Scite crash with steps to reproduce

[Vicente]

Hi,

there is a bug in SciTE that makes it crash.

It is reproducible on archlinux and alpinelinux, at least.

In order to make it happen, download and open this file:

https://raw.githubusercontent.com/bluez/bluez/refs/heads/master/src/main.conf

Then, do this:

```

Ctrl+h   Find & Replace
^#.*     Search term
Alt+e    Regular expression on
Alt+a    Replace all
Esc      Exit Find & Replace
Shift+Up Select Line Feed
Ctrl+c   Copy to clipboard
Ctrl+h   Find & Replace
Ctrl+v   Paste Line Feed from clipboard
Ctrl+v   Again
Tab      Goto Replace field
Tab      Ditto
Ctrl+v   Paste Line Feed from clipboard
Alt+e    Regular expression off
Alt+a    Replace all
Alt+a    Again
Alt+a    A total of 8 times
Alt+a    
Alt+a    
Alt+a    
Alt+a    
Alt+a    
Ctrl+z   Maintain pressed: undo everything
```

It is reproducible from a clean and unmodified build of scite.

I've built it this way:

rm -rf /tmp/sct
mkdir  /tmp/sct
cd     /tmp/sct

wget https://www.scintilla.org/scite567.tgz

rm -rf lexilla scintilla scite share
tar xf scite567.tgz

make -j4 prefix=/tmp/sct -C lexilla/src
make -j4 prefix=/tmp/sct -C scintilla/gtk
make -j4 prefix=/tmp/sct -C scite/gtk

mkdir -p share/scite
cp scite/src/SciTEGlobal.properties share/scite

./scite/bin/SciTE main.conf

Regards,

  Vicente.

[scintillaDotOrg]

Hi Vicente,

I can see this problem with Linux. The stack trace points to a problem in change tracking with a bad deallocation.

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
#3  0x00007ffff6e45b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff6e288ec in __GI_abort () at ./stdlib/abort.c:77
#5  0x00007ffff6e29979 in __libc_message_impl (vma_name=vma_name@entry=0x7ffff6fdb569 "glibc: fatal", fmt=fmt@entry=0x7ffff6fdeba5 "%s\n") at ../sysdeps/posix/libc_fatal.c:138
#6  0x00007ffff6eb0b2c in __libc_message_wrapper (vmaname=0x7ffff6fdb569 "glibc: fatal", fmt=0x7ffff6fdeba5 "%s\n") at ../include/stdio.h:203
#7  malloc_printerr (str=<optimized out>) at ./malloc/malloc.c:5341
#8  0x00007ffff6eb0b44 in malloc_printerr_tail (str=<optimized out>) at ./malloc/malloc.c:5358
#9  0x00007ffff7564680 in void Scintilla::Internal::SparseVector<std::unique_ptr<std::vector<Scintilla::Internal::EditionCount, std::allocator<Scintilla::Internal::EditionCount> >, std::default_delete<std::vector<Scintilla::Internal::EditionCount, std::allocator<Scintilla::Internal::EditionCount> > > > >::SetValueAt<std::unique_ptr<std::vector<Scintilla::Internal::EditionCount, std::allocator<Scintilla::Internal::EditionCount> >, std::default_delete<std::vector<Scintilla::Internal::EditionCount, std::allocator<Scintilla::Internal::EditionCount> > > > >(long, std::unique_ptr<std::vector<Scintilla::Internal::EditionCount, std::allocator<Scintilla::Internal::EditionCount> >, std::default_delete<std::vector<Scintilla::Internal::EditionCount, std::allocator<Scintilla::Internal::EditionCount> > > >&&) () at /tmp/sct/scite/bin/libscintilla.so
#10 0x00007ffff7561815 in Scintilla::Internal::ChangeLog::PopDeletion(long, long) () at /tmp/sct/scite/bin/libscintilla.so
#11 0x00007ffff7561bcb in Scintilla::Internal::ChangeHistory::UndoDeleteStep(long, long, bool) () at /tmp/sct/scite/bin/libscintilla.so
#12 0x00007ffff754d221 in Scintilla::Internal::CellBuffer::PerformUndoStep() () at /tmp/sct/scite/bin/libscintilla.so
#13 0x00007ffff758241a in Scintilla::Internal::Document::Undo() () at /tmp/sct/scite/bin/libscintilla.so

On Windows, the problem appears to be delayed with an assertion failure when the change history is next checked.

Neil

[scintillaDotOrg]

Can you confirm that this patch fixes the crash?

diff -r 1f7c9fbbd07f src/ChangeHistory.cxx
--- a/src/ChangeHistory.cxx Tue Oct 06 12:31:46 2026 +1100
+++ b/src/ChangeHistory.cxx Tue Oct 06 21:22:19 2026 +1100
@@ -238,7 +238,7 @@
  EditionSetPop(*editions);
  const int inserts = changeStack.PopStep();
  for (int i = 0; i < inserts;) {
- const ChangeSpan span = changeStack.PopSpan(inserts);
+ const ChangeSpan span = changeStack.PopSpan(inserts-i);
  if (span.direction == ChangeSpan::Direction::insertion) {
  assert(span.count == 1); // Insertions are never compressed
  insertEdition.FillRange(span.start, span.edition, span.length);

During undo, it may track the deletion history more accurately when many deletions are occurring at the same position.

Neil

[Vicente]

Hi Neil,

just tested and yes: it fixes the issue!

Thanks!

I have stomped on this a few times and it is very annoying, because all usaved data is lost.

Even when the file itself is saved to disk, the undo history is never saved.

But this last time i was able to reproduce it.

Thanks for the fix.

Regards,

  Vicente.