[Tcl-bugs] [ tcl-Bugs-589863 ] corruption in execution traces?

[<no...@so...>]

Bugs item #589863, was opened at 2002-08-01 20:05
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=589863&group_id=10894

Category: 39. Memory Allocation
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 9
Submitted By: miguel sofer (msofer)
>Assigned to: miguel sofer (msofer)
Summary: corruption in execution traces?

Initial Comment:
(make test, -DTCL_MEM_DEBUG):

==== trace-24.5 delete trace during all exec traces
except enter FAILED
==== Contents of test case:

    set info {}
    trace add execution foo {leave enterstep leavestep}
[list traceDelete foo]
    foo 1
    list $info [trace info execution foo]

---- Result was:
{{set b 1} entersdep} {}
---- Result should have been (exact matching):
{{set b 1} enterstep} {}
==== trace-24.5 FAILED

Note the corrupted "entersdep" ...

----------------------------------------------------------------------

>Comment By: miguel sofer (msofer)
Date: 2002-08-22 12:59

Message:
Logged In: YES 
user_id=148712

Yes, the patch fixes the issue. Already committed, thanks
Hemang!

----------------------------------------------------------------------

Comment By: Hemang Lavana (hemanglavana)
Date: 2002-08-22 11:53

Message:
Logged In: YES 
user_id=81875

The upload button doesn't show up on my browser, so I
am attaching the patch here. Please verify whether it resolves
the memory problem or not.

Index: tclBasic.c
===================================================================
RCS file: /cvsroot/tcl/tcl/generic/tclBasic.c,v
retrieving revision 1.68
diff -r1.68 tclBasic.c
5026c5026
<     ckfree( (char*) tracePtr );
---
>     Tcl_EventuallyFree( (char*) tracePtr, TCL_DYNAMIC);
Index: tclCmdMZ.c
===================================================================
RCS file: /cvsroot/tcl/tcl/generic/tclCmdMZ.c,v
retrieving revision 1.75
diff -r1.75 tclCmdMZ.c
4137a4138,4145
>             /*
>              * The proc invoked might delete the traced
command which 
>              * which might try to free tracePtr.  We want
to use tracePtr
>              * until the end of this if section, so we use
>              * Tcl_Preserve() and Tcl_Release() to be sure
it is not
>              * freed while we still need it.
>              */
>           Tcl_Preserve((ClientData) tracePtr);
4159a4168
>           Tcl_Release((ClientData) tracePtr);


----------------------------------------------------------------------

Comment By: miguel sofer (msofer)
Date: 2002-08-12 09:25

Message:
Logged In: YES 
user_id=148712

Committed the UMR fix to HEAD: "better intitialize to
possibly wrong values than using unitialised memory".

The read/write of freed memory is still there.

----------------------------------------------------------------------

Comment By: miguel sofer (msofer)
Date: 2002-08-07 17:45

Message:
Logged In: YES 
user_id=148712

Bug 547534 probably refers to this same problem. dkf's
original report is:

 Yuck. With a recent build of Tcl (not quite the HEAD)
I found this:
% proc bar {ctx from to op} {
puts [incr ::i]:[info level 0]
rename $from {}
}
% proc foo args {}
% trace add command foo delete "bar 1"
% trace add command foo delete "bar 2"
% trace add command foo delete "bar 3"
% rename foo {}
1:bar 3 foo {} delete
2:bar 2 foo {} delete
3:bar 1 elete {} delete
Looks like there's some memory corruption in there!

----------------------------------------------------------------------

Comment By: miguel sofer (msofer)
Date: 2002-08-07 12:39

Message:
Logged In: YES 
user_id=148712

Vince, can you please take a look at this? Maybe you
and/orHemang can help sort it out.


----------------------------------------------------------------------

Comment By: Donal K. Fellows (dkf)
Date: 2002-08-07 09:40

Message:
Logged In: YES 
user_id=79902

Looks good to me (or at least definitely not bad!)

----------------------------------------------------------------------

Comment By: miguel sofer (msofer)
Date: 2002-08-06 13:45

Message:
Logged In: YES 
user_id=148712

Attached a patch that seems to solve the UMR issue - Jeff,
could you confirm this is OK?

Wrt the invalid read/write in TclCheckInterpTraces
(tclCmdMZ.c:4157): this seems to be the cause of the above
corruption, the error is triggered by 24.5 and also by
25.10: after calling the trace procedure, we update the
trace flags and set a pointer to the struct. Trouble is, the
trace procedure freed the struct's memory. Maybe we should
Tcl_Preserve the Trace structure?

----------------------------------------------------------------------

Comment By: miguel sofer (msofer)
Date: 2002-08-05 17:56

Message:
Logged In: YES 
user_id=148712

There is definitely a memory problem with delete traces; I
enclose a summary of the relevant errors detected by
valgrind running with -DPURIFY.

In particular, it reports a read/write of freed memory in
test 24.5

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=589863&group_id=10894