Tcl Source Code

The following script produces a segmentation fault:

proc main {} {
    eval {
        try {
            lindex 5
        } on ok res {} 
    }
    puts $res
}
main

The issue is:

tclCmdMZ.c:TryPostBody extracts a variable name from a Tcl_Obj, causing a list internal representation to be created on that Tcl_Obj, and the original value of that Tcl_Obj to become the first item in the list, with a refCount of 1.

On the next line, Tcl_ObjSetVar2 is called, and TclObjLookupVarEx subsequently obtains that same Tcl_Obj from the cache of local variable names and frees that same list internal representation.

At this point, part1Ptr is a reference to that freed Tcl_Obj.