VimFiler ASAN trace

gistfile1.txt

=================================================================
==8540==ERROR: AddressSanitizer: heap-use-after-free on address 0x613000054748 at pc 0x0000007d1dd8 bp 0x7ffe71be6660 sp 0x7ffe71be6658
READ of size 4 at 0x613000054748 thread T0
    #0 0x7d1dd7 in copy_tv /home/jamessan/src/github.com/neovim/src/nvim/eval.c:20116:37
    #1 0x87b92c in f_get /home/jamessan/src/github.com/neovim/src/nvim/eval.c:9895:5
    #2 0x7b35c0 in call_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7286:11
    #3 0x7c8d7a in get_func_tv /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7091:11
    #4 0x8667f9 in eval7 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:4353:15
    #5 0x8621e5 in eval6 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:4073:7
    #6 0x85ce69 in eval5 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3925:7
    #7 0x858071 in eval4 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3666:7
    #8 0x857613 in eval3 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3588:7
    #9 0x856bb3 in eval2 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3525:7
    #10 0x7ab772 in eval1 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3458:7
    #11 0x7abe36 in eval1 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3494:9
    #12 0x7a9ecc in eval0 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3420:9
    #13 0x830cac in ex_return /home/jamessan/src/github.com/neovim/src/nvim/eval.c:22191:10
    #14 0xb06a1c in do_one_cmd /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:2198:5
    #15 0xae5557 in do_cmdline /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:601:20
    #16 0x7f2490 in call_user_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:21993:3
    #17 0x7b2eee in call_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7271:11
    #18 0x7c8d7a in get_func_tv /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7091:11
    #19 0x8667f9 in eval7 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:4353:15
    #20 0x8621e5 in eval6 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:4073:7
    #21 0x85ce69 in eval5 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3925:7
    #22 0x858071 in eval4 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3666:7
    #23 0x857613 in eval3 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3588:7
    #24 0x856bb3 in eval2 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3525:7
    #25 0x7ab772 in eval1 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3458:7
    #26 0x7a9ecc in eval0 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3420:9
    #27 0x7b78f2 in ex_let /home/jamessan/src/github.com/neovim/src/nvim/eval.c:1479:9
    #28 0xb06a1c in do_one_cmd /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:2198:5
    #29 0xae5557 in do_cmdline /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:601:20
    #30 0x7f2490 in call_user_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:21993:3
    #31 0x7b2eee in call_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7271:11
    #32 0x7c8d7a in get_func_tv /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7091:11
    #33 0x7c1d3d in ex_call /home/jamessan/src/github.com/neovim/src/nvim/eval.c:2843:9
    #34 0xb06a1c in do_one_cmd /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:2198:5
    #35 0xae5557 in do_cmdline /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:601:20
    #36 0x7f2490 in call_user_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:21993:3
    #37 0x7b2eee in call_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7271:11
    #38 0x7c8d7a in get_func_tv /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7091:11
    #39 0x7c1d3d in ex_call /home/jamessan/src/github.com/neovim/src/nvim/eval.c:2843:9
    #40 0xb06a1c in do_one_cmd /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:2198:5
    #41 0xae5557 in do_cmdline /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:601:20
    #42 0xca2918 in apply_autocmds_group /home/jamessan/src/github.com/neovim/src/nvim/fileio.c:6882:5
    #43 0xc6c446 in apply_autocmds /home/jamessan/src/github.com/neovim/src/nvim/fileio.c:6527:10
    #44 0x140f374 in screenalloc /home/jamessan/src/github.com/neovim/src/nvim/screen.c:6234:5
    #45 0x13958d1 in screenclear /home/jamessan/src/github.com/neovim/src/nvim/screen.c:6277:3
    #46 0x1417573 in screen_resize /home/jamessan/src/github.com/neovim/src/nvim/screen.c:7366:5
    #47 0x17fb59b in ui_refresh /home/jamessan/src/github.com/neovim/src/nvim/ui.c:175:3
    #48 0x17fc100 in ui_refresh_event /home/jamessan/src/github.com/neovim/src/nvim/ui.c:181:3
    #49 0xa05bbf in multiqueue_process_events /home/jamessan/src/github.com/neovim/src/nvim/event/multiqueue.c:146:7
    #50 0x9ff8b6 in loop_poll_events /home/jamessan/src/github.com/neovim/src/nvim/event/loop.c:56:3
    #51 0x120d584 in input_poll /home/jamessan/src/github.com/neovim/src/nvim/os/input.c:326:3
    #52 0x12092ef in inbuf_poll /home/jamessan/src/github.com/neovim/src/nvim/os/input.c:348:24
    #53 0x1209193 in os_inchar /home/jamessan/src/github.com/neovim/src/nvim/os/input.c:110:18
    #54 0x16d3615 in state_enter /home/jamessan/src/github.com/neovim/src/nvim/state.c:49:13
    #55 0x101090b in normal_enter /home/jamessan/src/github.com/neovim/src/nvim/normal.c:463:3
    #56 0xdd0a82 in main /home/jamessan/src/github.com/neovim/src/nvim/main.c:542:3
    #57 0x7f3c61df42b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #58 0x44b959 in _start (/home/jamessan/src/github.com/neovim/build/bin/nvim+0x44b959)

0x613000054748 is located 8 bytes inside of 352-byte region [0x613000054740,0x6130000548a0)
freed by thread T0 here:
    #0 0x4e9d70 in __interceptor_cfree.localalias.0 (/home/jamessan/src/github.com/neovim/build/bin/nvim+0x4e9d70)
    #1 0xefa184 in xfree /home/jamessan/src/github.com/neovim/src/nvim/memory.c:130:3
    #2 0x7e52b5 in dict_free_dict /home/jamessan/src/github.com/neovim/src/nvim/eval.c:6431:3
    #3 0x7e1e2c in free_unref_items /home/jamessan/src/github.com/neovim/src/nvim/eval.c:6063:7
    #4 0x7946cd in garbage_collect /home/jamessan/src/github.com/neovim/src/nvim/eval.c:5985:16
    #5 0xd08f4f in before_blocking /home/jamessan/src/github.com/neovim/src/nvim/getchar.c:1331:5
    #6 0x1209157 in os_inchar /home/jamessan/src/github.com/neovim/src/nvim/os/input.c:109:9
    #7 0x16d3615 in state_enter /home/jamessan/src/github.com/neovim/src/nvim/state.c:49:13
    #8 0x101090b in normal_enter /home/jamessan/src/github.com/neovim/src/nvim/normal.c:463:3
    #9 0xdd0a82 in main /home/jamessan/src/github.com/neovim/src/nvim/main.c:542:3
    #10 0x7f3c61df42b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

previously allocated by thread T0 here:
    #0 0x4e9f08 in malloc (/home/jamessan/src/github.com/neovim/build/bin/nvim+0x4e9f08)
    #1 0xef9ee4 in try_malloc /home/jamessan/src/github.com/neovim/src/nvim/memory.c:84:15
    #2 0xefa0a4 in xmalloc /home/jamessan/src/github.com/neovim/src/nvim/memory.c:118:15
    #3 0x78bcc6 in dict_alloc /home/jamessan/src/github.com/neovim/src/nvim/eval.c:6321:15
    #4 0x86dc02 in get_dict_tv /home/jamessan/src/github.com/neovim/src/nvim/eval.c:6789:9
    #5 0x865751 in eval7 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:4296:21
    #6 0x8621e5 in eval6 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:4073:7
    #7 0x85ce69 in eval5 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3925:7
    #8 0x858071 in eval4 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3666:7
    #9 0x857613 in eval3 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3588:7
    #10 0x856bb3 in eval2 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3525:7
    #11 0x7ab772 in eval1 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3458:7
    #12 0x7a9ecc in eval0 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3420:9
    #13 0x7b78f2 in ex_let /home/jamessan/src/github.com/neovim/src/nvim/eval.c:1479:9
    #14 0xb06a1c in do_one_cmd /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:2198:5
    #15 0xae5557 in do_cmdline /home/jamessan/src/github.com/neovim/src/nvim/ex_docmd.c:601:20
    #16 0x7f2490 in call_user_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:21993:3
    #17 0x7b2eee in call_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7271:11
    #18 0x7c8d7a in get_func_tv /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7091:11
    #19 0x8667f9 in eval7 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:4353:15
    #20 0x8621e5 in eval6 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:4073:7
    #21 0x85ce69 in eval5 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3925:7
    #22 0x858071 in eval4 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3666:7
    #23 0x857613 in eval3 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3588:7
    #24 0x856bb3 in eval2 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3525:7
    #25 0x7ab772 in eval1 /home/jamessan/src/github.com/neovim/src/nvim/eval.c:3458:7
    #26 0x93f89a in filter_map_one /home/jamessan/src/github.com/neovim/src/nvim/eval.c:9398:7
    #27 0x93f33a in filter_map /home/jamessan/src/github.com/neovim/src/nvim/eval.c:9372:13
    #28 0x8ceb57 in f_map /home/jamessan/src/github.com/neovim/src/nvim/eval.c:12900:3
    #29 0x7b35c0 in call_func /home/jamessan/src/github.com/neovim/src/nvim/eval.c:7286:11

SUMMARY: AddressSanitizer: heap-use-after-free /home/jamessan/src/github.com/neovim/src/nvim/eval.c:20116:37 in copy_tv
Shadow bytes around the buggy address:
  0x0c2680002890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c26800028a0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c26800028b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c26800028c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c26800028d0: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
=>0x0c26800028e0: fa fa fa fa fa fa fa fa fd[fd]fd fd fd fd fd fd
  0x0c26800028f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2680002900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2680002910: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2680002920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2680002930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==8540==ABORTING