Tcl Source Code

The following script causes a segmentation fault

proc dying {_ args} {
	puts [list $_ is dying]
}

oo::define oo::class {export createWithNamespace}
oo::class createWithNamespace obj1 obj1
::oo::define obj1 {self mixin [self]}

::oo::copy obj1 obj2
::oo::objdefine obj2 {mixin [self]}

::oo::copy obj2 obj3
trace add command obj3 delete [list obj3 dying]
rename obj2 {}

Fixed in commit [5f178e7f03].

The problem lies in TclOO.c/ReleaseClassContents(), in a section that seems to be about removing a class that has been mixed into one of its instances (an unusual use case, to say the least):

for(j=0 ; j<instancePtr->mixins.num ; j++) {
    Class *mixin = instancePtr->mixins.list[j];
    if (mixin == clsPtr) {
        instancePtr->mixins.list[j] = NULL;
    }
}

Leaving a NULL in the list breaks expectations. Instead, that particular item should be unstitched from the list.