CmdlineEnter throws "E5500: autocmd has thrown an exception: Vim:E685: Internal error: hash_add()"

[PawkyPenguin]

Neovim version (nvim -v)

NVIM v0.7.2 Build type: Release LuaJIT 2.1.0-beta3 Compiled by runner@fv-az164-457 Features: +acl +iconv +tui

Vim (not Nvim) behaves the same?

no, VIM - Vi IMproved 8.2 (2019 Dec 12, compiled Apr 18 2022 19:26:30) Included patches: 1-3995

Operating system/version

Ubuntu 22.4., 5.15.0-41-generic

Terminal name/version

GNOME Terminal 3.44.0 using VTE 0.68.0 +BIDI +GNUTLS +ICU +SYSTEMD

$TERM environment variable

xterm-256color

Installation

Download latest version from github releases. Also happens with latest Ubuntu package (v0.7.0-dev)

How to reproduce the issue

cat << "EOF" > dummyvimrc                                                                                                               
autocmd CmdlineEnter * execute "normal :"
autocmd CmdlineLeave * execute ""
EOF

nvim -u dummyvimrc

Then type :.

This issue also occurs when the autocommand executes normal ? or normal / or normal q:, so it probably occurs whenever the command line would be invoked twice.

Expected behavior

No error should be produced.

In Vim, nothing happens, so I would guess the auto command most likely aborts execution.

Actual behavior

Vim:E685: Internal error: hash_add() is produced.

Sometimes it crashes with malloc_consolidate(): unaligned fastbin chunk detected or double free or corruption (fasttop) or free(): double free detected in tcache 2 and leaves the terminal in unusable state, but this is not deterministic and I can't reliably reproduce it.

[PawkyPenguin]

Related: #11273

[zeertzjq]

=================================================================
==2356==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300000ce80 at pc 0x56429e19e0e4 bp 0x7fff3e770960 sp 0x7fff3e770958
READ of size 4 at 0x60300000ce80 thread T0
    #0 0x56429e19e0e3 in tv_clear **/src/nvim/eval/typval.c:3210:25
    #1 0x56429e1ba138 in tv_dict_item_free **/src/nvim/eval/typval.c:1870:3
    #2 0x56429e1bad12 in tv_dict_free_contents **/src/nvim/eval/typval.c:1945:3
    #3 0x56429dfccfa6 in restore_v_event **/src/nvim/eval.c:341:3
    #4 0x56429e379146 in command_line_enter **/src/nvim/ex_getln.c:755:5
    #5 0x56429e375abc in getcmdline **/src/nvim/ex_getln.c:2544:10
    #6 0x56429e37f108 in getexline **/src/nvim/ex_getln.c:2789:18
    #7 0x56429e2d78bf in do_cmdline **/src/nvim/ex_docmd.c:514:30
    #8 0x56429e97d09b in nv_colon **/src/nvim/normal.c:3213:20
    #9 0x56429e9692d5 in normal_execute **/src/nvim/normal.c:1180:3
    #10 0x56429ef79547 in state_enter **/src/nvim/state.c:99:26
    #11 0x56429e94cdd0 in normal_enter **/src/nvim/normal.c:477:3
    #12 0x56429e6594f0 in main **/src/nvim/main.c:595:3
    #13 0x7f3bf2cb228f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #14 0x7f3bf2cb2349 in __libc_start_main (/usr/lib/libc.so.6+0x23349) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #15 0x56429d9d4d44 in _start /build/glibc/src/glibc/csu/../sysdeps/x86_64/start.S:115

0x60300000ce80 is located 0 bytes inside of 26-byte region [0x60300000ce80,0x60300000ce9a)
freed by thread T0 here:
    #0 0x56429da88c02 in __interceptor_free.part.0 asan_malloc_linux.cpp.o
    #1 0x56429e841584 in xfree **/src/nvim/memory.c:136:3
    #2 0x56429e1ba1f5 in tv_dict_item_free **/src/nvim/eval/typval.c:1872:5
    #3 0x56429e1bad12 in tv_dict_free_contents **/src/nvim/eval/typval.c:1945:3
    #4 0x56429dfccfa6 in restore_v_event **/src/nvim/eval.c:341:3
    #5 0x56429e37a67f in command_line_enter **/src/nvim/ex_getln.c:822:5
    #6 0x56429e375abc in getcmdline **/src/nvim/ex_getln.c:2544:10
    #7 0x56429e37f108 in getexline **/src/nvim/ex_getln.c:2789:18
    #8 0x56429e2d78bf in do_cmdline **/src/nvim/ex_docmd.c:514:30
    #9 0x56429e97d09b in nv_colon **/src/nvim/normal.c:3213:20
    #10 0x56429e9692d5 in normal_execute **/src/nvim/normal.c:1180:3
    #11 0x56429e961f9f in normal_cmd **/src/nvim/normal.c:6564:9
    #12 0x56429e32bf18 in exec_normal **/src/nvim/ex_docmd.c:6455:5
    #13 0x56429e32bc2b in exec_normal_cmd **/src/nvim/ex_docmd.c:6438:3
    #14 0x56429e33c0c6 in ex_normal **/src/nvim/ex_docmd.c:6370:7
    #15 0x56429e30b8cf in execute_cmd0 **/src/nvim/ex_docmd.c:1621:7
    #16 0x56429e2e7c64 in do_one_cmd **/src/nvim/ex_docmd.c:2278:7
    #17 0x56429e2d85ce in do_cmdline **/src/nvim/ex_docmd.c:579:20
    #18 0x56429e0366e4 in ex_execute **/src/nvim/eval.c:7485:7
    #19 0x56429e30b8cf in execute_cmd0 **/src/nvim/ex_docmd.c:1621:7
    #20 0x56429e2e7c64 in do_one_cmd **/src/nvim/ex_docmd.c:2278:7
    #21 0x56429e2d85ce in do_cmdline **/src/nvim/ex_docmd.c:579:20
    #22 0x56429dd7ed53 in apply_autocmds_group **/src/nvim/autocmd.c:1924:5
    #23 0x56429dd85dad in apply_autocmds **/src/nvim/autocmd.c:1590:10
    #24 0x56429e379133 in command_line_enter **/src/nvim/ex_getln.c:754:5
    #25 0x56429e375abc in getcmdline **/src/nvim/ex_getln.c:2544:10
    #26 0x56429e37f108 in getexline **/src/nvim/ex_getln.c:2789:18
    #27 0x56429e2d78bf in do_cmdline **/src/nvim/ex_docmd.c:514:30
    #28 0x56429e97d09b in nv_colon **/src/nvim/normal.c:3213:20
    #29 0x56429e9692d5 in normal_execute **/src/nvim/normal.c:1180:3

previously allocated by thread T0 here:
    #0 0x56429da89c19 in malloc (**/build/bin/nvim+0xd0ec19) (BuildId: da9d9a3a1e4171e86f33ddfbd276f2a694a7fe3a)
    #1 0x56429e841292 in try_malloc **/src/nvim/memory.c:88:15
    #2 0x56429e84145c in xmalloc **/src/nvim/memory.c:122:15
    #3 0x56429e1b94db in tv_dict_item_alloc_len **/src/nvim/eval/typval.c:1840:26
    #4 0x56429e1beae5 in tv_dict_add_nr **/src/nvim/eval/typval.c:2314:28
    #5 0x56429e3790b3 in command_line_enter **/src/nvim/ex_getln.c:750:5
    #6 0x56429e375abc in getcmdline **/src/nvim/ex_getln.c:2544:10
    #7 0x56429e37f108 in getexline **/src/nvim/ex_getln.c:2789:18
    #8 0x56429e2d78bf in do_cmdline **/src/nvim/ex_docmd.c:514:30
    #9 0x56429e97d09b in nv_colon **/src/nvim/normal.c:3213:20
    #10 0x56429e9692d5 in normal_execute **/src/nvim/normal.c:1180:3
    #11 0x56429ef79547 in state_enter **/src/nvim/state.c:99:26
    #12 0x56429e94cdd0 in normal_enter **/src/nvim/normal.c:477:3
    #13 0x56429e6594f0 in main **/src/nvim/main.c:595:3
    #14 0x7f3bf2cb228f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)

SUMMARY: AddressSanitizer: heap-use-after-free **/src/nvim/eval/typval.c:3210:25 in tv_clear
Shadow bytes around the buggy address:
  0x0c067fff9980: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
  0x0c067fff9990: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c067fff99a0: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
  0x0c067fff99b0: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
  0x0c067fff99c0: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
=>0x0c067fff99d0:[fd]fd fd fd fa fa fd fd fd fa fa fa fd fd fd fd
  0x0c067fff99e0: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
  0x0c067fff99f0: fd fd fa fa fd fd fd fd fa fa fd fd fd fa fa fa
  0x0c067fff9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2356==ABORTING