Tk Source Code

tkTextDisp.c:8157
If TK_LAYOUT_WITH_BASE_CHUNKS is defined (deafult on macosx),
the fn CharUndisplayProc may invoke the function RemoveFromBaseChunk.

tkTextDisp.c:9094
The fn RemoveFromBaseChunk stores the pointer to the Tcl_DString into a global variable baseCharChunkPtr defined in tkTextDisp.c:478:
/* TODO: Thread safety */
static TkTextDispChunk *baseCharChunkPtr = NULL;

tkTextDisp.c:8965
If the Tk library was compiled with --enable-threads (default on macosx) the fn FreeBaseChunk may free baseCharChunkPtr and set it to NULL.

tkTextDisp.c:9110
The freed Tcl_DString is passed to Tcl_DStringSetLength and causes a crash: EXC_BAD_ACCESS (SIGSEGV)
KERN_INVALID_ADDRESS at 0x0000000000000024

Proposed fix:
Disable TK_LAYOUT_WITH_BASE_CHUNKS when compiled with --enable-threads

The attached script a0c1a9c6c6_sample.tcl reproduces the crash. It needs the Thread package, and on X11 a build with bidi rendering. Several threads relayout text widgets at the same time, and it prints "ok" if it survives:

wish a0c1a9c6c6_sample.tcl ?nthreads? ?seconds?

On Linux/X11 with 4 threads, trunk crashed in all 40 runs, in TkTextCharLayoutProc. Branch text-basechunk-threads passed all 40 runs.

Xft on its own is not thread safe: threads crash in XftGlyphExtents when they use the same font. So the script sets up the threads one at a time and gives each its own font family.

Confirmed, and it is now worse on 9.1: since [8ce823d20c] base chunks are also used on Windows and X11, not only on macOS. On X11, four threads laying out text widgets crash in TkTextCharLayoutProc every time; 9.0 does not crash there.

Fix on text-basechunk-threads: keep baseCharChunkPtr in thread-specific data. Disabling base chunks in threaded builds is not needed. The same change should apply to 8.6 and 9.0 for macOS (untested).