Hi,
With the latest Vim version (patch 9.0.1093), when sourcing the
following script:
------------------------------------------------------------------------------
vim9script
class MyCar
this.make: string
def new(make_arg: string)
this.make = make_arg
enddef
def GetMake()
echomsg $"make = {this.make}"
enddef
endclass
var c = MyCar.new("abc")
c.GetMake()
var c = MyCar.new("def")
c.GetMake()
------------------------------------------------------------------------------
the following ASAN log is generated:
=================================================================
==36972==ERROR: AddressSanitizer: heap-use-after-free on address
0x60600007cd08 at pc 0x55c5cf683dda bp 0x7ffe185805f0 sp
0x7ffe185805e0
READ of size 4 at 0x60600007cd08 thread T0
#0 0x55c5cf683dd9 in object_unref vim/src/vim9class.c:863
#1 0x55c5cf5dad0c in clear_tv vim/src/typval.c:167
#2 0x55c5ced6fdac in ex_let vim/src/evalvars.c:1162
#3 0x55c5ced6d5f3 in ex_var vim/src/evalvars.c:956
#4 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#5 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#6 0x55c5cf3876d8 in do_source_ext vim/src/scriptfile.c:1667
#7 0x55c5cf383b0e in cmd_source vim/src/scriptfile.c:1146
#8 0x55c5cf383e9d in ex_source vim/src/scriptfile.c:1189
#9 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#10 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#11 0x55c5cf0f1145 in nv_colon vim/src/normal.c:3191
#12 0x55c5cf0db1ec in normal_cmd vim/src/normal.c:939
#13 0x55c5cf90d694 in main_loop vim/src/main.c:1536
#14 0x55c5cf90ba86 in vim_main2 vim/src/main.c:888
#15 0x55c5cf90aec9 in main vim/src/main.c:434
#16 0x7f48456d0d8f in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
#17 0x7f48456d0e3f in __libc_start_main_impl ../csu/libc-start.c:392
#18 0x55c5ceb03764 in _start (vim/src/vim+0x1271764)
0x60600007cd08 is located 8 bytes inside of 56-byte region
[0x60600007cd00,0x60600007cd38)
freed by thread T0 here:
#0 0x7f48462d5517 in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x55c5ceb03f37 in vim_free vim/src/alloc.c:615
#2 0x55c5cf683d2b in object_clear vim/src/vim9class.c:853
#3 0x55c5cf683eb6 in object_unref vim/src/vim9class.c:864
#4 0x55c5cf5dad0c in clear_tv vim/src/typval.c:167
#5 0x55c5ced87d43 in set_var_const vim/src/evalvars.c:3971
#6 0x55c5cece8269 in set_var_lval vim/src/eval.c:1677
#7 0x55c5ced74bc2 in ex_let_one vim/src/evalvars.c:1868
#8 0x55c5ced70071 in ex_let_vars vim/src/evalvars.c:1200
#9 0x55c5ced6fd99 in ex_let vim/src/evalvars.c:1160
#10 0x55c5ced6d5f3 in ex_var vim/src/evalvars.c:956
#11 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#12 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#13 0x55c5cf3876d8 in do_source_ext vim/src/scriptfile.c:1667
#14 0x55c5cf383b0e in cmd_source vim/src/scriptfile.c:1146
#15 0x55c5cf383e9d in ex_source vim/src/scriptfile.c:1189
#16 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#17 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#18 0x55c5cf0f1145 in nv_colon vim/src/normal.c:3191
#19 0x55c5cf0db1ec in normal_cmd vim/src/normal.c:939
#20 0x55c5cf90d694 in main_loop vim/src/main.c:1536
#21 0x55c5cf90ba86 in vim_main2 vim/src/main.c:888
#22 0x55c5cf90aec9 in main vim/src/main.c:434
#23 0x7f48456d0d8f in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
previously allocated by thread T0 here:
#0 0x7f48462d5867 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x55c5ceb03c1c in lalloc vim/src/alloc.c:246
#2 0x55c5ceb03a83 in alloc_clear vim/src/alloc.c:177
#3 0x55c5cf6f0522 in exec_instructions vim/src/vim9execute.c:3018
#4 0x55c5cf7230e7 in call_def_function vim/src/vim9execute.c:5940
#5 0x55c5cf64e23e in call_user_func vim/src/userfunc.c:2771
#6 0x55c5cf6542a6 in call_user_func_check vim/src/userfunc.c:3189
#7 0x55c5cf681f65 in class_object_index vim/src/vim9class.c:699
#8 0x55c5ced152c3 in handle_subscript vim/src/eval.c:6793
#9 0x55c5ced000c0 in eval9 vim/src/eval.c:4268
#10 0x55c5cecfc72f in eval8 vim/src/eval.c:3798
#11 0x55c5cecfad52 in eval7 vim/src/eval.c:3602
#12 0x55c5cecf8d9b in eval6 vim/src/eval.c:3381
#13 0x55c5cecf7d43 in eval5 vim/src/eval.c:3270
#14 0x55c5cecf6705 in eval4 vim/src/eval.c:3121
#15 0x55c5cecf5544 in eval3 vim/src/eval.c:2982
#16 0x55c5cecf43ed in eval2 vim/src/eval.c:2856
#17 0x55c5cecf2895 in eval1 vim/src/eval.c:2702
#18 0x55c5cecf1f42 in eval0_retarg vim/src/eval.c:2613
#19 0x55c5cecf1b19 in eval0 vim/src/eval.c:2547
#20 0x55c5ced6f983 in ex_let vim/src/evalvars.c:1144
#21 0x55c5ced6d5f3 in ex_var vim/src/evalvars.c:956
#22 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#23 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#24 0x55c5cf3876d8 in do_source_ext vim/src/scriptfile.c:1667
#25 0x55c5cf383b0e in cmd_source vim/src/scriptfile.c:1146
#26 0x55c5cf383e9d in ex_source vim/src/scriptfile.c:1189
#27 0x55c5ceddb840 in do_one_cmd vim/src/ex_docmd.c:2582
#28 0x55c5cedcec2d in do_cmdline vim/src/ex_docmd.c:994
#29 0x55c5cf0f1145 in nv_colon vim/src/normal.c:3191
SUMMARY: AddressSanitizer: heap-use-after-free vim/src/vim9class.c:863
in object_unref
Shadow bytes around the buggy address:
0x0c0c80007950: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c0c80007960: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x0c0c80007970: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
0x0c0c80007980: 00 00 05 fa fa fa fa fa 00 00 00 00 00 00 00 fa
0x0c0c80007990: fa fa fa fa 00 00 00 00 00 00 01 fa fa fa fa fa
=>0x0c0c800079a0: fd[fd]fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c800079b0: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 02 fa
0x0c0c800079c0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x0c0c800079d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c800079e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c800079f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==36972==ABORTING
- Yegappan
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/vim_dev/CAAW7x7mn1JesbjKgHcWVd1-b2JHTREd%3DcCmGTFfHkTCivcxU6Q%40mail.gmail.com.
