[Tcl-bugs] [Bug #120819] image command segfault (overwrite .)

[<no...@so...>]

Bug #120819, was updated on 2000-Oct-31 16:54
Here is a current snapshot of the bug.

Project: Tk Toolkit
Category: Images
Status: Open
Resolution: None
Bug Group: 8.0.5
Priority: 9
Summary: image command segfault (overwrite .)

Details: OriginalBugID: 2156 Bug
Version: 8.0.5
SubmitDate: '1999-06-03'
LastModified: '2000-03-02'
Severity: CRIT
Status: Assigned
Submitter: techsupp
ChangedBy: hobbs
OS: Windows 95
Machine: X86


Name: Tim Peters

Comments:
This got reported in the Python world as a crash using Tkinter (Python's
interface to Tcl/Tk).  I can change Tkinter to refuse to accept
non-string "name" arguments, but Tk still shouldn't die.

ReproducibleScript:
Run this one-liner under wish:
    image create photo .

ObservedBehavior:
Memory fault in tk80.dll under Windows.
Segfault reported by someone else under an unspecified Linux version.

DesiredBehavior:
Don't care, so long as it doesn't bring down Tk!  An error msg would be
appropriate (the cmd doesn't make sense).

The problem here is that image create overwrites commands,
but in this case the user has asked to overwrite '.', which
is the main window.  Doing that brings down Tk, and in this
case, brings it down rather rudely. 
-- 09/20/1999 hobbs

Follow-Ups:

Date: 2000-Nov-23 03:10
By: dkf

Comment:
Verified in 8.4a2

One possible resolution would be to change [image create] so that it cannot create a command with the same name as some existing command; I've only ever seen people get confused from doing it...

I suspect that the particular crash may actually be due Tk_MainWindow(interp) returning a non-NULL value despite the fact that the window has actually been deleted at this point.  Fixing this requires checking whether the TK_ALREADY_DEAD flag has been set on the window...
-------------------------------------------------------

Date: 2000-Nov-23 05:52
By: dkf

Comment:
Fixed by prohibiting image names from starting with period since doing a *real* fix is kind of tricky (I suspect that a structure was getting free()d too early.)
-------------------------------------------------------

For detailed info, follow this link:
http://sourceforge.net/bugs/?func=detailbug&bug_id=120819&group_id=12997