[Tcl-bugs] [ tcl-Bugs-1482718 ] crash after removing trace in recursive call

[SourceForge.net <no...@so...>]

Bugs item #1482718, was opened at 2006-05-05 15:57
Message generated for change (Comment added) made by dgp
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=1482718&group_id=10894

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
>Category: 07. Variables
Group: development: 8.4.14
Status: Open
Resolution: None
Priority: 9
Submitted By: Yevgen Ryazanov (eugene_cdn)
>Assigned to: miguel sofer (msofer)
Summary: crash after removing trace in recursive call

Initial Comment:
OS: Solaris 5.8.
Removing trace on second level of recursive call can
corrupt or substitute wrong number of compiled
variables for first level of recursion. Then, on
return, TclLookupSimpleVar() will have two different
values of number of compiled variables in
   procPtr->numCompiledLocals (5)
and
   varFramePtr->numCompiledLocals (3)
at tclVar.c, line 818.
Then loop for all variables (line 823) will use bigger
value, procPtr->numCompiledLocals, and it will crash on
accessing varFramePtr->compiledLocals out of bound.
Please use attached testcase for reproducing the bug.


----------------------------------------------------------------------

>Comment By: Don Porter (dgp)
Date: 2006-05-08 15:32

Message:
Logged In: YES 
user_id=80530


Traces are probably involved,
but the root cause of the
crash appears to be corruption
of a Var struct, so let's bring
the Var expert in on this.

Miguel, the crash happens at
line 828 of tclVar.c where
localVarPtr->name has a bogus
value, even though
localVarPtr->refCount is 19.

Any hints?


----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2006-05-06 00:30

Message:
Logged In: YES 
user_id=80530


looks like it's still there in 8.4.13.

Upping priority to see if it can
get resolved before 8.4.14.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=1482718&group_id=10894