Tcl Source Code

tcl9.0 first call assocdata deletion callbacks, then release each data from hash after the callback, and then set iPtr->assocData to NULL when all assocdata is removed: https://github.com/tcltk/tcl/blob/db5ec326417727be7fdfcfe92d15193c7d886648/generic/tclBasic.c#L1982-L1990

if (iPtr->assocData != NULL) {
	AssocData *dPtr;

	hTablePtr = iPtr->assocData;
	/*
	 * Invoke deletion callbacks; note that a callback can create new
	 * callbacks, so we iterate.
	 */
	for (hPtr = Tcl_FirstHashEntry(hTablePtr, &search);
		hPtr != NULL;
		hPtr = Tcl_FirstHashEntry(hTablePtr, &search)) {
	    dPtr = (AssocData *)Tcl_GetHashValue(hPtr);
	    if (dPtr->proc != NULL) {
		dPtr->proc(dPtr->clientData, interp);
	    }
	    Tcl_DeleteHashEntry(hPtr);
	    Tcl_Free(dPtr);
	}
	Tcl_DeleteHashTable(hTablePtr);
	Tcl_Free(hTablePtr);
	iPtr->assocData = NULL;
    }

In tcl8.6.14 the behavior was different: it first set iPtr->assocData to NULL, then for each assocData it removes hash entry, and after that invokes callback: https://github.com/tcltk/tcl/blob/1d84e70c2decaf650f0f1a41b3de81bb0e19b58e/generic/tclBasic.c#L1539-L1550

The difference in behavior leads to crash if assocdata deletion callback invokes Tcl_DeleteAssocData(). Tcl9 tries to call the callback, callback releases assocdata hash entry, then DeleteInterpProc() continues and releases the hash entry again.

I don't see in documentation, that assocdata deletion callback must not call Tcl_DeleteAssocData(). Also, at least tclvfs is affected by this case: https://github.com/chpock/tclvfs/blob/289dfa5ebf0c7374737c7a1fdef7103a0100b303/generic/vfs.c#L434