Commit: patch 9.2.0784: crash when borrowing statusline highlight in silent Ex mode

[Christian Brabandt]

patch 9.2.0784: crash when borrowing statusline highlight in silent Ex mode

Commit: https://github.com/vim/vim/commit/27e560c68ccb6174805a358db55e1eaf555c1dd1
Author: Hirohito Higashi <h.eas...@gmail.com>
Date: Fri Jul 17 14:52:07 2026 +0000

patch 9.2.0784: crash when borrowing statusline highlight in silent Ex mode

Problem: Vim crashes with a NULL pointer dereference when a status line is
redrawn next to a vertical separator in silent Ex mode, where the
screen cell arrays are not allocated (tdjackey).
Solution: Skip borrowing the vertical separator highlight when the screen is
not allocated (Hirohito Higashi).

closes: #20776

Co-Authored-By: Claude Opus 4.8 (1M context) <nor...@anthropic.com>
Signed-off-by: Hirohito Higashi <h.eas...@gmail.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/drawscreen.c b/src/drawscreen.c
index be5f77a53..65d6a88d3 100644
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -657,7 +657,9 @@ borrow_stl_vsep_hl(void)
win_T *left = NULL;
win_T *right = NULL;

- if (!redrawing())
+ // In silent Ex mode the screen is not allocated, so LineOffset and
+ // ScreenAttrs are NULL; there is nothing to borrow.
+ if (!redrawing() || ScreenLines == NULL)
return;

FOR_ALL_WINDOWS(left)
diff --git a/src/testdir/crash/poc_borrow_stl_vsep_hl b/src/testdir/crash/poc_borrow_stl_vsep_hl
new file mode 100644
index 000000000..136b700c9
--- /dev/null
+++ b/src/testdir/crash/poc_borrow_stl_vsep_hl
@@ -0,0 +1,2 @@
+vnew
+o x
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 9b673e4e2..2a970a3c3 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -83,6 +83,11 @@ func Test_crash1()
call delete('Xerr')
call delete('@')

+ let file = 'crash/poc_borrow_stl_vsep_hl'
+ let args = printf(cmn_args, vim, file)
+ call s:RunCommandAndWait(buf, args ..
+ \ ' && echo "crash 11: [OK]" >> X_crash1_result.txt')
+
" clean up
exe buf .. "bw!"

@@ -99,6 +104,7 @@ func Test_crash1()
\ 'crash 8: [OK]',
\ 'crash 9: [OK]',
\ 'crash 10: [OK]',
+ \ 'crash 11: [OK]',
\ ]

call assert_equal(expected, getline(1, '$'))
diff --git a/src/version.c b/src/version.c
index e3b6bdf83..5d0425b3f 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 784,
/**/
783,
/**/