crash.vim

set nocompatible noswapfile viminfo=

let g:re = '\m\C\%(\\right\>\%(\\\w\+\>\|\\[|{}]\|.\)\|\\middle\>\%(\\\w\+\>\|\\[|{}]\|.\)\|\\left\>\%(\\\w\+\>\|\\[|{}]\|.\)\|\%(\\[bB]igg\?\)r\>\%(\\\w\+\>\|\\[|{}]\|.\)\|\%(\\[bB]igg\?\)m\>\%(\\\w\+\>\|\\[|{}]\|.\)\|\%(\\[bB]igg\?\)l\>\%(\\\w\+\>\|\\[|{}]\|.\)\|\%(\%(\w\[\)\@2<!\|\%(\\[bB]igg\?\[\)\@6<=\)\%(\\[bB]igg\?\)\%(\\r\%(angle\|floor\|ceil\|[vV]ert\)\>\|\\urcorner\>\|)\|]\|\\}\)\|\%(\\[bB]igg\?\)\%(\\vert\>\||\|\\|\)\|\%(\\[bB]igg\?\)\%(\\l\%(angle\|floor\|ceil\|[vV]ert\)\>\|\\ulcorner\>\|(\|\[\|\\{\)\|\%(\\left\|\\right\|\[\@1<!\\[bB]igg\?[lr]\?\)\@6<!\v%(\\@<!%(\\\\)*)@4<=\m\\}\|\%(\\left\|\\right\|\[\@1<!\\[bB]igg\?[lr]\?\)\@6<!\v%(\\@<!%(\\\\)*)@4<=\m\\{\|\%(\\left\|\\right\|\[\@1<!\\[bB]igg\?[lr]\?\)\@6<!\v%(\\@<!%(\\\\)*)@4<=\m]\|\%(\\left\|\\right\|\[\@1<!\\[bB]igg\?[lr]\?\)\@6<!\v%(\\@<!%(\\\\)*)@4<=\m\[\|\%(\\left\|\\right\|\[\@1<!\\[bB]igg\?[lr]\?\)\@6<!\v%(\\@<!%(\\\\)*)@4<=\m)\|\%(\\left\|\\right\|\[\@1<!\\[bB]igg\?[lr]\?\)\@6<!\v%(\\@<!%(\\\\)*)@4<=\m(\|}\|{\|\\)\|\\(\|\\]\|\\\[\|\\fi\>\|\\else\>\|\\if\w*\>\|\\makeatother\|\\makeatletter\|\\endgroup\|\\begingroup\|\\egroup\|\\bgroup\|\\end{tabular}\|\\toprule\>\|\\midrule\>\|\\bottomrule\>\|\\begin{tabular}\|\\end\s*{\%(enumerate\*\=\|itemize\*\=\)}\|\\item\>\|\\begin\s*{\%(enumerate\*\=\|itemize\*\=\)}\|\\end\s*{\%([^}]*\)}\|\\begin\s*{\%([^}]*\)}\)\%>1c\&'

let g:timer = timer_start(100, 'Callback', {'repeat': -1})
call timer_pause(g:timer, 1)

function! Callback(tid)
    call timer_pause(a:tid, 1)
    call searchpos(g:re, 'bnW')
endfunction
autocmd CursorMoved * call timer_pause(g:timer, 0)

function! TYP()
endfunction
autocmd TextYankPost * call TYP()

function! DoCrash(tid)
    call feedkeys(line('.') == line('$') ? 'k' : 'j', 'tm')
endfunction

let g:content = "\\subsection{callitype pouty}\n"
    \ . "Glans $\\endocoele$ neomycins anatifer coloring msent $\\multo$ athabasca carnied spreng piotty $\\rogerson$.\n"
    \ . "connell shawnees frugivora $\\glans$ endocoele neomycins anatifer coloring msent multo $\\athabasca$ carnied\n"
    \ . "spreng piotty rogerson connell shawnees frugivora."
noswapfile vspl ex.tex
sil put!=g:content

normal! gg0
call feedkeys('v', 'tm')
call timer_start(100, 'DoCrash', {'repeat': 40})

sanitizer.log

"ex.tex" [New File]
Press ENTER or type command to continue=================================================================
==26699==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300000206f at pc 0x55c6eb9f1a71 bp 0x7ffeb94f6170 sp 0x7ffeb94f6160
READ of size 1 at 0x60300000206f thread T0
    #0 0x55c6eb9f1a70 in utf_ptr2char /home/andy/ext/vim/src/mbyte.c:1793
    #1 0x55c6ebb24325 in nfa_regmatch /home/andy/ext/vim/src/regexp_nfa.c:5623
    #2 0x55c6ebb22b41 in recursive_regmatch /home/andy/ext/vim/src/regexp_nfa.c:5192
    #3 0x55c6ebb24e00 in nfa_regmatch /home/andy/ext/vim/src/regexp_nfa.c:5849
    #4 0x55c6ebb22b41 in recursive_regmatch /home/andy/ext/vim/src/regexp_nfa.c:5192
    #5 0x55c6ebb24e00 in nfa_regmatch /home/andy/ext/vim/src/regexp_nfa.c:5849
    #6 0x55c6ebb22b41 in recursive_regmatch /home/andy/ext/vim/src/regexp_nfa.c:5192
    #7 0x55c6ebb24e00 in nfa_regmatch /home/andy/ext/vim/src/regexp_nfa.c:5849
    #8 0x55c6ebb2b576 in nfa_regtry /home/andy/ext/vim/src/regexp_nfa.c:6995
    #9 0x55c6ebb2cad4 in nfa_regexec_both /home/andy/ext/vim/src/regexp_nfa.c:7188
    #10 0x55c6ebb2d372 in nfa_regexec_multi /home/andy/ext/vim/src/regexp_nfa.c:7398
    #11 0x55c6ebb2e137 in vim_regexec_multi /home/andy/ext/vim/src/regexp.c:8361
    #12 0x55c6ebb736e9 in searchit /home/andy/ext/vim/src/search.c:963
    #13 0x55c6eb81d0ba in search_cmn /home/andy/ext/vim/src/evalfunc.c:9982
    #14 0x55c6eb81fda3 in f_searchpos /home/andy/ext/vim/src/evalfunc.c:10451
    #15 0x55c6eb7f29fd in call_internal_func /home/andy/ext/vim/src/evalfunc.c:1072
    #16 0x55c6ebc93147 in call_func /home/andy/ext/vim/src/userfunc.c:1455
    #17 0x55c6ebc8e0e9 in get_func_tv /home/andy/ext/vim/src/userfunc.c:451
    #18 0x55c6ebc9daf8 in ex_call /home/andy/ext/vim/src/userfunc.c:3094
    #19 0x55c6eb88468b in do_one_cmd /home/andy/ext/vim/src/ex_docmd.c:2886
    #20 0x55c6eb878cbd in do_cmdline /home/andy/ext/vim/src/ex_docmd.c:1040
    #21 0x55c6ebc90961 in call_user_func /home/andy/ext/vim/src/userfunc.c:942
    #22 0x55c6ebc92fe7 in call_func /home/andy/ext/vim/src/userfunc.c:1436
    #23 0x55c6eb86208f in timer_callback /home/andy/ext/vim/src/ex_cmds2.c:1302
    #24 0x55c6eb862937 in check_due_timer /home/andy/ext/vim/src/ex_cmds2.c:1366
    #25 0x55c6ebc6b079 in ui_wait_for_chars_or_timer /home/andy/ext/vim/src/ui.c:234
    #26 0x55c6ebaaf392 in WaitForChar /home/andy/ext/vim/src/os_unix.c:5938
    #27 0x55c6eba9fdd7 in mch_inchar /home/andy/ext/vim/src/os_unix.c:487
    #28 0x55c6ebc6af2d in ui_inchar /home/andy/ext/vim/src/ui.c:190
    #29 0x55c6eb932bb1 in inchar /home/andy/ext/vim/src/getchar.c:3099
    #30 0x55c6eb931d85 in vgetorpeek /home/andy/ext/vim/src/getchar.c:2881
    #31 0x55c6eb92b7c7 in vgetc /home/andy/ext/vim/src/getchar.c:1634
    #32 0x55c6eb92c3e5 in safe_vgetc /home/andy/ext/vim/src/getchar.c:1838
    #33 0x55c6eba00a7c in normal_cmd /home/andy/ext/vim/src/normal.c:623
    #34 0x55c6ebde1e64 in main_loop /home/andy/ext/vim/src/main.c:1353
    #35 0x55c6ebde1048 in vim_main2 /home/andy/ext/vim/src/main.c:915
    #36 0x55c6ebde02ad in main /home/andy/ext/vim/src/main.c:443
    #37 0x7f702994906a in __libc_start_main (/usr/lib/libc.so.6+0x2306a)
    #38 0x55c6eb7509a9 in _start (/home/andy/ext/vim/src/vim+0x16c9a9)

0x60300000206f is located 31 bytes inside of 32-byte region [0x603000002050,0x603000002070)
freed by thread T0 here:
    #0 0x7f702d47a9b1 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:66
    #1 0x55c6eb9ca6e2 in vim_free /home/andy/ext/vim/src/misc2.c:1837
    #2 0x55c6eb90e429 in apply_autocmds_group /home/andy/ext/vim/src/fileio.c:9727
    #3 0x55c6eb90c927 in apply_autocmds /home/andy/ext/vim/src/fileio.c:9205
    #4 0x55c6eba4590e in yank_do_autocmd /home/andy/ext/vim/src/ops.c:1765
    #5 0x55c6eba52894 in op_yank /home/andy/ext/vim/src/ops.c:3446
    #6 0x55c6eba0ac81 in do_pending_operator /home/andy/ext/vim/src/normal.c:1888
    #7 0x55c6eba66734 in clip_get_selection /home/andy/ext/vim/src/ops.c:6689
    #8 0x55c6ebc746bb in clip_x11_convert_selection_cb /home/andy/ext/vim/src/ui.c:2412
    #9 0x7f702ae89ad8  (/usr/lib/libXt.so.6+0x36ad8)

previously allocated by thread T0 here:
    #0 0x7f702d47ad99 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:86
    #1 0x55c6eb9c83ee in lalloc /home/andy/ext/vim/src/misc2.c:976
    #2 0x55c6eb9c8245 in alloc /home/andy/ext/vim/src/misc2.c:874
    #3 0x55c6eb9c85ca in vim_strsave /home/andy/ext/vim/src/misc2.c:1315
    #4 0x55c6eb90d68f in apply_autocmds_group /home/andy/ext/vim/src/fileio.c:9546
    #5 0x55c6eb90c927 in apply_autocmds /home/andy/ext/vim/src/fileio.c:9205
    #6 0x55c6eba4590e in yank_do_autocmd /home/andy/ext/vim/src/ops.c:1765
    #7 0x55c6eba52894 in op_yank /home/andy/ext/vim/src/ops.c:3446
    #8 0x55c6eba0ac81 in do_pending_operator /home/andy/ext/vim/src/normal.c:1888
    #9 0x55c6eba66734 in clip_get_selection /home/andy/ext/vim/src/ops.c:6689
    #10 0x55c6ebc746bb in clip_x11_convert_selection_cb /home/andy/ext/vim/src/ui.c:2412
    #11 0x7f702ae89ad8  (/usr/lib/libXt.so.6+0x36ad8)

SUMMARY: AddressSanitizer: heap-use-after-free /home/andy/ext/vim/src/mbyte.c:1793 in utf_ptr2char
Shadow bytes around the buggy address:
  0x0c067fff83b0: 00 00 00 00 fa fa 00 00 00 04 fa fa 00 00 00 00
  0x0c067fff83c0: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
  0x0c067fff83d0: 00 00 fa fa 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c067fff83e0: 00 00 00 00 fa fa 00 00 00 06 fa fa fa fa fa fa
  0x0c067fff83f0: fa fa 00 00 00 00 fa fa fa fa fa fa fa fa 00 00
=>0x0c067fff8400: 00 00 fa fa 00 00 00 07 fa fa fd fd fd[fd]fa fa
  0x0c067fff8410: fa fa fa fa fa fa 00 00 07 fa fa fa 00 00 00 04
  0x0c067fff8420: fa fa 00 00 00 04 fa fa 00 00 00 05 fa fa 00 00
  0x0c067fff8430: 00 01 fa fa 00 00 00 02 fa fa 00 00 00 02 fa fa
  0x0c067fff8440: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 fa
  0x0c067fff8450: fa fa 00 00 06 fa fa fa 00 00 02 fa fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==26699==ABORTING