ASAN error when sourcing a Vim9 script defining a class more than once

[Yegappan Lakshmanan]

Hi,

When sourcing the following script twice, I see the below ASAN error:

----------------------------------------------------------------------
vim9script

class MyCar
this.make: string

def new(make_arg: string)
this.make = make_arg
enddef

def GetMake()
echomsg $"make = {this.make}"
enddef
endclass

var c = MyCar.new("abc")
c.GetMake()
----------------------------------------------------------------------

ASAN log:

=================================================================
==30141==ERROR: AddressSanitizer: attempting double-free on
0x6020001498f0 in thread T0:
#0 0x7f4ef6cdc517 in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x558f498def37 in vim_free vim/src/alloc.c:615
#2 0x558f4a3b52b3 in clear_tv vim/src/typval.c:122
#3 0x558f4a45ec02 in object_clear vim/src/vim9class.c:848
#4 0x558f4a45ee5d in object_unref vim/src/vim9class.c:864
#5 0x558f4a3b5cb3 in clear_tv vim/src/typval.c:167
#6 0x558f499f2c28 in dictitem_free vim/src/dict.c:283
#7 0x558f499f1aee in hashtab_free_contents vim/src/dict.c:139
#8 0x558f4a5434f9 in clear_vim9_scriptlocal_vars vim/src/vim9script.c:71
#9 0x558f4a543b51 in ex_vim9script vim/src/vim9script.c:126
#10 0x558f49bb67e7 in do_one_cmd vim/src/ex_docmd.c:2582
#11 0x558f49ba9bd4 in do_cmdline vim/src/ex_docmd.c:994
#12 0x558f4a16267f in do_source_ext vim/src/scriptfile.c:1667
#13 0x558f4a15eab5 in cmd_source vim/src/scriptfile.c:1146
#14 0x558f4a15ee44 in ex_source vim/src/scriptfile.c:1189
#15 0x558f49bb67e7 in do_one_cmd vim/src/ex_docmd.c:2582
#16 0x558f49ba9bd4 in do_cmdline vim/src/ex_docmd.c:994
#17 0x558f49ecc0ec in nv_colon vim/src/normal.c:3191
#18 0x558f49eb6193 in normal_cmd vim/src/normal.c:939
#19 0x558f4a6e86e4 in main_loop vim/src/main.c:1536
#20 0x558f4a6e6ad6 in vim_main2 vim/src/main.c:888
#21 0x558f4a6e5f19 in main vim/src/main.c:434
#22 0x7f4ef60d7d8f in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
#23 0x7f4ef60d7e3f in __libc_start_main_impl ../csu/libc-start.c:392
#24 0x558f498de764 in _start (vim/src/vim+0x1271764)

0x6020001498f0 is located 0 bytes inside of 4-byte region
[0x6020001498f0,0x6020001498f4)
freed by thread T0 here:
#0 0x7f4ef6cdc517 in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x558f498def37 in vim_free vim/src/alloc.c:615
#2 0x558f4a3b52b3 in clear_tv vim/src/typval.c:122
#3 0x558f4a4a6f8a in exe_concat vim/src/vim9execute.c:158
#4 0x558f4a4dcb95 in exec_instructions vim/src/vim9execute.c:4049
#5 0x558f4a4fe137 in call_def_function vim/src/vim9execute.c:5940
#6 0x558f4a4291e5 in call_user_func vim/src/userfunc.c:2771
#7 0x558f4a42f24d in call_user_func_check vim/src/userfunc.c:3189
#8 0x558f4a45cf0c in class_object_index vim/src/vim9class.c:699
#9 0x558f49af026a in handle_subscript vim/src/eval.c:6793
#10 0x558f49adb067 in eval9 vim/src/eval.c:4268
#11 0x558f49ad76d6 in eval8 vim/src/eval.c:3798
#12 0x558f49ad5cf9 in eval7 vim/src/eval.c:3602
#13 0x558f49ad3d42 in eval6 vim/src/eval.c:3381
#14 0x558f49ad2cea in eval5 vim/src/eval.c:3270
#15 0x558f49ad16ac in eval4 vim/src/eval.c:3121
#16 0x558f49ad04eb in eval3 vim/src/eval.c:2982
#17 0x558f49acf394 in eval2 vim/src/eval.c:2856
#18 0x558f49acd83c in eval1 vim/src/eval.c:2702
#19 0x558f49accee9 in eval0_retarg vim/src/eval.c:2613
#20 0x558f49accac0 in eval0 vim/src/eval.c:2547
#21 0x558f49c054aa in ex_eval vim/src/ex_eval.c:951
#22 0x558f49bb67e7 in do_one_cmd vim/src/ex_docmd.c:2582
#23 0x558f49ba9bd4 in do_cmdline vim/src/ex_docmd.c:994
#24 0x558f4a16267f in do_source_ext vim/src/scriptfile.c:1667
#25 0x558f4a15eab5 in cmd_source vim/src/scriptfile.c:1146
#26 0x558f4a15ee44 in ex_source vim/src/scriptfile.c:1189
#27 0x558f49bb67e7 in do_one_cmd vim/src/ex_docmd.c:2582
#28 0x558f49ba9bd4 in do_cmdline vim/src/ex_docmd.c:994
#29 0x558f49ecc0ec in nv_colon vim/src/normal.c:3191

previously allocated by thread T0 here:
#0 0x7f4ef6cdc867 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x558f498dec1c in lalloc vim/src/alloc.c:246
#2 0x558f498de9de in alloc vim/src/alloc.c:151
#3 0x558f4a27b493 in vim_strsave vim/src/strings.c:27
#4 0x558f4a3bc2ed in copy_tv vim/src/typval.c:1206
#5 0x558f4a4d0c76 in exec_instructions vim/src/vim9execute.c:3396
#6 0x558f4a4fe137 in call_def_function vim/src/vim9execute.c:5940
#7 0x558f4a4291e5 in call_user_func vim/src/userfunc.c:2771
#8 0x558f4a42f24d in call_user_func_check vim/src/userfunc.c:3189
#9 0x558f4a45cf0c in class_object_index vim/src/vim9class.c:699
#10 0x558f49af026a in handle_subscript vim/src/eval.c:6793
#11 0x558f49adb067 in eval9 vim/src/eval.c:4268
#12 0x558f49ad76d6 in eval8 vim/src/eval.c:3798
#13 0x558f49ad5cf9 in eval7 vim/src/eval.c:3602
#14 0x558f49ad3d42 in eval6 vim/src/eval.c:3381
#15 0x558f49ad2cea in eval5 vim/src/eval.c:3270
#16 0x558f49ad16ac in eval4 vim/src/eval.c:3121
#17 0x558f49ad04eb in eval3 vim/src/eval.c:2982
#18 0x558f49acf394 in eval2 vim/src/eval.c:2856
#19 0x558f49acd83c in eval1 vim/src/eval.c:2702
#20 0x558f49accee9 in eval0_retarg vim/src/eval.c:2613
#21 0x558f49accac0 in eval0 vim/src/eval.c:2547
#22 0x558f49b4a92a in ex_let vim/src/evalvars.c:1144
#23 0x558f49b4859a in ex_var vim/src/evalvars.c:956
#24 0x558f49bb67e7 in do_one_cmd vim/src/ex_docmd.c:2582
#25 0x558f49ba9bd4 in do_cmdline vim/src/ex_docmd.c:994
#26 0x558f4a16267f in do_source_ext vim/src/scriptfile.c:1667
#27 0x558f4a15eab5 in cmd_source vim/src/scriptfile.c:1146
#28 0x558f4a15ee44 in ex_source vim/src/scriptfile.c:1189
#29 0x558f49bb67e7 in do_one_cmd vim/src/ex_docmd.c:2582

SUMMARY: AddressSanitizer: double-free
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 in
__interceptor_free
==30141==ABORTING

[Yegappan Lakshmanan]

On Fri, Dec 23, 2022 at 5:54 PM Yegappan Lakshmanan <yega...@gmail.com> wrote:
>
> Hi,
>
> When sourcing the following script twice, I see the below ASAN error:
>
> ----------------------------------------------------------------------
> vim9script
>
> class MyCar
> this.make: string
>
> def new(make_arg: string)
> this.make = make_arg
> enddef
>
> def GetMake()
> echomsg $"make = {this.make}"
> enddef
> endclass
>
> var c = MyCar.new("abc")
> c.GetMake()
> ----------------------------------------------------------------------
>

I also see a similar ASAN error, when sourcing the following script:

---------------------------------------------------------------------------

vim9script

class MyCar
this.make: string

def new(make_arg: string)
this.make = make_arg
enddef

def GetMake()
echomsg $"make = {this.make}"
enddef
endclass

var c = MyCar.new("abc")
c.GetMake()

var c = MyCar.new("def")
c.GetMake()
---------------------------------------------------------------------------

- Yegappan