Fix invalid access to deleted line when updating insert completion

The computation of the completion end position was taking place too
early, before we checked if the buffer did get modified.

Fixes #3349

src/insert_completer.cc

@@ -267,12 +267,6 @@ InsertCompletion complete_option(const SelectionList& sels,
                          str_to_int({match[2].first, match[2].second}) - 1 };
         if (not buffer.is_valid(coord))
             return {};
-        auto end = cursor_pos;
-        if (match[3].matched)
-        {
-            ByteCount len = str_to_int({match[3].first, match[3].second});
-            end = buffer.advance(coord, len);
-        }
         size_t timestamp = (size_t)str_to_int({match[4].first, match[4].second});
         auto changes = buffer.changes_since(timestamp);
         if (any_of(changes, [&](auto&& change) { return change.begin < coord; }))
@@ -327,6 +321,12 @@ InsertCompletion complete_option(const SelectionList& sels,
                 std::pop_heap(first, last--, greater);
             }
 
+            auto end = cursor_pos;
+            if (match[3].matched)
+            {
+                ByteCount len = str_to_int({match[3].first, match[3].second});
+                end = buffer.advance(coord, len);
+            }
             return { std::move(candidates), coord, end, timestamp };
         }
     }

test/regression/3349-crash-in-completion/cmd

@@ -0,0 +1 @@
+gei<c-n><backspace><backspace>

test/regression/3349-crash-in-completion/in

@@ -0,0 +1,2 @@
+first
+a

test/regression/3349-crash-in-completion/out

@@ -0,0 +1 @@
+first

test/regression/3349-crash-in-completion/rc

@@ -0,0 +1,4 @@
+set-option global autocomplete insert
+declare-option -hidden completions my_completions
+set-option global completers option=my_completions
+set-option global my_completions "2.1+1@%val(timestamp)" "a||a"

test/regression/3349-crash-in-completion/script

@@ -0,0 +1,2 @@
+ui_out -ignore 4
+sleep .2 # trigger insert completion auto update