Tk Source Code

View Ticket
Login
Ticket UUID: 8e4fb0281dc96a2f38d910d342eb96f9731ec521
Title: crash in text sync subcommand
Type: Bug Version: trunk
Submitter: emiliano Created on: 2025-12-16 00:58:51
Subsystem: 18. [text] Assigned To: jan.nijtmans
Priority: 7 High Severity: Critical
Status: Closed Last Modified: 2025-12-16 14:42:41
Resolution: Fixed Closed By: jan.nijtmans
    Closed on: 2025-12-16 14:42:41
Description:
The following script crashes both 8.6.14 and trunk on X11

$ cat crash.tcl 
package require Tk
pack [text .text]
.text sync -command {puts 1}
.text sync

After trunk is built with symbols, this is the full backtrace

$ gdb /usr/local/bin/wish9.1 
[...]
(gdb) run crash.tcl 
Starting program: /usr/local/bin/wish9.1 crash.tcl
[...]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff785c09c in TclNREvalObjEx (interp=0x5555555ca040, objPtr=0x0, flags=131072, invoker=0x0, word=0) at /home/emiliano/src/tcl/generic/tclBasic.c:6148
6148	    if (TclListObjIsCanonical(objPtr)) {
(gdb) bt full
#0  0x00007ffff785c09c in TclNREvalObjEx (interp=0x5555555ca040, objPtr=0x0, flags=131072, invoker=0x0, word=0) at /home/emiliano/src/tcl/generic/tclBasic.c:6148
        iPtr = 0x5555555ca040
        result = -140809083
        __PRETTY_FUNCTION__ = "TclNREvalObjEx"
#1  0x00007ffff785c030 in TclEvalObjEx (interp=0x5555555ca040, objPtr=0x0, flags=131072, invoker=0x0, word=0) at /home/emiliano/src/tcl/generic/tclBasic.c:6123
        result = 0
        rootPtr = 0x0
#2  0x00007ffff785bfd8 in Tcl_EvalObjEx (interp=0x5555555ca040, objPtr=0x0, flags=131072) at /home/emiliano/src/tcl/generic/tclBasic.c:6105
No locales.
#3  0x00007ffff7d3d3b1 in TkTextRunAfterSyncCmd (clientData=0x5555556c0df0) at /home/emiliano/src/tk/unix/../generic/tkText.c:5583
        textPtr = 0x5555556c0df0
        code = 21845
#4  0x00007ffff79a5bcf in TclServiceIdle () at /home/emiliano/src/tcl/generic/tclTimer.c:754
        idlePtr = 0x55555588f100
        oldGeneration = 1
        blockTime = {sec = 140737488345856, usec = 140737346084380}
        tsdPtr = 0x555555714ef0
#5  0x00007ffff796c6f5 in Tcl_DoOneEvent (flags=34) at /home/emiliano/src/tcl/generic/tclNotify.c:1037
        result = 0
        oldMode = 0
        sourcePtr = 0x555555649090
        timePtr = 0x555555711b80
        tsdPtr = 0x555555585650
#6  0x00007ffff7ca8cf0 in MapFrame (clientData=0x555555649090) at /home/emiliano/src/tk/unix/../generic/tkFrame.c:1834
        framePtr = 0x555555649090
#7  0x00007ffff79a5bcf in TclServiceIdle () at /home/emiliano/src/tcl/generic/tclTimer.c:754
        idlePtr = 0x555555714ff0
        oldGeneration = 0
        blockTime = {sec = -8589943872, usec = 93824992433744}
        tsdPtr = 0x555555714ef0
#8  0x00007ffff796c6f5 in Tcl_DoOneEvent (flags=-3) at /home/emiliano/src/tcl/generic/tclNotify.c:1037
        result = 0
        oldMode = 0
        sourcePtr = 0x0
        timePtr = 0x555555585680
        tsdPtr = 0x555555585650
#9  0x00007ffff7c66544 in Tk_MainLoop () at /home/emiliano/src/tk/unix/../generic/tkEvent.c:2093
No locales.
#10 0x00007ffff7c7e320 in Tk_MainEx (argc=-1, argv=0x7fffffffdfc8, appInitProc=0x555555555278 <Tcl_AppInit>, interp=0x5555555ca040) at /home/emiliano/src/tk/unix/../generic/tkMain.c:372
        i = 2
        path = 0x555555625430
        argvPtr = 0x555555625460
        appName = 0x555555625430
        encodingName = 0x0
        code = 0
        nullStdin = false
        chan = 0x555555703870
        is = {interp = 0x5555555ca040, input = 0x28daf8abe785c000, command = {string = 0x7fffffffdcb8 "", length = 0, spaceAvl = 200, 
            staticSpace = "\000d\205\367\377\177\000\000\340\334\377\377\004", '\000' <repetidos 19 veces>, "\375\033\235\367\377\177\000\000\320}\243\367\377\177\000\000@\240\\UUU\000\000\020\t`UUU\000\000\336}\243\367\377\177\000\000\000\000\000\000\000\000\000\000@\250\\UUU\000\000@\240\\UUU\000\000\000\300\205\347\253\370\332(@\335\377\377\377\177\000\000AZ\235\367\377\177\000\000\220\353aUUU\000\000@\240\\UUU\000\000\200\336\377\377\377\177\000\000=>\205\367\377\177\000\000P\336\377\377\001\000\000\000@\240\\UUU\000\000@\240\\UUU\000\000\210ǫ\367\377\177\000\000\270(\254\367\377\177\000\000\330i\253\367\377\177\000"}, line = {string = 0x7fffffffdd98 "", length = 0, spaceAvl = 200, 
            staticSpace = "\000\270\\UUU\000\000@\262\\UUU\000\0000g]UUU\000\000@\300\\UUU\000\000`!aUUU\000\000P\aaUUU\000\000`2aUUU\000\000P\376`UUU\000\0000k`UUU\000\000\001\000\000\000UU\000\000\247&\205\367\377\177\000\000\210ǫ\367\377\177", '\000' <repetidos 26 veces>, "\210ǫ\367\377\177\000\000@\254\\UUU\000\000(\037\205\367\377\177\000\000\210ǫ\367\377\177\000\000PVXUUU\000\000\000Jt\366\377\177\001\000::tcl::mathop::ge\000ide\000\000dered\000\177\000"}, tty = false, gotPartial = false}
#11 0x0000555555555271 in main (argc=2, argv=0x7fffffffdfc8) at /home/emiliano/src/tk/unix/../unix/tkAppInit.c:115
No locales.
User Comments: jan.nijtmans added on 2025-12-16 14:42:41:

Fixed [7a3d5b0bfd7a9881|here]

Thanks for the report and the patch!


emiliano added on 2025-12-16 01:33:30:
The patch is against trunk. Same fix should be applied to core-8-6-branch, too.

emiliano added on 2025-12-16 01:26:26:

The problem is this:

  • [$txt sync -command $cmd] schedules and idle call to evaluate $cmd at idle time here.

  • The following [$txt sync] syncs the text info and, if present, removes any stored $cmd, but fails to cancel the idle call here.

  • The callback is called at idle time, and $cmd is now NULL.

The attached patch fixes the crash by removing the idle call.


Attachments: