Tcl Source Code

The following script causes a segmentation fault

<code><verbatim>
proc dying {_ args} {
	puts [list $_ is dying]
}

oo::define oo::class {export createWithNamespace}
oo::class createWithNamespace obj1 obj1
::oo::define obj1 {self mixin [self]}

::oo::copy obj1 obj2
::oo::objdefine obj2 {mixin [self]}

::oo::copy obj2 obj3
trace add command obj3 delete [list obj3 dying]
rename obj2 {}
</verbatim></code>

Fixed in commit [5f178e7f03].

The problem lies in TclOO.c/ReleaseClassContents(), in a section that seems to
be about removing a class that has been mixed into one of its instances (an
unusual use case, to say the least):

<code><verbatim>
for(j=0 ; j<instancePtr->mixins.num ; j++) {
    Class *mixin = instancePtr->mixins.list[j];
    if (mixin == clsPtr) {
        instancePtr->mixins.list[j] = NULL;
    }
}
</verbatim></code>

Leaving a <code>NULL<code> in the list breaks expectations.  Instead, that
particular item should be unstitched from the list.