Tk Source Code

Found on Windows 11, with tcl/tk 9.0.2 build from source with the icx compiler. We have not been able to reproduce it when using MinGW instead.

To reproduce:

--------------------------------------------------------------

set top [toplevel .top2]

update

after 10000

# Click on .top2 until Windows marks it as "not responding". When the .top2 is not interacted with the crash does not happen.

# The application crashes here
::destroy $top

--------------------------------------------------------------

When running our application (not wish, we do not have a functional wish on Windows for testing this with) under a sanitizer, we get the following report (with some paths redacted):

--------------------------------------------------------------

######/tcl/tk9.0.2/win/tkWinWindow.c:145:40: runtime error: member access within null pointer of type 'TkWinDrawable'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ######/tcl/tk9.0.2/win/tkWinWindow.c:145:40
######/tcl/tk9.0.2/win/tkWinWindow.c:145:40: runtime error: member access within null pointer of type 'TkWinWindow'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ######/tcl/tk9.0.2/win/tkWinWindow.c:145:40
=================================================================
==14692==ERROR: AddressSanitizer: access-violation on unknown address 0x000000000008 (pc 0x7ff7f477f337 bp 0x0008a77b00a0 sp 0x0008a77aff60 T0)
==14692==The signal is caused by a READ memory access.
==14692==Hint: address points to the zero page.
    #0 0x7ff7f477f336 in Tk_GetHWND ######\tcl\tk9.0.2\win\tkWinWindow.c:145
    #1 0x7ff7f47043a0 in CheckForPointer ######\tcl\tk9.0.2\win\tkWinWm.c:2513
    #2 0x7ff7f47043a0 in TkWmDeadWindow ######\tcl\tk9.0.2\win\tkWinWm.c:2671
    #3 0x7ff7f4523065 in Tk_DestroyWindow ######\tcl\tk9.0.2\generic\tkWindow.c:1569
    #4 0x7ff7f478e59d in Tk_DestroyObjCmd ######\tcl\tk9.0.2\generic\tkCmds.c:501
    #5 0x7ff7f4eb5311 in Tcl_EvalObjv (######\app.exe+0x141e85311)
    #6 0x7ff7f4eb67a6 in TclEvalEx (######\app.exe+0x141e867a6)
    #7 0x7ff7f4eb5bef in Tcl_EvalEx (######\app.exe+0x141e85bef)
    #8 0x7ff7f3133b8e in ######
    #9 0x7ff7f31161fe in ######
    #10 0x7ff7f303223c in ######
    #11 0x7ff7f453d9b9 in Tk_MainEx ######\tcl\tk9.0.2\generic\tkMain.c:312
    #12 0x7ff7f745f240 in main ######
    #13 0x7ff7f72ad09f in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #14 0x7ff7f72ad09f in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #15 0x7ffd57eae8d6  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
    #16 0x7ffd59da8d9b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180008d9b)

==14692==Register values:
rax = 1  rbx = 8a77b0020  rcx = 8  rdx = 0
rdi = 1c5e1d80000  rsi = 0  rbp = 8a77b00a0  rsp = 8a77aff60
r8  = 0  r9  = 8a77af298  r10 = 0  r11 = 200246
r12 = 1c59285b560  r13 = 1fe9428b6ac  r14 = 1c59285b560  r15 = 1c5e1d80000
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: access-violation ######\tcl\tk9.0.2\win\tkWinWindow.c:145 in Tk_GetHWND
==14692==ABORTING

--------------------------------------------------------------

Merged into main, core-9-0-branch, and core-8-6-branch by commits [e2cb4db7] (Jan), [28aeb921], and [65f603c2]. Closing the ticket.

Reproduced on Windows 11 with an MSVC build. When the toplevel is destroyed, TkWmStackorderToplevel() expects to find all mapped toplevels with EnumWindows(), but the wrapper of the toplevel being destroyed is already gone (and after the "not responding" episode the toplevel is still flagged as mapped), so the first slot of the returned array stays uninitialized and CheckForPointer() dereferences it. Fixed on branch win-stackorder-dead-toplevel in [502eb15e23].