Tcl Source Code: View Ticket

Ticket UUID:	b24becc2ab302f95e395d9dc2586d421969eee18
Title:	Crash on indexing into abstract lists
Type:	Bug	Created on:	2026-10-25 03:16:59
Submitter:	apnadkarni	Assigned to:	nobody
Subsystem:	- New Builtin Commands	Severity:	Severe
Priority:	5 Medium	Last modified:	2026-10-29 11:56:44
Status:	Closed	Closed by:	apnadkarni
Resolution:	Fixed	Closed on:	2026-10-29 11:56:44
Version:	9.0

Description:
`% package req Tcl 9.0.4 % set x [lseq 1]; lindex $x $x -> NULL pointer access crash`
User Comments:
apnadkarni added on 2026-10-25 04:14:24: `% set x [lseq 1]; [subst lindex] $x $x 0` so crash only occurs on compiled path where the code does not guard against shimmering. A general pattern that the whole code base needs to be examined for is `if (TclObjTypeHasProc(objPtr, XXX)) { ...some code... TclObjTypeXXX(objPtr...) }` where "some code" shimmers objPtr so the TclObjTypeXXX call is no longer valid. apnadkarni added on 2026-10-25 05:59:59: Proposed fix is in place in [b24becc2ab] as part of the bug-0c82728f85 branch that is dealing with various shimmering issues. Leaving open as similar occurrences need to be hunted down. apnadkarni added on 2026-10-25 06:02:29: As an aside, it may be worth optimizing the Tcl_GetIndexFromObj/Tcl_GetNumberFromObj/ParseNumber call tree to not shimmer single element lists but instead parse the first element instead. apnadkarni added on 2026-10-27 10:16:07: Another shimmering crash for the record. This one happens when the abstract list does not define the (optional) `indexProc` method. `% set l [lstring -not INDEX 0] 0 % lindex $l $l -> crash` apnadkarni added on 2026-10-29 11:56:44: Fixed for 9.1 in [54a03368ce] and 9.0 in [d27dbcd1b3].