Crash `marktree_del_itr: Assertion 'b->meta_root[m] >= meta_inc[m]' failed.`

[galou]

Problem

The crash (vim: ./src/nvim/marktree.c:673: marktree_del_itr: Assertion 'b->meta_root[m] >= meta_inc[m]' failed.) happened when I deleted some lines from a file. I already had an apport coredump so no new report was generated when Neovim crashed and the version of Neovim changed inbetween.

Steps to reproduce

This happen when deleting some files in a C++ file, don't know how to reproduce.

I have the impression that is related to folding but I'm not sure.

Expected behavior

Shouldn't crash.

Neovim version (nvim -v)

0.10.0-dev

Vim (not Nvim) behaves the same?

Don't know

Operating system/version

Linux Pop!OS 22.04

Terminal name/version

kitty 0.30.0

$TERM environment variable

xterm-kitty

Installation

system package manager (deb Version: 0.10.0~ubuntu1+git202401232106-8b2365369-c60402a16-0c0ea1f52~ubuntu22.04.1)

[galou]

/usr/bin/nvim is blacklisted from apport. Do you know how to fix this? The crash happened twice to me since first reporting.

[yorickpeterse]

I can reliably reproduce this using my custom completion code, though that certainly is more than a basic repro. Basically the way I reproduce it is as follows:

1. git clone https://github.com/yorickpeterse/dotfiles, then run make in the directory. This will set it up as your dotfiles, so you'll want to do this in some sort of container
2. nvim src/main.rs in a test project
3. Type Vec:: and press Tab to trigger completion, then cancel the completion with Esc

I'll see if I can set up a way to more easily reproduce this, and get a stack trace.

[yorickpeterse]

Obtaining a stacktrace proves tricky, as even b abort in GDB doesn't seem to produce a stack trace.

[yorickpeterse]

Possibly related: https://github.com/neovim/neovim/issues/27196

[yorickpeterse]

This seems to specifically relate to using virt_text_pos = 'inline'. My completion plugin uses this to display a preview of the completed text. In addition to just not being displayed at the moment for some reason, this also leads to the crash. If I use eol instead the text does show up, and there's no crash.

[yorickpeterse]

I can reproduce this using the following:

local namespace = vim.api.nvim_create_namespace("")
local buf = vim.api.nvim_win_get_buf(0)
local mark = vim.api.nvim_buf_set_extmark(buf, namespace, 0, 0, {
    virt_text = {},
    virt_text_pos = "inline",
})

vim.api.nvim_buf_set_extmark(buf, namespace, 0, 0, {
    id = mark,
    virt_text = { { "testing", "Comment" } },
    virt_text_pos = "inline",
})

vim.api.nvim_buf_del_extmark(buf, namespace, mark)

Save this in repro.lua, then start nvim --clean and run :so repro.lua, and you'll trigger the crash.

[yorickpeterse]

For context: my completion plugin initially sets the extmark virtual text to nothing, then updates it according to the completion results.

A temporary workaround for this crash seems to be setting the text to something empty, i.e virt_text = { { '', 'Comment' } }.

[yorickpeterse]

git bisect suggests that 9af2be292db3db7b28a6210263f719a6bbc4059f is to blame, and indeed the parent commit doesn't reproduce this problem.

[bfredl]

Thanks for the simple reproduce. Please try https://github.com/neovim/neovim/pull/27481

[yorickpeterse]

@bfredl I can confirm that said pull request resolves this problem.

[bfredl]

marked as fixed based on provided reproduce. There might be other bugs leading to similar failures, please open a new issue which a reproduce in such case.