Created attachment 1126590 [details]
build.log

Created attachment 1126591 [details]
root.log

Created attachment 1126592 [details]
state.log

This bug appears to have been reported against 'rawhide' during the Fedora 24 development cycle.
Changing version to '24'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora24#Rawhide_Rebase

Test 65 ('ls-F') segfaults on x86_64 but not i686 (per link in comment 0).  The last successful build[1] was with gcc-5.3.1-3.fc24 and glibc-2.22.90-27.fc24.

[1] http://koji.fedoraproject.org/koji/buildinfo?buildID=710863

Program received signal SIGSEGV, Segmentation fault.
__GI___rewinddir (dirp=dirp@entry=0x5555557ef808)
    at ../sysdeps/posix/rewinddir.c:34
34        dirp->size = 0;
(gdb) bt full
#0  __GI___rewinddir (dirp=dirp@entry=0x5555557ef808)
    at ../sysdeps/posix/rewinddir.c:34
No locals.
#1  0x0000555555581305 in tw_file_start (dfd=dfd@entry=0x5555557ef808,
    pat=pat@entry=0x5555557be858 <STRNULL> L"") at tw.init.c:737
        vp = <optimized out>
#2  0x0000555555582eca in tw_collect (command=command@entry=LIST,
    looking=looking@entry=4, exp_dir=exp_dir@entry=0x7fffffffd8c0,
    exp_name=exp_name@entry=0x7fffffffd900,
    target=target@entry=0x5555557e7098 L"", pat=0x5555557be858 <STRNULL> L"",
    flags=64, dir_fd=0x5555557ef808) at tw.parse.c:1360
        omark = 0
        ni = 0
        osetexit = {j = {{__jmpbuf = {1, -4323463647815646328, 0, 0,
                93824995057672, 0, 4323463646555554696, 7590063007764202376},
              __mask_was_saved = 1, __saved_mask = {__val = {
                  0 <repeats 16 times>}}}}}
#3  0x0000555555584445 in t_search (word=word@entry=0x7fffffffd970,
    command=command@entry=LIST, looking=4, looking@entry=4095,
    list_max=list_max@entry=0, pat=<optimized out>, suf=suf@entry=0)
    at tw.parse.c:1775
        numitems = <optimized out>
        flags = 64
        gpat = <optimized out>
        res = <optimized out>
        exp_dir = {s = 0x555555806a08 L"", len = 0, size = 64}
        dir = {s = 0x555555806808 L"", len = 0, size = 64}
        exp_name = {s = 0x0, len = 0, size = 0}
        name = 0x5555557e7098 L""
        dir_fd = 0x5555557ef808
#4  0x000055555559b8a2 in dolist (v=<optimized out>, c=<optimized out>)
    at tc.func.c:205
        word = {s = 0x5555557d5608 L"", len = 0, size = 64}
        globbed = <optimized out>
        i = <optimized out>
        k = <optimized out>
        ret = 0
        st = {st_dev = 1, st_ino = 93824992548085,
          st_nlink = 140737354080256, st_mode = 4294957640, st_uid = 70,
          st_gid = 4294957638, __pad0 = 32767, st_rdev = 140737351913809,
          st_size = 9288820264534023, st_blksize = -1711223578520623104,
          st_blocks = 140737488345620, st_atim = {tv_sec = 93824992563913,
            tv_nsec = 140737488345620}, st_mtim = {tv_sec = 93824992548177,
            tv_nsec = 93824994951688}, st_ctim = {tv_sec = 93824992563914,
            tv_nsec = 93824994766912}, __glibc_reserved = {93824992397027,
            93824995052488, 93824994739040}}
#5  0x000055555557bd80 in execute (t=0x555555806008, wanttty=<optimized out>,
    pipein=pipein@entry=0x0, pipeout=pipeout@entry=0x0,
    do_glob=do_glob@entry=1) at sh.sem.c:651
        oldexit = {j = {{__jmpbuf = {1, 4323463647498224520, 140737488348808,
                0, 0, 1, 4323463647335695240, 7590062990958543752},
              __mask_was_saved = 1, __saved_mask = {__val = {
                  0 <repeats 16 times>}}}}}
        ohaderr = 0
        forked = 0
        bifunc = 0x5555557b8360 <bfunc+960>
        pid = 0
        pv = {12, 0}
        set = {__val = {140737488346336, 140737344615501, 4295032832,
            140737344615436, 1, 140737354127768, 0, 24011439870050307,
            140737347251040, 140737351930937, 140737344937839,
            140737488345904, 6, 140733193388032, 93824995049480,
            140737344613823}}
        csigset = {__val = {0 <repeats 16 times>}}
        nosigchld = 0
#6  0x000055555557b998 in execute (t=0x5555558037c8, wanttty=<optimized out>,
    pipein=0x0, pipeout=0x0, do_glob=1) at sh.sem.c:744
        forked = 0
        bifunc = 0x7fffffffdf38
        pid = 0
        pv = {1434280048, 21845}
        set = {__val = {140737488346824, 140737488346816, 140737488346800,
            93824995040104, 1, 0, 140737488347144, 140737351916721,
            140737488346928, 140737488347073, 140737488347068,
            140737343411456, 93824994859016, 140737488347072, 93824995052360,
            93824995047368}}
        csigset = {__val = {0 <repeats 16 times>}}
        nosigchld = 0
#7  0x000055555555d2e1 in process (catch=1) at sh.c:2144
        t = 0x5555558037c8
        hadhist = <optimized out>
        old_pintr_disabled = 1
        osetexit = {j = {{__jmpbuf = {0, 4323463647498224520,
                140737488348808, 0, 0, 1, 4323463647421678472,
                7590062990388511624}, __mask_was_saved = 1, __saved_mask = {
                __val = {0 <repeats 16 times>}}}}}
        omark = 1
        didexitset = 1
#8  0x000055555555bec1 in main (argc=<optimized out>, argv=0x7fffffffe668)
    at sh.c:1418
        batch = 0
        nexececho = 0
        nofile = <optimized out>
        nverbose = 0
        rdirs = 0
        quitit = <optimized out>
        cp = <optimized out>
        cp2 = <optimized out>
        tcp = <optimized out>
        ttyn = <optimized out>
        f = <optimized out>
        reenter = <optimized out>
        tempv = 0x7fffffffe688
        osetintr = 1
        oparintr = {__sigaction_handler = {sa_handler = 0x0,
            sa_sigaction = 0x0}, sa_mask = {__val = {0, 112, 0, 0,
              16735520495188928512, 140737488348020, 93824992554291,
              140737488348020, 93824995046856, 93824995052072,
              93824992554288, 0, 93824995046856, 0, 93824992549401, 4}},
          sa_flags = 0, sa_restorer = 0x0}

Are you able to provide a self-contained reproducer that we can review?

Isolating exactly which glibc version the regression first appeared would also be very helpful, similarly with gcc versions.

(In reply to Carlos O'Donell from comment #6)
> Are you able to provide a self-contained reproducer that we can review?

Not at the moment.

> Isolating exactly which glibc version the regression first appeared would
> also be very helpful, similarly with gcc versions.

glibc-2.22.90-31.fc24. -27 and -29 pass even with gcc-6 (there was no -30); -32, -36, and -38 also fail.

Is this at all related to tcsh's interposed malloc which violates the x86_64 ABI?

https://bugzilla.redhat.com/show_bug.cgi?id=1303323#c19

Yes, the backtrace is exactly the same.

*** This bug has been marked as a duplicate of bug 1303323 ***