Tcl Source Code

Here's the real bug I've been striving to demonstrate,
recording mismatches with exec tracing capability
along the way.

oo::object create foo
oo::objdefine foo {
    method target {} {puts Hit!}
    forward bar my target
    method bump {} {
        set ns [info object namespace ::foo]
        rename ${ns}::my ${ns}::
        rename ${ns}:: ${ns}::my
    }
}
proc harness {} {
    foo target
    foo bar
}
proc handle {cmd args} {
    foo bump
}
trace add execution harness enterstep handle
proc my {method} {
    puts Missed!
}
harness

Output:

Hit!
Missed!

The re-resolution of "my" happens in the wrong
context.

Comparing with the machinery in [tailcall], I think
this one has a simple fix.

Finally getting back to closing this...

committed to core-8-5-branch

Here's the patch:

Index: generic/tclBasic.c
==================================================================
--- generic/tclBasic.c
+++ generic/tclBasic.c
@@ -3650,10 +3650,11 @@

        if (cmdEpoch != newEpoch) {
            checkTraces = 0;
            if (commandPtr) {
                Tcl_DecrRefCount(commandPtr);
+               commandPtr = NULL;
            }
            goto reparseBecauseOfTraces;
        }
     }

Looks like the problem is refCount management
of the commandPtr in the TclEvalObjvInternal() routine.

(There's a list inside AppendPrintfToObjVA that should only have a single reference to it and which should — in this case — end up with four elements in it, and which is never passed externally, but it is ending up with two references and 5 elements, at which point Tcl_ListObjAppendElement gets rightfully upset. Real WTF moment.)

And I can't see where it is happening at all. :-(

The 8.5 crash seems to be an "impossible" case. Memory corruption suspected.

And that appears to be a bug in Tcl 8.5.

And the new tests cause a panic under 8.5!

  Tcl_ListObjAppendElement called with shared object

That bumps it right to highest priority.

Flushing that cache in that way shouldn't cause that. Ick.

Branch bug-3610404 has the one-liner fix.