Fix invalid access when recording keys

<c-n>/<c-p> handling in insert was always dropping the last key in
the last_insert() vector (in order to replace it with the actual
completion text inserted), this was not valid for synthetized keys
that are not added to that vector in the first place.

Take the opportunity to merge insert completion handling code between
<c-n>/<c-p> and direct menu selection.

Fixes #5120

src/input_handler.cc

@@ -1191,7 +1191,7 @@ class Insert : public InputMode
         }
     }
 
-    void on_key(Key key, bool) override
+    void on_key(Key key, bool synthesized) override
     {
         auto& buffer = context().buffer();
 
@@ -1289,22 +1289,13 @@ class Insert : public InputMode
                 }, "enter register name", register_doc.str());
             update_completions = false;
         }
-        else if (key == ctrl('n'))
-        {
-            last_insert().keys.pop_back();
-            m_completer.select(1, true, last_insert().keys);
-            update_completions = false;
-        }
-        else if (key == ctrl('p'))
-        {
-            last_insert().keys.pop_back();
-            m_completer.select(-1, true, last_insert().keys);
-            update_completions = false;
-        }
-        else if (key.modifiers == Key::Modifiers::MenuSelect)
+        else if (key == ctrl('n') or key == ctrl('p') or key.modifiers == Key::Modifiers::MenuSelect)
         {
-            last_insert().keys.pop_back();
-            m_completer.select(key.key, false, last_insert().keys);
+            if (not synthesized)
+                last_insert().keys.pop_back();
+            bool relative = key.modifiers != Key::Modifiers::MenuSelect;
+            int index = relative ? (key == ctrl('n') ? 1 : -1) : key.key;
+            m_completer.select(index, relative, last_insert().keys);
             update_completions = false;
         }
         else if (key == ctrl('x'))

test/regression/5120-double-free-or-corruption-crash/cmd

@@ -0,0 +1 @@
+ggQm*nWd<a-l>d<a-d>n<a-c>\fo<c-n>{<c-r>"}<esc>Q8q

test/regression/5120-double-free-or-corruption-crash/in

@@ -0,0 +1,40 @@
+Lorem ipsum dolor sit amet consectetur adipisicing elit[1]. Maxime mollitia,
+molestiae quas vel sint commodi[2] repudiandae consequuntur voluptatum laborum
+numquam blanditiis harum quisquam eius sed odit fugiat iusto fuga praesentium
+optio, eaque rerum![3] Provident similique accusantium nemo autem. Veritatis
+obcaecati tenetur iure eius earum ut molestias architecto voluptate aliquam
+nihil,[4] eveniet aliquid culpa officia aut! Impedit sit sunt quaerat, odit,
+tenetur error, harum nesciunt ipsum debitis quas aliquid. Reprehenderit,
+quia. Quo neque error repudiandae fuga? Ipsa laudantium molestias eos 
+sapiente officiis modi at sunt excepturi expedita sint? Sed quibusdam
+recusandae alias error harum maxime adipisci amet laborum[5]. Perspiciatis 
+minima nesciunt dolorem! Officiis iure rerum voluptates a cumque velit 
+quibusdam sed amet tempora[6]. Sit laborum ab, eius fugit doloribus tenetur 
+fugiat, temporibus enim commodi iusto libero magni deleniti quod quam 
+consequuntur! Commodi minima excepturi repudiandae velit hic maxime
+doloremque[7]. Quaerat provident commodi consectetur veniam similique ad 
+earum omnis ipsum saepe, voluptas, hic voluptates pariatur est explicabo 
+fugiat, dolorum eligendi quam cupiditate excepturi mollitia maiores labore 
+suscipit quas? Nulla, placeat[8]. Voluptatem quaerat non architecto ab laudantium
+modi minima sunt esse temporibus sint culpa, recusandae aliquam numquam 
+totam ratione voluptas quod exercitationem fuga[9]. Possimus quis earum veniam 
+quasi aliquam eligendi, placeat qui corporis!
+
+
+[1] This is the first footnote.
+
+[2] This is the second footnote.
+
+[3] This is the third footnote.
+
+[4] This is the fourth footnote.
+
+[5] This is the fifth footnote.
+
+[6] This is the sixth footnote.
+
+[7] This is the seventh footnote.
+
+[8] This is the eighth footnote.
+
+[9] This is the Ninth footnote.