Repository: neovim
Issue: crash with .norg files: __assert_fail "attrs[i] >= 0"
Labels: needs:repro,has:backtrace,bug-crash

### Problem



![image](https://github.com/neovim/neovim/assets/69250723/267456b5-83d7-4a67-8ced-6ce3fc97a204)


```
⋊> ~ coredumpctl -1 gdb | tee -a bt.txt                                                                                                                                                   13:48:09
     thread apply all bt full
           PID: 6402 (nvim)
           UID: 1000 (kawre)
           GID: 1000 (kawre)
        Signal: 6 (ABRT)
     Timestamp: Fri 2024-02-02 13:45:29 CET (2min 51s ago)
  Command Line: nvim --embed /home/kawre/pjatk/sbd
    Executable: /usr/bin/nvim
 Control Group: /user.slice/user-1000.slice/session-2.scope
          Unit: session-2.scope
         Slice: user-1000.slice
       Session: 2
     Owner UID: 1000 (kawre)
       Boot ID: 3977c26c74fb428c9b1435742b7321de
    Machine ID: d96db0ae371346fe8f197a804b82560e
      Hostname: desktop
       Storage: /var/lib/systemd/coredump/core.nvim.1000.3977c26c74fb428c9b1435742b7321de.6402.1706877929000000.zst (present)
  Size on Disk: 11.7M
       Message: Process 6402 (nvim) of user 1000 dumped core.
                
                Stack trace of thread 6402:
                #0  0x000076f273ace83c n/a (libc.so.6 + 0x8a83c)
                #1  0x000076f273a7e668 raise (libc.so.6 + 0x3a668)
                #2  0x000076f273a664b8 abort (libc.so.6 + 0x224b8)
                #3  0x000076f273a663dc n/a (libc.so.6 + 0x223dc)
                #4  0x000076f273a76d26 __assert_fail (libc.so.6 + 0x32d26)
                #5  0x0000650d20f19c9e ui_comp_raw_line (nvim + 0x2f0c9e)
                #6  0x0000650d20f14df2 ui_call_raw_line (nvim + 0x2ebdf2)
                #7  0x0000650d20f153eb ui_line (nvim + 0x2ec3eb)
                #8  0x0000650d20dd7696 grid_put_linebuf (nvim + 0x1ae696)
                #9  0x0000650d20d3dcae n/a (nvim + 0x114cae)
                #10 0x0000650d20d432ba win_line (nvim + 0x11a2ba)
                #11 0x0000650d20d481a3 n/a (nvim + 0x11f1a3)
                #12 0x0000650d20d4517b update_screen (nvim + 0x11c17b)
                #13 0x0000650d20e41d30 n/a (nvim + 0x218d30)
                #14 0x0000650d20e41f90 n/a (nvim + 0x218f90)
                #15 0x0000650d20ee6ed9 state_enter (nvim + 0x2bded9)
                #16 0x0000650d20e41519 normal_enter (nvim + 0x218519)
                #17 0x0000650d20e0441d main (nvim + 0x1db41d)
                #18 0x000076f273a67cd0 n/a (libc.so.6 + 0x23cd0)
                #19 0x000076f273a67d8a __libc_start_main (libc.so.6 + 0x23d8a)
                #20 0x0000650d20cc18de _start (nvim + 0x988de)
                
                Stack trace of thread 6404:
                #0  0x0000000000000000 n/a (n/a + 0x0)
                ELF object binary architecture: AMD x86-64

GNU gdb (GDB) 14.1
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/nvim...

This GDB supports auto-downloading debuginfo from the following URLs:
  <https://debuginfod.archlinux.org>
Enable debuginfod for this session? (y or [n]) y
Debuginfod has been enabled.
To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit.
Downloading separate debug info for /usr/bin/nvim...
(No debugging symbols found in /usr/bin/nvim)

warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing
[New LWP 6402]
[New LWP 6404]
[New LWP 6405]
[New LWP 6407]
[New LWP 6406]
[New LWP 6408]
Downloading separate debug info for /usr/lib/libm.so.6...
Downloading separate debug info for /usr/lib/libdl.so.2...
Downloading separate debug info for /usr/lib/libpthread.so.0...
Downloading separate debug info for /usr/lib/libc.so.6...
Downloading separate debug info for /lib64/ld-linux-x86-64.so.2...
Downloading separate debug info for /usr/lib/libutil.so.1...
Downloading separate debug info for /usr/lib/libnss_systemd.so.2...
Downloading separate debug info for /usr/lib/libcap.so.2...
Downloading separate debug info for /home/kawre/.local/share/nvim/lazy/LuaSnip/deps/luasnip-jsregexp.so...
Downloading separate debug info for /home/kawre/.local/share/nvim/lazy/nvim-treesitter/parser/norg.so...
Downloading separate debug info for /home/kawre/.local/share/nvim/lazy/nvim-treesitter/parser/vim.so...
Downloading separate debug info for /home/kawre/.local/share/nvim/lazy/nvim-treesitter/parser/regex.so...
Downloading separate debug info for system-supplied DSO at 0x7ffd61b66000...
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `nvim --embed /home/kawre/pjatk/sbd'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
Downloading source file /usr/src/debug/glibc/glibc/nptl/pthread_kill.c...
44	     return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
[Current thread is 1 (Thread 0x76f273a3a740 (LWP 6402))]
(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x000076f273ace8a3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
#2  0x000076f273a7e668 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x000076f273a664b8 in __GI_abort () at abort.c:79
#4  0x000076f273a663dc in __assert_fail_base (fmt=0x76f273bdfae8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x650d2109755e "attrs[i] >= 0", 
    file=file@entry=0x650d21096a00 "/home/runner/work/neovim/neovim/src/nvim/ui_compositor.c", line=line@entry=546, function=function@entry=0x650d2109aa10 "ui_comp_raw_line") at assert.c:92
#5  0x000076f273a76d26 in __assert_fail (assertion=0x650d2109755e "attrs[i] >= 0", file=0x650d21096a00 "/home/runner/work/neovim/neovim/src/nvim/ui_compositor.c", line=546, 
    function=0x650d2109aa10 "ui_comp_raw_line") at assert.c:101
#6  0x0000650d20f19c9e in ui_comp_raw_line ()
#7  0x0000650d20f14df2 in ui_call_raw_line ()
#8  0x0000650d20f153eb in ui_line ()
#9  0x0000650d20dd7696 in grid_put_linebuf ()
#10 0x0000650d20d3dcae in ?? ()
#11 0x0000650d20d432ba in win_line ()
#12 0x0000650d20d481a3 in ?? ()
#13 0x0000650d20d4517b in update_screen ()
#14 0x0000650d20e41d30 in ?? ()
#15 0x0000650d20e41f90 in ?? ()
#16 0x0000650d20ee6ed9 in state_enter ()
#17 0x0000650d20e41519 in normal_enter ()
#18 0x0000650d20e0441d in main ()
```

```
⋊> ~ stty -a                                                                                                                                                                              13:58:54
speed 38400 baud; rows 51; columns 194; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O;
min = 1; time = 0;
-parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl -ixon -ixoff -iuclc -ixany -imaxbel iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt echoctl echoke -flusho -extproc
```

### Steps to reproduce

I've created both `W1.norg` and `W2.norg` files with neotree, as seen in the screenshot, then when my cursors was at one of these files(don't remember which) i tried to move back to `index.norg` with `<C-w>l`, my neovim crashed.

I tried a few times to reproduce this but coudn't. All i can provide is the backtrace

### Expected behavior

.

### Neovim version (nvim -v)

NVIM v0.10.0-dev-2216+g2cd76a758

### Vim (not Nvim) behaves the same?

.

### Operating system/version

6.7.2-arch1-2

### Terminal name/version

kitty 0.31.0

### $TERM environment variable

xterm-kitty

### Installation

https://aur.archlinux.org/packages/neovim-nightly-bin