[vim/vim] [Windows] gvim crashes while searching tag (Issue #19255)

[Rodrigo Queipo]

rodrigoq created an issue (vim/vim#19255)

Steps to reproduce

The problem with this crash is it doesn't happens consistently (but sooner or later gvim crashes). This happens editing a big codebase in PHP using an LSP server when I try to autocomplete some function name, but happens randomly maybe after an hour of working, maybe after a few minutes. I don't know if this is the plugin fault, if it is maybe you can give me some orientation to isolate the problem.

Expected behaviour

Not to crash.

Version of Vim

9.1.2105

Environment

Everything is in the dump analysis, used procdump to get the dump and windbg !analyze -v command.
The full dump (81 mb compressed) can be downloaded from here: https://drive.google.com/file/d/1RuxJFALjS8nVOjG5VOtmnlnpAn2JnTox/view?usp=sharing

Logs and stack traces

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : AV.Type
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 500

    Key  : Analysis.Elapsed.mSec
    Value: 2186

    Key  : Analysis.IO.Other.Mb
    Value: 8

    Key  : Analysis.IO.Read.Mb
    Value: 36

    Key  : Analysis.IO.Write.Mb
    Value: 353

    Key  : Analysis.Init.CPU.mSec
    Value: 73812

    Key  : Analysis.Init.Elapsed.mSec
    Value: 11425267

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 567

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29507.1001

    Key  : Analysis.Version.Description
    Value: 10.2511.5.1 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2511.5.1

    Key  : Failure.Bucket
    Value: INVALID_POINTER_READ_c0000005_vim64.dll!Unknown

    Key  : Failure.Exception.Code
    Value: 0xc0000005

    Key  : Failure.Exception.IP.Address
    Value: 0x7fffeb5ab030

    Key  : Failure.Exception.IP.Module
    Value: vim64

    Key  : Failure.Exception.IP.Offset
    Value: 0x28b030

    Key  : Failure.Hash
    Value: {ee7726e1-645e-050f-01d9-5bedba6e1f32}

    Key  : Failure.ProblemClass.Primary
    Value: INVALID_POINTER_READ

    Key  : Faulting.IP.Type
    Value: Paged

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 767653

    Key  : Timeline.Process.Start.DeltaSec
    Value: 8988

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Version
    Value: 10.0.19041.1

    Key  : WER.Process.Version
    Value: 9.1.2105.0


FILE_IN_CAB:  gvim.exe_260123_185645.dmp

COMMENT:  
*** procdump  -e -ma -w gvim .\dump
*** Unhandled exception: C0000005.ACCESS_VIOLATION

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=000000001770b980 rbx=ffffffffffffffff rcx=0000002500000000
rdx=00007fffeb7071a8 rsi=0000000000000000 rdi=0000002500000000
rip=00007fffeb5ab030 rsp=00000000008fdda0 rbp=0000000013d1ebc0
 r8=7461645f72657375  r9=00007ff80f4c20f6 r10=00007ff80f4b0000
r11=45f73ffdfff9a9b7 r12=000000000000004e r13=0000000000000001
r14=0000000000000000 r15=00000000177df560
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010204
vim64!vim_strsave+0x20:
00007fff`eb5ab030 807c190100      cmp     byte ptr [rcx+rbx+1],0 ds:00000025`00000000=??
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007fffeb5ab030 (vim64!vim_strsave+0x0000000000000020)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000002500000000
Attempt to read from address 0000002500000000

PROCESS_NAME:  gvim.exe

READ_ADDRESS:  0000002500000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000002500000000

STACK_TEXT:  
00000000`008fdda0 00007fff`eb37360f     : 00000000`1770b980 00000000`00000000 00000000`0000004e 00000000`1b5a3450 : vim64!vim_strsave+0x20
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : vim64!dict_add_string_len+0x25
00000000`008fddd0 00007fff`eb5c0509     : 00000000`1b2dc110 00000000`0000004e 00000000`1b5a3450 00000000`00000000 : vim64!dict_add_string+0x3f
00000000`008fde00 00007fff`eb5c2d23     : 00000000`00000000 00000000`008fe010 00007fff`eb713180 00000000`0000012c : vim64!find_tagfunc_tags+0xd9
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : vim64!findtags_apply_tfu+0x49
00000000`008fdf10 00007fff`eb44b0c9     : 00000000`00000001 00000000`00000001 00000000`00000001 00000000`00000001 : vim64!find_tags+0x3d3
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : vim64!get_next_tag_completion+0xa5
00000000`008ff510 00007fff`eb44a7ed     : 00000000`00000004 00000000`00000001 00000000`00000000 00007ff8`3c12f05b : vim64!get_next_completion_match+0x229
00000000`008ff5d0 00007fff`eb449994     : 00000000`00000105 00007fff`00000001 0000000b`0000003b 00000000`00000000 : vim64!ins_compl_get_exp+0x44d
00000000`008ff650 00007fff`eb4495de     : 00000000`00000001 ffffffff`ffffffff 00000000`00000000 00000000`1f22e627 : vim64!find_next_completion_match+0x184
00000000`008ff6a0 00007fff`eb456a03     : 00000000`00000001 00000000`ffffffff 00000000`00000001 00000000`00000000 : vim64!ins_compl_next+0x17e
00000000`008ff700 00007fff`eb398f2c     : 00000000`00000012 00000000`00000000 00000000`00000000 00000000`008ff82a : vim64!ins_complete+0x183
00000000`008ff750 00007fff`eb4c19dd     : 00000000`00000006 00000000`00000001 00007fff`eb7a0065 00007fff`eb429765 : vim64!edit+0x297c
00000000`008ff890 00007fff`eb4c9661     : 00000000`00000014 00000000`008ffba8 00000000`00000000 00000000`1b5a3168 : vim64!op_change+0x19d
00000000`008ff960 00007fff`eb4be089     : 00000000`00000000 00000000`0000000a 00000000`00000000 00000000`00000000 : vim64!do_pending_operator+0x1471
00000000`008ffa50 00007fff`eb46bc47     : 01dc8cb3`00000001 00000000`00000001 00000000`00000000 00000000`00000000 : vim64!normal_cmd+0x879
00000000`008ffb30 00007fff`eb469ae1     : 00000000`00000000 00007fff`eb7aa5c0 00000000`00000001 00000000`00000000 : vim64!main_loop+0x9a7
00000000`008ffc20 00007fff`eb46b082     : 00000000`00000022 00007fff`00000002 00007fff`eb709150 00007fff`eb78d270 : vim64!vim_main2+0x1021
00000000`008ffce0 00007ff7`b1ad121a     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : vim64!VimMain+0x14b2
00000000`008ffea0 00007ff8`3d177374     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : gvim+0x121a
00000000`008ffee0 00007ff8`3e25cc91     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
00000000`008fff10 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21


STACK_COMMAND: ~0s; .ecxr ; kb

IP_IN_PAGED_CODE: 
vim64!vim_strsave+20 [C:\Users\Admin\Code\gvim\src\strings.c @ 26]
00007fff`eb5ab030 807c190100      cmp     byte ptr [rcx+rbx+1],0

FAULTING_SOURCE_LINE:  C:\Users\Admin\Code\gvim\src\strings.c

FAULTING_SOURCE_FILE:  C:\Users\Admin\Code\gvim\src\strings.c

FAULTING_SOURCE_LINE_NUMBER:  26

FAULTING_SOURCE_CODE:  
    22: {
    23:     char_u	*p;
    24:     size_t	len;
    25: 
>   26:     len = STRLEN(string) + 1;
    27:     p = alloc(len);
    28:     if (p != NULL)
    29: 	mch_memmove(p, string, len);
    30:     return p;
    31: }


SYMBOL_NAME:  vim64+28b030

MODULE_NAME: vim64

IMAGE_NAME:  vim64.dll

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_vim64.dll!Unknown

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  9.1.2105.0

FAILURE_ID_HASH:  {ee7726e1-645e-050f-01d9-5bedba6e1f32}

Followup:     MachineOwner
---------

—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/issues/19255@github.com>