Tcl Source Code

The following script produces a segmentation fault:

proc main {} {
    eval {
        try {
            lindex 5
        } on ok res {} 
    }
    puts $res
}
main

The issue is:

tclCmdMZ.c:TryPostBody extracts a variable name from a Tcl_Obj, causing a list internal representation to be created on that Tcl_Obj, and the original value of that Tcl_Obj to become the first item in the list, with a refCount of 1.

On the next line, Tcl_ObjSetVar2 is called, and TclObjLookupVarEx subsequently obtains that same Tcl_Obj from the cache of local variable names and frees that same list internal representation.

At this point, part1Ptr is a reference to that freed Tcl_Obj.

closed in [e62a48e964]

Fixed in [4100488a3ca38abf].

See also related ticket [578155d5a1].

I'm for solution with TCL_OWN_OBJREF flag, which is a year ago merged in my own branches and it works there without any issue.