Tk Source Code

Please use the following steps to reproduce the problem:

#1. Run the attached game script on a Windows 
machine (not sure if the bug manifests itself on Unix).
#2. The game has been modified so that it will 
continuously cascade. Simply swap two of the pieces 
and watch the action fly for a while.
#3. Attempt to exit the game by closing the window.

This bug works equally well with 8.4.x and the current 
CVS HEAD.

Tk will crash upon calling Tcl_DeleteHashEntry in 
tkImage.c near line #680:

    if ((masterPtr->typePtr == NULL) && (masterPtr-
>instancePtr == NULL)) {
        Tcl_DeleteHashEntry(masterPtr->hPtr);
ckfree((char *) masterPtr);
    }

Based on my research, it appears that Tk is attempting 
to delete an already deleted hash entry.

If you change the code to the following, the crash is not 
seen:

    if ((masterPtr->typePtr == NULL) && (masterPtr-
>instancePtr == NULL)) {
        if (!masterPtr->deleted) {
           Tcl_DeleteHashEntry(masterPtr->hPtr);
        }
ckfree((char *) masterPtr);
    }

Since I am not an expert in Tk, I am not sure if this 
slight modification gets to the "heart" of the actual 
problem.  For example, why would Tk attempt to delete 
the same hash entry twice?

Here is the stack trace:

Tcl_DeleteHashEntry(Tcl_HashEntry * 0x00dc8f28) line 
518 + 3 bytes
Tk_FreeImage(Tk_Image__ * 0x00db0680) line 680 + 19 
bytes
DeleteImage(Tk_Canvas_ * 0x00dd04b8, Tk_Item * 
0x00e2c9b0, _XDisplay * 0x009c32c0) line 412 + 12 
bytes
DestroyCanvas(char * 0x00dd04b8) line 1951 + 24 bytes
Tcl_Release(void * 0x00dd04b8) line 241 + 7 bytes
CanvasBindProc(void * 0x00dd04b8, _XEvent * 
0x00e2ccb8) line 4537 + 16 bytes
Tk_HandleEvent(_XEvent * 0x00e2ccb8) line 1010 + 17 
bytes
WindowEventProc(Tcl_Event * 0x00e2ccb0, int -3) line 
1414 + 12 bytes
Tcl_ServiceEvent(int -3) line 625 + 11 bytes
Tcl_DoOneEvent(int -3) line 930 + 9 bytes
Tk_MainLoop() line 1472 + 13 bytes
Tk_MainEx(int 1, char * * 0x00866e20, int (Tcl_Interp *)
* 0x004010b9 Tcl_AppInit(Tcl_Interp *), Tcl_Interp * 
0x0086ade8) line 284
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 
0x00000000, char * 0x001335d5, int 1) line 130 + 26 
bytes
WinMainCRTStartup() line 330 + 54 bytes

Logged In: YES 
user_id=79902

Backported to 8.4 branch

Logged In: YES 
user_id=79902

Oooh.  This is nastier than I thought.  It seems that the 
problem is caused by trying to delete an image hash entry 
from a table where the table itself was previously deleted (as 
opposed to multiple deletion of an actual image.)

Logged In: YES 
user_id=79902

There's a resource leak around here; Tcl_Preserve()s and
Tcl_Release()s don't match up properly...

Is the crash present in the HEAD or just with v 1.19 of
tclImage.c?  I did some overhauling in this area, so it's
hard to tell whether the problem is still there (I can't run
a build of 8.5a0 here at the moment, so I can't verify it
for myself.)

File Added - 52243: gemgame.tcl