fish 3.0.2 clang asan ubsan backtrace

gistfile1.txt

$ ninja fish && ./fish -c:
/usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_tree.h:1910:28: runtime error: upcast of address 0x000001fdde88 with insufficient space for an object of type 'std::_Rb_tree_node<std::pair<const std::__cxx11::basic_string<wchar_t>, const (anonymous namespace)::test_expressions::token_info_t> >'
0x000001fdde88: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  88 de fd 01 00 00 00 00  88 de fd 01
              ^
    #0 0x6f4f24  (/fish-shell/build/fish+0x6f4f24)
    #1 0x6f20d0  (/fish-shell/build/fish+0x6f20d0)
    #2 0x6f160d  (/fish-shell/build/fish+0x6f160d)
    #3 0x6f048a  (/fish-shell/build/fish+0x6f048a)
    #4 0x63a055  (/fish-shell/build/fish+0x63a055)
    #5 0x7db118  (/fish-shell/build/fish+0x7db118)
    #6 0x7d789a  (/fish-shell/build/fish+0x7d789a)
    #7 0xa037a4  (/fish-shell/build/fish+0xa037a4)
    #8 0x9f81af  (/fish-shell/build/fish+0x9f81af)
    #9 0x9f78de  (/fish-shell/build/fish+0x9f78de)
    #10 0xa02442  (/fish-shell/build/fish+0xa02442)
    #11 0x9f81af  (/fish-shell/build/fish+0x9f81af)
    #12 0xa0db6e  (/fish-shell/build/fish+0xa0db6e)
    #13 0xa05292  (/fish-shell/build/fish+0xa05292)
    #14 0x8fe6c3  (/fish-shell/build/fish+0x8fe6c3)
    #15 0x8fa0cf  (/fish-shell/build/fish+0x8fa0cf)
    #16 0x949696  (/fish-shell/build/fish+0x949696)
    #17 0x6bf604  (/fish-shell/build/fish+0x6bf604)
    #18 0x63a055  (/fish-shell/build/fish+0x63a055)
    #19 0x7db118  (/fish-shell/build/fish+0x7db118)
    #20 0x7d789a  (/fish-shell/build/fish+0x7d789a)
    #21 0xa037a4  (/fish-shell/build/fish+0xa037a4)
    #22 0x9f81af  (/fish-shell/build/fish+0x9f81af)
    #23 0xa0db6e  (/fish-shell/build/fish+0xa0db6e)
    #24 0xa05292  (/fish-shell/build/fish+0xa05292)
    #25 0x8fe6c3  (/fish-shell/build/fish+0x8fe6c3)
    #26 0x8fa0cf  (/fish-shell/build/fish+0x8fa0cf)
    #27 0x8f9012  (/fish-shell/build/fish+0x8f9012)
    #28 0x6325f5  (/fish-shell/build/fish+0x6325f5)
    #29 0x631434  (/fish-shell/build/fish+0x631434)
    #30 0x7fc95e4fb82f  (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #31 0x55b6c8  (/fish-shell/build/fish+0x55b6c8)

SUMMARY: AddressSanitizer: insufficient-object-size /usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_tree.h:1910:28 in
/usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_tree.h:1505:43: runtime error: upcast of address 0x000001fdde88 with insufficient space for an object of type 'std::_Rb_tree_node<std::pair<const std::__cxx11::basic_string<wchar_t>, const (anonymous namespace)::test_expressions::token_info_t> >'
0x000001fdde88: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  88 de fd 01 00 00 00 00  88 de fd 01
              ^
    #0 0x6f5366  (/fish-shell/build/fish+0x6f5366)
    #1 0x6f20d0  (/fish-shell/build/fish+0x6f20d0)
    #2 0x6f160d  (/fish-shell/build/fish+0x6f160d)
    #3 0x6f048a  (/fish-shell/build/fish+0x6f048a)
    #4 0x63a055  (/fish-shell/build/fish+0x63a055)
    #5 0x7db118  (/fish-shell/build/fish+0x7db118)
    #6 0x7d789a  (/fish-shell/build/fish+0x7d789a)
    #7 0xa037a4  (/fish-shell/build/fish+0xa037a4)
    #8 0x9f81af  (/fish-shell/build/fish+0x9f81af)
    #9 0x9f78de  (/fish-shell/build/fish+0x9f78de)
    #10 0xa02442  (/fish-shell/build/fish+0xa02442)
    #11 0x9f81af  (/fish-shell/build/fish+0x9f81af)
    #12 0xa0db6e  (/fish-shell/build/fish+0xa0db6e)
    #13 0xa05292  (/fish-shell/build/fish+0xa05292)
    #14 0x8fe6c3  (/fish-shell/build/fish+0x8fe6c3)
    #15 0x8fa0cf  (/fish-shell/build/fish+0x8fa0cf)
    #16 0x949696  (/fish-shell/build/fish+0x949696)
    #17 0x6bf604  (/fish-shell/build/fish+0x6bf604)
    #18 0x63a055  (/fish-shell/build/fish+0x63a055)
    #19 0x7db118  (/fish-shell/build/fish+0x7db118)
    #20 0x7d789a  (/fish-shell/build/fish+0x7d789a)
    #21 0xa037a4  (/fish-shell/build/fish+0xa037a4)
    #22 0x9f81af  (/fish-shell/build/fish+0x9f81af)
    #23 0xa0db6e  (/fish-shell/build/fish+0xa0db6e)
    #24 0xa05292  (/fish-shell/build/fish+0xa05292)
    #25 0x8fe6c3  (/fish-shell/build/fish+0x8fe6c3)
    #26 0x8fa0cf  (/fish-shell/build/fish+0x8fa0cf)
    #27 0x8f9012  (/fish-shell/build/fish+0x8f9012)
    #28 0x6325f5  (/fish-shell/build/fish+0x6325f5)
    #29 0x631434  (/fish-shell/build/fish+0x631434)
    #30 0x7fc95e4fb82f  (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #31 0x55b6c8  (/fish-shell/build/fish+0x55b6c8)

SUMMARY: AddressSanitizer: insufficient-object-size /usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_tree.h:1505:43 in