Tk Source Code

Reported by Ramon Ribó on CLT:

interp create local
local eval { set argc 0 ; set argv "" }
local eval source notebook.tcl
interp delete local

where notebook is the nice Notebook App in
http://mini.net/cgi-bin/wikit/3712

(needs BWidgets and other packages installed)

Stack trace:

Crash because TclLookupVar is being passed NULL for part1.

#0  0x1201c8394 in TclLookupVar (interp=0x12043b620,
part1=0x0, part2=0x0, 
    flags=1, msg=0x120216be7 "set", createPart1=1,
createPart2=1, 
    arrayPtrPtr=0x11fffe5c0) at ./../generic/tclVar.c:236
#1  0x1201ca084 in Tcl_SetVar2Ex (interp=0x12043b620,
part1=0x0, part2=0x0, 
    newValuePtr=0x12051bac0, flags=1) at
./../generic/tclVar.c:1430
#2  0x1201c9f80 in Tcl_SetVar2 (interp=0x12043b620,
part1=0x0, part2=0x0, 
    newValue=0x1205ba810 "", flags=1) at
./../generic/tclVar.c:1367
#3  0x1201c9ecc in Tcl_SetVar (interp=0x12043b620,
varName=0x0, 
    newValue=0x1205ba810 "", flags=1) at
./../generic/tclVar.c:1311
#4  0x1200392cc in EntryTextVarProc
(clientData=0x1205ba5c0, 
    interp=0x12043b620, name1=0x1205312c0 "", 
    name2=0x12054ad40 ".pb-searchtext", flags=192)
    at /local/src/tk/unix/../generic/tkEntry.c:3305
#5  0x1201ceef8 in CallVarTraces (iPtr=0x12043b620,
arrayPtr=0x0, 
    varPtr=0x12054ad60, part1=0x1205312c0 "", 
    part2=0x12054ad40 ".pb-searchtext", flags=192,
leaveErrMsg=0)
    at ./../generic/tclVar.c:4188
#6  0x1201cff40 in DeleteArray (iPtr=0x12043b620,
arrayName=0x1205312c0 "", 
    varPtr=0x120576df0, flags=64) at
./../generic/tclVar.c:4769
#7  0x1201cf8b0 in TclDeleteVars (iPtr=0x12043b620,
tablePtr=0x120589ac8)
    at ./../generic/tclVar.c:4573
#8  0x12019ede8 in TclTeardownNamespace (nsPtr=0x1205899d0)
    at ./../generic/tclNamesp.c:761
#9  0x12019eb04 in Tcl_DeleteNamespace
(namespacePtr=0x1205899d0)
    at ./../generic/tclNamesp.c:640
#10 0x12019eea0 in TclTeardownNamespace (nsPtr=0x1204df7a0)
    at ./../generic/tclNamesp.c:791
#11 0x12019eb04 in Tcl_DeleteNamespace
(namespacePtr=0x1204df7a0)
    at ./../generic/tclNamesp.c:640
#12 0x12019eea0 in TclTeardownNamespace (nsPtr=0x12043b920)
    at ./../generic/tclNamesp.c:791
#13 0x120119e14 in DeleteInterpProc (interp=0x12043b620)
    at ./../generic/tclBasic.c:990
#14 0x1201b3504 in Tcl_EventuallyFree
(clientData=0x12043b620, 
    freeProc=0x120119d80 <DeleteInterpProc>) at
./../generic/tclPreserve.c:313
#15 0x120119d60 in Tcl_DeleteInterp (interp=0x12043b620)
    at ./../generic/tclBasic.c:927
#16 0x12017e7d0 in SlaveObjCmdDeleteProc
(clientData=0x12043b620)
    at ./../generic/tclInterp.c:2031
#17 0x12011be5c in Tcl_DeleteCommandFromToken
(interp=0x1203462f0, 
    cmd=0x1203d8bc0) at ./../generic/tclBasic.c:2447
#18 0x12017b544 in Tcl_InterpObjCmd (clientData=0x0,
interp=0x1203462f0, 
    objc=3, objv=0x11ffff080) at
./../generic/tclInterp.c:511
#19 0x12011cf3c in TclEvalObjvInternal
(interp=0x1203462f0, objc=3, 
    objv=0x11ffff080, command=0x12043b5d4 "interp
delete local\n", length=20, 
    flags=0) at ./../generic/tclBasic.c:3033
#20 0x12011e05c in Tcl_EvalEx (interp=0x1203462f0, 
    script=0x12043aef0 "interp create local\nlocal eval
[list set argc 0]\nlocal eval [list set argv {}]\nlocal
eval {\nset notebookVersion \"V0.9\"\npackage require
Tk\nset appdir [file dirname [info script]]\nlappend
auto_path [fil"..., 
    numBytes=1784, flags=0) at ./../generic/tclBasic.c:3631
#21 0x120191608 in Tcl_FSEvalFile (interp=0x1203462f0,
pathPtr=0x1203b76b0)
    at ./../generic/tclIOUtil.c:1371
#22 0x120190288 in Tcl_EvalFile (interp=0x1203462f0, 
    fileName=0x11ffff3e8 "crash.tcl") at
./../generic/tclIOUtil.c:234
#23 0x12001b348 in Tk_MainEx (argc=1, argv=0x11ffff550, 
    appInitProc=0x12001ae80 <Tcl_AppInit>,
interp=0x1203462f0)
    at /local/src/tk/unix/../generic/tkMain.c:234
#24 0x12001ae58 in main (argc=2, argv=0x11ffff548)
    at /local/src/tk/unix/tkAppInit.c:68

Logged In: YES 
user_id=80530

patch committed.

Logged In: YES 
user_id=148712

Patch looks fine, passes testsuite, no leaks. I didn't test
if it fixes the bug, but don surely did that already ...

File Added - 30496: delvar.patch

Logged In: YES 
user_id=80530


Here's the patch that makes TclDeleteVars set the
TCL_INTERP_DESTROYED flag as described in
TraceVar.3.  This corrects the reported segfault.
solving the immediate issue.

In the longer term,  this bug suggests several improvements:
1) Add a Tcl_Panic() to TclLookupVar when part1=NULL.
2) The flag value TCL_INTERP_DESTROYED isn't really
    needed, as the trace procedure can always call
    Tcl_InterpDeleted() itself.  Two ways just leads to
confusion
    and bugs, as seen here.
3) Should add a flag value that indicates the namespace (or
    perhaps more generally, the variable context) containing the
    variablle is being destroyed.  This is different from interp
    desctruction, but something the trace procedure may need
    to know.

Logged In: YES 
user_id=80530

ok, just read TraceVar.3,  patch coming.

Logged In: YES 
user_id=80530


sorry, no that's not really right.  While perhaps [entry]
should not recreate a textvariable in a namespace
that's being deleted, there's no flag being passed
that could indicate that's what's happening, so it's
still Tcl's fault.

All EntryTextVarProc is getting is 
(TCL_TRACE_UNSETS | TCL_TRACE_DESTROYED).
It needs some other signal that it should not re-create
its textvariable.

Logged In: YES 
user_id=80530

TclDeleteVars passes TCL_INTERP_DESTROYED
only when it's deleting vars in the global namespace.
Once again, confusion that the global namespace
is somehow "special" and needs special hacks gets
us into trouble.  A namespace is a namespace.

Arguably, [entry] should not re-create its text variable
when the namespace in which that text variable lives
is being destroyed.  So perhaps a Tk [entry] bug after all.

Logged In: YES 
user_id=80530

Tracing futher it appears that DeleteArray()
is failing to pass along the TCL_INTERP_DESTROYED
flag in its call to CallVarTraces().

Really a Tcl bug after all then?

Logged In: YES 
user_id=80530

stack trace appears to show the trouble comes from
EntryTextVarProc() passing a NULL varName to
Tcl_SetVar().