1 files changed, 24 insertions, 5 deletions

diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c
index 63dc1e539e..09cf6601ee 100644
--- a/src/nvim/ex_docmd.c
+++ b/src/nvim/ex_docmd.c
@@ -2036,6 +2036,18 @@ doend:
   return ea.nextcmd;
 }
 
+static char ex_error_buf[MSG_BUF_LEN];
+
+/// @return an error message with argument included.
+/// Uses a static buffer, only the last error will be kept.
+/// "msg" will be translated, caller should use N_().
+char *ex_errmsg(const char *const msg, const char_u *const arg)
+  FUNC_ATTR_NONNULL_ALL
+{
+  vim_snprintf(ex_error_buf, MSG_BUF_LEN, _(msg), arg);
+  return ex_error_buf;
+}
+
 // Parse and skip over command modifiers:
 // - update eap->cmd
 // - store flags in "cmdmod".
@@ -2704,7 +2716,7 @@ static char_u *find_ucmd(exarg_T *eap, char_u *p, int *full, expand_T *xp, int *
                                      // only full match global is accepted.
 
   // Look for buffer-local user commands first, then global ones.
-  gap = is_in_cmdwin() ? &prevwin->w_buffer->b_ucmds : &curbuf->b_ucmds;
+  gap = &prevwin_curwin()->w_buffer->b_ucmds;
   for (;;) {
     for (j = 0; j < gap->ga_len; j++) {
       uc = USER_CMD_GA(gap, j);
@@ -4861,7 +4873,13 @@ static int get_tabpage_arg(exarg_T *eap)
       if (STRCMP(p, "$") == 0) {
         tab_number = LAST_TAB_NR;
       } else if (STRCMP(p, "#") == 0) {
-        tab_number = tabpage_index(lastused_tabpage);
+        if (valid_tabpage(lastused_tabpage)) {
+          tab_number = tabpage_index(lastused_tabpage);
+        } else {
+          eap->errmsg = ex_errmsg(e_invargval, eap->arg);
+          tab_number = 0;
+          goto theend;
+        }
       } else if (p == p_save || *p_save == '-' || *p != NUL
                  || tab_number > LAST_TAB_NR) {
         // No numbers as argument.
@@ -5378,7 +5396,7 @@ static void uc_list(char_u *name, size_t name_len)
   uint32_t a;
 
   // In cmdwin, the alternative buffer should be used.
-  garray_T *gap = is_in_cmdwin() ? &prevwin->w_buffer->b_ucmds : &curbuf->b_ucmds;
+  const garray_T *gap = &prevwin_curwin()->w_buffer->b_ucmds;
   for (;;) {
     for (i = 0; i < gap->ga_len; i++) {
       cmd = USER_CMD_GA(gap, i);
@@ -6357,7 +6375,7 @@ char_u *get_user_commands(expand_T *xp FUNC_ATTR_UNUSED, int idx)
   FUNC_ATTR_PURE FUNC_ATTR_WARN_UNUSED_RESULT
 {
   // In cmdwin, the alternative buffer should be used.
-  const buf_T *const buf = is_in_cmdwin() ? prevwin->w_buffer : curbuf;
+  const buf_T *const buf = prevwin_curwin()->w_buffer;
 
   if (idx < buf->b_ucmds.ga_len) {
     return USER_CMD_GA(&buf->b_ucmds, idx)->uc_name;
@@ -6379,7 +6397,8 @@ static char_u *get_user_command_name(int idx, int cmdidx)
   }
   if (cmdidx == CMD_USER_BUF) {
     // In cmdwin, the alternative buffer should be used.
-    buf_T *buf = is_in_cmdwin() ? prevwin->w_buffer : curbuf;
+    const buf_T *const buf = prevwin_curwin()->w_buffer;
+
     if (idx < buf->b_ucmds.ga_len) {
       return USER_CMD_GA(&buf->b_ucmds, idx)->uc_name;
     }