Repository: neovim
Issue: address sanitizer report heap use after free
Labels: needs:repro,has:backtrace,bug-crash,syntax

<!-- Before reporting: search existing issues and check the FAQ. -->

nvim -version
```
NVIM v0.4.0-731-g400ee5924
Build type: Debug
LuaJIT 2.0.5
Compilation: /usr/bin/cc -fsanitize=address -g -Wall -Wextra -pedantic -Wno-unused-parameter -Wstrict-prototypes -std=gnu99 -Wshadow -Wconversion -Wmissing-prototypes -Wimplicit-fallthrough -Wvla -fstack-protector-strong -fdiagnostics-color=auto -Wno-array-bounds -DINCLUDE_GENERATED_DECLARATIONS -D_GNU_SOURCE -DNVIM_MSGPACK_HAS_FLOAT32 -DNVIM_UNIBI_HAS_VAR_FROM -I/tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/build/config -I/tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src -I/usr/include -I/tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/build/src/nvim/auto -I/tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/build/include
Compiled by wangxinyu@archlinux

Features: +acl +iconv +tui 
See ":help feature-compile"

   system vimrc file: "$VIM/sysinit.vim"
  fall-back for $VIM: "/usr/share/nvim"
```

- Vim (version: ) behaves differently?
   not confirmed
- Operating system/version:
  archlinux 64
- Terminal name/version:
  run from nvim-qt

### Steps to reproduce using `nvim -u NORC`

not tried


```
=================================================================
==5794==ERROR: AddressSanitizer: heap-use-after-free on address 0x62f000a10408 at pc 0x562841629ce8 bp 0x7ffc4af3fc60 sp 0x7ffc4af3fc50
READ of size 8 at 0x62f000a10408 thread T0
    #0 0x562841629ce7 in syn_stack_find_entry /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/syntax.c:1227
    #1 0x56284162b787 in syntax_end_parsing /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/syntax.c:1459
    #2 0x56284154d553 in win_update /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/screen.c:1429
    #3 0x56284154651a in update_screen /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/screen.c:473
    #4 0x56284141c2f5 in normal_redraw /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/normal.c:1244
    #5 0x56284141ca43 in normal_check /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/normal.c:1321
    #6 0x56284161d380 in state_enter /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/state.c:28
    #7 0x562841414915 in normal_enter /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/normal.c:462
    #8 0x562841368c6c in main /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/main.c:597
    #9 0x7f2799db0222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)
    #10 0x56284102475d in _start (/usr/bin/nvim+0x15575d)

0x62f000a10408 is located 8 bytes inside of 49248-byte region [0x62f000a10400,0x62f000a1c460)
freed by thread T0 here:
    #0 0x7f279a4c7c19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:66
    #1 0x5628413ba5f5 in xfree /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/memory.c:115
    #2 0x5628416283b1 in syn_stack_free_block /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/syntax.c:997
    #3 0x562841628445 in syn_stack_free_all /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/syntax.c:1008
    #4 0x562841636290 in syntax_clear /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/syntax.c:3195
    #5 0x5628410b9290 in buf_freeall /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/buffer.c:744
    #6 0x5628410b8161 in close_buffer /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/buffer.c:559
    #7 0x5628412162ac in do_ecmd /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/ex_cmds.c:2370
    #8 0x562841276b4e in do_exedit /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/ex_docmd.c:7036
    #9 0x562841275f41 in ex_edit /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/ex_docmd.c:6964
    #10 0x56284125875b in do_one_cmd /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/ex_docmd.c:2242
    #11 0x56284124cd43 in do_cmdline /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/ex_docmd.c:593
    #12 0x56284124b43b in do_cmdline_cmd /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/src/nvim/ex_docmd.c:269
    #13 0x562841287779 in ex_terminal /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovi
    #14 0x56284125875b in do_one_cmd /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim
    #15 0x56284124cd43 in do_cmdline /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim
    #16 0x5628414357ff in nv_colon /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-g
    #17 0x56284141b5cc in normal_execute /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/ne
    #18 0x56284161d4c4 in state_enter /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovi
    #19 0x562841414915 in normal_enter /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neov
    #20 0x562841368c6c in main /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/s
    #21 0x7f2799db0222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)

previously allocated by thread T0 here:
    #0 0x7f279a4c8231 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_
    #1 0x5628413ba655 in xcalloc /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git
    #2 0x562841628944 in syn_stack_alloc /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/ne
    #3 0x562841625cd8 in syntax_start /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovi
    #4 0x562841552ec8 in win_line /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-gi
    #5 0x56284154cdaf in win_update /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-
    #6 0x56284154651a in update_screen /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neov
    #7 0x56284166db65 in redraw /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/
    #8 0x56284166c7b8 in refresh_timer_cb /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/n
    #9 0x5628412085ac in time_event /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-
    #10 0x5628411fd1e1 in multiqueue_process_events /tmp/yaourt-tmp-wangxinyu/aur-neovim
    #11 0x5628414512e2 in nv_event /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-g
    #12 0x56284141b5cc in normal_execute /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/ne
    #13 0x56284161d4c4 in state_enter /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovi
    #14 0x562841414915 in normal_enter /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neov
    #15 0x562841368c6c in main /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/src/neovim-git/s
    #16 0x7f2799db0222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)

SUMMARY: AddressSanitizer: heap-use-after-free /tmp/yaourt-tmp-wangxinyu/aur-neovim-git/
Shadow bytes around the buggy address:
  0x0c5e8013a030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e8013a040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e8013a050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e8013a060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e8013a070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c5e8013a080: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5e8013a090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5e8013a0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5e8013a0b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5e8013a0c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5e8013a0d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==5794==ABORTING
```


[asan.error.5794.txt](https://github.com/neovim/neovim/files/3160195/asan.error.5794.txt)