patch 9.0.0940: crash when typing a letter in a terminal window

Problem:    Crash when typing a letter in a terminal window. (Shane-XB-Qian)
Solution:   Use the "vterm" variable instead of getting the terminal pointer
            from the current buffer.  (closes #11608)
diff --git a/src/terminal.c b/src/terminal.c
index d0cdd45..bc36317 100644
--- a/src/terminal.c
+++ b/src/terminal.c
@@ -1590,7 +1590,7 @@
     // Ctrl-Shift-i may have the key "I" instead of "i", but for the kitty
     // keyboard protocol should use "i".  Applies to all ascii letters.
     if (ASCII_ISUPPER(c)
-	    && vterm_is_kitty_keyboard(curbuf->b_term->tl_vterm)
+	    && vterm_is_kitty_keyboard(vterm)
 	    && mod == (VTERM_MOD_CTRL | VTERM_MOD_SHIFT))
 	c = TOLOWER_ASC(c);
 
diff --git a/src/testdir/test_termcodes.vim b/src/testdir/test_termcodes.vim
index 8cab98b..97b06c6 100644
--- a/src/testdir/test_termcodes.vim
+++ b/src/testdir/test_termcodes.vim
@@ -2156,6 +2156,9 @@
 endfunc
 
 func Test_CSIu_keys_without_modifiers()
+  " make this execute faster
+  set timeoutlen=10
+
   " Escape sent as `CSI 27 u` should act as normal escape and not undo
   call setline(1, 'a')
   call feedkeys('a' .. GetEscCodeCSIuWithoutModifier("\e"), 'Lx!')
@@ -2166,6 +2169,8 @@
   call setline(1, '')
   call feedkeys('a' .. GetEscCodeCSIuWithoutModifier("\t") .. "\<Esc>", 'Lx!')
   call assert_equal("\t", getline(1))
+
+  set timeoutlen&
 endfunc
 
 " Check that when DEC mouse codes are recognized a special key is handled.
diff --git a/src/version.c b/src/version.c
index 86f857e..da0b1e5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -696,6 +696,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    940,
+/**/
     939,
 /**/
     938,