fix(substitute): subtract number of backslashes later

src/nvim/ex_cmds.c

@@ -4142,6 +4142,7 @@ static int do_sub(exarg_T *eap, proftime_T timeout, long cmdpreview_ns, handle_T
           // That is Vi compatible.
           for (p1 = new_end; *p1; p1++) {
             if (p1[0] == '\\' && p1[1] != NUL) {            // remove backslash
+              sublen--;  // correct the byte counts for extmark_splice()
               STRMOVE(p1, p1 + 1);
             } else if (*p1 == CAR) {
               if (u_inssub(lnum) == OK) {             // prepare for undo

src/nvim/regexp.c

@@ -1737,10 +1737,6 @@ static int vim_regsub_both(char_u *source, typval_T *expr, char_u *dest, int des
   static char_u *eval_result = NULL;
   bool copy = flags & REGSUB_COPY;
 
-  // We need to keep track of how many backslashes we escape, so that the byte
-  // counts for `extmark_splice` are correct.
-  int num_escaped = 0;
-
   // Be paranoid...
   if ((source == NULL && expr == NULL) || dest == NULL) {
     emsg(_(e_null));
@@ -1928,7 +1924,6 @@ static int vim_regsub_both(char_u *source, typval_T *expr, char_u *dest, int des
           // later.  Used to insert a literal CR.
           default:
             if (flags & REGSUB_BACKSLASH) {
-              num_escaped += 1;
               if (copy) {
                 if (dst + 1 > dest + destlen) {
                   iemsg("vim_regsub_both(): not enough space");
@@ -2096,7 +2091,7 @@ static int vim_regsub_both(char_u *source, typval_T *expr, char_u *dest, int des
   }
 
 exit:
-  return (int)((dst - dest) + 1 - num_escaped);
+  return (int)((dst - dest) + 1);
 }
 
 /*

test/functional/lua/buffer_updates_spec.lua

@@ -612,7 +612,15 @@ describe('lua: nvim_buf_attach on_bytes', function()
       }
 
       feed("<esc>")
-      -- replacing with escaped characters
+      -- replacing with expression register
+      feed([[:%s/b/\=5+5]])
+      check_events {
+        { "test1", "bytes", 1, 3, 0, 1, 1, 0, 1, 1, 0, 2, 2 };
+        { "test1", "bytes", 1, 5, 0, 1, 1, 0, 2, 2, 0, 1, 1 };
+      }
+
+      feed("<esc>")
+      -- replacing with backslash
       feed([[:%s/b/\\]])
       check_events {
         { "test1", "bytes", 1, 3, 0, 1, 1, 0, 1, 1, 0, 1, 1 };
@@ -620,8 +628,24 @@ describe('lua: nvim_buf_attach on_bytes', function()
       }
 
       feed("<esc>")
-      -- replacing with expression register
+      -- replacing with backslash from expression register
-      feed([[:%s/b/\=5+5]])
+      feed([[:%s/b/\='\']])
+      check_events {
+        { "test1", "bytes", 1, 3, 0, 1, 1, 0, 1, 1, 0, 1, 1 };
+        { "test1", "bytes", 1, 5, 0, 1, 1, 0, 1, 1, 0, 1, 1 };
+      }
+
+      feed("<esc>")
+      -- replacing with backslash followed by another character
+      feed([[:%s/b/\\!]])
+      check_events {
+        { "test1", "bytes", 1, 3, 0, 1, 1, 0, 1, 1, 0, 2, 2 };
+        { "test1", "bytes", 1, 5, 0, 1, 1, 0, 2, 2, 0, 1, 1 };
+      }
+
+      feed("<esc>")
+      -- replacing with backslash followed by another character from expression register
+      feed([[:%s/b/\='\!']])
       check_events {
         { "test1", "bytes", 1, 3, 0, 1, 1, 0, 1, 1, 0, 2, 2 };
         { "test1", "bytes", 1, 5, 0, 1, 1, 0, 2, 2, 0, 1, 1 };