patch 9.1.0043: ml_get: invalid lnum when :s replaces visual selection

Problem:  ml_get: invalid lnum when :s replaces visual selection
          (@ropery)
Solution: substitute may decrement the number of lines in a buffer,
          so validate, that the bottom lines of the visual selection
          stays within the max buffer line

fixes: #13890
closes: #13892

Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
index 401a350..f0d8edc 100644
--- a/src/testdir/test_visual.vim
+++ b/src/testdir/test_visual.vim
@@ -1622,4 +1622,12 @@
   bwipe!
 endfunc
 
+func Test_visual_substitute_visual()
+  new
+  call setline(1, ['one', 'two', 'three'])
+  call feedkeys("Gk\<C-V>j$:s/\\%V\\_.*\\%V/foobar\<CR>", 'tx')
+  call assert_equal(['one', 'foobar'], getline(1, '$'))
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab