I spend some more time reading the code. It seems that the member `vts` of
struct `BalloonEval` needs to be initialized in `check_due_timer()` after
allocating the storage. Otherwise the pointer `vts` has arbitrary value and
`vim_free()` is called in `get_beval_info()` for this uninitialized pointer.

The attached patch solves the problem for me. I don`t know if this is the
best solution.

Markus Braun

-- 
Any errors in spelling, tact or fact are transmission errors

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.
diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c
--- a/src/ex_cmds2.c
+++ b/src/ex_cmds2.c
@@ -1423,6 +1423,9 @@ check_due_timer(void)
 		balloonEvalForTerm = TRUE;
 	    }
 	    if (balloonEval != NULL)
+#ifdef FEAT_VARTABS
+		balloonEval->vts = NULL;
+#endif
 		general_beval_cb(balloonEval, 0);
 	}
 	else if (next_due == -1 || next_due > this_due)

Raspunde prin e-mail lui