Repository: neovim
Issue: heap-use-after-free in garbage collection with EXITFREE
Labels: vimscript,needs:repro,has:backtrace,bug-crash

### Describe the bug

heap-use-after-free in garbage collection with EXITFREE
```
=================================================================
==653241==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000a9c9ac at pc 0x55953f8e3a78 bp 0x7ffe13ce0550 sp 0x7ffe13ce0548
READ of size 4 at 0x61d000a9c9ac thread T0
    #0 0x55953f8e3a77 in tv_list_len **/src/nvim/eval/typval.h:181:13
    #1 0x55953f91baff in _typval_encode_nothing_convert_one_value **/src/nvim/eval/typval_encode.c.h:365:36
    #2 0x55953f907b1e in encode_vim_to_nothing **/src/nvim/eval/typval_encode.c.h:661:7
    #3 0x55953f8dc3cd in tv_clear **/src/nvim/eval/typval.c:3217:25
    #4 0x55953f975ea1 in vars_clear_ext **/src/nvim/eval/vars.c:1152:9
    #5 0x55953f975a99 in vars_clear **/src/nvim/eval/vars.c:1131:3
    #6 0x55953f962fe3 in free_funccal_contents **/src/nvim/eval/userfunc.c:648:3
    #7 0x55953f9629ed in free_unref_funccal **/src/nvim/eval/userfunc.c:3395:7
    #8 0x55953f714d67 in garbage_collect **/src/nvim/eval.c:4278:16
    #9 0x55953f71083c in eval_clear **/src/nvim/eval.c:514:9
    #10 0x55953ff4882f in free_all_mem **/src/nvim/memory.c:803:3
    #11 0x55953f1fbc2e in os_exit **/src/nvim/main.c:659:3
    #12 0x55953f1fa0d6 in getout **/src/nvim/main.c:784:3
    #13 0x55953fa7de60 in ex_quit **/src/nvim/ex_docmd.c:4541:7
    #14 0x55953fa4b22f in execute_cmd0 **/src/nvim/ex_docmd.c:1621:7
    #15 0x55953fa2758a in do_one_cmd **/src/nvim/ex_docmd.c:2280:7
    #16 0x55953fa17e6e in do_cmdline **/src/nvim/ex_docmd.c:579:20
    #17 0x55953fa1cf80 in do_cmdline_cmd **/src/nvim/ex_docmd.c:282:10
    #18 0x55954008d4cb in nv_Zet **/src/nvim/normal.c:3313:7
    #19 0x55954006d495 in normal_execute **/src/nvim/normal.c:1181:3
    #20 0x55954067f5a7 in state_enter **/src/nvim/state.c:99:26
    #21 0x559540050d70 in normal_enter **/src/nvim/normal.c:478:3
    #22 0x55953f1e79ab in main **/src/nvim/main.c:628:3
    #23 0x7ff2317fd28f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #24 0x7ff2317fd349 in __libc_start_main (/usr/lib/libc.so.6+0x23349) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)
    #25 0x55953f0ead64 in _start /build/glibc/src/glibc/csu/../sysdeps/x86_64/start.S:115

0x61d000a9c9ac is located 1324 bytes inside of 2056-byte region [0x61d000a9c480,0x61d000a9cc88)
freed by thread T0 here:
    #0 0x55953f19ec22 in __interceptor_free.part.0 asan_malloc_linux.cpp.o
    #1 0x55953ff449b4 in xfree **/src/nvim/memory.c:137:3
    #2 0x55953f967c1e in free_funccal **/src/nvim/eval/userfunc.c:636:3
    #3 0x55953f9631ae in free_funccal_contents **/src/nvim/eval/userfunc.c:655:3
    #4 0x55953f9629ed in free_unref_funccal **/src/nvim/eval/userfunc.c:3395:7
    #5 0x55953f714d67 in garbage_collect **/src/nvim/eval.c:4278:16
    #6 0x55953f71083c in eval_clear **/src/nvim/eval.c:514:9
    #7 0x55953ff4882f in free_all_mem **/src/nvim/memory.c:803:3
    #8 0x55953f1fbc2e in os_exit **/src/nvim/main.c:659:3
    #9 0x55953f1fa0d6 in getout **/src/nvim/main.c:784:3
    #10 0x55953fa7de60 in ex_quit **/src/nvim/ex_docmd.c:4541:7
    #11 0x55953fa4b22f in execute_cmd0 **/src/nvim/ex_docmd.c:1621:7
    #12 0x55953fa2758a in do_one_cmd **/src/nvim/ex_docmd.c:2280:7
    #13 0x55953fa17e6e in do_cmdline **/src/nvim/ex_docmd.c:579:20
    #14 0x55953fa1cf80 in do_cmdline_cmd **/src/nvim/ex_docmd.c:282:10
    #15 0x55954008d4cb in nv_Zet **/src/nvim/normal.c:3313:7
    #16 0x55954006d495 in normal_execute **/src/nvim/normal.c:1181:3
    #17 0x55954067f5a7 in state_enter **/src/nvim/state.c:99:26
    #18 0x559540050d70 in normal_enter **/src/nvim/normal.c:478:3
    #19 0x55953f1e79ab in main **/src/nvim/main.c:628:3
    #20 0x7ff2317fd28f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 1e94beb079e278ac4f2c8bce1f53091548ea1584)

previously allocated by thread T0 here:
    #0 0x55953f19ff91 in __interceptor_calloc (**/build/bin/nvim+0xcf1f91) (BuildId: ea0be20ab6084f8dc184fbe5a453f898d4ca58de)
    #1 0x55953ff44a56 in xcalloc **/src/nvim/memory.c:151:15
    #2 0x55953f92d0e7 in call_user_func **/src/nvim/eval/userfunc.c:876:8
    #3 0x55953f93de02 in call_user_func_check **/src/nvim/eval/userfunc.c:1254:5
    #4 0x55953f92bdd1 in call_func **/src/nvim/eval/userfunc.c:1612:17
    #5 0x55953f93b879 in func_call **/src/nvim/eval/userfunc.c:1406:7
    #6 0x55953f83ae18 in f_call **/src/nvim/eval/funcs.c:582:3
    #7 0x55953f82412a in call_internal_func **/src/nvim/eval/funcs.c:242:3
    #8 0x55953f92c21d in call_func **/src/nvim/eval/userfunc.c:1621:15
    #9 0x55953f929345 in get_func_tv **/src/nvim/eval/userfunc.c:494:11
    #10 0x55953f79b943 in eval_func **/src/nvim/eval.c:2229:13
    #11 0x55953f7924dc in eval7 **/src/nvim/eval.c:3103:15
    #12 0x55953f78dc0b in eval6 **/src/nvim/eval.c:2768:7
    #13 0x55953f78b322 in eval5 **/src/nvim/eval.c:2603:7
    #14 0x55953f789d60 in eval4 **/src/nvim/eval.c:2505:7
    #15 0x55953f789282 in eval3 **/src/nvim/eval.c:2436:7
    #16 0x55953f739782 in eval2 **/src/nvim/eval.c:2379:7
    #17 0x55953f7296b4 in eval1 **/src/nvim/eval.c:2317:7
    #18 0x55953f928ce3 in get_func_tv **/src/nvim/eval/userfunc.c:465:9
    #19 0x55953f79b943 in eval_func **/src/nvim/eval.c:2229:13
    #20 0x55953f7924dc in eval7 **/src/nvim/eval.c:3103:15
    #21 0x55953f78dc0b in eval6 **/src/nvim/eval.c:2768:7
    #22 0x55953f78b322 in eval5 **/src/nvim/eval.c:2603:7
    #23 0x55953f789d60 in eval4 **/src/nvim/eval.c:2505:7
    #24 0x55953f789282 in eval3 **/src/nvim/eval.c:2436:7
    #25 0x55953f739782 in eval2 **/src/nvim/eval.c:2379:7
    #26 0x55953f7296b4 in eval1 **/src/nvim/eval.c:2317:7
    #27 0x55953f72722d in eval0 **/src/nvim/eval.c:2272:9
    #28 0x55953f95c248 in ex_return **/src/nvim/eval/userfunc.c:2968:10
    #29 0x55953fa4b22f in execute_cmd0 **/src/nvim/ex_docmd.c:1621:7

SUMMARY: AddressSanitizer: heap-use-after-free **/src/nvim/eval/typval.h:181:13 in tv_list_len
Shadow bytes around the buggy address:
  0x0c3a8014b8e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3a8014b8f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3a8014b900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3a8014b910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3a8014b920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3a8014b930: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x0c3a8014b940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3a8014b950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3a8014b960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3a8014b970: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3a8014b980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==653241==ABORTING

```

### Steps to reproduce

Not available

### Expected behavior

No heap-use-after-free

### Neovim version (nvim -v)

v0.9.0-dev-655+g08d5b4275

### Vim (not Nvim) behaves the same?

Unable to verify

### Operating system/version

Arch Linux

### Terminal name/version

kitty 0.26.5

### $TERM environment variable

xterm-kitty

### Installation

build from repo