vim and glibc malloc crash

gistfile1.txt

Ubuntu 11.10 vim-7.3.346

Breakpoint 1, find_var_in_ht (ht=0x861308, varname=0xe39da0 "autofmt#compat#formatexpr", writing=0) at eval.c:19590
19590	    ___hi = hi;
(gdb) print ___hi
$1 = (hashitem_T *) 0x0
(gdb) n
19591	printf("YYY: 0: %p %p\n", hi, hi->hi_key);
(gdb) print ___hi
$2 = (hashitem_T *) 0x9e7f80
(gdb) print ___hi->hi_key
$3 = (char_u *) 0x0
(gdb) watch(___hi->hi_key)
Hardware watchpoint 2: (___hi->hi_key)
(gdb) c
Continuing.
YYY: 0: 0x9e7f80 (nil)
[Thread 0x7fffecc20700 (LWP 5345) exited]
Hardware watchpoint 2: (___hi->hi_key)

Old value = (char_u *) 0x0
New value = (char_u *) 0xa1 <Address 0xa1 out of bounds>
0x00007ffff4f624cb in ?? () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) bt
#0  0x00007ffff4f624cb in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007ffff4f6477d in malloc () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00000000004e2bbf in lalloc (size=30, message=1) at misc2.c:928
#3  0x00000000004e2acc in alloc (size=30) at misc2.c:827
#4  0x00000000004e2cbb in vim_strsave (string=0xabc550 "    call setline(lnum, line1)") at misc2.c:1245
#5  0x000000000046ca0d in do_cmdline (cmdline=0xcd2fe0 "\" Maintainer:   Yukihiro Nakadaira <[email protected]>", fgetline=0x46adc6 <getsourceline>, cookie=0x7fffffffd490, flags=7) at ex_docmd.c:1052
#6  0x000000000046aa0b in do_source (fname=0xa5d290 "/home/yukihiro/tmp/vim/src/autofmt/autoload/autofmt/compat.vim", check_other=0, is_vimrc=0) at ex_cmds2.c:3188
#7  0x0000000000469cb8 in source_callback (fname=0xa5d290 "/home/yukihiro/tmp/vim/src/autofmt/autoload/autofmt/compat.vim", cookie=0x0) at ex_cmds2.c:2615
#8  0x0000000000469f00 in do_in_runtimepath (name=0xabc440 "autoload/autofmt/compat.vim", all=0, callback=0x469c92 <source_callback>, cookie=0x0) at ex_cmds2.c:2709
#9  0x0000000000469ce2 in source_runtime (name=0xabc440 "autoload/autofmt/compat.vim", all=0) at ex_cmds2.c:2629
#10 0x00000000004549ec in script_autoload (name=0xe39da0 "autofmt#compat#formatexpr", reload=0) at eval.c:21696
#11 0x00000000004500ff in find_var_in_ht (ht=0x861308, varname=0xe39da0 "autofmt#compat#formatexpr", writing=0) at eval.c:19600
#12 0x000000000044ff52 in find_var (name=0xe39da0 "autofmt#compat#formatexpr", htp=0x0) at eval.c:19549
#13 0x000000000043dc75 in deref_func_name (name=0xe39da0 "autofmt#compat#formatexpr", lenp=0x7fffffffd7c0) at eval.c:8137
#14 0x0000000000439934 in eval7 (arg=0x7fffffffdbf0, rettv=0x7fffffffdbe0, evaluate=1, want_string=0) at eval.c:5131
#15 0x0000000000439216 in eval6 (arg=0x7fffffffdbf0, rettv=0x7fffffffdbe0, evaluate=1, want_string=0) at eval.c:4786
#16 0x0000000000438d85 in eval5 (arg=0x7fffffffdbf0, rettv=0x7fffffffdbe0, evaluate=1) at eval.c:4602
#17 0x0000000000438184 in eval4 (arg=0x7fffffffdbf0, rettv=0x7fffffffdbe0, evaluate=1) at eval.c:4295
#18 0x0000000000437fd1 in eval3 (arg=0x7fffffffdbf0, rettv=0x7fffffffdbe0, evaluate=1) at eval.c:4207
#19 0x0000000000437e50 in eval2 (arg=0x7fffffffdbf0, rettv=0x7fffffffdbe0, evaluate=1) at eval.c:4136
#20 0x0000000000437c8f in eval1 (arg=0x7fffffffdbf0, rettv=0x7fffffffdbe0, evaluate=1) at eval.c:4061
#21 0x0000000000432ec1 in eval_to_number (expr=0xe39da0 "autofmt#compat#formatexpr") at eval.c:1419
#22 0x000000000050c43d in fex_format (lnum=4, count=3, c=0) at ops.c:4555
#23 0x000000000050c3aa in op_formatexpr (oap=0x7fffffffdde0) at ops.c:4526
#24 0x00000000004f6c13 in do_pending_operator (cap=0x7fffffffdd10, old_col=2, gui_yank=0) at normal.c:2078
#25 0x00000000004f52d8 in normal_cmd (oap=0x7fffffffdde0, toplevel=1) at normal.c:1228
#26 0x00000000005d6243 in main_loop (cmdwin=0, noexmode=0) at main.c:1263
#27 0x00000000005d5c0d in main (argc=5, argv=0x7fffffffe108) at main.c:964