Intermittent SIGABRT (POINTER_BEING_FREED_WAS_NOT_ALLOCATED) in --check on macOS arm64, 2.3.0 — drop_in_place<TokenReference> from format_function_call

[yoyo999888]

Summary

StyLua v2.3.0 intermittently aborts (SIGABRT, abort() called via malloc's POINTER_BEING_FREED_WAS_NOT_ALLOCATED) while running stylua --check over a large repo of ~271 Luau files on macOS arm64. The crash is rare/intermittent (16 crashes observed over 5 days of CI-style runs) but reproducible enough to flake our format gate.

Crash signature is identical across all observed crashes: dropping full_moon::tokenizer::structs::TokenReference inside drop_in_place::<full_moon::ast::Expression> reached from format_function_call → format_expression_internal → format_punctuated → format_assignment.

Environment

• StyLua 2.3.0 (official release binary, installed via rokit)
• macOS 15.x (darwin 25.2.0), Apple Silicon (arm64)
• Invocation: stylua --check <271 .luau files> (single process, default thread count)

Crash report (macOS .ips, 2 of 16, identical signature)

Both crashes: EXC_CRASH / SIGABRT (Abort trap: 6), terminated by stylua itself, ASI: libsystem_c.dylib: abort() called.

Crash 1 (faulting thread 5):

#0 libsystem_kernel.dylib  __pthread_kill
#1 libsystem_pthread.dylib pthread_kill
#2 libsystem_c.dylib       abort
#3 libsystem_malloc.dylib  malloc_vreport
#4 libsystem_malloc.dylib  malloc_report
#5 libsystem_malloc.dylib  ___BUG_IN_CLIENT_OF_LIBMALLOC_POINTER_BEING_FREED_WAS_NOT_ALLOCATED
#6 stylua  core::ptr::drop_in_place<full_moon..tokenizer..structs..TokenReference>
#7 stylua  core::ptr::drop_in_place<full_moon..ast..Expression> +344
#8 stylua  core::ptr::drop_in_place<full_moon..ast..Expression> +524
#9 stylua  stylua_lib::formatters::functions::format_function_call +760
#10 stylua stylua_lib::formatters::expression::format_expression_internal +684
#11 stylua stylua_lib::formatters::general::format_punctuated +256
#12 stylua stylua_lib::formatters::assignment::format_assignment_no_trivia +448
#13 stylua stylua_lib::formatters::assignment::format_assignment +284
#14 stylua stylua_lib::formatters::stmt::format_stmt +488
#15 stylua stylua_lib::formatters::block::format_block +468
#16 stylua stylua_lib::formatters::stmt::format_if +2708
#17 stylua stylua_lib::formatters::stmt::format_stmt +3672

Crash 2 (faulting thread 2): identical frames #5–#15 (same POINTER_BEING_FREED_WAS_NOT_ALLOCATED in drop_in_place<TokenReference> ← format_function_call), diverging only deeper (#16 format_else_if, #17 Vec::from_iter).

Frequency and trigger context

• 16 crash reports in ~/Library/Logs/DiagnosticReports/stylua-*.ips between 2026-09-05 and 2026-09-10, each time-correlated with a stylua --check gate failure.
• All crashes happened when stylua ran as one gate in a serial chain of 29 static gates, typically after heavy processes had just run on the same machine (luau-lsp analyze and selene over the same 271-file set immediately before).
• Faulting thread differs between crashes (2 and 5 observed), and the crashing run's file set is not always the same batch — so it does not look tied to one specific input file.

Cannot reproduce in isolation

Looping stylua --check over the same 271 files 30× consecutively, three configurations, zero crashes (all rc=0, no new .ips):

config	runs	crashes
2.3.0 default	30	0
2.3.0 --num-threads 1	30	0
2.5.2 default	30	0

This smells like a heap-corruption/double-free that only trips when the process's heap is in a particular state — possibly racing with other threads, or a latent invalid free in full_moon's AST drop path that allocator state decides whether it catches.

Happy to provide full .ips files or more of the 16 reports if useful.