From: Christian Brabandt <cb@256bit.org>
Date: Sat, 14 Mar 2026 17:31:45 +0000 (+0000)
Subject: patch 9.2.0167: terminal: setting buftype=terminal may cause a crash
X-Git-Tag: v9.2.0167^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ba27e4fffae67ba142e6fb5551348c48fd2ffad6;p=thirdparty%2Fvim.git

patch 9.2.0167: terminal: setting buftype=terminal may cause a crash

Problem:  setting buftype=terminal may cause a crash
          (lacygoill, after v9.2.0127)
Solution: Validate that curwin->w_buffer->b_term is not null

fixes:  #19686
closes: #19676

Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/eval.c b/src/eval.c
index 42719d9e57..7168b19dee 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -6984,7 +6984,7 @@ var2fpos(
 	if (name[1] == '0')		// "w0": first visible line
 	{
 #ifdef FEAT_TERMINAL
-	    if (bt_terminal(curwin->w_buffer))
+	    if (bt_terminal(curwin->w_buffer) && curwin->w_buffer->b_term != NULL)
 		may_move_terminal_to_buffer(curwin->w_buffer->b_term, TRUE);
 #endif
 	    update_topline();
@@ -6996,7 +6996,7 @@ var2fpos(
 	else if (name[1] == '$')	// "w$": last visible line
 	{
 #ifdef FEAT_TERMINAL
-	    if (bt_terminal(curwin->w_buffer))
+	    if (bt_terminal(curwin->w_buffer) && curwin->w_buffer->b_term != NULL)
 		may_move_terminal_to_buffer(curwin->w_buffer->b_term, TRUE);
 #endif
 	    validate_botline();
diff --git a/src/testdir/test_terminal3.vim b/src/testdir/test_terminal3.vim
index 8046f14a5c..c8825917e9 100644
--- a/src/testdir/test_terminal3.vim
+++ b/src/testdir/test_terminal3.vim
@@ -1203,6 +1203,11 @@ func Test_term_getpos()
   call assert_true(str2nr(result[0]) > 1)
 
   call StopVimInTerminal(buf)
+  " this crashed
+  new
+  setl buftype=terminal
+  call assert_equal(2, line('w0') + line('w$'))
+  bw
 endfunc
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index ddf2d64bdb..74d4b6cd44 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    167,
 /**/
     166,
 /**/