Setting a public member variable generates an ASAN error

[Yegappan Lakshmanan]

Hi,

Sourcing the following script:

-------------------------------------------------------------------------------------
vim9script

class MyCar
public this.make: string

def new(make_arg: string)
this.make = make_arg
enddef

def GetMake()
echomsg $"make = {this.make}"
enddef
endclass

var c = MyCar.new("abc")
c.GetMake()
c.make = "def"
c.GetMake()
-------------------------------------------------------------------------------------

generates the below ASAN log:

=================================================================
==31097==ERROR: AddressSanitizer: attempting double-free on
0x602000149b50 in thread T0:
#0 0x7f5c34474517 in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x55c165dbbf37 in vim_free vim/src/alloc.c:615
#2 0x55c1668922b3 in clear_tv vim/src/typval.c:122
#3 0x55c165fa133e in set_var_lval vim/src/eval.c:1743
#4 0x55c16602cb69 in ex_let_one vim/src/evalvars.c:1868
#5 0x55c166028018 in ex_let_vars vim/src/evalvars.c:1200
#6 0x55c166027d40 in ex_let vim/src/evalvars.c:1160
#7 0x55c16602559a in ex_var vim/src/evalvars.c:956
#8 0x55c1660937e7 in do_one_cmd vim/src/ex_docmd.c:2582
#9 0x55c166086bd4 in do_cmdline vim/src/ex_docmd.c:994
#10 0x55c16663f67f in do_source_ext vim/src/scriptfile.c:1667
#11 0x55c16663bab5 in cmd_source vim/src/scriptfile.c:1146
#12 0x55c16663be44 in ex_source vim/src/scriptfile.c:1189
#13 0x55c1660937e7 in do_one_cmd vim/src/ex_docmd.c:2582
#14 0x55c166086bd4 in do_cmdline vim/src/ex_docmd.c:994
#15 0x55c1663a90ec in nv_colon vim/src/normal.c:3191
#16 0x55c166393193 in normal_cmd vim/src/normal.c:939
#17 0x55c166bc56e4 in main_loop vim/src/main.c:1536
#18 0x55c166bc3ad6 in vim_main2 vim/src/main.c:888
#19 0x55c166bc2f19 in main vim/src/main.c:434
#20 0x7f5c3386fd8f in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
#21 0x7f5c3386fe3f in __libc_start_main_impl ../csu/libc-start.c:392
#22 0x55c165dbb764 in _start (vim/src/vim+0x1271764)

0x602000149b50 is located 0 bytes inside of 4-byte region
[0x602000149b50,0x602000149b54)
freed by thread T0 here:
#0 0x7f5c34474517 in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x55c165dbbf37 in vim_free vim/src/alloc.c:615
#2 0x55c1668922b3 in clear_tv vim/src/typval.c:122
#3 0x55c166983f8a in exe_concat vim/src/vim9execute.c:158
#4 0x55c1669b9b95 in exec_instructions vim/src/vim9execute.c:4049
#5 0x55c1669db137 in call_def_function vim/src/vim9execute.c:5940
#6 0x55c1669061e5 in call_user_func vim/src/userfunc.c:2771
#7 0x55c16690c24d in call_user_func_check vim/src/userfunc.c:3189
#8 0x55c166939f0c in class_object_index vim/src/vim9class.c:699
#9 0x55c165fcd26a in handle_subscript vim/src/eval.c:6793
#10 0x55c165fb8067 in eval9 vim/src/eval.c:4268
#11 0x55c165fb46d6 in eval8 vim/src/eval.c:3798
#12 0x55c165fb2cf9 in eval7 vim/src/eval.c:3602
#13 0x55c165fb0d42 in eval6 vim/src/eval.c:3381
#14 0x55c165fafcea in eval5 vim/src/eval.c:3270
#15 0x55c165fae6ac in eval4 vim/src/eval.c:3121
#16 0x55c165fad4eb in eval3 vim/src/eval.c:2982
#17 0x55c165fac394 in eval2 vim/src/eval.c:2856
#18 0x55c165faa83c in eval1 vim/src/eval.c:2702
#19 0x55c165fa9ee9 in eval0_retarg vim/src/eval.c:2613
#20 0x55c165fa9ac0 in eval0 vim/src/eval.c:2547
#21 0x55c1660e24aa in ex_eval vim/src/ex_eval.c:951
#22 0x55c1660937e7 in do_one_cmd vim/src/ex_docmd.c:2582
#23 0x55c166086bd4 in do_cmdline vim/src/ex_docmd.c:994
#24 0x55c16663f67f in do_source_ext vim/src/scriptfile.c:1667
#25 0x55c16663bab5 in cmd_source vim/src/scriptfile.c:1146
#26 0x55c16663be44 in ex_source vim/src/scriptfile.c:1189
#27 0x55c1660937e7 in do_one_cmd vim/src/ex_docmd.c:2582
#28 0x55c166086bd4 in do_cmdline vim/src/ex_docmd.c:994
#29 0x55c1663a90ec in nv_colon vim/src/normal.c:3191

previously allocated by thread T0 here:
#0 0x7f5c34474867 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x55c165dbbc1c in lalloc vim/src/alloc.c:246
#2 0x55c165dbb9de in alloc vim/src/alloc.c:151
#3 0x55c166758493 in vim_strsave vim/src/strings.c:27
#4 0x55c1668992ed in copy_tv vim/src/typval.c:1206
#5 0x55c1669adc76 in exec_instructions vim/src/vim9execute.c:3396
#6 0x55c1669db137 in call_def_function vim/src/vim9execute.c:5940
#7 0x55c1669061e5 in call_user_func vim/src/userfunc.c:2771
#8 0x55c16690c24d in call_user_func_check vim/src/userfunc.c:3189
#9 0x55c166939f0c in class_object_index vim/src/vim9class.c:699
#10 0x55c165fcd26a in handle_subscript vim/src/eval.c:6793
#11 0x55c165fb8067 in eval9 vim/src/eval.c:4268
#12 0x55c165fb46d6 in eval8 vim/src/eval.c:3798
#13 0x55c165fb2cf9 in eval7 vim/src/eval.c:3602
#14 0x55c165fb0d42 in eval6 vim/src/eval.c:3381
#15 0x55c165fafcea in eval5 vim/src/eval.c:3270
#16 0x55c165fae6ac in eval4 vim/src/eval.c:3121
#17 0x55c165fad4eb in eval3 vim/src/eval.c:2982
#18 0x55c165fac394 in eval2 vim/src/eval.c:2856
#19 0x55c165faa83c in eval1 vim/src/eval.c:2702
#20 0x55c165fa9ee9 in eval0_retarg vim/src/eval.c:2613
#21 0x55c165fa9ac0 in eval0 vim/src/eval.c:2547
#22 0x55c16602792a in ex_let vim/src/evalvars.c:1144
#23 0x55c16602559a in ex_var vim/src/evalvars.c:956
#24 0x55c1660937e7 in do_one_cmd vim/src/ex_docmd.c:2582
#25 0x55c166086bd4 in do_cmdline vim/src/ex_docmd.c:994
#26 0x55c16663f67f in do_source_ext vim/src/scriptfile.c:1667
#27 0x55c16663bab5 in cmd_source vim/src/scriptfile.c:1146
#28 0x55c16663be44 in ex_source vim/src/scriptfile.c:1189
#29 0x55c1660937e7 in do_one_cmd vim/src/ex_docmd.c:2582

SUMMARY: AddressSanitizer: double-free
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 in
__interceptor_free
==31097==ABORTING

- Yegappan

[Yegappan Lakshmanan]

Hi,

On Sat, Dec 24, 2022 at 7:46 AM Yegappan Lakshmanan <yega...@gmail.com> wrote:
>
> Hi,
>
> Sourcing the following script:
>
> -------------------------------------------------------------------------------------
> vim9script
>
> class MyCar
> public this.make: string
>
> def new(make_arg: string)
> this.make = make_arg
> enddef
>
> def GetMake()
> echomsg $"make = {this.make}"
> enddef
> endclass
>
> var c = MyCar.new("abc")
> c.GetMake()
> c.make = "def"
> c.GetMake()
> -------------------------------------------------------------------------------------
>
> generates the below ASAN log:
>

A similar ASAN log is generated with the following script:

-------------------------------------------------------------------------------------
vim9script

class MyCar

this.make: string

def new(make_arg: string)
this.make = make_arg
enddef

def GetMake()
echomsg $"make = {this.make}"
enddef

def SetMake(new_make: string)
this.make = new_make

enddef
endclass

var c = MyCar.new("abc")
c.GetMake()

c.SetMake("def")
c.GetMake()
-------------------------------------------------------------------------------------

- Yegappan

[Bram Moolenaar]

Yegappan wrote:

> Sourcing the following script:
>
> -------------------------------------------------------------------------------------
> vim9script
>
> class MyCar
> public this.make: string
>
> def new(make_arg: string)
> this.make = make_arg
> enddef
>
> def GetMake()
> echomsg $"make = {this.make}"
> enddef
> endclass
>
> var c = MyCar.new("abc")
> c.GetMake()
> c.make = "def"
> c.GetMake()
> -------------------------------------------------------------------------------------
>
> generates the below ASAN log:

I cannot reproduce it now, I think patch 9.0.1093 fixed this one as
well.

--
Proofread carefully to see if you any words out.

/// Bram Moolenaar -- Br...@Moolenaar.net -- http://www.Moolenaar.net \\\
/// \\\
\\\ sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///