Patch 721: Segfault while resizing gvim in 1 out of 10 cases if set list is on and lcs_eof is empty #362
Description
What steps will reproduce the problem?
1. Compile vim 7.4 Patchlevel 721
2. gvim -u NONE -U NONE -c 'set list lcs=' file_with_text.txt
3. Resize gvim-Window
[I'm pretty sure this problem was introduced in Patch 721. I cannot reproduce
the problem in Vim 7.4 Patchlevel 720.]
In about 10% of the cases(=resizements) I get an segfault (see below).
What is the expected output? What do you see instead?
Excpected: No Segfault; show Text-File in resized window.
What version of the product are you using? On what operating system?
Vim 7.4 Patches 1-207,209-721 on Fedora 21.
Please provide any additional information below.
Here is the error message/backtrace:
*** Error in `gvim': free(): invalid next size (normal): 0x0000000000e05920 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3980277d9e]
/lib64/libc.so.6(cfree+0x5b5)[0x39802839f5]
/lib64/libcairo.so.2(+0x16251)[0x7f6e7c1f4251]
/lib64/libcairo.so.2(+0x2b859)[0x7f6e7c209859]
gvim[0x5c2238]
gvim(gui_gtk2_draw_string+0x85e)[0x5c5e0e]
gvim(gui_outstr_nowrap+0x15b)[0x5b7fbb]
gvim(gui_write+0x1b1)[0x5bb821]
gvim(ui_write+0xc8)[0x5a4048]
gvim(out_str_nf+0x55)[0x59e295]
gvim(windgoto+0xae)[0x555d4e]
gvim[0x55629f]
gvim[0x558d9e]
gvim[0x55d51a]
gvim[0x562235]
gvim(update_screen+0x346)[0x564766]
gvim(set_shellsize+0x1f3)[0x59ecf3]
gvim(gui_resize_shell+0x65)[0x5ba585]
gvim[0x5c218f]
Here my compile vim version
VIM - Vi IMproved 7.4 (2013 Aug 10, compiled May 6 2015 15:32:21)
Included patches: 1-207, 209-721
Modified by <[email protected]>
Compiled by <[email protected]>
Huge version with GTK2 GUI. Features included (+) or not (-):
+acl -ebcdic +localmap +printer +title
+arabic +emacs_tags -lua +profile +toolbar
+autocmd +eval +menu +python/dyn
+user_commands
+balloon_eval +ex_extra +mksession -python3 +vertsplit
+browse +extra_search +modify_fname +quickfix +virtualedit
++builtin_terms +farsi +mouse +reltime +visual
+byte_offset +file_in_path +mouseshape +rightleft +visualextra
+cindent +find_in_path +mouse_dec +ruby/dyn +viminfo
+clientserver +float +mouse_gpm +scrollbind +vreplace
+clipboard +folding -mouse_jsbterm +signs +wildignore
+cmdline_compl -footer +mouse_netterm +smartindent +wildmenu
+cmdline_hist +fork() +mouse_sgr -sniff +windows
+cmdline_info +gettext -mouse_sysmouse +startuptime +writebackup
+comments -hangul_input +mouse_urxvt +statusline +X11
+conceal +iconv +mouse_xterm -sun_workshop -xfontset
+cryptv +insert_expand +multi_byte +syntax +xim
+cscope +jumplist +multi_lang +tag_binary
+xsmp_interact
+cursorbind +keymap -mzscheme +tag_old_static
+xterm_clipboard
+cursorshape +langmap +netbeans_intg -tag_any_white -xterm_save
+dialog_con_gui +libcall +path_extra -tcl +xpm
+diff +linebreak +perl +terminfo
+digraphs +lispindent +persistent_undo +termresponse
+dnd +listcmds +postscript +textobjects
Original issue reported on code.google.com by [email protected] on 6 May 2015 at 4:06