vim-patch:8.2.2422: crash when deleting with line number out of range

Problem:    Crash when deleting with line number out of range. (Houyunsong)
Solution:   Avoid using a negative line number.
1d859e2421

src/nvim/normal.c

@@ -818,7 +818,7 @@ static bool normal_get_command_count(NormalState *s)
     }
 
     if (s->ca.count0 < 0) {
-      // got too large!
+      // overflow
       s->ca.count0 = 999999999L;
     }
 
@@ -1025,10 +1025,14 @@ static int normal_execute(VimState *state, int key)
     // If you give a count before AND after the operator, they are
     // multiplied.
     if (s->ca.count0) {
-      s->ca.count0 *= s->ca.opcount;
+      s->ca.count0 = (long)((uint64_t)s->ca.count0 * (uint64_t)s->ca.opcount);
     } else {
       s->ca.count0 = s->ca.opcount;
     }
+    if (s->ca.count0 < 0) {
+      // overflow
+      s->ca.count0 = 999999999L;
+    }
   }
 
   // Always remember the count.  It will be set to zero (on the next call,
@@ -5817,6 +5821,9 @@ static void nv_percent(cmdarg_T *cap)
         curwin->w_cursor.lnum = (curbuf->b_ml.ml_line_count *
                                  cap->count0 + 99L) / 100L;
       }
+      if (curwin->w_cursor.lnum < 1) {
+        curwin->w_cursor.lnum = 1;
+      }
       if (curwin->w_cursor.lnum > curbuf->b_ml.ml_line_count) {
         curwin->w_cursor.lnum = curbuf->b_ml.ml_line_count;
       }

src/nvim/testdir/test_ex_mode.vim

@@ -1,5 +1,8 @@
 " Test editing line in Ex mode (see :help Q and :help gQ).
 
+source check.vim
+source shared.vim
+
 " Helper function to test editing line in Q Ex mode
 func Ex_Q(cmd)
   " Is there a simpler way to test editing Ex line?
@@ -79,4 +82,20 @@ func Test_ex_mode_errors()
   quit
 endfunc
 
+func Test_ex_mode_count_overflow()
+  " this used to cause a crash
+  let lines =<< trim END
+    call feedkeys("\<Esc>Q\<CR>")
+    v9|9silent! vi|333333233333y32333333%O
+    call writefile(['done'], 'Xdidexmode')
+    qall!
+  END
+  call writefile(lines, 'Xexmodescript')
+  call assert_equal(1, RunVim([], [], '-e -s -S Xexmodescript -c qa'))
+  call assert_equal(['done'], readfile('Xdidexmode'))
+
+  call delete('Xdidexmode')
+  call delete('Xexmodescript')
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab