#2078 Wish core dump with window-delete + index

[Peter MacDonald]

Wish core dumps with the script below. To reproduce
run it and press <PgDn> then <Down> until the window
gets mapped, deleted and replaced with blue text.
Does not occur every time, but has been reproduced
under versions Tk 8.3, 8.4 and 8.5 and CVS HEAD.

Following is the gdb traceback of CVS HEAD.

**************************************
#0 0x400d7b8e in TkTextUpdateLineMetrics
(textPtr=0x80e8ca8, lineNum=103,
endLine=202, doThisMuch=256)
at
/home/pcmacdon/tmp/TclCvs/tk/unix/../generic/tkTextDisp.c:3035
3035 if (TkBTreeLinePixelEpoch(textPtr,
linePtr)

(gdb) p linePtr->pixels
$3 = (int *) 0x1

(gdb) bt
#0 0x400d7b8e in TkTextUpdateLineMetrics
(textPtr=0x80e8ca8, lineNum=103,
endLine=202, doThisMuch=256)
at
/home/pcmacdon/tmp/TclCvs/tk/unix/../generic/tkTextDisp.c:3035
#1 0x400d78fd in AsyncUpdateLineMetrics
(clientData=0x80e8ca8)
at
/home/pcmacdon/tmp/TclCvs/tk/unix/../generic/tkTextDisp.c:2901
#2 0x401c3ac5 in TimerHandlerEventProc ()
from /home/pcmacdon/tmp/TclCvs/lib/libtcl8.5.so
#3 0x401a9a3a in Tcl_ServiceEvent ()
from /home/pcmacdon/tmp/TclCvs/lib/libtcl8.5.so
#4 0x401a9d3c in Tcl_DoOneEvent ()
from /home/pcmacdon/tmp/TclCvs/lib/libtcl8.5.so
#5 0x40042146 in Tk_MainLoop ()
at
/home/pcmacdon/tmp/TclCvs/tk/unix/../generic/tkEvent.c:2150
#6 0x40053579 in Tk_MainEx (argc=-1, argv=0xbffff63c,
appInitProc=0x804887c <Tcl_AppInit>, interp=0x804b360)
at
/home/pcmacdon/tmp/TclCvs/tk/unix/../generic/tkMain.c:308
#7 0x08048864 in main (argc=2, argv=0xbffff634)
at
/home/pcmacdon/tmp/TclCvs/tk/unix/../unix/tkAppInit.c:68
#8 0x42017499 in __libc_start_main () from
/lib/i686/libc.so.6

(gdb) l
3030
3031 /*
3032 * Now update the line's metrics if
necessary.
3033 */
3034
3035 if (TkBTreeLinePixelEpoch(textPtr,
linePtr)
3036 !=
textPtr->dInfoPtr->lineMetricUpdateEpoch) {
3037 if (doThisMuch == -1) {
3038 count += 8 *
TkTextUpdateOneLine(textPtr, linePtr,
0,
3039 NULL, 0);

***********************************************************

# Demonstrate TEXT using a window frame as placeholder for
# a section rendering. When window gets mapped, it's
# deleted and the section gets rendered.
set str [string repeat "The quick red fox jumped over
the lazy brown dog\n" 100]
pack [text .t] -fill both -expand y -side left
pack [scrollbar .sb -command ".t yview"] -fill y -side left
.t conf -yscrollc ".sb set"
.t insert end $str\n
.t window create end -window [frame .f1 -width 800
-height 800]
.t insert end \n$str
.t tag conf foo -background lightblue
proc MAPPED w {
puts "MAPPED"
set i [.t index $w]
set oi [.t index @0,0]
.t delete $w
destroy $w
.t insert $i [string toupper $::str] foo
.t mark set insert $oi
.t see $oi
}
bind .f1 <Map> "MAPPED %W"
focus .t

[Peter MacDonald]

Reproducable script

[Peter MacDonald]

Logged In: YES
user_id=190660

Script attached below.