#2018 listbox crash caused by listvariable in a namespace

[Csaba Nemethi]

Consider the following simple script:

namespace eval test {
variable foo {bar0 bar1}
}

listbox .lb -listvariable ::test::foo
pack .lb

namespace delete test
.lb insert end bar2 bar3

On my PC running SUSE LINUX 9.3, this script generates
the following error message:

Error in startup script:
while executing
".lb insert end bar2 bar3"
(file "Bug.tcl" line 10)
Segmentation fault

If I set an own trace on the variable ::test::foo then
the behavior becomes even worse:

namespace eval test {
variable foo {bar0 bar1}
}
proc tracer {args} {
puts "tracer called"
}

listbox .lb -listvariable ::test::foo
pack .lb

trace add variable ::test::foo unset tracer
namespace delete test
.lb insert end bar2 bar3

This version of the script generates the following output:

Error in startup script:
while executing
".lb insert end bar2 bar3"
(file "Bug.tcl" line 14)
*** glibc detected *** free(): invalid pointer:
0x080af108 ***

One could argue that it is not expected to delete a
namespace containing a listvariable. On the other
hand, IMHO, doing so must not cause a crash.

[Jeffrey Hobbs]

Logged In: YES
user_id=72656

Attached is the patch to fix this problem. In particular,
the listObj should not have been decr'd originally, as that
will be needed. While we could throw an error, instead we
choose to ignore the error in the same way that the entry
widget does. This can make things slightly inconsistent, as
the namespace really won't exist, but at least it is
consistent between these widgets now (and doesn't crash).

Fix applied to 8.4.14 and 8.5a5.

[Jeffrey Hobbs]