Patch 721: Segfault while resizing gvim in 1 out of 10 cases if set list is on and lcs_eof is empty

[GoogleCodeExporter]

What steps will reproduce the problem?
1. Compile vim 7.4 Patchlevel 721 
2. gvim -u NONE -U NONE -c 'set list lcs=' file_with_text.txt
3. Resize gvim-Window

[I'm pretty sure this problem was introduced in Patch 721. I cannot reproduce 
the problem in Vim 7.4 Patchlevel 720.]

In about 10% of the cases(=resizements) I get an segfault (see below).


What is the expected output? What do you see instead?
Excpected: No Segfault; show Text-File in resized window.


What version of the product are you using? On what operating system?
Vim 7.4 Patches 1-207,209-721 on Fedora 21.

Please provide any additional information below.
Here is the error message/backtrace:
*** Error in `gvim': free(): invalid next size (normal): 0x0000000000e05920 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3980277d9e]
/lib64/libc.so.6(cfree+0x5b5)[0x39802839f5]
/lib64/libcairo.so.2(+0x16251)[0x7f6e7c1f4251]
/lib64/libcairo.so.2(+0x2b859)[0x7f6e7c209859]
gvim[0x5c2238]
gvim(gui_gtk2_draw_string+0x85e)[0x5c5e0e]
gvim(gui_outstr_nowrap+0x15b)[0x5b7fbb]
gvim(gui_write+0x1b1)[0x5bb821]
gvim(ui_write+0xc8)[0x5a4048]
gvim(out_str_nf+0x55)[0x59e295]
gvim(windgoto+0xae)[0x555d4e]
gvim[0x55629f]
gvim[0x558d9e]
gvim[0x55d51a]
gvim[0x562235]
gvim(update_screen+0x346)[0x564766]
gvim(set_shellsize+0x1f3)[0x59ecf3]
gvim(gui_resize_shell+0x65)[0x5ba585]
gvim[0x5c218f]

Here my compile vim version
VIM - Vi IMproved 7.4 (2013 Aug 10, compiled May  6 2015 15:32:21)
Included patches: 1-207, 209-721
Modified by <bugzilla@redhat.com>
Compiled by <bugzilla@redhat.com>
Huge version with GTK2 GUI.  Features included (+) or not (-):
+acl             -ebcdic          +localmap        +printer         +title
+arabic          +emacs_tags      -lua             +profile         +toolbar
+autocmd         +eval            +menu            +python/dyn      
+user_commands
+balloon_eval    +ex_extra        +mksession       -python3         +vertsplit
+browse          +extra_search    +modify_fname    +quickfix        +virtualedit
++builtin_terms  +farsi           +mouse           +reltime         +visual
+byte_offset     +file_in_path    +mouseshape      +rightleft       +visualextra
+cindent         +find_in_path    +mouse_dec       +ruby/dyn        +viminfo
+clientserver    +float           +mouse_gpm       +scrollbind      +vreplace
+clipboard       +folding         -mouse_jsbterm   +signs           +wildignore
+cmdline_compl   -footer          +mouse_netterm   +smartindent     +wildmenu
+cmdline_hist    +fork()          +mouse_sgr       -sniff           +windows
+cmdline_info    +gettext         -mouse_sysmouse  +startuptime     +writebackup
+comments        -hangul_input    +mouse_urxvt     +statusline      +X11
+conceal         +iconv           +mouse_xterm     -sun_workshop    -xfontset
+cryptv          +insert_expand   +multi_byte      +syntax          +xim
+cscope          +jumplist        +multi_lang      +tag_binary      
+xsmp_interact
+cursorbind      +keymap          -mzscheme        +tag_old_static  
+xterm_clipboard
+cursorshape     +langmap         +netbeans_intg   -tag_any_white   -xterm_save
+dialog_con_gui  +libcall         +path_extra      -tcl             +xpm
+diff            +linebreak       +perl            +terminfo        
+digraphs        +lispindent      +persistent_undo +termresponse    
+dnd             +listcmds        +postscript      +textobjects     

Original issue reported on code.google.com by Ludwi...@gmx.de on 6 May 2015 at 4:06