Re: SIGBUS in Vim 7.4

fREW Schmidt <frioux@gmail.com> wrote:

> I am on Ubuntu 16.04 and Vim gets killed fairly regularly (maybe once
> a week?) Last time it happened I went through the effort of setting
> up vim to dump core instead of just leaving me with an empty console
> after crashing. I now have the coredump!
>
> The vim version is reported as:
>
> VIM - Vi IMproved 7.4 (2013 Aug 10, compiled Apr 08 2016 11:38:28) [25/1416]
> Included patches: 1-1689
> Modified by pkg-vim-maintainers@lists.alioth.debian.org
> Compiled by pkg-vim-maintainers@lists.alioth.debian.org
> Huge version with GTK2-GNOME GUI. Features included (+) or not (-):
> +acl +farsi +mouse_netterm +tag_binary
> +arabic +file_in_path +mouse_sgr +tag_old_static
> +autocmd +find_in_path -mouse_sysmouse -tag_any_white
> +balloon_eval +float +mouse_urxvt +tcl
> +browse +folding +mouse_xterm +terminfo
> ++builtin_terms -footer +multi_byte +termresponse
> +byte_offset +fork() +multi_lang +textobjects
> +channel +gettext -mzscheme +timers
> +cindent -hangul_input +netbeans_intg +title
> +clientserver +iconv +packages +toolbar
> +clipboard +insert_expand +path_extra +user_commands
> +cmdline_compl +job +perl +vertsplit
> +cmdline_hist +jumplist +persistent_undo +virtualedit
> +cmdline_info +keymap +postscript +visual
> +comments +langmap +printer +visualextra
> +conceal +libcall +profile +viminfo
> +cryptv +linebreak -python +vreplace
> +cscope +lispindent +python3 +wildignore
> +cursorbind +listcmds +quickfix +wildmenu
> +cursorshape +localmap +reltime +windows
> +dialog_con_gui +lua +rightleft +writebackup
> +diff +menu +ruby +X11
> +digraphs +mksession +scrollbind -xfontset
> +dnd +modify_fname +signs +xim
> -ebcdic +mouse +smartindent +xsmp_interact
> +emacs_tags +mouseshape +startuptime +xterm_clipboard
> +eval +mouse_dec +statusline -xterm_save
> +ex_extra +mouse_gpm -sun_workshop +xpm
> +extra_search -mouse_jsbterm +syntax
> system vimrc file: "$VIM/vimrc"
> user vimrc file: "$HOME/.vimrc"
> 2nd user vimrc file: "~/.vim/vimrc"
> user exrc file: "$HOME/.exrc"
> system gvimrc file: "$VIM/gvimrc"
> user gvimrc file: "$HOME/.gvimrc"
> 2nd user gvimrc file: "~/.vim/gvimrc"
> system menu file: "$VIMRUNTIME/menu.vim"
> fall-back for $VIM: "/usr/share/vim"
> Compilation: gcc -c -I. -Iproto -DHAVE_CONFIG_H -DFEAT_GUI_GTK -pthread -I/usr/include/gtk-2.0
> -I/usr/lib/x86_64-linux-gnu/gtk-2.0/include -I/usr/include/gio-unix-2.0/ -I/usr/include/cairo
> -I/usr/include/pango-1.0 -I/usr/include/atk-1.0 -I/usr/include/cairo -I/usr/include/pixman-1 -I
> /usr/include/libpng12 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/libpng12 -I/usr/include/pang
> o-1.0 -I/usr/include/harfbuzz -I/usr/include/pango-1.0 -I/usr/include/glib-2.0 -I/usr/lib/x86_6
> 4-linux-gnu/glib-2.0/include -I/usr/include/freetype2 -D_REENTRANT -DORBIT2=1 -pthread -I/usr/i
> nclude/libgnomeui-2.0 -I/usr/include/gnome-keyring-1 -I/usr/include/libbonoboui-2.0 -I/usr/incl
> ude/libxml2 -I/usr/include/libgnome-2.0 -I/usr/include/libbonobo-2.0 -I/usr/include/bonobo-acti
> vation-2.0 -I/usr/include/orbit-2.0 -I/usr/include/libgnomecanvas-2.0 -I/usr/include/gail-1.0 -
> I/usr/include/libart-2.0 -I/usr/include/gtk-2.0 -I/usr/lib/x86_64-linux-gnu/gtk-2.0/include -I/
> usr/include/gio-unix-2.0/ -I/usr/include/cairo -I/usr/include/pango-1.0 -I/usr/include/atk-1.0
> -I/usr/include/cairo -I/usr/include/pixman-1 -I/usr/include/libpng12 -I/usr/include/pango-1.0 -
> I/usr/include/harfbuzz -I/usr/include/pango-1.0 -I/usr/include/freetype2 -I/usr/include/gdk-pix
> buf-2.0 -I/usr/include/libpng12 -I/usr/include/gnome-vfs-2.0 -I/usr/lib/x86_64-linux-gnu/gnome-
> vfs-2.0/include -I/usr/include/gconf/2 -I/usr/include/dbus-1.0 -I/usr/lib/x86_64-linux-gnu/dbus
> -1.0/include -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -Wdate-time
> -g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -U_FORTIFY_SOURCE -D_FOR
> TIFY_SOURCE=1
> Linking: gcc -L. -Wl,-Bsymbolic-functions -Wl,-z,relro -fstack-protector -rdynamic -Wl,-expor
> t-dynamic -Wl,-E -Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -
> o vim -lgtk-x11-2.0 -lgdk-x11-2.0 -lpangocairo-1.0 -latk-1.0 -lcairo -lgdk_pixbuf-2.0 -lgio-2
> .0 -lpangoft2-1.0 -lpango-1.0 -lgobject-2.0 -lglib-2.0 -lfontconfig -lfreetype -lgnomeui-2 -lS
> M -lICE -lbonoboui-2 -lgnome-2 -lpopt -lbonobo-2 -lbonobo-activation -lORBit-2 -lgnomecanvas-2
> -lart_lgpl_2 -lgtk-x11-2.0 -lgdk-x11-2.0 -lpangocairo-1.0 -latk-1.0 -lcairo -lgio-2.0 -lpangoft
> 2-1.0 -lpango-1.0 -lfontconfig -lfreetype -lgdk_pixbuf-2.0 -lgnomevfs-2 -lgconf-2 -lgthread-2.0
> -lgmodule-2.0 -lgobject-2.0 -lglib-2.0 -lSM -lICE -lXpm -lXt -lX11 -lXdmcp -lSM -lICE -lm -lt
> info -lnsl -lselinux -lacl -lattr -lgpm -ldl -L/usr/lib -llua5.2 -Wl,-E -fstack-protector-s
> trong -L/usr/local/lib -L/usr/lib/x86_64-linux-gnu/perl/5.22/CORE -lperl -ldl -lm -lpthread -l
> crypt -L/usr/lib/python3.5/config-3.5m-x86_64-linux-gnu -lpython3.5m -lpthread -ldl -lutil -lm
> -L/usr/lib/x86_64-linux-gnu -ltcl8.6 -ldl -lz -lpthread -lieee -lm -lruby-2.3 -lpthread -lgmp
> -ldl -lcrypt -lm
>
> Here is the backtrace from the coredump:
>
> Program terminated with signal SIGBUS, Bus error.
> #0 0x00007fa650515757 in kill () at ../sysdeps/unix/syscall-template.S:84
> 84 ../sysdeps/unix/syscall-template.S: No such file or directory.
> [Current thread is 1 (Thread 0x7fa65557ca80 (LWP 38810))]
> (gdb) bt
> #0 0x00007fa650515757 in kill () at ../sysdeps/unix/syscall-template.S:84
> #1 0x0000555fad98c273 in may_core_dump () at os_unix.c:3297
> #2 0x0000555fad98dd20 in may_core_dump () at os_unix.c:3266
> #3 mch_exit (r=1) at os_unix.c:3263
> #4 <signal handler called>
> #5 in_id_list (cur_si=<optimized out>, cur_si@entry=0x555fb0591700, list=0x6578655f3931313e,
> ssp=ssp@entry=0x555faf7497a0, contained=0) at syntax.c:6193
> #6 0x0000555fad9fb902 in syn_current_attr (syncing=syncing@entry=0,
> displaying=displaying@entry=0, can_spell=can_spell@entry=0x0,
> keep_state=keep_state@entry=0) at syntax.c:2090
> #7 0x0000555fad9fc1b4 in syn_finish_line (syncing=syncing@entry=0) at syntax.c:1781
> #8 0x0000555fad9fcd3f in syn_finish_line (syncing=0) at syntax.c:758
> #9 syntax_start (wp=0x555faf633720, lnum=3250) at syntax.c:536
> #10 0x0000555fad9fcf45 in syn_get_foldlevel (wp=0x555faf633720, lnum=lnum@entry=3250)
> at syntax.c:6546
> #11 0x0000555fad9167e9 in foldlevelSyntax (flp=0x7ffe2b90beb0) at fold.c:3222
> #12 0x0000555fad917fe8 in foldUpdateIEMSRecurse (gap=gap@entry=0x555faf633828,
> level=level@entry=1, startlnum=startlnum@entry=1, flp=flp@entry=0x7ffe2b90beb0,
> getlevel=getlevel@entry=0x555fad9167a0 <foldlevelSyntax>, bot=bot@entry=7532, topflags=2)
> at fold.c:2652
> #13 0x0000555fad918dbf in foldUpdateIEMS (bot=7532, top=1, wp=0x555faf633720) at fold.c:2292
> #14 foldUpdate (wp=wp@entry=0x555faf633720, top=top@entry=1, bot=bot@entry=2147483647)
> at fold.c:835
> #15 0x0000555fad919123 in checkupdate (wp=wp@entry=0x555faf633720) at fold.c:1187
> #16 0x0000555fad91936a in checkupdate (wp=0x555faf633720) at fold.c:217
> #17 hasFoldingWin (win=0x555faf633720, lnum=5591, firstp=0x555faf633798,
> lastp=lastp@entry=0x0, cache=cache@entry=1, infop=infop@entry=0x0) at fold.c:158
> #18 0x0000555fad91942e in hasFolding (lnum=<optimized out>, firstp=<optimized out>,
> lastp=lastp@entry=0x0) at fold.c:133
> #19 0x0000555fad959c3e in update_topline () at move.c:291
> #20 0x0000555fad9118ee in buf_reload (buf=buf@entry=0x555faf25e210,
> orig_mode=orig_mode@entry=33204) at fileio.c:7155
> #21 0x0000555fad911d0c in buf_check_timestamp (buf=buf@entry=0x555faf25e210,
> focus=focus@entry=1) at fileio.c:6997
> #22 0x0000555fad912422 in check_timestamps (focus=1) at fileio.c:6664
> #23 0x0000555fada1091b in ui_focus_change (in_focus=<optimized out>) at ui.c:3203
> #24 0x0000555fad91fd96 in vgetc () at getchar.c:1670
> #25 0x0000555fad920019 in safe_vgetc () at getchar.c:1801
> #26 0x0000555fad96e775 in normal_cmd (oap=0x7ffe2b90c440, toplevel=1) at normal.c:627
> #27 0x0000555fada5d665 in main_loop (cmdwin=0, noexmode=0) at main.c:1359
> #28 0x0000555fad88d21d in main (argc=<optimized out>, argv=<optimized out>) at main.c:1051

As Christian wrote, the stack has things in common
with a stack already reported a few days ago, where the *list
pointer was invalid. Here is a more direct link:

https://www.mail-archive.com/vim_dev@googlegroups.com/msg39698.html

We still don't have a fix for this crash.

In my case, it was a SIGSEV. In your case, it's a SIGBUS.
In my case, it looked triggered by conceal. In your case, it looks
like it's caused by folding. But it might be the same bug. It would
be interesting to know how to reproduce it. What plugin and vimrc
are you're using?

> I am willing to attempt building a newer Vim, but in my experience
> that can be a bit of a bear, and if any of my many, many plugins stop
> working, I expect that I won't be able to keep going on with it.

Reproducing bugs with the latest vim from git is always preferable.
I suspect that this bug is still in the latest vim.

Vim can be rebuilt with:

$ sudo apt-get build-dep vim-gnome
$ sudo apt-get install git
$ git clone https://github.com/vim/vim.git
$ cd vim
$ ./configure --with-features=huge --enable-gui=gtk2
$ make -j4
$ sudo make install

Plugins should work fine with the latest vim as there are
only bug fixes I think.

> I am happy to run gdb commands on the coredump, but I cannot send it
> as I was editing work code at the time, and besides it's 125 megs.
>
> Let me know how to proceed.

You can try running vim with valgrind and try to reproduce the bug:

$ valgrind --log-file=vg.log --num-callers=50 --track-origins=yes ./vim

You can also build Vim with asan (address sanitizer) so which will
detect memory errors such as use of free memory, which might
otherwise not cause crashes sometimes. To do that, you need
to rebuild after uncommenting the following line in src/Makefile:

SANITIZER_CFLAGS = -g -O0 -fsanitize=address -fno-omit-frame-pointer

You should also comment out this line in src/Makefile:

#$(STRIP) $(DEST_BIN)/$(VIMTARGET)

Regards
Dominique

--
--
You received this message from the "vim_use" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

---
You received this message because you are subscribed to the Google Groups "vim_use" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vim_use+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.