Tcl Source Code

set l [lseq 5]
lset l 1 0 X
for {set i 0} {$i < 2000} {incr i} {lappend z [list $i]}

On an -O2 build the loop segfaults (TclThreadAllocObj, object pool corrupted). On a --enable-symbols=mem build it panics at once: Tcl_DbIncrRefCount: Tcl_Obj allocated in another thread, from TclListObjSetElement (tclListObj.c:3289) called by TclLsetFlat (tclListObj.c:3108).

Same with lset l {1 0} X, with lreverse [lseq 5] and lrange [lseq 10] 2 6 as the list, and after a lindex $l 1 has run on the lseq list. Not affected: single-index lset, native lists, lrepeat.

Cause: in TclLsetFlat, elemPtrs comes from Tcl_ListObjGetElements on the arithseries list, i.e. its cached element array, with no reference added. subListObj = elemPtrs[index] is then passed to TclListObjSetElement(parentList, index, subListObj). That call converts the abstract list to a native list (SetListFromAny, building new elements through indexProc) and frees the arithseries internal rep, including the cache, so subListObj (refCount 1, owned only by the cache) is freed before it is stored. A fix could be to take a reference on subListObj around the conversion, or to convert parentList to a native list before reading elemPtrs.

Found by mutation testing of the abstract-list code (using claude, so can't say i understand his reasoning). But it crashes my windows wish91.exe