Repository: neovim
Issue: SIGSEGV in build_stl_str_h
Labels: needs:repro,has:backtrace,bug-crash,statusline

This is an extremely sporadic crash with SIGSEGV with no specific repro at this time. I'm on a system that doesn't do automatic core dumps, so it was a nightmare getting the backtrace.

```gdb
Thread 1 "nvim" received signal SIGSEGV, Segmentation fault.
0x00000000004776b4 in build_stl_str_hl (wp=0x4, out=<optimized out>, outlen=<optimized out>,
    fmt=0x2d33420 "%{lightline#link()}%#LightlineLeft_active_0#%( %{lightline#mode()} %)%{(&paste)?\"|\":\"\"}%( %{&paste?\"PASTE\":\"\"} %)%#LightlineLeft_active_0_1#%#LightlineLeft_active_1#%( %R %)%{(&readonly)&&(1||(&modifi"..., use_sandbox=<optimized out>, fillchar=<optimized out>, maxwidth=215,
    hltab=0x7fffc91e1d88, tabtab=0x7fffc91e1d80) at ../src/nvim/buffer.c:4507
4507            char_u *start = stl_items[stl_separator_locations[i]].start;
(gdb) bt
#0  0x00000000004776b4 in build_stl_str_hl (wp=0x4, out=<optimized out>, outlen=<optimized out>,
    fmt=0x2d33420 "%{lightline#link()}%#LightlineLeft_active_0#%( %{lightline#mode()} %)%{(&paste)?\"|\":\"\"}%( %{&paste?\"PASTE\":\"\"} %)%#LightlineLeft_active_0_1#%#LightlineLeft_active_1#%( %R %)%{(&readonly)&&(1||(&modifi"..., use_sandbox=<optimized out>, fillchar=<optimized out>, maxwidth=215,
    hltab=0x7fffc91e1d88, tabtab=0x7fffc91e1d80) at ../src/nvim/buffer.c:4507
#1  0x00000000005faaa0 in win_redr_custom (wp=<optimized out>, draw_ruler=<optimized out>) at ../src/nvim/screen.c:5270
#2  0x00000000005faf7b in redraw_custom_statusline (wp=<optimized out>) at ../src/nvim/screen.c:5086
#3  showruler (always=<optimized out>) at ../src/nvim/screen.c:7090
#4  0x0000000000498fd2 in ins_redraw (ready=<optimized out>) at ../src/nvim/edit.c:1509
#5  0x000000000048fbbf in insert_check (state=0x7fffc91e2ec8) at ../src/nvim/edit.c:619
#6  0x0000000000639661 in state_enter (s=0x7fffc91e2ec8) at ../src/nvim/state.c:28
#7  0x000000000048e980 in insert_enter (s=0x7fffc91e2ec8) at ../src/nvim/edit.c:484
#8  edit (cmdchar=<optimized out>, startln=<optimized out>, count=<optimized out>) at ../src/nvim/edit.c:1404
#9  0x00000000005890f2 in invoke_edit (cap=0x7fffc91e3080, repl=0, cmd=105, startln=0) at ../src/nvim/normal.c:7694
#10 nv_edit (cap=0x7fffc91e3080) at ../src/nvim/normal.c:7666
#11 0x0000000000586a63 in normal_execute (state=0x7fffc91e2ff8, key=<optimized out>) at ../src/nvim/normal.c:1142
#12 0x0000000000639680 in state_enter (s=0x7fffc91e2ff8) at ../src/nvim/state.c:69
#13 0x0000000000580520 in normal_enter (cmdwin=<optimized out>, noexmode=<optimized out>) at ../src/nvim/normal.c:463
#14 0x000000000054da81 in main (argc=<optimized out>, argv=<optimized out>) at ../src/nvim/main.c:562
```

Crash is clearly triggered by a bug in lightline, but obviously no VimL plugin should be able to crash the editor. 
I haven't changed any status line integration/configuration on my end in years but lightline [has been seeing some updates](https://github.com/itchyny/lightline.vim/commits/master). This was observed on at least both 28a0f6b17 and bfed67e00 if not earlier.

The status line at the time of the crash (before the bad update):
![image](https://user-images.githubusercontent.com/606923/103367727-7a6ff800-4a8b-11eb-8f5c-1071184b3b74.png)

I was in insert mode but may have been switching out of it (can't remember), no PASTE,  no READONLY.

The problem line is line 4507:

https://github.com/neovim/neovim/blob/52163c66b936c21f00832af19fb438b6db6f9766/src/nvim/buffer.c#L4504-L4519

The full `fmt` value:

```
fmt%{lightline#link()}%#LightlineLeft_active_0#%( %{lightline#mode()} %)%{(&paste)?"|":""}%( %{&paste?"PASTE":""} %)%#LightlineLeft_active_0_1#%#LightlineLeft_active_1#%( %R %)%{(&readonly)&&(1||(&modified||!&modifiable))?"|":""}%( %t %)%{(&modified||!&modifiable)?"|":""}%( %M %)%#LightlineLeft_active_1_2#%#LightlineLeft_active_2#%( %{LightlineNeomake()} %)%#LightlineLeft_active_2_3#%#LightlineLeft_active_3#%( %{SpinnerText()} %)%#LightlineLeft_active_3_4#%#LightlineMiddle_active#%=%#LightlineRight_active_3_4#%#LightlineRight_active_3#%#LightlineRight_active_2_3#%#LightlineRight_active_2#%( %{&ff} %)%{1||1?"|":""}%( %{&fenc!=#""?&fenc:&enc} %)%{1?"|":""}%( %{&ft!=#""?&ft:"no ft"} %)%#LightlineRight_active_1_2#%#LightlineRight_active_1#%( %3p%% %)%#LightlineRight_active_0_1#%#LightlineRight_active_0#%( %3l:%-2v %)
```

`num_separators` is 32, but they seem to be both out-of-order and out-of-bounds

```
stl_separator_locations[0] = 27
stl_separator_locations[1] = 0
stl_separator_locations[2] = 1769170037
stl_separator_locations[3] = 1633889839 
...
```

The 3rd entry (`stl_separator_locations[2]`) is unsurprisingly what triggers `SIGSEGV`. I don't know what `itemcnt` is (`stl_items_len` is 67), but it definitely isn't that high.

My guess is that the problem isn't actually here but rather higher up. First thought was truncation resulting in incorrect (negative) start index, but `width` is only 38 while `maxwidth` is 215.

- `nvim --version`:
```
NVIM v0.5.0-dev+980-g28a0f6b17
Build type: RelWithDebInfo
LuaJIT 2.1.0-beta3
Compilation: /usr/local/bin/ccc -march=native -msse4a -mavx2 -mfma -msha -g -O2 -g -Wall -Wextra -pedantic -Wno-unused-parameter -Wstrict-prototypes -std=gnu99 -Wshadow -Wconversion -Wmissing-prototypes -Wimplicit-fallthrough -Wvla -fstack-protector-strong -fno-common -fdiagnostics-color=always -DINCLUDE_GENERATED_DECLARATIONS -D_GNU_SOURCE -DNVIM_MSGPACK_HAS_FLOAT32 -DNVIM_UNIBI_HAS_VAR_FROM -DMIN_LOG_LEVEL=3 -I/mnt/d/rand/neovim/build/config -I/mnt/d/rand/neovim/src -I/mnt/d/rand/neovim/.deps/usr/include -I/usr/include -I/mnt/d/rand/neovim/build/src/nvim/auto -I/mnt/d/rand/neovim/build/include
Compiled by mqudsi@Blitzkrieg

Features: +acl +iconv +tui
See ":help feature-compile"

   system vimrc file: "$VIM/sysinit.vim"
  fall-back for $VIM: "/usr/local/share/nvim"

Run :checkhealth for more info
```
- `vim -u DEFAULTS` (version: ) behaves differently? n/a
- Operating system/version: WSLv1 but n/a
- Terminal name/version: conhost
- `$TERM`: xterm-256color

### Steps to reproduce using `nvim -u NORC`

unknown