Building fish with the CFLAG `-fipa-pta` makes fish SIGSEGV on launch

[CamilleScholtz]

3.1.2 (and 3.1.0)

Linux punpun 5.5.13-zen2-punpun #1 ZEN SMP PREEMPT Sun Apr 5 20:55:32 UTC 2020 x86_64 GNU/Linux

I don't know if this is actually something that should be fixed, but it might point to some deeper issue? Note that I build my entire system with this flag, and fish is the only package with issues.

[ridiculousfish]

I tried adding -fipa-pta to CMAKE_CXX_FLAGS by editing CMakeLists.txt, and compiled and ran successfully (g++ 9.3.0). Can you please provide a backtrace or crash log? Thanks

[CamilleScholtz]

strace output:

execve("/usr/bin/fish", ["fish"], 0x7ffc6f99e5c0 /* 26 vars */) = 0
arch_prctl(ARCH_SET_FS, 0x7f7ea7994dc8) = 0
set_tid_address(0x7f7ea7995244)         = 22904
open("/etc/ld-musl-x86_64.path", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/lib/libncursesw.so.6", O_RDONLY|O_CLOEXEC) = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
fstat(3, {st_mode=S_IFREG|0755, st_size=518048, ...}) = 0
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\206\1\0\0\0\0\0"..., 960) = 960
mmap(NULL, 524288, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f7ea7851000
mmap(0x7f7ea7868000, 303104, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0x17000) = 0x7f7ea7868000
mmap(0x7f7ea78b2000, 102400, PROT_READ, MAP_PRIVATE|MAP_FIXED, 3, 0x61000) = 0x7f7ea78b2000
mmap(0x7f7ea78cb000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x79000) = 0x7f7ea78cb000
close(3)                                = 0
open("/lib/libpcre2-32.so.0", O_RDONLY|O_CLOEXEC) = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
fstat(3, {st_mode=S_IFREG|0755, st_size=559544, ...}) = 0
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 2\0\0\0\0\0\0"..., 960) = 960
mmap(NULL, 565248, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f7ea77c7000
mmap(0x7f7ea77ca000, 380928, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0x3000) = 0x7f7ea77ca000
mmap(0x7f7ea7827000, 163840, PROT_READ, MAP_PRIVATE|MAP_FIXED, 3, 0x60000) = 0x7f7ea7827000
mmap(0x7f7ea784f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x87000) = 0x7f7ea784f000
close(3)                                = 0
open("/lib/libstdc++.so.6", O_RDONLY|O_CLOEXEC) = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
fstat(3, {st_mode=S_IFREG|0755, st_size=2275184, ...}) = 0
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340Z\v\0\0\0\0\0"..., 960) = 960
mmap(NULL, 2293760, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f7ea7597000
mmap(0x7f7ea7649000, 1175552, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0xb2000) = 0x7f7ea7649000
mmap(0x7f7ea7768000, 319488, PROT_READ, MAP_PRIVATE|MAP_FIXED, 3, 0x1d1000) = 0x7f7ea7768000
mmap(0x7f7ea77b6000, 69632, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x21e000) = 0x7f7ea77b6000
mmap(0x7f7ea77c3000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f7ea77c3000
close(3)                                = 0
open("/lib/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
fstat(3, {st_mode=S_IFREG|0644, st_size=100544, ...}) = 0
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\2202\0\0\0\0\0\0"..., 960) = 960
mmap(NULL, 106496, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f7ea757d000
mmap(0x7f7ea7580000, 69632, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0x3000) = 0x7f7ea7580000
mmap(0x7f7ea7591000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED, 3, 0x14000) = 0x7f7ea7591000
mmap(0x7f7ea7595000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x17000) = 0x7f7ea7595000
close(3)                                = 0
mprotect(0x7f7ea78cb000, 16384, PROT_READ) = 0
mprotect(0x7f7ea784f000, 4096, PROT_READ) = 0
mprotect(0x7f7ea77b6000, 45056, PROT_READ) = 0
mprotect(0x7f7ea7991000, 4096, PROT_READ) = 0
mprotect(0x7f7ea7595000, 4096, PROT_READ) = 0
mprotect(0x55fd49be0000, 20480, PROT_READ) = 0
brk(NULL)                               = 0x55fd4a402000
brk(0x55fd4a414000)                     = 0x55fd4a414000
open(".", O_RDONLY|O_CLOEXEC)           = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
getpid()                                = 22904
pipe([4, 5])                            = 0
fcntl(4, F_GETFD)                       = 0
fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
fcntl(5, F_GETFD)                       = 0
fcntl(5, F_SETFD, FD_CLOEXEC)           = 0
fcntl(5, F_GETFL)                       = 0x1 (flags O_WRONLY)
fcntl(5, F_SETFL, O_WRONLY|O_NONBLOCK)  = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ioctl(0, TIOCGWINSZ, {ws_row=27, ws_col=95, ws_xpixel=65535, ws_ypixel=65535}) = 0
ioctl(0, TIOCGPGRP, [22901])            = 0
readlink("/proc/self/exe", "/usr/bin/fish", 4095) = 13
open("/usr/bin/fish", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_PATH) = 6
readlink("/proc/self/fd/6", "/usr/bin/fish", 4095) = 13
fstat(6, {st_mode=S_IFREG|0755, st_size=1999608, ...}) = 0
stat("/usr/bin/fish", {st_mode=S_IFREG|0755, st_size=1999608, ...}) = 0
close(6)                                = 0
stat("/usr/share/fish", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
stat("/usr/etc/fish", 0x7fff1a7d65b0)   = -1 ENOENT (No such file or directory)
brk(0x55fd4a415000)                     = 0x55fd4a415000
brk(0x55fd4a416000)                     = 0x55fd4a416000
brk(0x55fd4a417000)                     = 0x55fd4a417000
stat("/home/onodera/.config/fish", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
stat("/home/onodera/.local/share/fish", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
brk(0x55fd4a418000)                     = 0x55fd4a418000
getuid()                                = 1000
getpid()                                = 22904
uname({sysname="Linux", nodename="punpun", ...}) = 0
stat("/var/db/kiss/repos/community/fish", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
stat(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
uname({sysname="Linux", nodename="punpun", ...}) = 0
ioctl(0, TIOCGWINSZ, {ws_row=27, ws_col=95, ws_xpixel=65535, ws_ypixel=65535}) = 0
readlink("/proc/self/fd/0", "/dev/pts/7", 32) = 10
stat("/dev/pts/7", {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0x7), ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0x7), ...}) = 0
ioctl(1, TIOCGWINSZ, {ws_row=27, ws_col=95, ws_xpixel=65535, ws_ypixel=65535}) = 0
brk(0x55fd4a419000)                     = 0x55fd4a419000
stat("/home/onodera/.terminfo", 0x7fff1a7d3090) = -1 ENOENT (No such file or directory)
stat("/usr/share/terminfo", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
access("/usr/share/terminfo/s/st-256color", R_OK) = 0
open("/usr/share/terminfo/s/st-256color", O_RDONLY) = 6
readv(6, [{iov_base="\32\1(\0\35\0\17\0i\1N\6st-256color| simplet"..., iov_len=32768}, {iov_base="", iov_len=1024}], 2) = 2549
readv(6, [{iov_base="", iov_len=30219}, {iov_base="", iov_len=1024}], 2) = 0
brk(0x55fd4a41a000)                     = 0x55fd4a41a000
close(6)                                = 0
brk(0x55fd4a41b000)                     = 0x55fd4a41b000
ioctl(1, TIOCGWINSZ, {ws_row=27, ws_col=95, ws_xpixel=65535, ws_ypixel=65535}) = 0
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, TIOCGWINSZ, {ws_row=27, ws_col=95, ws_xpixel=65535, ws_ypixel=65535}) = 0
ioctl(1, TIOCGWINSZ, {ws_row=27, ws_col=95, ws_xpixel=65535, ws_ypixel=65535}) = 0
ioctl(0, TIOCGWINSZ, {ws_row=27, ws_col=95, ws_xpixel=65535, ws_ypixel=65535}) = 0
readlink("/proc/self/fd/0", "/dev/pts/7", 4096) = 10
stat("/dev/pts/7", {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0x7), ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0x7), ...}) = 0
brk(0x55fd4a41d000)                     = 0x55fd4a41d000
brk(0x55fd4a41e000)                     = 0x55fd4a41e000
brk(0x55fd4a420000)                     = 0x55fd4a420000
brk(0x55fd4a421000)                     = 0x55fd4a421000
open("/home/onodera/.config/fish/fish_variables", O_RDONLY|O_CLOEXEC) = 6
fcntl(6, F_SETFD, FD_CLOEXEC)           = 0
fstat(6, {st_mode=S_IFREG|0644, st_size=893, ...}) = 0
read(6, "# This file contains fish univer"..., 4096) = 893
read(6, "", 4096)                       = 0
brk(0x55fd4a422000)                     = 0x55fd4a422000
brk(0x55fd4a423000)                     = 0x55fd4a423000
brk(0x55fd4a424000)                     = 0x55fd4a424000
brk(0x55fd4a425000)                     = 0x55fd4a425000
close(6)                                = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=NULL} ---
+++ killed by SIGSEGV +++
fish: 'strace fish' terminated by signal SIGSEGV (Address boundary error)

Flags build with:

/var/db/kiss/repos/community/fish echo $CFLAGS
-O3 -pipe -march=native -mtune=native  -fipa-pta
/var/db/kiss/repos/community/fish echo $CXXFLAGS
-O3 -pipe -march=native -mtune=native  -fipa-pta
/var/db/kiss/repos/community/fish echo $LDFLAGS
-Wl,-O1 -Wl,--as-needed -O3 -pipe -march=native -mtune=native  -fipa-pta

This is on a system running musl instead glibc by the way.

[ridiculousfish]

Thanks, it looks like a null pointer dereference, but strace is not sufficient to figure out where it's coming from, I will need a backtrace.

Can you please try launching fish under gdb - gdb ./fish might be enough, or perhaps gdb ./fish --args /path/to/script.fish (unless the crash is happening only in interactive mode)?

If gdb catches the crash, please paste the contents of backtrace - thanks!

[zanchey]

Getting a musl environment up to test this was not trivial, but I can reproduce a segmentation fault in libc after proc_init() runs signal_set_handlers_once(false):

proc_init () at /home/wheel/zanchey/src/fish-shell/src/proc.cpp:95
95      void proc_init() { signal_set_handlers_once(false); }
(gdb) step
signal_set_handlers_once (interactive=interactive@entry=false)
    at /scratch/zanchey/musl-cross-make/output/x86_64-linux-musl/include/c++/9.2.0/mutex:666
666         call_once(once_flag& __once, _Callable&& __f, _Args&&... __args)
(gdb) n

Program received signal SIGSEGV, Segmentation fault.
0x000000000081e7e0 in ?? ()

[zanchey]

(gdb) backtrace
#0  0x000000000081e7e0 in ?? ()
#1  0x00007ffff7fbae4c in ?? () from /lib/ld-musl-x86_64.so.1
#2  0x00007ffff7fbad90 in ?? () from /lib/ld-musl-x86_64.so.1
#3  0x00000000007f4120 in signal_set_handlers_once(bool)::s_inter_once ()
#4  0x0000000000000000 in ?? ()

[CamilleScholtz]

Sorry, I wasn't able to run gdb yesterday. Is this still needed?

[zanchey]

If possible - I might be seeing a different crash to you, as my environment is full of hacks to make it work!

[CamilleScholtz]

Eh I build with the -g3 and -ggdb flags and cmake release tye Debug, but gdb is not giving me anything upon run

[ridiculousfish]

I am now able to reproduce by adding this flag manually on a musl system. FYI after banging my head for a while, I found that the alpine/alpine64 Vagrant box is good for testing on musl (probably Void Linux would work as well, but it was cranky for me).

[ridiculousfish]

Program received signal SIGSEGV, Segmentation fault.
std::call_once<void (&)(bool), bool>(std::once_flag&, void (&)(bool), bool&&)::{lambda()#1}::operator()() const (
    this=0x7d8fd48a5b00, this=0x7d8fd48a5b00) at /usr/include/c++/9.3.0/mutex:671
671		  std::__invoke(std::forward<_Callable>(__f),
(gdb) bt
#0  std::call_once<void (&)(bool), bool>(std::once_flag&, void (&)(bool), bool&&)::{lambda()#1}::operator()() const (
    this=0x7d8fd48a5b00, this=0x7d8fd48a5b00) at /usr/include/c++/9.3.0/mutex:671
#1  std::call_once<void (&)(bool), bool>(std::once_flag&, void (&)(bool), bool&&)::{lambda()#2}::operator()() const (
    this=0x0) at /usr/include/c++/9.3.0/mutex:676
#2  std::call_once<void (&)(bool), bool>(std::once_flag&, void (&)(bool), bool&&)::{lambda()#2}::_FUN() ()
    at /usr/include/c++/9.3.0/mutex:676
#3  0x0000785ae72737ef in ?? () from /lib/ld-musl-x86_64.so.1
#4  0x00000b7e01971740 in ?? ()
#5  0x0000785ae7273762 in pthread_mutexattr_settype () from /lib/ld-musl-x86_64.so.1
#6  0x00000b7dfe86c6c0 in signal_set_handlers_once(bool)::s_inter_once ()
#7  0x0000000000000000 in ?? ()

[ridiculousfish]

Reduced test case, compiled with g++ -O1 -std=c++11 -fipa-pta -lpthread test.cpp crashes on Alpine but not Arch (gcc 9.3.0 on both).

Edit: creduce had her say, I will chase down more later.

[ridiculousfish]

My first reduction was bogus, this is the new reduction.

Pretty sure this is a gcc IPA bug. Filed as https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94947

[zanchey]

OK, as this is confirmed upstream as a GCC bug, I'll close this issue. Thanks for filing! Perhaps you have found other compiler bugs before, but this was certainly an achievement!