[vim/vim] Coredump due to race condition between invoke_listeners() and listener_flush() (Issue #19300)
Sainnhe Park
sainnhe created an issue (vim/vim#19300)Steps to reproduce
- Compile vim from master branch:
#!/usr/bin/bash export LOCAL_INSTALL_DIR="$HOME/.local" ./configure \ --prefix="$HOME/.local" \ CFLAGS="-g -O0 -D_DEBUG" \ CXXFLAGS="-g -O0 -D_DEBUG" \ LDFLAGS="-g" make -j `nproc` make STRIP=/bin/true install
- Install coc.nvim and coc-clangd
- Edit a C++ project and vim will crash randomly.
This bug is due to race condition, so it's not easy to reproduce. I captured the coredump file and uses gdb to print its backtrace, and the backtrace has been attached below (some sensitive outputs have been masked).
Also, I uses opencode + GLM 4.7 to analyze this backtrace, and here is it's response:
Use-after-free crash in invoke_listeners()
Description: Segmentation fault when iterating over buf->b_recorded_changes in invoke_listeners() at change.c:595. The crash occurs when accessing li->li_tv.vval.v_dict which points to a freed dictionary.
Backtrace:
#0 hash_lookup() at hashtab.c:161
#1 hash_find() at hashtab.c:134
#2 dict_find() at dict.c:675
#3 dict_get_number_def() at dict.c:747
#4 dict_get_number() at dict.c:735
#5 invoke_listeners() at change.c:595
#6 f_listener_flush() at change.c:404
Root Cause: Race condition between invoke_listeners() and listener_flush().
When coc.nvim plugin calls listener_flush() from a channel callback path (coc#api#Call → ch_evalexpr → listener_flush), it triggers:
- listener_flush() calls list_unref(buf->b_recorded_changes) at change.c:607
- This frees the list and its dictionary items
- Meanwhile, invoke_listeners() is still iterating over the same list
- Accessing the freed dict's dv_hashtab causes SIGSEGV
Concurrency Flow:
Thread 1: invoke_listeners() → FOR_ALL_LIST_ITEMS loop
Thread 2: coc#api#Call() → listener_flush() → list_unref()
└─> frees list and its dictionaries
Thread 1: accesses freed dict->dv_hashtab → CRASH
Possible Fix:
Add a recursion guard or increment reference count before accessing items in the invoke_listeners() loop to prevent premature freeing during iteration.
Expected behaviour
Don't crash.
Version of Vim
:version VIM - Vi IMproved 9.1 (2024 Jan 02, compiled Jan 30 2026 15:16:24) Included patches: 1-2114 Compiled by xxx@cvm Huge version without GUI. Features included (+) or not (-): +acl -clipboard +digraphs +fork() +lispindent +mouse_sgr +popupwin +socketserver +termguicolors +viminfo +xattr +arabic +clipboard_provider -dnd +gettext +listcmds -mouse_sysmouse +postscript -sodium +terminal +virtualedit -xfontset +autocmd +cmdline_compl -ebcdic -hangul_input +localmap +mouse_urxvt +printer -sound +terminfo +visual -xim +autochdir +cmdline_hist +emacs_tags +iconv -lua +mouse_xterm +profile +spell +termresponse +visualextra -xpm -autoservername +cmdline_info +eval +insert_expand +menu +multi_byte -python +startuptime +textobjects +vreplace -xsmp -balloon_eval +comments +ex_extra +ipv6 +mksession +multi_lang -python3 +statusline +textprop -wayland -xterm_clipboard +balloon_eval_term +conceal +extra_search +job +modify_fname -mzscheme +quickfix -sun_workshop +timers -wayland_clipboard -xterm_save -browse +cryptv -farsi +jumplist +mouse +netbeans_intg +reltime +syntax +title -wayland_focus_steal ++builtin_terms +cscope +file_in_path +keymap -mouseshape +num64 +rightleft +tabpanel -toolbar +wildignore +byte_offset +cursorbind +find_in_path +lambda +mouse_dec +packages -ruby +tag_binary +user_commands +wildmenu +channel +cursorshape +float +langmap -mouse_gpm +path_extra +scrollbind -tag_old_static +vartabs +windows +cindent +dialog_con +folding +libcall -mouse_jsbterm -perl +signs -tag_any_white +vertsplit +writebackup +clientserver +diff -footer +linebreak +mouse_netterm +persistent_undo +smartindent -tcl +vim9script -X11 system vimrc file: "$VIM/vimrc" user vimrc file: "$HOME/.vimrc" 2nd user vimrc file: "/.vim/vimrc" 3rd user vimrc file: "/.config/vim/vimrc" user exrc file: "$HOME/.exrc" defaults file: "$VIMRUNTIME/defaults.vim" fall-back for $VIM: "/home/tianfugao/.local/share/vim" Compilation: gcc -c -I. -Iproto -DHAVE_CONFIG_H -g -O0 -D_DEBUG -D_REENTRANT -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1 Linking: gcc -g -L/usr/local/lib -Wl,--as-needed -o vim -lm -ltinfo -lselinux
Environment
OS: TencentOS Server 4.4 x86_64
Terminal: iTerm2 + SSH
$TERM: xterm-256color
Shell: zsh 5.8.1
Logs and stack traces
(gdb) bt #0 0x00000000004e5395 in hash_lookup (ht=0x120c5cf0, key=0x721b60 "lnum", hash=112406544) at hashtab.c:161 #1 0x00000000004e5353 in hash_find (ht=0x120c5cf0, key=0x721b60 "lnum") at hashtab.c:134 #2 0x0000000000437c9e in dict_find (d=0x120c5ce0, key=0x721b60 "lnum", len=-1) at dict.c:675 #3 0x0000000000437e30 in dict_get_number_def (d=0x120c5ce0, key=0x721b60 "lnum", def=0) at dict.c:747 #4 0x0000000000437e03 in dict_get_number (d=0x120c5ce0, key=0x721b60 "lnum") at dict.c:735 #5 0x0000000000417f8b in invoke_listeners (buf=0x1239b260) at change.c:595 #6 0x0000000000417ac1 in f_listener_flush (argvars=0x7ffcbcbe6b60, rettv=0x1283ac00) at change.c:404 #7 0x0000000000471f55 in call_internal_func_by_idx (idx=273, argvars=0x7ffcbcbe6b60, rettv=0x1283ac00) at evalfunc.c:3509 #8 0x000000000069c41a in call_bfunc (func_idx=273, argcount=1, ectx=0x7ffcbcbe7cf0) at vim9execute.c:1387 #9 0x00000000006a45ca in exec_instructions (ectx=0x7ffcbcbe7cf0) at vim9execute.c:4868 #10 0x00000000006aa49a in call_def_function (ufunc=0x11b71570, argc_arg=1, argv=0x7ffcbcbe8800, flags=0, partial=0x0, object=0x0, funccal=0x1274b120, rettv=0x7ffcbcbe8a20) at vim9execute.c:6870 #11 0x00000000006775ba in call_user_func (fp=0x11b71570, argcount=1, argvars=0x7ffcbcbe8800, rettv=0x7ffcbcbe8a20, funcexe=0x7ffcbcbe89b0, selfdict=0x0) at userfunc.c:3050 #12 0x000000000067867c in call_user_func_check (fp=0x11b71570, argcount=1, argvars=0x7ffcbcbe8800, rettv=0x7ffcbcbe8a20, funcexe=0x7ffcbcbe89b0, selfdict=0x0) at userfunc.c:3485 #13 0x000000000067976b in call_func (funcname=0x12573b40 "coc#api#Buf_flush", len=-1, rettv=0x7ffcbcbe8a20, argcount_in=1, argvars_in=0x7ffcbcbe8800, funcexe=0x7ffcbcbe89b0) at userfunc.c:4158 #14 0x0000000000675d4b in get_func_tv (name=0x12573b40 "coc#api#Buf_flush", len=-1, rettv=0x7ffcbcbe8a20, arg=0x7ffcbcbe8bc8, evalarg=0x7ffcbcbe8b00, funcexe=0x7ffcbcbe89b0) at userfunc.c:2190 #15 0x000000000067e42e in ex_call_inner (eap=0x7ffcbcbe8d30, name=0x12573b40 "coc#api#Buf_flush", arg=0x7ffcbcbe8bc8, startarg=0x121745ba "(bufnr('%'))", funcexe_init=0x7ffcbcbe8a70, evalarg=0x7ffcbcbe8b00) at userfunc.c:6511 #16 0x000000000067efc3 in ex_call (eap=0x7ffcbcbe8d30) at userfunc.c:6869 #17 0x000000000049e2c6 in do_one_cmd (cmdlinep=0x7ffcbcbe9568, flags=7, cstack=0x7ffcbcbe8f30, fgetline=0x67f3af <get_func_line>, cookie=0x12753970) at ex_docmd.c:2629 #18 0x000000000049b3ea in do_cmdline (cmdline=0x0, fgetline=0x67f3af <get_func_line>, cookie=0x12753970, flags=7) at ex_docmd.c:1041 #19 0x0000000000678082 in call_user_func (fp=0x11b7ea70, argcount=2, argvars=0x7ffcbcbe9f30, rettv=0x7ffcbcbea1a0, funcexe=0x7ffcbcbe9ec0, selfdict=0x0) at userfunc.c:3312 #20 0x000000000067867c in call_user_func_check (fp=0x11b7ea70, argcount=2, argvars=0x7ffcbcbe9f30, rettv=0x7ffcbcbea1a0, funcexe=0x7ffcbcbe9ec0, selfdict=0x0) at userfunc.c:3485 #21 0x000000000067976b in call_func (funcname=0x128724b0 "coc#api#Call", len=-1, rettv=0x7ffcbcbea1a0, argcount_in=2, argvars_in=0x7ffcbcbe9f30, funcexe=0x7ffcbcbe9ec0) at userfunc.c:4158 #22 0x0000000000678bdd in func_call (name=0x128724b0 "coc#api#Call", args=0x7ffcbcbea230, partial=0x0, selfdict=0x0, rettv=0x7ffcbcbea1a0) at userfunc.c:3764 #23 0x00000000006fcda2 in channel_exe_cmd (channel=0x11b01280, part=PART_OUT, argv=0x7ffcbcbea210) at channel.c:2661 #24 0x00000000006fd7ff in may_invoke_callback (channel=0x11b01280, part=PART_OUT) at channel.c:2959 #25 0x0000000000700b1d in channel_parse_messages () at channel.c:4948 #26 0x00000000006ff2ed in channel_read_json_block (channel=0x11b01280, part=PART_OUT, timeout_arg=60000, id=35, rettv=0x7ffcbcbea928) at channel.c:3964 #27 0x0000000000700301 in ch_expr_common (argvars=0x7ffcbcbead80, rettv=0x7ffcbcbeb7c0, eval=1) at channel.c:4582 #28 0x0000000000701297 in f_ch_evalexpr (argvars=0x7ffcbcbead80, rettv=0x7ffcbcbeb7c0) at channel.c:5246 #29 0x0000000000471f0e in call_internal_func (name=0x1281b8d0 "ch_evalexpr", argcount=3, argvars=0x7ffcbcbead80, rettv=0x7ffcbcbeb7c0) at evalfunc.c:3499 #30 0x00000000006797c7 in call_func (funcname=0x1295c690 "ch_evalexpr(channel, [a:method, a:args], {'timeout': 60 * 1000})", len=11, rettv=0x7ffcbcbeb7c0, argcount_in=3, argvars_in=0x7ffcbcbead80, funcexe=0x7ffcbcbeaf30) at userfunc.c:4176 #31 0x0000000000675d4b in get_func_tv (name=0x1295c690 "ch_evalexpr(channel, [a:method, a:args], {'timeout': 60 * 1000})", len=11, rettv=0x7ffcbcbeb7c0, arg=0x7ffcbcbeb688, evalarg=0x7ffcbcbeb720, funcexe=0x7ffcbcbeaf30) at userfunc.c:2190 #32 0x00000000004649bd in eval_func (arg=0x7ffcbcbeb688, evalarg=0x7ffcbcbeb720, name=0x1298d6a0 "ch_evalexpr(channel, [a:method, a:args], {'timeout': 60 * 1000})", name_len=11, rettv=0x7ffcbcbeb7c0, flags=1, basetv=0x0) at eval.c:3234 #33 0x000000000046824b in eval9_var_func_name (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720, evaluate=1, name_start=0x7ffcbcbeb090) at eval.c:5127 #34 0x00000000004686cb in eval9 (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720, want_string=0) at eval.c:5342 #35 0x00000000004677dc in eval8 (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720, want_string=0) at eval.c:4805 #36 0x0000000000467422 in eval7 (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720, want_string=0) at eval.c:4703 #37 0x0000000000466d54 in eval6 (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720) at eval.c:4453 #38 0x00000000004667a2 in eval5 (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720) at eval.c:4247 #39 0x00000000004660e0 in eval4 (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720) at eval.c:4034 #40 0x0000000000465ccb in eval3 (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720) at eval.c:3895 #41 0x00000000004658cc in eval2 (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720) at eval.c:3769 #42 0x000000000046529b in eval1 (arg=0x7ffcbcbeb688, rettv=0x7ffcbcbeb7c0, evalarg=0x7ffcbcbeb720) at eval.c:3607 #43 0x0000000000465057 in eval0_retarg (arg=0x1298d6a0 "ch_evalexpr(channel, [a:method, a:args], {'timeout': 60 * 1000})", rettv=0x7ffcbcbeb7c0, eap=0x7ffcbcbeb960, evalarg=0x7ffcbcbeb720, retarg=0x0) at eval.c:3518 #44 0x0000000000464ed1 in eval0 (arg=0x1298d6a0 "ch_evalexpr(channel, [a:method, a:args], {'timeout': 60 * 1000})", rettv=0x7ffcbcbeb7c0, eap=0x7ffcbcbeb960, evalarg=0x7ffcbcbeb720) at eval.c:3453 #45 0x00000000004839a4 in ex_let (eap=0x7ffcbcbeb960) at evalvars.c:1211 #46 0x000000000049e2c6 in do_one_cmd (cmdlinep=0x7ffcbcbec198, flags=7, cstack=0x7ffcbcbebb60, fgetline=0x67f3af <get_func_line>, cookie=0x125b3790) at ex_docmd.c:2629 #47 0x000000000049b3ea in do_cmdline (cmdline=0x0, fgetline=0x67f3af <get_func_line>, cookie=0x125b3790, flags=7) at ex_docmd.c:1041 #48 0x0000000000678082 in call_user_func (fp=0x11b1aed0, argcount=2, argvars=0x7ffcbcbecb00, rettv=0x7ffcbcbed560, funcexe=0x7ffcbcbeccc0, selfdict=0x11afe800) at userfunc.c:3312 #49 0x000000000067867c in call_user_func_check (fp=0x11b1aed0, argcount=2, argvars=0x7ffcbcbecb00, rettv=0x7ffcbcbed560, funcexe=0x7ffcbcbeccc0, selfdict=0x11afe800) at userfunc.c:3485 #50 0x000000000067976b in call_func (funcname=0x11b05f90 "<SNR>91_request", len=-1, rettv=0x7ffcbcbed560, argcount_in=2, argvars_in=0x7ffcbcbecb00, funcexe=0x7ffcbcbeccc0) at userfunc.c:4158 #51 0x0000000000675d4b in get_func_tv (name=0x11b05f90 "<SNR>91_request", len=-1, rettv=0x7ffcbcbed560, arg=0x7ffcbcbed438, evalarg=0x7ffcbcbed4d0, funcexe=0x7ffcbcbeccc0) at userfunc.c:2190 #52 0x0000000000468b37 in call_func_rettv (arg=0x7ffcbcbed438, evalarg=0x7ffcbcbed4d0, rettv=0x7ffcbcbed560, evaluate=1, selfdict=0x11afe800, basetv=0x0) at eval.c:5515 #53 0x000000000046c29d in handle_subscript (arg=0x7ffcbcbed438, name_start=0x125478b9 "s:client['request'](a:method, a:args)", rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0, verbose=1) at eval.c:7487 #54 0x00000000004686f2 in eval9 (arg=0x7ffcbcbed438, rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0, want_string=0) at eval.c:5348 #55 0x00000000004677dc in eval8 (arg=0x7ffcbcbed438, rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0, want_string=0) at eval.c:4805 #56 0x0000000000467422 in eval7 (arg=0x7ffcbcbed438, rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0, want_string=0) at eval.c:4703 #57 0x0000000000466d54 in eval6 (arg=0x7ffcbcbed438, rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0) at eval.c:4453 #58 0x00000000004667a2 in eval5 (arg=0x7ffcbcbed438, rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0) at eval.c:4247 #59 0x00000000004660e0 in eval4 (arg=0x7ffcbcbed438, rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0) at eval.c:4034 #60 0x0000000000465ccb in eval3 (arg=0x7ffcbcbed438, rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0) at eval.c:3895 #61 0x00000000004658cc in eval2 (arg=0x7ffcbcbed438, rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0) at eval.c:3769 #62 0x000000000046529b in eval1 (arg=0x7ffcbcbed438, rettv=0x7ffcbcbed560, evalarg=0x7ffcbcbed4d0) at eval.c:3607 --Type <RET> for more, q to quit, c to continue without paging--c #63 0x0000000000465057 in eval0_retarg (arg=0x125478b9 "s:client['request'](a:method, a:args)", rettv=0x7ffcbcbed560, eap=0x7ffcbcbed6b0, evalarg=0x7ffcbcbed4d0, retarg=0x0) at eval.c:3518 #64 0x0000000000464ed1 in eval0 (arg=0x125478b9 "s:client['request'](a:method, a:args)", rettv=0x7ffcbcbed560, eap=0x7ffcbcbed6b0, evalarg=0x7ffcbcbed4d0) at eval.c:3453 #65 0x000000000067e1b6 in ex_return (eap=0x7ffcbcbed6b0) at userfunc.c:6437 #66 0x000000000049e2c6 in do_one_cmd (cmdlinep=0x7ffcbcbedee8, flags=7, cstack=0x7ffcbcbed8b0, fgetline=0x67f3af <get_func_line>, cookie=0x12626a00) at ex_docmd.c:2629 #67 0x000000000049b3ea in do_cmdline (cmdline=0x0, fgetline=0x67f3af <get_func_line>, cookie=0x12626a00, flags=7) at ex_docmd.c:1041 #68 0x0000000000678082 in call_user_func (fp=0x11918050, argcount=2, argvars=0x7ffcbcbee850, rettv=0x7ffcbcbeea70, funcexe=0x7ffcbcbeea00, selfdict=0x0) at userfunc.c:3312 #69 0x000000000067867c in call_user_func_check (fp=0x11918050, argcount=2, argvars=0x7ffcbcbee850, rettv=0x7ffcbcbeea70, funcexe=0x7ffcbcbeea00, selfdict=0x0) at userfunc.c:3485 #70 0x000000000067976b in call_func (funcname=0x12425570 "coc#rpc#request", len=-1, rettv=0x7ffcbcbeea70, argcount_in=2, argvars_in=0x7ffcbcbee850, funcexe=0x7ffcbcbeea00) at userfunc.c:4158 #71 0x0000000000675d4b in get_func_tv (name=0x12425570 "coc#rpc#request", len=-1, rettv=0x7ffcbcbeea70, arg=0x7ffcbcbeec18, evalarg=0x7ffcbcbeeb50, funcexe=0x7ffcbcbeea00) at userfunc.c:2190 #72 0x000000000067e42e in ex_call_inner (eap=0x7ffcbcbeed80, name=0x12425570 "coc#rpc#request", arg=0x7ffcbcbeec18, startarg=0x120a4d2b "('doAutocmd', [2])", funcexe_init=0x7ffcbcbeeac0, evalarg=0x7ffcbcbeeb50) at userfunc.c:6511 #73 0x000000000067efc3 in ex_call (eap=0x7ffcbcbeed80) at userfunc.c:6869 #74 0x000000000049e2c6 in do_one_cmd (cmdlinep=0x7ffcbcbef5b8, flags=7, cstack=0x7ffcbcbeef80, fgetline=0x408f5a <getnextac>, cookie=0x7ffcbcbef730) at ex_docmd.c:2629 #75 0x000000000049b3ea in do_cmdline (cmdline=0x0, fgetline=0x408f5a <getnextac>, cookie=0x7ffcbcbef730, flags=7) at ex_docmd.c:1041 #76 0x0000000000408748 in apply_autocmds_group (event=EVENT_VIMLEAVEPRE, fname=0x129a7e40 "/path/to/file", fname_io=0x0, force=0, group=-3, buf=0x1239b260, eap=0x0) at autocmd.c:2428 #77 0x0000000000407b61 in apply_autocmds (event=EVENT_VIMLEAVEPRE, fname=0x0, fname_io=0x0, force=0, buf=0x1239b260) at autocmd.c:1858 #78 0x000000000071097c in getout (exitval=1) at main.c:1768 #79 0x00000000005337d8 in preserve_exit () at misc1.c:2337 #80 0x000000000057318d in deathtrap (sigarg=11) at os_unix.c:1359 #81 <signal handler called> #82 0x00000000004e5395 in hash_lookup (ht=0x120c5cf0, key=0x721b60 "lnum", hash=112406544) at hashtab.c:161 #83 0x00000000004e5353 in hash_find (ht=0x120c5cf0, key=0x721b60 "lnum") at hashtab.c:134 #84 0x0000000000437c9e in dict_find (d=0x120c5ce0, key=0x721b60 "lnum", len=-1) at dict.c:675 #85 0x0000000000437e30 in dict_get_number_def (d=0x120c5ce0, key=0x721b60 "lnum", def=0) at dict.c:747 #86 0x0000000000437e03 in dict_get_number (d=0x120c5ce0, key=0x721b60 "lnum") at dict.c:735 #87 0x00000000004176b9 in check_recorded_changes (buf=0x1239b260, lnum=190, lnume=190, xtra=1) at change.c:256 #88 0x0000000000417c37 in may_invoke_listeners (buf=0x1239b260, lnum=190, lnume=190, added=1) at change.c:472 #89 0x00000000005276a6 in ml_append_flush (buf=0x1239b260, lnum=189, line=0x721b73 "", len=0, flags=0) at memline.c:3492 #90 0x0000000000527778 in ml_append_flags (lnum=189, line=0x721b73 "", len=0, flags=0) at memline.c:3532 #91 0x0000000000527711 in ml_append (lnum=189, line=0x721b73 "", len=0, newfile=0) at memline.c:3519 #92 0x000000000041ba64 in open_line (dir=1, flags=2, second_line_indent=0, did_do_comment=0x0) at change.c:2337 #93 0x000000000054faa2 in n_opencmd (cap=0x7ffcbcbf0460) at normal.c:6345 #94 0x0000000000551c19 in nv_open (cap=0x7ffcbcbf0460) at normal.c:7553 #95 0x0000000000545dd5 in normal_cmd (oap=0x7ffcbcbf0500, toplevel=1) at normal.c:955 #96 0x00000000007106d1 in main_loop (cmdwin=0, noexmode=0) at main.c:1639 #97 0x000000000070fb48 in vim_main2 () at main.c:977 #98 0x000000000070f380 in main (argc=1, argv=0x7ffcbcbf0738) at main.c:453
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Christian Brabandt
chrisbra left a comment (vim/vim#19300)that is strange. Are you using any VimLeavePre autocommands?
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Sainnhe Park
sainnhe left a comment (vim/vim#19300)that is strange. Are you using any VimLeavePre autocommands?
@chrisbra I didn't use VimLeavePre autocmd, but I use VimLeave autocmd to change cursor shape on vim exiting: https://github.com/sainnhe/dotfiles/blob/590fdca516a16cf0700c76046a5c6f6a15230a90/.vim/settings.vim#L170
Could this autocmd lead to a coredump?
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Paul Ollis
paul-ollis left a comment (vim/vim#19300)VimLeavePre autocommands are not the cause of the problem. They are only being triggered after the SIGSEGV, which is happening at line 82 of the stack trace.
Somehow the recorded changes data for a Vim buffer is getting corrupted. The corruption almost certainly happened earlier.
@sainnhe Can you confirm that this only happens with the "coc/coc-clangd" plugin combo active and that there are no other active plugins in use?
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Sainnhe Park
sainnhe left a comment (vim/vim#19300)@paul-ollis Honestly this is pretty hard to confirm, because the crash is not very frequent on my machine (about 4~8 hour for once), and I have to finish my daily work with all my plugins installed. Currently I’m using neovim to avoid this random crash.
Is there any easier method to debug this issue? I can provide the coredump file and the compiled executable, will this help?
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.