Commit: patch 9.2.0167: terminal: setting buftype=terminal may cause a crash

[Christian Brabandt]

patch 9.2.0167: terminal: setting buftype=terminal may cause a crash

Commit: https://github.com/vim/vim/commit/ba27e4fffae67ba142e6fb5551348c48fd2ffad6
Author: Christian Brabandt <c...@256bit.org>
Date: Sat Mar 14 17:31:45 2026 +0000

patch 9.2.0167: terminal: setting buftype=terminal may cause a crash

Problem: setting buftype=terminal may cause a crash
(lacygoill, after v9.2.0127)
Solution: Validate that curwin->w_buffer->b_term is not null

fixes: #19686
closes: #19676

Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/eval.c b/src/eval.c
index 42719d9e5..7168b19de 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -6984,7 +6984,7 @@ var2fpos(
if (name[1] == '0') // "w0": first visible line
{
#ifdef FEAT_TERMINAL
- if (bt_terminal(curwin->w_buffer))
+ if (bt_terminal(curwin->w_buffer) && curwin->w_buffer->b_term != NULL)
may_move_terminal_to_buffer(curwin->w_buffer->b_term, TRUE);
#endif
update_topline();
@@ -6996,7 +6996,7 @@ var2fpos(
else if (name[1] == '$') // "w$": last visible line
{
#ifdef FEAT_TERMINAL
- if (bt_terminal(curwin->w_buffer))
+ if (bt_terminal(curwin->w_buffer) && curwin->w_buffer->b_term != NULL)
may_move_terminal_to_buffer(curwin->w_buffer->b_term, TRUE);
#endif
validate_botline();
diff --git a/src/testdir/test_terminal3.vim b/src/testdir/test_terminal3.vim
index 8046f14a5..c8825917e 100644
--- a/src/testdir/test_terminal3.vim
+++ b/src/testdir/test_terminal3.vim
@@ -1203,6 +1203,11 @@ func Test_term_getpos()
call assert_true(str2nr(result[0]) > 1)

call StopVimInTerminal(buf)
+ " this crashed
+ new
+ setl buftype=terminal
+ call assert_equal(2, line('w0') + line('w$'))
+ bw
endfunc

" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index ddf2d64bd..74d4b6cd4 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 167,
/**/
166,
/**/