Segfault inside wadd_wch_literal() in ncurses v2017-11-11

[Genki Sky]

Like the subject says, getting a segfault in wadd_wch_literal(). Still
happens in v20171111. A little hard to reproduce, but the quickest way
I've found is:

  0. Open ranger [0] in st [1] in X11
  1. Repeatedly and rapidly increase and decrease the size of the st window
  2. ncurses segfaults: ranger closes and the terminal needs a reset.

  [0]: http://ranger.nongnu.org/
  [1]: https://st.suckless.org/

According to $(coredumpctl list /usr/bin/python3.6), I've experienced
this issue 21 times since 2017-10-10, and never before. According to
my package manager log:

  [2017-05-13 12:49] [ALPM] reinstalled ranger (1.8.1-1)
  [2017-07-24 20:53] [ALPM] upgraded python (3.6.1-1 -> 3.6.2-1)
  [2017-09-10 03:02] [ALPM] upgraded ncurses (6.0+20170527-1 -> 6.0+20170902-1)
  [2017-10-27 18:15] [ALPM] upgraded ncurses (6.0+20170902-1 -> 6.0+20170902-2)

So I'm not sure why it started only on 2017-10-10, but by chance.

A short gdb session with one of the coredumps is as follows:

  Core was generated by `/usr/bin/python -O /usr/bin/ranger 
--choosedir=/tmp/tmp.lbPtBf9f8g'.
  Program terminated with signal SIGSEGV, Segmentation fault.
  (gdb) bt
    #0  0x00007f5194b72d19 in wadd_wch_literal (address@hidden, ch=...) at 
../ncurses/./widechar/lib_add_wch.c:281
    #1  0x00007f5194b73058 in wadd_wch_nosync (ch=..., win=0x558e6617ed10) at 
../ncurses/./widechar/lib_add_wch.c:316
    #2  wadd_wch (address@hidden, address@hidden) at 
../ncurses/./widechar/lib_add_wch.c:416
    #3  0x00007f5194b4f9c5 in waddnwstr (win=0x558e6617ed10, str=0x7f51925b1bb0 
L"", n=<optimized out>) at ../ncurses/./base/lib_addstr.c:241
    #4  0x00007f5194d903c0 in ?? () from 
/usr/lib/python3.6/lib-dynload/_curses.cpython-36m-x86_64-linux-gnu.so
    [ snipped: more python backtrace ]
  (gdb) list ../ncurses/./widechar/lib_add_wch.c:281
    276     }
    277
    278     /*
    279      * Single-column characters.
    280      */
    281     line->text[x++] = ch;
    282     /*
    283      * This label is used only for wide-characters.
    284      */
    285   testwrapping:
  (gdb) p line
    $1 = (struct ldat *) 0x558e661fe2c0
  (gdb) p x
    $2 = 1
  (gdb) p ch
    $3 = {
      attr = 768,
      chars = L"7\000\000\000",
      ext_color = 3
    }
  (gdb) p line->text
    $9 = (cchar_t *) 0x0

I decided to stop there at least for now. So not sure yet why line->text becomes
NULL. I put the coredump at https://genki.is/python.coredump . Let me know if
anything else would be useful.

Thanks,
Genki