	    vcol = 0;
+
+			if (lnum > 0
+				   && lnum <= wp->w_buffer->b_ml.ml_line_count)
+			    vcol = (long_u)win_linetabsize(wp, lnum,
+								rex.line, col);
+			result = nfa_re_num_cmp(t->state->val, op, vcol + 1);
+		    }
 		    if (result)
 		    {
 			add_here = TRUE;
diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -1129,4 +1129,16 @@ func Test_recursive_substitute_expr()
   delfunc Repl
 endfunc
 
+def Test_compare_columns()
+  # this was using a line below the last line
+  enew
+  setline(1, ['', ''])
+  prop_type_add('name', {highlight: 'ErrorMsg'})
+  prop_add(1, 1, {length: 1, type: 'name'})
+  search('\%#=1\%>.l\n.*\%<2v', 'nW')
+  search('\%#=2\%>.l\n.*\%<2v', 'nW')
+  bwipe!
+  prop_type_delete('name')
+enddef
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -732,6 +732,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    228,
+/**/
     227,
 /**/
     226,