vi crash occasionally when opening large file

[xiaoge1001]

Steps to reproduce

1. Generate a very large file, such as: fallocate -l 10G bigfile.
2. Run vi bigfile
3. After about 30 seconds, run ':q" doesn't exit, press ctrl-c, vi program coredump

Expected behaviour

vi exits normally without coredump

Version of Vim

9.0

Environment

openEuler

Logs and stack traces

Program terminated with signal SIGSEGV, Segmentation fault.

#0  kill()
#1  may_core_dump() os_unix.c:3519
#2  may_core_dump() os_unix.c:3514
#3 mch_exit()  
#4 <signal handler called>
#5 __memmove_evex_unaligned_erma()
#6 memmove()
#7 ml_append_int()
#8 ml_append_flush()
#9 ml_append()
#10 readfile()
#11 open_buffer()
#12 create_windows()
#13 vim_main2()
#14 __libc_start_call_main()
#15 __libc_start_main_impl()
#16 _start()

[chrisbra]

What version? Did you try vim --clean? Can you please check latest master version?

[xiaoge1001]

What version? Did you try vim --clean? Can you please check latest master version?

I'm very sorry, there is an occasional problem. I tried to reproduce it again later, but it was not successful.

[xiaoge1001]

Other information can be found at:
#17936 (comment)

[xiaoge1001]

I don't try to run vim --clean, can this avoid such problems?

[xiaoge1001]

I will try to reproduce this problem again, but I may not be able to successfully reproduce it

[chrisbra]

please try to build a debugging version so we have a better strack trace. Using ASAN builds would also help.

[xiaoge1001]

Steps to reproduce:

dd if=/dev/zero bs=1M count=10240 | tr '\0' 'A' > bigline.txt
echo -n "A" >> bigline.txt
echo "" >> bigline.txt
vi bigline.txt   # crash after waiting for a certain period of time.

[chrisbra]

Please get a DEBUG build and show the stack trace

[he7850]

#0  0x00007effe859442b in kill () from /usr/lib64/libc.so.6
#1  0x000055eb07a57dc3 in may_core_dump () at os_unix.c:3519
#2  may_core_dump () at os_unix.c:3514
#3  mch_exit (r=1) at os_unix.c:3485
#4  <signal handler called>
#5  0x00007effe86e295f in ?? () from /usr/lib64/libc.so.6
#6  0x000055eb07a2cae2 in memmove (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>)
    at /usr/include/bits/string_fortified.h:36
#7  ml_append_int (buf=0x55eb08dbf320, lnum=lnum@entry=0, line_arg=line_arg@entry=0x7eff67265010 'A' <repeats 200 times>..., 
    len_arg=<optimized out>, flags=flags@entry=1) at memline.c:2895
#8  0x000055eb07a2e5db in ml_append_flush (flags=1, len=<optimized out>, line=0x7eff67265010 'A' <repeats 200 times>..., lnum=0, 
    buf=<optimized out>) at memline.c:3325
#9  0x000055eb07a2e62d in ml_append (lnum=lnum@entry=0, line=line@entry=0x7eff67265010 'A' <repeats 200 times>..., 
    len=<optimized out>, newfile=newfile@entry=1) at memline.c:3347
#10 0x000055eb07a0841a in readfile (fname=0x55eb08dc3fe0 "bigline.txt", sfname=0x55eb08dc3fe0 "bigline.txt", from=from@entry=0, 
    lines_to_skip=lines_to_skip@entry=0, lines_to_read=lines_to_read@entry=9223372036854775807, eap=eap@entry=0x0, flags=1)
    at fileio.c:2238
#11 0x000055eb079d2655 in open_buffer (read_stdin=0, eap=0x0, flags=0) at buffer.c:253
#12 0x000055eb07abc2a4 in create_windows (parmp=0x55eb07b1b6e0 <params>) at main.c:2902
#13 vim_main2 () at main.c:711
#14 0x00007effe8580390 in ?? () from /usr/lib64/libc.so.6
#15 0x00007effe858043c in __libc_start_main () from /usr/lib64/libc.so.6
#16 0x000055eb079c8895 in _start ()

[xiaoge1001]

Hello, is anyone still following this issue?

[xiaoge1001]

Steps to reproduce:

dd if=/dev/zero bs=1M count=10240 | tr '\0' 'A' > bigline.txt
echo -n "A" >> bigline.txt
echo "" >> bigline.txt
vi bigline.txt   # crash after waiting for a certain period of time.

vim bigline.txt
vim-9.1.1984 is still reproducible. It took a long time, and a segmentation fault occurred after about 1 hour.

[chrisbra]

Please get a DEBUG build and show the stack trace

Still waiting on the above. Also, please reproduce using vim --clean, to rule out any customizations.

[xiaoge1001]

Please get a DEBUG build and show the stack trace

Core was generated by `vim vim/bigline.txt'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000ffffb1c3a20c in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
120     T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
(gdb) bt
#0  0x0000ffffb1c3a20c in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
#1  0x0000aaaabb57e610 in may_core_dump () at os_unix.c:3864
#2  0x0000aaaabb57e5b4 in mch_exit (r=1) at os_unix.c:3830
#3  0x0000aaaabb786eec in getout (exitval=1) at main.c:1861
#4  0x0000aaaabb52c1c4 in preserve_exit () at misc1.c:2337
#5  0x0000aaaabb57c414 in deathtrap (sigarg=11) at os_unix.c:1359
#6  <signal handler called>
#7  __memcpy_generic () at ../sysdeps/aarch64/multiarch/../memcpy.S:122
#8  0x0000aaaabb51cc04 in ml_append_int (buf=0xaaaabbf513a0, lnum=0, line_arg=0xffff307ef010 'A' <repeats 200 times>..., len_arg=-2147416559, flags=1) at memline.c:3068
#9  0x0000aaaabb51dbb8 in ml_append_flush (buf=0xaaaabbf513a0, lnum=0, line=0xffff307ef010 'A' <repeats 200 times>..., len=-2147416559, flags=1) at memline.c:3497
#10 0x0000aaaabb51dc74 in ml_append_flags (lnum=0, line=0xffff307ef010 'A' <repeats 200 times>..., len=-2147416559, flags=1) at memline.c:3532
#11 0x0000aaaabb51dbfc in ml_append (lnum=0, line=0xffff307ef010 'A' <repeats 200 times>..., len=-2147416559, newfile=1) at memline.c:3519
#12 0x0000aaaabb49d248 in readfile (fname=0xaaaabbf59ad0 "vim/bigline.txt", sfname=0xaaaabbf59ad0 "vim/bigline.txt", from=0, lines_to_skip=0, lines_to_read=9223372036854775807, eap=0x0,
    flags=1) at fileio.c:2298
#13 0x0000aaaabb3cc2f8 in open_buffer (read_stdin=0, eap=0x0, flags_arg=0) at buffer.c:297
#14 0x0000aaaabb788de4 in create_windows (parmp=0xaaaabb87fd30 <params>) at main.c:3067
#15 0x0000aaaabb7856ec in vim_main2 () at main.c:787
#16 0x0000aaaabb7850e8 in main (argc=2, argv=0xffffff35b228) at main.c:453
(gdb) f 8
#8  0x0000aaaabb51cc04 in ml_append_int (buf=0xaaaabbf513a0, lnum=0, line_arg=0xffff307ef010 'A' <repeats 200 times>..., len_arg=-2147416559, flags=1) at memline.c:3068
3068                mch_memmove((char *)dp + dp->db_txt_start,
(gdb) p *dp
$7 = {db_id = 25697, db_free = 2147420622, db_txt_start = 2147420654, db_txt_end = 4096, db_line_count = 2, db_index = {4095}}
(gdb)