| Ticket UUID: | bb937366b4cf197080c1818d477cd519f24f3744 | ||
| Title: | macOS Aqua : crash with Tcl_UtfToChar16 | ||
| Type: | Bug | Created on: | 2021-04-30 17:47:14 |
| Submitter: | sl1200mk2 | Assigned to: | jan.nijtmans |
| Subsystem: | 44. UTF-8 Strings | Severity: | Minor |
| Priority: | 5 Medium | Last modified: | 2021-05-21 08:00:42 |
| Status: | Closed | Closed by: | jan.nijtmans |
| Resolution: | Fixed | Closed on: | 2021-05-21 08:00:42 |
| Version: | 8.7a4 | ||
| Description: | ||||
Hi Jan,
using latest core-8-branch of Tcl, some users have reported this crash.
(for the record, it's used withe mac_styles_87 branch merged with glyph_index_2 branch)
do you want me to try to get a more precise crash log or that's enough?
best regards,
nicolas
Date/Time: 2021-04-25 12:15:42.213 +0200
OS Version: Mac OS X 10.15.7 (19H524)
Report Version: 12
Anonymous UUID: DA9D897C-AEE6-4088-ADD9-01A638CA0ECC
Time Awake Since Boot: 480 seconds
System Integrity Protection: disabled
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00007f9d51000000
Exception Note: EXC_CORPSE_NOTIFY
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [578]
VM Regions Near 0x7f9d51000000:
MALLOC_SMALL 00007f9d50800000-00007f9d51000000 [ 8192K] rw-/rwx SM=PRV
-->
STACK GUARD 00007ffedc29a000-00007ffedfa9a000 [ 56.0M] ---/rwx SM=NUL stack guard for thread 0
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 Tcl 0x000000010feacf64 Tcl_UtfToChar16 + 4
1 Tk 0x000000010ff90ff3 0x10ff56000 + 241651
2 Tk 0x000000011002a467 0x10ff56000 + 869479
3 Tk 0x000000011003983c 0x10ff56000 + 931900
4 Tk 0x0000000110042b7b 0x10ff56000 + 969595
5 Tcl 0x000000010fdc3843 0x10fda3000 + 133187
6 Tcl 0x000000010fdbf86a Tcl_EvalObjv + 378
7 Tcl 0x000000010fdc114b 0x10fda3000 + 123211
8 Tcl 0x000000010fdc067a Tcl_EvalEx + 26
9 Tk 0x000000010ff60db5 Tk_BindEvent + 6373
10 Tk 0x000000010ff68538 TkBindEventProc + 360
11 Tk 0x000000010ff7076e Tk_HandleEvent + 974
12 Tk 0x000000010ff70eb4 0x10ff56000 + 110260
13 Tcl 0x000000010fe8283c Tcl_ServiceEvent + 156
14 Tcl 0x000000010fe82b48 Tcl_DoOneEvent + 392
15 Tk 0x000000010ff713db Tk_MainLoop + 43
16 Tk 0x000000010ff82adc Tk_MainEx + 1452
17 com.LightingStudioDevice.DLight 0x000000010fb8a7cc main + 300
| ||||
| User Comments: | ||||
jan.nijtmans added on 2021-05-01 16:53:59:
Thanks, Nicolas. Well, I don't think this is a Tcl 8.7 bug, most likely Tcl_UtfToChar16 is called with a non-null-terminated string without the proper protection. That's Tk's fault. I previously mentioned that glyph_index_2 is not production-ready yet, that's the branch I suspect is containing the bug. Does the mac_styles_87 branch as-is have the same problem? If not, that's proof of my theory. Yes, I would like a stack-trace, so I can see at least where in Tk the Tcl_UtfToChar16 call is located. fvogel added on 2021-05-01 17:12:13:
Well, Tcl_UtfToChar16 is called at exactly one place in Tk 8.7. fvogel added on 2021-05-01 17:13:21:
Oops, forget about this. That call is for Tcl_UtfToChar16DString. Sorry. jan.nijtmans added on 2021-05-02 16:17:23:
There are two Tcl_UtfToUniChar() calls (which is actually Tcl_UtfToChar16() when TCL_UTF_MAX=3) in TkUniCharToUtf(). But there are 16 TkUniCharToUtf() calls in (generic part of) Tk, so it would help if I knew which of those 16 calls is responsible for this crash. sl1200mk2 added on 2021-05-02 16:27:20:
Hi Jan, yes I've understood. I'll send versions of my app compiled as debug and report here. ++ sl1200mk2 added on 2021-05-03 16:30:21:
Hi Jan, after a day of (hard) trying the crash did not occurs again. It was related to a ttk::entry, so I wonder if François's recent fix did solve the issue... the guy that have the computer that's crashing will try again tomorrow. ++ jan.nijtmans added on 2021-05-03 19:50:23:
François's fix indeed fixed an index underflow in ttk::entry, so this might very well be the cause. Thanks for letting us know. If it cannot be reproduced any more, this one can be closed as duplicate. I'll wait a little bit to be sure. fvogel added on 2021-05-04 06:07:52:
You could also try to revert the fix [fee2e853] in ttk::entry and possibly get the crash back (if it's the cause). sl1200mk2 added on 2021-05-04 14:54:56:
Hi François, I did what you suggest (with latest mac_styles_87 + glyph_index_2 branch) but we were not able to reproduce it... I didn't kept Tcl/Tk versions that were used when the crash happens, sorry... ++ sl1200mk2 added on 2021-05-05 13:15:34:
I finally got it... in a version of Tk that do contains recent François fix I was just trying to insert 21 in a ttk::entry embedded in a tableList Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 Tcl 0x0000000101902d44 Tcl_UtfToChar16 + 4 1 Tk 0x00000001019e6663 TkUtfAtIndex + 67 2 Tk 0x0000000101a68549 InsertChars + 41 3 Tk 0x0000000101a67577 EntryInsertCommand + 103 4 Tk 0x0000000101a75a56 Ttk_InvokeEnsemble + 166 5 Tk 0x0000000101a7ce3b WidgetInstanceObjCmd + 75 6 Tcl 0x0000000101827660 Dispatch + 176 7 Tcl 0x0000000101824973 TclNRRunCallbacks + 115 8 Tcl 0x00000001018247da Tcl_EvalObjv + 42 9 Tcl 0x00000001018257b8 TclEvalEx + 2104 10 Tcl 0x0000000101824f7a Tcl_EvalEx + 26 11 Tk 0x00000001019bad01 Tk_BindEvent + 3137 12 Tk 0x00000001019c30de TkBindEventProc + 382 13 Tk 0x00000001019ca9ec Tk_HandleEvent + 460 14 Tk 0x00000001019cb3a0 WindowEventProc + 96 15 Tcl 0x00000001018db74c Tcl_ServiceEvent + 156 16 Tcl 0x00000001018dba38 Tcl_DoOneEvent + 376 17 Tk 0x00000001019cb87b Tk_MainLoop + 43 18 Tk 0x00000001019d9857 Tk_MainEx + 1255 19 com.LightingStudioDevice.DLight 0x00000001015cc61c main + 124 (main.c:783) 20 libdyld.dylib 0x00007fff2071ff3d start + 1 ++ jan.nijtmans added on 2021-05-07 21:04:09:
This should be fixed now, in the latest commif of the "glyph_index_2" branch. sl1200mk2 added on 2021-05-12 16:34:50:
Hi Jan, the crash didn't pop up since your fix. thanks, ++ | ||||