5 files changed, 29 insertions, 4 deletions

diff --git a/src/nvim/ex_getln.c b/src/nvim/ex_getln.c
index c966c780a0..fe52a6cfa7 100644
--- a/src/nvim/ex_getln.c
+++ b/src/nvim/ex_getln.c
@@ -443,6 +443,10 @@ static void may_do_incsearch_highlighting(int firstc, long count,
   if (search_first_line == 0) {
     // start at the original cursor position
     curwin->w_cursor = s->search_start;
+  } else if (search_first_line > curbuf->b_ml.ml_line_count) {
+    // start after the last line
+    curwin->w_cursor.lnum = curbuf->b_ml.ml_line_count;
+    curwin->w_cursor.col = MAXCOL;
   } else {
     // start at the first line in the range
     curwin->w_cursor.lnum = search_first_line;
diff --git a/src/nvim/memline.c b/src/nvim/memline.c
index f9390bcb88..2a75f13cc2 100644
--- a/src/nvim/memline.c
+++ b/src/nvim/memline.c
@@ -1818,6 +1818,7 @@ ml_get_buf (
     linenr_T lnum,
     bool will_change                        // line will be changed
 )
+  FUNC_ATTR_NONNULL_ALL
 {
   bhdr_T      *hp;
   DATA_BL     *dp;
diff --git a/src/nvim/quickfix.c b/src/nvim/quickfix.c
index ddce1e922d..5754950745 100644
--- a/src/nvim/quickfix.c
+++ b/src/nvim/quickfix.c
@@ -901,6 +901,7 @@ static bool qf_list_has_valid_entries(qf_list_T *qfl)
 
 /// Return a pointer to a list in the specified quickfix stack
 static qf_list_T * qf_get_list(qf_info_T *qi, int idx)
+  FUNC_ATTR_NONNULL_ALL
 {
   return &qi->qf_lists[idx];
 }
@@ -1230,6 +1231,7 @@ static char_u * qf_cmdtitle(char_u *cmd)
 
 /// Return a pointer to the current list in the specified quickfix stack
 static qf_list_T * qf_get_curlist(qf_info_T *qi)
+  FUNC_ATTR_NONNULL_ALL
 {
   return qf_get_list(qi, qi->qf_curlist);
 }
@@ -4825,12 +4827,13 @@ static bool vgr_qflist_valid(win_T *wp, qf_info_T *qi, unsigned qfid,
 /// Search for a pattern in all the lines in a buffer and add the matching lines
 /// to a quickfix list.
 static bool vgr_match_buflines(qf_info_T *qi, char_u *fname, buf_T *buf,
-                               regmmatch_T *regmatch, long tomatch,
+                               regmmatch_T *regmatch, long *tomatch,
                                int duplicate_name, int flags)
+  FUNC_ATTR_NONNULL_ARG(1, 3, 4, 5)
 {
   bool found_match = false;
 
-  for (long lnum = 1; lnum <= buf->b_ml.ml_line_count && tomatch > 0; lnum++) {
+  for (long lnum = 1; lnum <= buf->b_ml.ml_line_count && *tomatch > 0; lnum++) {
     colnr_T col = 0;
     while (vim_regexec_multi(regmatch, curwin, buf, lnum, col, NULL,
                              NULL) > 0) {
@@ -4856,7 +4859,7 @@ static bool vgr_match_buflines(qf_info_T *qi, char_u *fname, buf_T *buf,
         break;
       }
       found_match = true;
-      if (--tomatch == 0) {
+      if (--*tomatch == 0) {
         break;
       }
       if ((flags & VGR_GLOBAL) == 0 || regmatch->endpos[0].lnum > 0) {
@@ -5030,7 +5033,7 @@ void ex_vimgrep(exarg_T *eap)
     } else {
       // Try for a match in all lines of the buffer.
       // For ":1vimgrep" look for first match only.
-      found_match = vgr_match_buflines(qi, fname, buf, &regmatch, tomatch,
+      found_match = vgr_match_buflines(qi, fname, buf, &regmatch, &tomatch,
                                        duplicate_name, flags);
 
       if (using_dummy) {
diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c
index bcf02af4ef..a570328499 100644
--- a/src/nvim/regexp.c
+++ b/src/nvim/regexp.c
@@ -7387,6 +7387,7 @@ long vim_regexec_multi(
     proftime_T  *tm,                // timeout limit or NULL
     int         *timed_out          // flag is set when timeout limit reached
 )
+  FUNC_ATTR_NONNULL_ARG(1)
 {
   regexec_T rex_save;
   bool rex_in_use_save = rex_in_use;
diff --git a/src/nvim/testdir/test_quickfix.vim b/src/nvim/testdir/test_quickfix.vim
index 926103b69f..eeec5bd2c3 100644
--- a/src/nvim/testdir/test_quickfix.vim
+++ b/src/nvim/testdir/test_quickfix.vim
@@ -2450,6 +2450,22 @@ func Test_vimgrep()
   call XvimgrepTests('l')
 endfunc
 
+" Test for incsearch highlighting of the :vimgrep pattern
+" This test used to cause "E315: ml_get: invalid lnum" errors.
+func Test_vimgrep_incsearch()
+  throw 'skipped: Nvim does not support test_override()'
+  enew
+  set incsearch
+  call test_override("char_avail", 1)
+
+  call feedkeys(":2vimgrep assert test_quickfix.vim test_cdo.vim\<CR>", "ntx")
+  let l = getqflist()
+  call assert_equal(2, len(l))
+
+  call test_override("ALL", 0)
+  set noincsearch
+endfunc
+
 func XfreeTests(cchar)
   call s:setup_commands(a:cchar)