#18261: Using withArgs concurrently segfaults · Issues · Glasgow Haskell Compiler / GHC

Using withArgs concurrently segfaults

Summary

Calling withArgs simultaneously from multiple threads crashes the program.

Steps to reproduce

Compile the following program with -threaded and run it with +RTS -N.

import Control.Concurrent ( forkIO )
import Control.Monad ( replicateM_ )
import System.Environment ( withArgs )

main = replicateM_ 64 . forkIO . withArgs [] $ pure ()

I can reproduce this bug by spawning fewer than 64 threads, so that number doesn't seem to matter too much. Similarly I can reproduce the bug when running with -Nx for all x > 1. But as those numbers go down, the likelihood of reproducing this bug seems to go down as well.

At any rate, I see output like this:

double free or corruption (fasttop)
free(): double free detected in tcache 2
Aborted (core dumped)

Segmentation fault (core dumped)

double free or corruption (out)
Aborted (core dumped)

free(): double free detected in tcache 2
Segmentation fault (core dumped)

Expected behavior

I don't really know what multiple calls to withArgs from separate threads should do, but it probably shouldn't segfault 😆

Environment

GHC version used: 8.10.1, 8.8.3, 8.6.5

Optional:

Operating System: Ubuntu 20.04
System Architecture: x86_64

## Summary

Calling `withArgs` simultaneously from multiple threads crashes the program.

## Steps to reproduce

Compile the following program with `-threaded` and run it with `+RTS -N`.

``` hs
import Control.Concurrent ( forkIO )
import Control.Monad ( replicateM_ )
import System.Environment ( withArgs )

main = replicateM_ 64 . forkIO . withArgs [] $ pure ()
```

I can reproduce this bug by spawning fewer than 64 threads, so that number doesn't seem to matter too much. Similarly I can reproduce the bug when running with `-Nx` for all `x > 1`. But as those numbers go down, the likelihood of reproducing this bug seems to go down as well.

At any rate, I see output like this:

```
double free or corruption (fasttop)
free(): double free detected in tcache 2
Aborted (core dumped)
```

```
Segmentation fault (core dumped)
```

```
double free or corruption (out)
Aborted (core dumped)
```

```
free(): double free detected in tcache 2
Segmentation fault (core dumped)
```

## Expected behavior

I don't really know what multiple calls to `withArgs` from separate threads should do, but it probably shouldn't segfault :laughing:

## Environment

* GHC version used: 8.10.1, 8.8.3, 8.6.5