Repository: neovim
Issue: SIGSEGV in ts_node_end_point()
Labels: has:backtrace,bug-crash,treesitter

### Problem

Occasionally, when I am using `nvim-treesitter`'s incremental selection, neovim crashes. I see it occurring while editing Rust and Python files.

At first I was pretty sure it was https://github.com/neovim/neovim/issues/24783 and https://github.com/neovim/neovim/issues/23613, which was finally fixed by https://github.com/neovim/neovim/pull/24796 and back ported to nvim v0.9.2. But even after updating I am still seeing similar crashes.

In the archive below are two coredumps of the crash, and following it the output of `bt` in gdb for the last coredump.

[coredumps.tar.gz](https://github.com/neovim/neovim/files/12667664/coredumps.tar.gz)

<details>
  <summary>Backtrace</summary>

```gdb
           PID: 4597 (nvim)
           UID: 1000 (rodrigodd)
           GID: 1000 (rodrigodd)
        Signal: 11 (SEGV)
     Timestamp: Tue 2023-09-19 21:39:53 -03 (39min ago)
  Command Line: nvim --embed render/src/lib.rs
    Executable: /usr/bin/nvim
 Control Group: /user.slice/user-1000.slice/session-3.scope
          Unit: session-3.scope
         Slice: user-1000.slice
       Session: 3
     Owner UID: 1000 (rodrigodd)
       Boot ID: 41590c1a451849c9b790cc567bbcc5f5
    Machine ID: e031b41f9df244e2b74641456973fcab
      Hostname: nb-rodrigo
       Storage: /var/lib/systemd/coredump/core.nvim.1000.41590c1a451849c9b790cc567bbcc5f5.4597.1695170393000000.zst (present)
  Size on Disk: 9.8M
       Message: Process 4597 (nvim) of user 1000 dumped core.

                Stack trace of thread 4597:
                #0  0x00007f4067ec5f74 ts_node_end_point (libtree-sitter.so.0 + 0x7f74)
                #1  0x0000556dc036fbee n/a (nvim + 0x1e9bee)
                #2  0x00007f4067e1fef6 n/a (libluajit-5.1.so.2 + 0x9ef6)
                #3  0x00007f4067e32ab3 lua_pcall (libluajit-5.1.so.2 + 0x1cab3)
                #4  0x0000556dc03639b1 n/a (nvim + 0x1dd9b1)
                #5  0x0000556dc0373163 n/a (nvim + 0x1ed163)
                #6  0x0000556dc0374638 ex_lua (nvim + 0x1ee638)
                #7  0x0000556dc0515881 n/a (nvim + 0x38f881)
                #8  0x0000556dc0309559 do_cmdline (nvim + 0x183559)
                #9  0x0000556dc03ca777 n/a (nvim + 0x244777)
                #10 0x0000556dc03c4436 n/a (nvim + 0x23e436)
                #11 0x0000556dc04931c7 state_enter (nvim + 0x30d1c7)
                #12 0x0000556dc03c3309 normal_enter (nvim + 0x23d309)
                #13 0x0000556dc01fb777 main (nvim + 0x75777)
                #14 0x00007f4067a27cd0 n/a (libc.so.6 + 0x27cd0)
                #15 0x00007f4067a27d8a __libc_start_main (libc.so.6 + 0x27d8a)
                #16 0x0000556dc01fdb85 _start (nvim + 0x77b85)

                Stack trace of thread 13134:
                #0  0x0000000000000000 n/a (n/a + 0x0)
                ELF object binary architecture: AMD x86-64

GNU gdb (GDB) 13.2
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/nvim...
Reading symbols from /home/rodrigodd/.cache/debuginfod_client/c581c5fbec614fe78eb1c89dc0bf1cb2eebcc357/debuginfo...

warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing

warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing

warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing

warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing

warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing

warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing

warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing

warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing
[New LWP 4597]
[New LWP 13134]
[New LWP 4599]
[New LWP 4616]
[New LWP 19958]
[New LWP 18796]
[New LWP 4600]
                                                                                                                                                                          --Type <RET> for more, q to quit, c to continue without paging--
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `nvim --embed render/src/lib.rs'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f4067ec5f74 in ts_node_end_point () from /usr/lib/libtree-sitter.so.0
[Current thread is 1 (Thread 0x7f4067ccb740 (LWP 4597))]
(gdb) bt
#0  0x00007f4067ec5f74 in ts_node_end_point () from /usr/lib/libtree-sitter.so.0
#1  0x0000556dc036fbee in node_range (L=0x7f4067cab380) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/lua/treesitter.c:821
#2  0x00007f4067e1fef6 in lj_BC_FUNCC () at buildvm_x86.dasc:857
#3  0x00007f4067e32ab3 in lua_pcall (L=L@entry=0x7f4067cab380, nargs=nargs@entry=0, nresults=nresults@entry=0, errfunc=errfunc@entry=-2)
    at /usr/src/debug/luajit/luajit-2.0-4611e25/src/lj_api.c:1116
#4  0x0000556dc03639b1 in nlua_pcall (lstate=0x7f4067cab380, nargs=0, nresults=0) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/lua/executor.c:159
#5  0x0000556dc0373163 in nlua_typval_exec (lcmd=<optimized out>, lcmd_len=<optimized out>, name=<optimized out>, args=<optimized out>, argcount=0, special=false,
    ret_tv=0x0) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/lua/executor.c:1443
#6  0x0000556dc0374638 in nlua_typval_exec (ret_tv=0x0, special=false, argcount=0, args=0x0, name=0x556dc052730d ":lua", lcmd_len=<optimized out>,
    lcmd=0x556dc283d260 "require'nvim-treesitter.incremental_selection'.node_incremental()") at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/memory.c:134
#7  ex_lua (eap=<optimized out>) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/lua/executor.c:1639
#8  0x0000556dc0515881 in execute_cmd0.constprop.0 (retv=0x7fffeda90c68, eap=0x7fffeda90cf0, errormsg=0x7fffeda90c60, preview=false)
    at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/ex_docmd.c:1620
#9  0x0000556dc0309559 in do_one_cmd (cookie=0x0, fgetline=0x556dc031c830 <getexline>, cstack=0x7fffeda90eb0, flags=<optimized out>, cmdlinep=0x7fffeda90c58)
    at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/ex_docmd.c:2279
#10 do_cmdline (cmdline=<optimized out>, fgetline=0x556dc031c830 <getexline>, cookie=0x0, flags=0) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/ex_docmd.c:578
#11 0x0000556dc03ca777 in nv_colon (cap=0x7fffeda915d0) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/normal.c:3247
#12 0x0000556dc03c4436 in normal_execute (state=0x7fffeda91550, key=<optimized out>) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/normal.c:1207
#13 0x0000556dc04931c7 in state_enter (s=0x7fffeda91550) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/state.c:99
#14 0x0000556dc03c3309 in normal_enter (cmdwin=<optimized out>, noexmode=<optimized out>) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/normal.c:497
#15 0x0000556dc01fb777 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/neovim/neovim-0.9.2/src/nvim/main.c:642
```

</details>

### Steps to reproduce

I tried both reproduction steps in https://github.com/neovim/neovim/issues/24783 and https://github.com/neovim/neovim/issues/23613, but they either did not triggered the crash or didn't work in v0.9.2 (missing treesitter parser, even though `:help treesitter-parsers` says neovim bundles them by default?).

I could not create a reproduction, at least not yet.

### Expected behavior

not crash

### Neovim version (nvim -v)

NVIM v0.9.2 Build type: Release LuaJIT 2.1.1694285958     system vimrc file: "$VIM/sysinit.vim"   fall-back for $VIM: "/usr/share/nvim"  Run :checkhealth for more info

### Vim (not Nvim) behaves the same?

N/A

### Operating system/version

Arch Linux, kernel 6.5.3-zen1-1-zen

### Terminal name/version

alacritty 0.12.2 (9d9982df)

### $TERM environment variable

xterm-256color

### Installation

pacman -S neovim