Tk Source Code

$ make test TESTFLAGS="-file textDisp.test -match textDisp-26.14.2"
...
Running tests that match:  textDisp-26.14.2
...
Only running test files that match:  textDisp.test
Tests began at 2026-10-01 11:55:50 EDT
textDisp.test
make: *** [Makefile:751: test-classic] Segmentation fault

Merged into trunk in [256eb803be]. No backport is needed: in 9.0 and 8.6 a chunk ending in a tab is always a break opportunity, so the line is never wrapped before it, and textDisp-26.14.* is valgrind-clean on both branches.

Reproduced with a --disable-bidi build; the default build passes, but reads freed memory too. When a line is wrapped before the last tab (here, between two consecutive tabs), LayoutDLine frees that tab's chunk and then passes it to AdjustForTab.

Proposed fix in branch [text-tab-chunk-free].

Program received signal SIGSEGV, Segmentation fault.
AdjustForTab (textPtr=0x5555568d1500, tabArrayPtr=0x0, index=4, chunkPtr=0x555556bd0150) at /home/dgp/fossil/tk/unix/../generic/tkTextDisp.c:9278
9278	    x = chunkPtr->nextPtr->x;
(gdb) bt
#0  AdjustForTab
    (textPtr=0x5555568d1500, tabArrayPtr=0x0, index=4, chunkPtr=0x555556bd0150)
    at /home/dgp/fossil/tk/unix/../generic/tkTextDisp.c:9278
#1  0x000055555598e587 in LayoutDLine
    (textPtr=0x5555568d1500, indexPtr=0x7fffffffd350)
    at /home/dgp/fossil/tk/unix/../generic/tkTextDisp.c:1834
#2  0x000055555598ebb6 in UpdateDisplayInfo (textPtr=0x5555568d1500)
    at /home/dgp/fossil/tk/unix/../generic/tkTextDisp.c:2026
#3  0x000055555599806f in TkTextIndexBbox
    (textPtr=0x5555568d1500, indexPtr=0x555556bf5690, xPtr=0x7fffffffd498, yPtr=0x7fffffffd4b8, widthPtr=0x7fffffffd670, heightPtr=0x7fffffffd690, charWidthPtr=0x7fffffffd3fc, cursorWidthPtr=0x0)
    at /home/dgp/fossil/tk/unix/../generic/tkTextDisp.c:7611
#4  0x0000555555978eaf in TextWidgetObjCmd
    (clientData=0x5555568d1500, interp=0x5555562f94e0, objc=3, objv=0x5555564c9dd8) at /home/dgp/fossil/tk/unix/../generic/tkText.c:727
#5  0x0000555555a8892c in Dispatch
    (data=0x555556e9d688, interp=0x5555562f94e0, dummy4662=0)
    at /home/dgp/fossil/tcl/generic/tclBasic.c:4702
#6  0x0000555555a88997 in TclNRRunCallbacks
    (interp=0x5555562f94e0, result=0, rootPtr=0x0)
    at /home/dgp/fossil/tcl/generic/tclBasic.c:4718
#7  0x0000555555a8808f in Tcl_EvalObjv
    (interp=0x5555562f94e0, objc=3, objv=0x5555564c8c80, flags=2097168)
    at /home/dgp/fossil/tcl/generic/tclBasic.c:4457
#8  0x0000555555a8ad32 in TclEvalEx
    (interp=0x5555562f94e0, script=0x5555564a7070 "# all.tcl --\n#\n# This file contains a top-level script to run all of the Tk\n# tests. Execute it by invoking \"source all.tcl\" when running tktest\n# in this directory.\n#\n# Copyright © 1998-1999 Scripti"..., numBytes=2466, flags=0, line=81, clNextOuter=0x0, outerScript=0x5555564a7070 "# all.tcl --\n#\n# This file contains a top-level script to run all of the Tk\n# tests. Execute it by invoking \"source all.tcl\" when running tktest\n# in this directory.\n#\n# Copyright © 1998-1999 Scripti"...)
    at /home/dgp/fossil/tcl/generic/tclBasic.c:5545
#9  0x0000555555b841b2 in Tcl_FSEvalFileEx
    (interp=0x5555562f94e0, pathPtr=0x555556346240, encodingName=0x5555560976c9 "utf-8") at /home/dgp/fossil/tcl/generic/tclIOUtil.c:1792
#10 0x00005555558e542f in Tk_MainEx
    (argc=-1, argv=0x7fffffffde58, appInitProc=0x5555558e4e88 <Tcl_AppInit>, interp=0x5555562f94e0) at /home/dgp/fossil/tk/unix/../generic/tkMain.c:324
#11 0x00005555558e4e81 in main (argc=2, argv=0x7fffffffde58)
    at /home/dgp/fossil/tk/unix/../unix/tkAppInit.c:115