Tcl Source Code

When passed as a file to tclsh, the following script, with eva missing the final l, results in a segmentation fault:

    namespace eva n1 {error hello}

An alternate script that produces the same result is:

    namespace eval n1 {
        namespace ensemble create
        namespace export *
        proc p1 args {error hello}
    }
    namespace eva n1 {::n1 p1}

The reason is that TclSpellFix sets NULL as the first object pointer in iPtr->ensembleRewrite.sourceObjs and then later, in NRNamespaceEvalCmd, TclFetchEnsembleRoot copies a pointer to this array into framePtr->objv. Next, when an error occurs, TclLogCommandInfo accesses this array and trips on the NULL, causing the segmentation fault.