Race condition in std::locale (IDFGH-3132)

[Tasssadar]

Environment

• Development Kit: ESP32-DevKitC
• Kit version (for WroverKit/PicoKit/DevKitC): v2
• Module or chip used: ESP32-WROOM-32
• IDF version: v4.2-dev-1126-gd85d3d969
• Build System: idf.py
• Compiler version: xtensa-esp32-elf-gcc (crosstool-NG esp-2020r1) 8.2.0
• Operating System: Linux
• Using an IDE?: No
• Power Supply: USB

Problem Description

When std::stringstream constructor is invoked from multiple tasks at once, the ESP crashes on heap corruption.

Possibly related:

• https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91057
• gcc-mirror/gcc@cc386cf

Code to reproduce this issue

https://gist.github.com/Tasssadar/dd22596e666d62ac4f7d8a15eb0e3f08

Debug Logs

Full log from esp is in the gist above.

assertion "heap != NULL && "free() target pointer is outside heap areas"" failed: file "/home/tassadar/mickoflus/esp-idf/components/heap/heap_caps.c", line 271, function: heap_caps_free
abort() was called at PC 0x400f0133 on core 0
Backtrace:0x40085277:0x3ffb9710 0x40084b11:0x3ffb9730 0x400876ba:0x3ffb9750 0x400f0133:0x3ffb97c0 0x40083943:0x3ffb97f0 0x400875b5:0x3ffb9810 0x400d67ed:0x3ffb9830 0x400df16c:0x3ffb9850 0x400d70d5:0x3ffb9870 0x400d73cb:0x3ffb9890 0x400d7ae6:0x3ffb98c0 0x400d7bd0:0x3ffb9900 0x400d7bf5:0x3ffb9920 0x400d7c06:0x3ffb9940 0x400f0051:0x3ffb9970 0x400e7f65:0x3ffb9990 0x400d6523:0x3ffb99b0 0x400d38e1:0x3ffb99d0 0x40087885:0x3ffb9ac0
  #0  0x40085277:0x3ffb9710 in panic_abort at /home/tassadar/mickoflus/esp-idf/components/esp_system/panic.c:330
  #1  0x40084b11:0x3ffb9730 in esp_system_abort at /home/tassadar/mickoflus/esp-idf/components/esp_system/system_api.c:68
  #2  0x400876ba:0x3ffb9750 in abort at /home/tassadar/mickoflus/esp-idf/components/newlib/abort.c:46
  #3  0x400f0133:0x3ffb97c0 in __assert_func at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/newlib/newlib/libc/stdlib/assert.c:62 (discriminator 8)
  #4  0x40083943:0x3ffb97f0 in heap_caps_free at /home/tassadar/mickoflus/esp-idf/components/heap/heap_caps.c:271 (discriminator 1)
  #5  0x400875b5:0x3ffb9810 in free at /home/tassadar/mickoflus/esp-idf/components/newlib/heap.c:47
  #6  0x400d67ed:0x3ffb9830 in operator delete(void*) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/libsupc++/del_op.cc:49
  #7  0x400df16c:0x3ffb9850 in std::__numpunct_cache<char>::~__numpunct_cache() at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/build/build-cc-gcc-final/xtensa-esp32-elf/no-rtti/libstdc++-v3/include/bits/locale_facets.h:1661
  #8  0x400d70d5:0x3ffb9870 in std::locale::facet::_M_remove_reference() const at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/build/build-cc-gcc-final/xtensa-esp32-elf/no-rtti/libstdc++-v3/include/bits/locale_classes.h:458 (discriminator 1)
  #9  0x400d73cb:0x3ffb9890 in std::locale::_Impl::_M_install_facet(std::locale::id const*, std::locale::facet const*) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/src/c++98/locale.cc:415
  #10 0x400d7ae6:0x3ffb98c0 in std::locale::_Impl::_Impl(unsigned int) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/build/build-cc-gcc-final/xtensa-esp32-elf/no-rtti/libstdc++-v3/include/bits/locale_classes.h:611
      (inlined by) std::locale::_Impl::_Impl(unsigned int) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/src/c++98/locale_init.cc:541
  #11 0x400d7bd0:0x3ffb9900 in std::locale::_S_initialize_once() at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/src/c++98/locale_init.cc:307
  #12 0x400d7bf5:0x3ffb9920 in std::locale::_S_initialize() at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/src/c++98/locale_init.cc:319
  #13 0x400d7c06:0x3ffb9940 in std::locale::locale() at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/src/c++98/locale_init.cc:250
  #14 0x400f0051:0x3ffb9970 in std::ios_base::ios_base() at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/src/c++11/ios.cc:79 (discriminator 2)
  #15 0x400e7f65:0x3ffb9990 in std::basic_ios<char, std::char_traits<char> >::basic_ios() at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/build/build-cc-gcc-final/xtensa-esp32-elf/no-rtti/libstdc++-v3/include/bits/basic_ios.h:462
  #16 0x400d6523:0x3ffb99b0 in std::__cxx11::basic_stringstream<char, std::char_traits<char>, std::allocator<char> >::basic_stringstream(std::_Ios_Openmode) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/build/build-cc-gcc-final/xtensa-esp32-elf/no-rtti/libstdc++-v3/include/sstream:705
      (inlined by) std::__cxx11::basic_stringstream<char, std::char_traits<char>, std::allocator<char> >::basic_stringstream(std::_Ios_Openmode) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/build/build-cc-gcc-final/xtensa-esp32-elf/no-rtti/libstdc++-v3/include/sstream:706
  #17 0x400d38e1:0x3ffb99d0 in task(void*) at /home/tassadar/mickoflus/hello_world/main/hello_world_main.cpp:7
  #18 0x40087885:0x3ffb9ac0 in vPortTaskWrapper at /home/tassadar/mickoflus/esp-idf/components/freertos/xtensa/port.c:143