patch 9.1.0043: ml_get: invalid lnum when :s replaces visual selection

Problem:  ml_get: invalid lnum when :s replaces visual selection
          (@ropery)
Solution: substitute may decrement the number of lines in a buffer,
          so validate, that the bottom lines of the visual selection
          stays within the max buffer line

fixes: #13890
closes: #13892

Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/regexp.c b/src/regexp.c
index c3bc496..7355201 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -1318,6 +1318,10 @@
 	    top = curbuf->b_visual.vi_end;
 	    bot = curbuf->b_visual.vi_start;
 	}
+	// a substitue command may have
+	// removed some lines
+	if (bot.lnum > curbuf->b_ml.ml_line_count)
+	    bot.lnum = curbuf->b_ml.ml_line_count;
 	mode = curbuf->b_visual.vi_mode;
 	curswant = curbuf->b_visual.vi_curswant;
     }