LC_CTYPE设为C.UTF-8时Bash在Valgrind中崩溃的调试咨询

当Bash 5.2仅在Valgrind中运行，且设置LC_CTYPE=C.UTF-8时，会因malloc断言失败崩溃，示例执行命令及报错如下：

$ path/to/env - foo=bar LC_CTYPE=C.UTF-8 path/to/valgrind path/to/bash -c 'echo ${foo#spam}'

...

malloc: subst.c:5331: assertion botched
free: called with unallocated block argument
Aborting...==2753214== 
==2753214== Process terminating with default action of signal 6 (SIGABRT): dumping core
==2753214==    at 0x48DFA8C: __pthread_kill_implementation (in /nix/store/aw2fw9ag10wr9pf0qk4nk5sxi0q0bn56-glibc-2.37-8/lib/libc.so.6)
==2753214==    by 0x4890C85: raise (in /nix/store/aw2fw9ag10wr9pf0qk4nk5sxi0q0bn56-glibc-2.37-8/lib/libc.so.6)
==2753214==    by 0x487A8B9: abort (in /nix/store/aw2fw9ag10wr9pf0qk4nk5sxi0q0bn56-glibc-2.37-8/lib/libc.so.6)
==2753214==    by 0x443AF9: programming_error (in /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash)
==2753214==    by 0x4ACAC4: internal_free.constprop.0 (in /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash)
==2753214==    by 0x450A5E: remove_pattern (in /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash)
==2753214==    by 0x465D2B: parameter_brace_remove_pattern (in /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash)
==2753214==    by 0x46023A: param_expand (in /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash)
==2753214==    by 0x460CD9: expand_word_internal (in /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash)
==2753214==    by 0x466C0D: shell_expand_word_list.constprop.0 (in /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash)
==2753214==    by 0x467479: expand_words (in /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash)
==2753214==    by 0x4361CE: execute_command_internal (in /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash)

...

==2753214== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)
/nix/store/a683qmhmrrzrwn8fmqh53yyylm7yn2hq-test.sh: line 2: 2753214 Aborted                 (core dumped) /nix/store/v45j2p2izb3pa2fxdw978bahhkb2ghza-toybox-0.8.10/bin/env - LC_CTYPE=C.UTF-8 /nix/store/14fg82n6grqhrd2algx31sv1kmgvz0gl-valgrind-3.21.0/bin/valgrind /nix/store/vqvj60h076bhqj6977caz0pfxs6543nb-bash-5.2-p15/bin/bash -c 'echo ${PATH#":"}'

参数扩展说明 #

${parameter#word}是Shell参数扩展的一种形式，作用是从parameter变量值的开头删除匹配word的最短模式。

报错细节 #

报错信息指向subst.c第5331行，但实际是在调用free时触发了「传入未分配块」的断言失败，进而引发崩溃。

已验证的实验结果 #

• 在Valgrind外运行Bash不会出现崩溃；
• 当foo未设置或设为空字符串时Bash运行正常，赋值非空值则触发崩溃；
• 若使用foo中存在的匹配模式，Bash会在subst.c第5336行而非第5331行崩溃，无论模式是否匹配都会崩溃，但触发位置不同；
• 未设置LC_CTYPE或设为其他locale（包括不存在的locale）时，Bash不会崩溃，但会出现非致命的invalid free()警告。

问题 #

该如何调试此问题？

复现说明 #

• 无需依赖系统默认环境变量、二进制文件或库，x86_64架构机器均可复现，测试环境为Ubuntu 22.04.3、Linux 5.15.0-83-generic；
• 可通过Nix flake快速复现：将flake.nix和flake.lock下载到空目录后执行nix run即可。

内容的提问来源于stack exchange，提问作者charmoniumQ