https://github.com/vim/vim/pull/2107

asan.log

=================================================================
==11624==ERROR: AddressSanitizer: heap-use-after-free on address 0x6230001b21f8 at pc 0x55c7bcd562c4 bp 0x7ffefb0a3ce0 sp 0x7ffefb0a3cd0
READ of size 4 at 0x6230001b21f8 thread T0
    #0 0x55c7bcd562c3 in curs_rows /home/who/trunk/vim/src/shadow/move.c:673
    #1 0x55c7bcd58135 in curs_columns /home/who/trunk/vim/src/shadow/move.c:945
    #2 0x55c7bcd56272 in validate_cursor /home/who/trunk/vim/src/shadow/move.c:636
    #3 0x55c7bd079ce2 in main_loop /home/who/trunk/vim/src/shadow/main.c:1235
    #4 0x55c7bd079540 in vim_main2 /home/who/trunk/vim/src/shadow/main.c:919
    #5 0x55c7bd078b70 in main /home/who/trunk/vim/src/shadow/main.c:443
    #6 0x7ff80d5d0b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #7 0x55c7bcad8639 in _start (/home/who/trunk/vim/src/shadow/vim+0xeb639)

0x6230001b21f8 is located 248 bytes inside of 6328-byte region [0x6230001b2100,0x6230001b39b8)
freed by thread T0 here:
    #0 0x7ff80e24a7b8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7b8)
    #1 0x55c7bcd43ebb in vim_free /home/who/trunk/vim/src/shadow/misc2.c:1837
    #2 0x55c7bd00b4db in win_free /home/who/trunk/vim/src/shadow/window.c:4737
    #3 0x55c7bd001af8 in win_free_mem /home/who/trunk/vim/src/shadow/window.c:2589
    #4 0x55c7bd000e32 in win_close /home/who/trunk/vim/src/shadow/window.c:2434
    #5 0x55c7bcae1822 in do_buffer /home/who/trunk/vim/src/shadow/buffer.c:1434
    #6 0x55c7bcae08d3 in do_bufdel /home/who/trunk/vim/src/shadow/buffer.c:1183
    #7 0x55c7bcc1613d in ex_bunload /home/who/trunk/vim/src/shadow/ex_docmd.c:5626
    #8 0x55c7bcc03027 in do_one_cmd /home/who/trunk/vim/src/shadow/ex_docmd.c:2533
    #9 0x55c7bcbfa520 in do_cmdline /home/who/trunk/vim/src/shadow/ex_docmd.c:1041
    #10 0x55c7bcb6d6aa in ex_execute /home/who/trunk/vim/src/shadow/eval.c:8177
    #11 0x55c7bcc03027 in do_one_cmd /home/who/trunk/vim/src/shadow/ex_docmd.c:2533
    #12 0x55c7bcbfa520 in do_cmdline /home/who/trunk/vim/src/shadow/ex_docmd.c:1041
    #13 0x55c7bcfe2265 in call_user_func /home/who/trunk/vim/src/shadow/userfunc.c:953
    #14 0x55c7bcfe49aa in call_func /home/who/trunk/vim/src/shadow/userfunc.c:1458
    #15 0x55c7bd065900 in job_cleanup /home/who/trunk/vim/src/shadow/channel.c:5297
    #16 0x55c7bd0667c3 in job_check_ended /home/who/trunk/vim/src/shadow/channel.c:5516
    #17 0x55c7bcd51d8e in parse_queued_messages /home/who/trunk/vim/src/shadow/misc2.c:6396
    #18 0x55c7bce0c5f3 in mch_inchar /home/who/trunk/vim/src/shadow/os_unix.c:420
    #19 0x55c7bcfc69b1 in ui_inchar /home/who/trunk/vim/src/shadow/ui.c:190
    #20 0x55c7bccb46c3 in inchar /home/who/trunk/vim/src/shadow/getchar.c:3099
    #21 0x55c7bccb3988 in vgetorpeek /home/who/trunk/vim/src/shadow/getchar.c:2881
    #22 0x55c7bccae5d1 in vpeekc /home/who/trunk/vim/src/shadow/getchar.c:1876
    #23 0x55c7bccae80e in char_avail /home/who/trunk/vim/src/shadow/getchar.c:1932
    #24 0x55c7bced0e71 in redrawing /home/who/trunk/vim/src/shadow/screen.c:10823
    #25 0x55c7bcd56286 in curs_rows /home/who/trunk/vim/src/shadow/move.c:672
    #26 0x55c7bcd58135 in curs_columns /home/who/trunk/vim/src/shadow/move.c:945
    #27 0x55c7bcd56272 in validate_cursor /home/who/trunk/vim/src/shadow/move.c:636
    #28 0x55c7bd079ce2 in main_loop /home/who/trunk/vim/src/shadow/main.c:1235
    #29 0x55c7bd079540 in vim_main2 /home/who/trunk/vim/src/shadow/main.c:919

previously allocated by thread T0 here:
    #0 0x7ff80e24ab50 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50)
    #1 0x55c7bcd41bb6 in lalloc /home/who/trunk/vim/src/shadow/misc2.c:976
    #2 0x55c7bcd41aae in alloc_clear /home/who/trunk/vim/src/shadow/misc2.c:898
    #3 0x55c7bd00aaf1 in win_alloc /home/who/trunk/vim/src/shadow/window.c:4548
    #4 0x55c7bcff8d64 in win_split_ins /home/who/trunk/vim/src/shadow/window.c:1005
    #5 0x55c7bcff7659 in win_split /home/who/trunk/vim/src/shadow/window.c:742
    #6 0x55c7bcc22a5c in ex_splitview /home/who/trunk/vim/src/shadow/ex_docmd.c:8425
    #7 0x55c7bcc03027 in do_one_cmd /home/who/trunk/vim/src/shadow/ex_docmd.c:2533
    #8 0x55c7bcbfa520 in do_cmdline /home/who/trunk/vim/src/shadow/ex_docmd.c:1041
    #9 0x55c7bcbf4394 in do_source /home/who/trunk/vim/src/shadow/ex_cmds2.c:4573
    #10 0x55c7bd07fa31 in source_startup_scripts /home/who/trunk/vim/src/shadow/main.c:3007
    #11 0x55c7bd078b6b in main /home/who/trunk/vim/src/shadow/main.c:431
    #12 0x7ff80d5d0b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-use-after-free /home/who/trunk/vim/src/shadow/move.c:673 in curs_rows
Shadow bytes around the buggy address:
  0x0c468002e3e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c468002e3f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c468002e400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c468002e410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c468002e420: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c468002e430: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
  0x0c468002e440: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c468002e450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c468002e460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c468002e470: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c468002e480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11624==ABORTING