Crash when closing file, opening another, selecting bytes: double free or corruption

[cweiske]

I had one file open, closed it via the x in the tab, opened another file and then selected some 4 bytes. bless hang, and I had some stack information in the terminal.

double free or corruption (out)
Stacktrace:

  at <unknown> <0xffffffff>
  at (wrapper managed-to-native) GLib.SList.g_free (intptr) [0x00002] in <5a439e0caae7469886e7119d9f6bc621>:0
  at GLib.ListBase.Empty () [0x000b5] in <5a439e0caae7469886e7119d9f6bc621>:0
  at GLib.ListBase.Dispose (bool) [0x00000] in <5a439e0caae7469886e7119d9f6bc621>:0
  at GLib.ListBase.Finalize () [0x00000] in <5a439e0caae7469886e7119d9f6bc621>:0
  at (wrapper runtime-invoke) object.runtime_invoke_virtual_void__this__ (object,intptr,intptr,intptr) [0x0001e] in <d0e12f672b88444ab4b6d9b2ecf20142>:0
/proc/self/maps:
40071000-40081000 rwxp 00000000 00:00 0 
41cce000-41d9e000 rwxp 00000000 00:00 0 
563ededcd000-563ededf8000 r--p 00000000 fe:01 530520                     /usr/bin/mono-sgen
563ededf8000-563edf0ee000 r-xp 0002b000 fe:01 530520                     /usr/bin/mono-sgen
563edf0ee000-563edf21b000 r--p 00321000 fe:01 530520                     /usr/bin/mono-sgen
563edf21c000-563edf222000 r--p 0044e000 fe:01 530520                     /usr/bin/mono-sgen
563edf222000-563edf228000 rw-p 00454000 fe:01 530520                     /usr/bin/mono-sgen
563edf228000-563edf2b9000 rw-p 00000000 00:00 0 
563edf424000-563ee00f8000 rw-p 00000000 00:00 0                          [heap]
7f6030000000-7f6030021000 rw-p 00000000 00:00 0 
7f6030021000-7f6034000000 ---p 00000000 00:00 0 
7f6038000000-7f6038021000 rw-p 00000000 00:00 0 
7f6038021000-7f603c000000 ---p 00000000 00:00 0 
7f603c000000-7f603c021000 rw-p 00000000 00:00 0 
7f603c021000-7f6040000000 ---p 00000000 00:00 0 
7f6040000000-7f6040021000 rw-p 00000000 00:00 0 
7f6040021000-7f6044000000 ---p 00000000 00:00 0 
7f6044000000-7f6044021000 rw-p 00000000 00:00 0 
7f6044021000-7f6048000000 ---p 00000000 00:00 0 
7f6048000000-7f6048021000 rw-p 00000000 00:00 0 
7f6048021000-7f604c000000 ---p 00000000 00:00 0 
7f604f7ff000-7f604f800000 ---p 00000000 00:00 0 
7f604f800000-7f6050000000 rw-p 00000000 00:00 0 
7f6050000000-7f6050021000 rw-p 00000000 00:00 0 
7f6050021000-7f6054000000 ---p 00000000 00:00 0 
Memory around native instruction pointer (0x7f608df207bb):
0x7f608df207ab  d2 4c 89 ce bf 02 00 00 00 b8 0e 00 00 00 0f 05  .L..............
0x7f608df207bb  48 8b 8c 24 08 01 00 00 64 48 33 0c 25 28 00 00  H..$....dH3.%(..
0x7f608df207cb  00 44 89 c0 75 1d 48 81 c4 10 01 00 00 5b c3 66  .D..u.H......[.f
0x7f608df207db  0f 1f 44 00 00 48 8b 15 89 36 18 00 f7 d8 64 89  ..D..H...6....d.

Native stacktrace:

	mono(+0x12296d) [0x563edeeef96d]
	mono(+0x122c87) [0x563edeeefc87]
	mono(+0xba8e4) [0x563edee878e4]
	/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730) [0x7f608e0d6730]
	/lib/x86_64-linux-gnu/libc.so.6(gsignal+0x10b) [0x7f608df207bb]
	/lib/x86_64-linux-gnu/libc.so.6(abort+0x121) [0x7f608df0b535]
	/lib/x86_64-linux-gnu/libc.so.6(+0x79508) [0x7f608df62508]
	/lib/x86_64-linux-gnu/libc.so.6(+0x7fc1a) [0x7f608df68c1a]
	/lib/x86_64-linux-gnu/libc.so.6(+0x81730) [0x7f608df6a730]
	[0x41d9773d]

[cweiske]

The problem happened with Mono JIT compiler version 5.18.0.240 (Debian 5.18.0.240+dfsg-3 Wed Apr 17 16:37:36 UTC 2019).
It does not happen with the mono version from https://www.mono-project.com/download/stable/ (Debian unstable), currently Mono JIT compiler version 5.20.1.19 (tarball Thu Apr 11 09:07:22 UTC 2019)