Fix regression causing crash when history token search hits end

This is consistent with what we do for highlighting history search,
see d7354880e3 (Fix regression causing crash in token history search,
2025-01-27).  In future, we should try to find a better fix (and a
better test).

Fixes the other problem described in #11096

src/reader.rs

@@ -4044,7 +4044,7 @@ fn update_termsize(&mut self) {
     }
 
     /// Flash the screen. This function changes the color of the current line momentarily.
-    fn flash(&mut self, flash_range: Range<usize>) {
+    fn flash(&mut self, mut flash_range: Range<usize>) {
         // Multiple flashes may be enqueued by keypress repeat events and can pile up to cause a
         // significant delay in processing future input while all the flash() calls complete, as we
         // effectively sleep for 100ms each go. See #8610.
@@ -4062,6 +4062,10 @@ fn flash(&mut self, flash_range: Range<usize>) {
 
         // Save off the colors and set the background.
         let saved_colors = data.colors.clone();
+        if flash_range.end > data.colors.len() {
+            flash_range.start = flash_range.start.min(data.colors.len());
+            flash_range.end = data.colors.len();
+        }
         for color in &mut data.colors[flash_range] {
             color.foreground = HighlightRole::search_match;
             color.background = HighlightRole::search_match;

tests/checks/tmux-history-search2.fish

@@ -0,0 +1,14 @@
+#RUN: %fish %s
+#REQUIRES: command -v tmux
+#REQUIRES: test -z "$CI"
+
+isolated-tmux-start
+isolated-tmux send-keys ': 1' Enter
+isolated-tmux send-keys ': ' M-Up M-Down M-Up M-Up M-Up Enter
+isolated-tmux send-keys C-l 'echo still alive' Enter
+tmux-sleep
+# isolated-tmux capture-pane -p | tail -2
+isolated-tmux capture-pane -p
+# CHECK: prompt 2> echo still alive
+# CHECK: still alive
+# CHECK: prompt 3>