ASAN error seen when creating two instances of a class

[Yegappan Lakshmanan]

Hi,

With the latest Vim version (patch 9.0.1093), when sourcing the
following script:

------------------------------------------------------------------------------
vim9script

class MyCar
this.make: string

def new(make_arg: string)
this.make = make_arg
enddef

def GetMake()
echomsg $"make = {this.make}"
enddef
endclass

var c = MyCar.new("abc")
c.GetMake()

var c = MyCar.new("def")
c.GetMake()
------------------------------------------------------------------------------

the following ASAN log is generated:

=================================================================
==36972==ERROR: AddressSanitizer: heap-use-after-free on address
0x60600007cd08 at pc 0x55c5cf683dda bp 0x7ffe185805f0 sp
0x7ffe185805e0
READ of size 4 at 0x60600007cd08 thread T0
#0 0x55c5cf683dd9 in object_unref vim/src/vim9class.c:863
#1 0x55c5cf5dad0c in clear_tv vim/src/typval.c:167
#2 0x55c5ced6fdac in ex_let vim/src/evalvars.c:1162
#3 0x55c5ced6d5f3 in ex_var vim/src/evalvars.c:956
#4 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#5 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#6 0x55c5cf3876d8 in do_source_ext vim/src/scriptfile.c:1667
#7 0x55c5cf383b0e in cmd_source vim/src/scriptfile.c:1146
#8 0x55c5cf383e9d in ex_source vim/src/scriptfile.c:1189
#9 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#10 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#11 0x55c5cf0f1145 in nv_colon vim/src/normal.c:3191
#12 0x55c5cf0db1ec in normal_cmd vim/src/normal.c:939
#13 0x55c5cf90d694 in main_loop vim/src/main.c:1536
#14 0x55c5cf90ba86 in vim_main2 vim/src/main.c:888
#15 0x55c5cf90aec9 in main vim/src/main.c:434
#16 0x7f48456d0d8f in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
#17 0x7f48456d0e3f in __libc_start_main_impl ../csu/libc-start.c:392
#18 0x55c5ceb03764 in _start (vim/src/vim+0x1271764)

0x60600007cd08 is located 8 bytes inside of 56-byte region
[0x60600007cd00,0x60600007cd38)
freed by thread T0 here:
#0 0x7f48462d5517 in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x55c5ceb03f37 in vim_free vim/src/alloc.c:615
#2 0x55c5cf683d2b in object_clear vim/src/vim9class.c:853
#3 0x55c5cf683eb6 in object_unref vim/src/vim9class.c:864
#4 0x55c5cf5dad0c in clear_tv vim/src/typval.c:167
#5 0x55c5ced87d43 in set_var_const vim/src/evalvars.c:3971
#6 0x55c5cece8269 in set_var_lval vim/src/eval.c:1677
#7 0x55c5ced74bc2 in ex_let_one vim/src/evalvars.c:1868
#8 0x55c5ced70071 in ex_let_vars vim/src/evalvars.c:1200
#9 0x55c5ced6fd99 in ex_let vim/src/evalvars.c:1160
#10 0x55c5ced6d5f3 in ex_var vim/src/evalvars.c:956
#11 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#12 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#13 0x55c5cf3876d8 in do_source_ext vim/src/scriptfile.c:1667
#14 0x55c5cf383b0e in cmd_source vim/src/scriptfile.c:1146
#15 0x55c5cf383e9d in ex_source vim/src/scriptfile.c:1189
#16 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#17 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#18 0x55c5cf0f1145 in nv_colon vim/src/normal.c:3191
#19 0x55c5cf0db1ec in normal_cmd vim/src/normal.c:939
#20 0x55c5cf90d694 in main_loop vim/src/main.c:1536
#21 0x55c5cf90ba86 in vim_main2 vim/src/main.c:888
#22 0x55c5cf90aec9 in main vim/src/main.c:434
#23 0x7f48456d0d8f in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
#0 0x7f48462d5867 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x55c5ceb03c1c in lalloc vim/src/alloc.c:246
#2 0x55c5ceb03a83 in alloc_clear vim/src/alloc.c:177
#3 0x55c5cf6f0522 in exec_instructions vim/src/vim9execute.c:3018
#4 0x55c5cf7230e7 in call_def_function vim/src/vim9execute.c:5940
#5 0x55c5cf64e23e in call_user_func vim/src/userfunc.c:2771
#6 0x55c5cf6542a6 in call_user_func_check vim/src/userfunc.c:3189
#7 0x55c5cf681f65 in class_object_index vim/src/vim9class.c:699
#8 0x55c5ced152c3 in handle_subscript vim/src/eval.c:6793
#9 0x55c5ced000c0 in eval9 vim/src/eval.c:4268
#10 0x55c5cecfc72f in eval8 vim/src/eval.c:3798
#11 0x55c5cecfad52 in eval7 vim/src/eval.c:3602
#12 0x55c5cecf8d9b in eval6 vim/src/eval.c:3381
#13 0x55c5cecf7d43 in eval5 vim/src/eval.c:3270
#14 0x55c5cecf6705 in eval4 vim/src/eval.c:3121
#15 0x55c5cecf5544 in eval3 vim/src/eval.c:2982
#16 0x55c5cecf43ed in eval2 vim/src/eval.c:2856
#17 0x55c5cecf2895 in eval1 vim/src/eval.c:2702
#18 0x55c5cecf1f42 in eval0_retarg vim/src/eval.c:2613
#19 0x55c5cecf1b19 in eval0 vim/src/eval.c:2547
#20 0x55c5ced6f983 in ex_let vim/src/evalvars.c:1144
#21 0x55c5ced6d5f3 in ex_var vim/src/evalvars.c:956
#22 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#23 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#24 0x55c5cf3876d8 in do_source_ext vim/src/scriptfile.c:1667
#25 0x55c5cf383b0e in cmd_source vim/src/scriptfile.c:1146
#26 0x55c5cf383e9d in ex_source vim/src/scriptfile.c:1189
#27 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#28 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#29 0x55c5cf0f1145 in nv_colon vim/src/normal.c:3191

SUMMARY: AddressSanitizer: heap-use-after-free vim/src/vim9class.c:863
in object_unref
Shadow bytes around the buggy address:
0x0c0c80007950: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c0c80007960: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x0c0c80007970: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
0x0c0c80007980: 00 00 05 fa fa fa fa fa 00 00 00 00 00 00 00 fa
0x0c0c80007990: fa fa fa fa 00 00 00 00 00 00 01 fa fa fa fa fa
=>0x0c0c800079a0: fd[fd]fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c800079b0: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 02 fa
0x0c0c800079c0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x0c0c800079d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c800079e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c800079f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==36972==ABORTING

- Yegappan

[Bram Moolenaar]

Yegappan wrote:

> With the latest Vim version (patch 9.0.1093), when sourcing the
> following script:

Should be fixed by patch 9.0.1093.

--
Yesterday is history.
Tomorrow is a mystery.
Today is a gift.
That's why it is called 'present'.

/// Bram Moolenaar -- Br...@Moolenaar.net -- http://www.Moolenaar.net \\\
/// \\\
\\\ sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///

[Yegappan Lakshmanan]

Hi Bram,

On Sun, Dec 25, 2022 at 7:02 AM Bram Moolenaar <Br...@moolenaar.net> wrote:
>
>
> Yegappan wrote:
>
> > With the latest Vim version (patch 9.0.1093), when sourcing the
> > following script:
>
> Should be fixed by patch 9.0.1093.
>

This issue is not fixed by 9.0.1093. I still see the ASAN traceback
when sourcing
the script.

- Yegappan

[Bram Moolenaar]

Yegappan wrote:

> > > With the latest Vim version (patch 9.0.1093), when sourcing the
> > > following script:
> >
> > Should be fixed by patch 9.0.1093.
>
> This issue is not fixed by 9.0.1093. I still see the ASAN traceback
> when sourcing the script.

I tried with valgrind. There is an error in the script, variable "c" is
declared twice. I fixed that error, but now I notice that the problem
you refer to only happens when running into the error. I can fix that,
but need to check for side effects.

--
It's not hard to meet expenses, they're everywhere.