[Tcl-bugs] [ tktoolkit-Patches-1737288 ] Text segfault with Modified event after delete

[SourceForge.net <no...@so...>]

Patches item #1737288, was opened at 2007-06-14 16:47
Message generated for change (Settings changed) made by dkf
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=312997&aid=1737288&group_id=12997

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: 18. [text]
Group: None
Status: Open
Resolution: None
>Priority: 9
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Jeffrey Hobbs (hobbs)
Summary: Text segfault with Modified event after delete

Initial Comment:
8.4 text widget has problems when processing <<Modified>> event caused by delete. This segfaults once the widget gets focus (sorry, I cannot test 8.5):

#!/usr/bin/wish8.4
text .t
.t insert insert x
bind .t <<Modified>> update
.t edit modified 0
pack .t

update
after 4000
.t delete 1.0 1.1

Alternatively, use just the first 6 lines, click in the left halve of the window and press Backspace to get Segmentation fault as well.

This is a minimalistic example and rather strange one, doing "update" does not make much sense. However it ilustrates likely data corruption which has other symptoms as well.

I wanted to invoke procedure after every text change and I found that after delete and <<Modified>> event, this procedure still reports text as it was BEFORE delete (while inserting chars is fine). Example:

proc modified {} {
  if {![.t edit modified]} {
    # invoked by itself
    return
  }
  .t edit modified 0
  puts text:[.t get 1.0 end]
}
text .t
bind .t <<Modified>> modified
pack .t

Now type "A" in text widget, delete it and type "X". Response is:

text:A    <-- OK
text:A    <-- WRONG! Text is empty now!
text:X    <-- OK

Text widget itself looks as it should ("A" appears, disappears, "X" appears). Things also look OK when inspected outside of the event processing procedure. Just after delete, while processing <<Modified>>, data structures seem to be inconsistent, leading to slight errors or even segfaults.

Vaclav Hanzl

hanzl (at) noel dot feld dot cvut dot cz


----------------------------------------------------------------------

Comment By: Koen Danckaert (danckaert)
Date: 2007-06-19 15:00

Message:
Logged In: YES 
user_id=1388916
Originator: NO

Seems like the dirty-flag is incremented too early during a delete
action.
Following patch solves this issue:

diff -bru tk8.5a6/generic/tkText.c tk8.5a6my/generic/tkText.c
--- tk8.5a6/generic/tkText.c	2007-06-19 15:36:52.000000000 +0200
+++ tk8.5a6my/generic/tkText.c	2007-06-19 15:37:11.000000000 +0200
@@ -3111,11 +3111,11 @@
 	    get = TextGetText(textPtr, &index1, &index2, 0);
 	    TextPushUndoAction(textPtr, get, 0, &index1, &index2);
 	}
-	UpdateDirtyFlag(sharedTextPtr);
-
 	sharedTextPtr->stateEpoch++;

 	TkBTreeDeleteIndexRange(sharedTextPtr->tree, &index1, &index2);
+
+	UpdateDirtyFlag(sharedTextPtr);
     }

     resetViewCount = 0;


----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2007-06-14 23:44

Message:
Logged In: NO 

Original report was for Debian Sarge.

Now I verified that the first 6 lines can also bring down freewrap6.2 Wish
under Windows XP.

Vaclav Hanzl


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=312997&aid=1737288&group_id=12997