patch 8.0.0886: crash when using ":term ls"

Problem:    Crash when using ":term ls".
Solution:   Fix line number computation.  Add a test for this.

src/terminal.c

@@ -695,14 +695,16 @@ term_job_running(term_T *term)
     static void
 add_scrollback_line_to_buffer(term_T *term, char_u *text, int len)
 {
-    linenr_T	    lnum = term->tl_scrollback.ga_len - 1;
+    buf_T	*buf = term->tl_buffer;
+    int		empty = (buf->b_ml.ml_flags & ML_EMPTY);
+    linenr_T	lnum = buf->b_ml.ml_line_count;
 
     ml_append_buf(term->tl_buffer, lnum, text, len + 1, FALSE);
-    if (lnum == 0)
+    if (empty)
     {
 	/* Delete the empty line that was in the empty buffer. */
-	curbuf = term->tl_buffer;
+	curbuf = buf;
-	ml_delete(2, FALSE);
+	ml_delete(1, FALSE);
 	curbuf = curwin->w_buffer;
     }
 }

src/testdir/test_terminal.vim

@@ -210,6 +210,31 @@ func Test_terminal_scrape_multibyte()
   call delete('Xtext')
 endfunc
 
+func Test_terminal_scroll()
+  call writefile(range(1, 200), 'Xtext')
+  if has('win32')
+    let cmd = 'cmd /c "type Xtext"'
+  else
+    let cmd = "cat Xtext"
+  endif
+  let buf = term_start(cmd)
+
+  let g:job = term_getjob(buf)
+  call WaitFor('job_status(g:job) == "dead"')
+  call term_wait(buf)
+  if has('win32')
+    " TODO: this should not be needed
+    sleep 100m
+  endif
+
+  call assert_equal('1', getline(1))
+  call assert_equal('49', getline(49))
+  call assert_equal('200', getline(200))
+
+  exe buf . 'bwipe'
+  call delete('Xtext')
+endfunc
+
 func Test_terminal_size()
   let cmd = Get_cat_123_cmd()
 

src/version.c

@@ -769,6 +769,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    886,
 /**/
     885,
 /**/