Tk Source Code

Calling Tk_FindPhoto() after the main window goes away crashes Tk. The sequence is

• Tk_FindPhoto() in generic/tkImgPhoto.c calls Tk_GetImageModelData() here.

• Tk_GetImageModelData() in generic/tkImage.c calls Tk_MainWindow() here. At this point, winPtr is NULL (application destroyed).

• Right after it calls Tcl_FindHashEntry() here. The program segfaults.

A minimal script to reproduce:

# file crash.tcl
# get extension from https://chiselapp.com/user/egavilan/repository/photorotate
package require photorotate
update
destroy .
photorotate dummy dummy 0.0

Here, photorotate calls Tk_FindPhoto() on their two first arguments. Running it

$ make shell SCRIPT=crash.tcl 
make: *** [Makefile:254: shell] Segmentation fault (core dumped)

The solution is to return NULL if winPtr is NULL. Patch is attached.