Segmentation fault with 3.0 on RHEL 7.4

[dniku]

$ fish --version
fish, version 3.0.0
$ uname -a
Linux airulsf01 3.10.0-693.el7.x86_64 #1 SMP Thu Jul 6 19:56:57 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux
$ echo $TERM
xterm-256color
$ sh -c 'env HOME=$(mktemp -d) fish'
Segmentation fault

Segfault is also produced just by running fish.

I don't have an easy way to test the issue with 2.7.1 as I am running on a server without root, where I installed fish using nix, itself installed via proot in ~/.nix.

This gist contains outputs of the following commands:

• nix log nixpkgs.fish
• fish -d 5
• gdb fish
• strace fish

Note that the output of gdb fish is most likely unhelpful as it seems that fish detects that it is launched in a non-interactive environment (probably due to gdb) and does something weird.

Also note that I have also tried to install fish on the same machine using Linuxbrew, and it also failed with a segfault.

[faho]

Specifically, this crashes on fish installed on RHEL 7 via nix.

Can you try building it manually to rule out any nix changes (I know there are a few), or at least try a log from one of those builds to remove all the nix paths?

There's a few things here that look weird, one is that the last message of fish -d 5 is one about doing a universal variable sync, another is the "access: Bad address" (that's an EFAULT), which is supposed to mean:

 EFAULT pathname points outside your accessible address space.

(http://man7.org/linux/man-pages/man2/access.2.html)

Which could be down to some kind of sandboxing or some such.

@ridiculousfish's knowledge would be appreciated here.

[dniku]

I am a novice nix user and unfortunately it will take me time to research how to populate all fish dependencies using nix. For now, I can only mention that on the same machine, I am also getting a segfault with fish build by Linuxbrew.

[faho]

how to populate all fish dependencies using nix

What I mean is building without nix.

For now, I can only mention that on the same machine, I am also getting a segfault with fish build by Linuxbrew.

Can you upload the output for a fish built using linuxbrew instead of nix?

It's both that nix does special stuff, and that the nix output is quite noisy (these ugly /nix/store/buesfhaeiodfhiosjd paths).

Also you might get an actual backtrace here, which would be great.

[dniku]

What I mean is building without nix.

I still need to get the curses dependency on that machine somehow (it is not currently installed), and the easiest way to do that seems to be by using nix for that. Or are you suggesting that ncurses built by nix may be the culprit here?

[faho]

Or are you suggesting that ncurses built by nix may be the culprit here?

No.

What I'm suggesting is simply that I feel like running fish outside of nix would result in nicer output.

It's probably alright to get the dependencies via nix (I'm assuming you don't have root, because otherwise this'd be a simple sudo yum install ncurses-devel).

[kirelagin]

Hey, I’d like to add my 2 cents. I would guess that the problem is in the weird combination of nix and proot. The output with exactly the same hash as in OP’s log files is available straight in the official nixpkgs cache, and I have no problems running it:

$ sudo nix copy --from https://cache.nixos.org/ /nix/store/rfvad85vjz26bcwb55fhaiq0k4mzh63f-fish-3.0.0
[3 copied (12.6 MiB), 2.1 MiB DL]

$ /nix/store/rfvad85vjz26bcwb55fhaiq0k4mzh63f-fish-3.0.0/bin/fish
Welcome to fish, the friendly interactive shell
kirelagin@deployer ~>

[ridiculousfish]

This is a null dereference; gdb should be able to tell us where if we can catch it. But the access() failures are showing EFAULT which means it's probably there but I don't know why.

Can you please try repeating the gdb command with set follow-fork-mode parent instead?

[horta]

https://pastebin.com/raw/Sq0rPqjf

Fish installed via linuxbrew.

[horta]

Compiling from source, manually, also produces segmentation fault. During the compilation I get the following warnings:

/nfs/software/stegle/system/.linuxbrew/bin/ld: libfishlib.a(wutil.cpp.o): in function `safe_strerror(int)':
/homes/horta/code/fish-shell/src/wutil.cpp:334: warning: `sys_errlist' is deprecated; use `strerror' or `strerror_r' instead
/nfs/software/stegle/system/.linuxbrew/bin/ld: /homes/horta/code/fish-shell/src/wutil.cpp:334: warning: `sys_nerr' is deprecated; use `strerror' or `strerror_r' instead
[ 94%] Built target fish_key_reader
Scanning dependencies of target fish
[ 95%] Building CXX object CMakeFiles/fish.dir/src/fish.cpp.o
[ 95%] Linking CXX executable fish
/nfs/software/stegle/system/.linuxbrew/bin/ld: libfishlib.a(wutil.cpp.o): in function `safe_strerror(int)':
/homes/horta/code/fish-shell/src/wutil.cpp:334: warning: `sys_errlist' is deprecated; use `strerror' or `strerror_r' instead
/nfs/software/stegle/system/.linuxbrew/bin/ld: /homes/horta/code/fish-shell/src/wutil.cpp:334: warning: `sys_nerr' is deprecated; use `strerror' or `strerror_r' instead
[ 95%] Built target fish
Scanning dependencies of target pofiles_3
[ 96%] Generating fr.gmo
[ 96%] Built target pofiles_3
Scanning dependencies of target fish_indent
[ 97%] Building CXX object CMakeFiles/fish_indent.dir/src/fish_indent.cpp.o
[ 98%] Building CXX object CMakeFiles/fish_indent.dir/src/print_help.cpp.o
[100%] Linking CXX executable fish_indent
/nfs/software/stegle/system/.linuxbrew/bin/ld: libfishlib.a(wutil.cpp.o): in function `safe_strerror(int)':
/homes/horta/code/fish-shell/src/wutil.cpp:334: warning: `sys_errlist' is deprecated; use `strerror' or `strerror_r' instead
/nfs/software/stegle/system/.linuxbrew/bin/ld: /homes/horta/code/fish-shell/src/wutil.cpp:334: warning: `sys_nerr' is deprecated; use `strerror' or `strerror_r' instead

[floam]

follow-fork-mode is something you want to set in gdb, not fish.

[dniku]

follow-fork-mode parent is the default setting in gdb, so @horta's log is still relevant.
(Also, I assume that the log from fish installed by Linuxbrew on my machine is no longer needed.)

[faho]

During the compilation I get the following warnings:

Yeah, glibc deprecated some stuff without easy replacement. Not to worry.

Your log shows that it crashes in

0x000000000048aa4c in env_get_runtime_pathabi:cxx11 ()

Which has an access() and also a possible NULL dereference:

    const char *dir = getenv("XDG_RUNTIME_DIR");
    if (dir != NULL && access(dir, mode) == 0 && check_runtime_path(dir) == 0) {
        result = str2wcstring(dir);
    } else {
        const char *uname = getpwuid(geteuid())->pw_name;
        // /tmp/fish.user
        std::string tmpdir = "/tmp/fish.";
        tmpdir.append(uname);

So, I am assuming the following:

• $XDG_RUNTIME_DIR is set but not accessible to fish, because of some sandboxy stuff (it could also be unset, which would still get to the crash, just without the EFAULT)

• getpwuid() fails, so getting its pw_name field is a NULL dereference, so we get a crash

[horta]

I'm trying to use fish on a cluster, btw.