[Tcl-bugs] [ tcl-Bugs-1876793 ] lreverse crashes on unshared empty list

[SourceForge.net <no...@so...>]

Bugs item #1876793, was opened at 2008-01-21 19:18
Message generated for change (Comment added) made by msofer
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=1876793&group_id=10894

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: 14. List Object
Group: development: 8.5.1b1
Status: Closed
Resolution: Fixed
Priority: 9
Private: No
Submitted By: Neil Madden (tallniel)
Assigned to: miguel sofer (msofer)
Summary: lreverse crashes on unshared empty list

Initial Comment:
I am seeing a bus error on Mac OS X 10.4.11 (Intel) using current Tcl CVS HEAD. A minimal script to reproduce the crash is the following:

proc foo args {
    set n [lrange $args 0 end]
    lreverse [lrange $n 0 end-1]
}
foo bar

I'm not entirely sure where the problem lies, but it seems to be some combination of the use of "args", the 2 uses of "lrange", and it seems to rely on the "end-N" syntax (just "lrange $n 0 end" doesn't cause a bus error). I suspect a tricky ref-counting bug somewhere and am investigating further. I'll add more here if I track it down.

Neil

----------------------------------------------------------------------

>Comment By: miguel sofer (msofer)
Date: 2008-01-22 10:20

Message:
Logged In: YES 
user_id=148712
Originator: NO

This was a bug in bugfix #1672585

----------------------------------------------------------------------

Comment By: miguel sofer (msofer)
Date: 2008-01-22 08:16

Message:
Logged In: YES 
user_id=148712
Originator: NO

Even simpler:
mig@uh:~$ /home/CVS/tcl_SF_clean/unix/tclsh
% lreverse {}
Segmentation fault


----------------------------------------------------------------------

Comment By: Neil Madden (tallniel)
Date: 2008-01-21 19:40

Message:
Logged In: YES 
user_id=102050
Originator: YES

Gah, tracking it down even further, this could be a problem with shared
literals for empty lists. The following also causes a bus error:
lreverse [lrange [lrange {} 0 -1] 0 0]
and the even the following:
lreverse [lrange {} 0 -1]
causes a bus error if it is the first use of an empty list in the program,
but if you do say:
set a {}
lreverse [lrange {} 0 -1]
then there is no crash.

----------------------------------------------------------------------

Comment By: Neil Madden (tallniel)
Date: 2008-01-21 19:33

Message:
Logged In: YES 
user_id=102050
Originator: YES

gdb isn't showing much interesting as is typical with ref-counting bugs:
the location of the error is well removed from where the memory violation
shows up. An even more minimal script is:

lreverse [lrange [lrange foo 0 end] 0 end-1]
or
lreverse [lrange [lrange foo 0 end-1] 0 end]

Both lreverse and the end-1 syntax seem to be needed, but "args" is a red
herring.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=1876793&group_id=10894