Merge overlapping selections before replacing characters

Without doing this, replace with multiple selection at buffer end
breaks as the first selection will replace the end-of-line with a
non-eol character, then a new eol will automatically be added which
will put remaining selections past the end of the buffer.

Fixes #5316

4 files changed, 8 insertions, 2 deletions

diff --git a/src/normal.cc b/src/normal.cc
index d2318865..a2a2504b 100644
--- a/src/normal.cc
+++ b/src/normal.cc
@@ -448,10 +448,12 @@ void replace_with_char(Context& context, NormalParams)
         ScopedEdition edition(context);
         ScopedSelectionEdition selection_edition{context};
         Buffer& buffer = context.buffer();
-        context.selections().for_each([&](size_t index, Selection& sel) {
+        auto& sels = context.selections();
+        sels.merge_overlapping();
+        sels.for_each([&](size_t index, Selection& sel) {
             CharCount count = char_length(buffer, sel);
             replace(buffer, sel, String{*cp, count});
-        }, false);
+        }, true);
     }, "replace with char", "enter char to replace with\n");
 }
 
diff --git a/test/regression/5316-crash-on-duplicate-cursor-replace-at-end/cmd b/test/regression/5316-crash-on-duplicate-cursor-replace-at-end/cmd
new file mode 100644
index 00000000..f0fb467d
--- /dev/null
+++ b/test/regression/5316-crash-on-duplicate-cursor-replace-at-end/cmd
@@ -0,0 +1 @@
+<a-O>+rc
diff --git a/test/regression/5316-crash-on-duplicate-cursor-replace-at-end/in b/test/regression/5316-crash-on-duplicate-cursor-replace-at-end/in
new file mode 100644
index 00000000..8b137891
--- /dev/null
+++ b/test/regression/5316-crash-on-duplicate-cursor-replace-at-end/in
@@ -0,0 +1 @@
+
diff --git a/test/regression/5316-crash-on-duplicate-cursor-replace-at-end/out b/test/regression/5316-crash-on-duplicate-cursor-replace-at-end/out
new file mode 100644
index 00000000..02b64336
--- /dev/null
+++ b/test/regression/5316-crash-on-duplicate-cursor-replace-at-end/out
@@ -0,0 +1,2 @@
+
+c