From 0a65d821fcc3fe1cab52b4102f2a55b7aa89df03 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Tue, 18 Jan 2022 10:05:31 +0800
Subject: vim-patch:8.2.3494: illegal memory access in utf_head_off

Problem:    Illegal memory access in utf_head_off.
Solution:   Check cursor position when reselecting the Visual area.
            (closes vim/vim#8963)
https://github.com/vim/vim/commit/b07626d4afa73dd2af0f03c0d59eed25ee159ef9

Including the XTest_beval -> XTest_block from patch 8.2.3096.
---
 src/nvim/normal.c                |  7 ++-----
 src/nvim/testdir/test_visual.vim | 22 +++++++++++++++++++++-
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/src/nvim/normal.c b/src/nvim/normal.c
index 2b5b47c0b3..418ba133bd 100644
--- a/src/nvim/normal.c
+++ b/src/nvim/normal.c
@@ -5963,11 +5963,8 @@ static void nv_visual(cmdarg_T *cap)
        * was only one -- webb
        */
       if (resel_VIsual_mode != 'v' || resel_VIsual_line_count > 1) {
-        curwin->w_cursor.lnum +=
-          resel_VIsual_line_count * cap->count0 - 1;
-        if (curwin->w_cursor.lnum > curbuf->b_ml.ml_line_count) {
-          curwin->w_cursor.lnum = curbuf->b_ml.ml_line_count;
-        }
+        curwin->w_cursor.lnum += resel_VIsual_line_count * cap->count0 - 1;
+        check_cursor();
       }
       VIsual_mode = resel_VIsual_mode;
       if (VIsual_mode == 'v') {
diff --git a/src/nvim/testdir/test_visual.vim b/src/nvim/testdir/test_visual.vim
index d58ca92a2f..2e26da4947 100644
--- a/src/nvim/testdir/test_visual.vim
+++ b/src/nvim/testdir/test_visual.vim
@@ -1120,7 +1120,27 @@ func Test_visual_block_with_virtualedit()
   " clean up
   call term_sendkeys(buf, "\<Esc>")
   call StopVimInTerminal(buf)
-  call delete('XTest_beval')
+  call delete('XTest_block')
+endfunc
+
+func Test_visual_reselect_with_count()
+  " this was causing an illegal memory access
+  let lines =<< trim END
+
+
+
+      :
+      r<sfile>
+      exe "%norm e3\<c-v>kr\t"
+      :
+
+      :
+  END
+  call writefile(lines, 'XvisualReselect')
+  source XvisualReselect
+
+  bwipe!
+  call delete('XvisualReselect')
 endfunc
 
 
-- 
cgit