Tcl Source Code

The attached script causes a segfault, as discussed on the chat with aku and kbk.

allow_comments - 1

Fixes committed to head and 8.5 branch.

The attached fixes (represented by unidiff patches) pass the segfault.tcl.
This example does not crash any longer.

File Added - 368854: patch-86

File Added - 368853: patch-85

The problem is equivalent to 2921116, except for reflected channel instead of reflected transform.

The crashing script deeply nests through the script handler of the channel, then destroys the channel very deeply in the stack, and during the unwinding process it tries to invoke the script handler at a point where the structure is already destroyed, with bogus interp and other pointers.

This can be seen very nicely in the modified segfault.tcl script where I changed the logging to show the nesting structure of Tcl procedures. The nesting does occur because of the immediate posting of events in some places, calling immediately back into the Tcl layer. This is why defering this action via 'after' is a workaround. It prevents the nesting and thus each callback into the channel handler can be sure to have the C structure whole and complete for the lifetime of its operation.

Now working on the fix (Tcl_Preserve/Release the C level ReflectedChannel structure to keep it alive while there are references to it in C and Tcl stacks).

File Added - 368848: segfault-log.txt

File Added - 368847: segfault.tcl

File Deleted - 368655: 



File Added - 368657: valgrind.out

File Added - 368655: valgrind.out

File Added - 368654: segfault.tcl