Python/Tkinter/tk crash [long]

[Jeff Epler]

I can duplicate the signal 11 on RedHat Linux 9 and the following
relevant packages installed:
        python-2.2.2-26
        tcl-8.3.5-88
        tk-8.3.5-88

My traceback looks like the following.  I believe that the lines listed
as "Tk_GetItemTypes" actually correspond to static functions defined in
tkCanvas.c.
#0  0x4011b1a7 in Tk_GetItemTypes () from /usr/lib/libtk8.3.so
#1  0x4011aec1 in Tk_GetItemTypes () from /usr/lib/libtk8.3.so
#2  0x4011ac25 in Tk_GetItemTypes () from /usr/lib/libtk8.3.so
#3  0x400d1a7c in Tk_HandleEvent () from /usr/lib/libtk8.3.so
#4  0x400d1e7c in TkQueueEventForAllChildren () from /usr/lib/libtk8.3.so
#5  0x401c300d in Tcl_ServiceEvent () from /usr/lib/libtcl8.3.so
#6  0x401c326d in Tcl_DoOneEvent () from /usr/lib/libtcl8.3.so
#7  0x40062115 in Tkapp_MainLoop (self=0x815dfb0, args=0x8269358) at Modules/_tkinter.c:1696
#8  0x080d0df4 in PyCFunction_Call ()
#9  0x0807a65e in PyEval_EvalCode ()
#10 0x0807b0ce in PyEval_EvalCodeEx ()
#11 0x0807c62b in PyEval_GetFuncDesc ()
#12 0x0807a5a3 in PyEval_EvalCode ()
#13 0x0807b0ce in PyEval_EvalCodeEx ()
#14 0x08077fc5 in PyEval_EvalCode ()
#15 0x08097e29 in PyRun_FileExFlags ()
#16 0x08096d90 in PyRun_SimpleFileExFlags ()
#17 0x080966da in PyRun_AnyFileExFlags ()
#18 0x08053a19 in Py_Main ()
#19 0x08053469 in main ()
#20 0x42015574 in __libc_start_main () from /lib/tls/libc.so.6

This leads me to two things: first, reproduce this using a libtk
compiled with debugging information.  second, this is likely to be a Tk
bug and not a Python bug given where it happens.  It should be possible
to write a test-case that is purely tcl code..

In fact, the following tcl code crashed on me once (not in gdb, so I
can't compare stack traces), and when I run it under valgrind the *first*
click I make sprays "invalid read" and "invalid write" errors such as
==23796== Invalid write of size 4
==23796==    at 0x4026ACEB: (within /usr/lib/libtk8.3.so)
==23796==    by 0x4026AC24: (within /usr/lib/libtk8.3.so)
==23796==    by 0x40221A7B: Tk_HandleEvent (in /usr/lib/libtk8.3.so)
==23796==    by 0x40221E7B: (within /usr/lib/libtk8.3.so)
==23796==    Address 0x41493D98 is 188 bytes inside a block of size 460 free'd
==23796==    at 0x40161048: free (in /usr/lib/valgrind/valgrind.so)
==23796==    by 0x402D8368: TclpFree (in /usr/lib/libtcl8.3.so)
==23796==    by 0x402DD4F4: Tcl_Free (in /usr/lib/libtcl8.3.so)
==23796==    by 0x402685C5: (within /usr/lib/libtk8.3.so)

Now, in the python and wish cases, the shared libraries are loaded at
different addresses. but note that the number of bytes between
TK_HandleEvent and the next stack frame inwards (called Tk_GetItemTypes
by gdb) is the same distance on my system.

Jeff

# --- tk program kinda like original python program
proc p {} {
    puts p
    destroy .c
    canvas .c
    grid .c

    set tabIndex 0
    set pos 0
    foreach p { a b c } {
        set tags [list TAB_$tabIndex]
        if {$tabIndex == 1} {
            lappend tags CURRENT_TAB
        }
        set textId [.c create text $pos 10 -text $p -anchor w -tags $tags]
        .c bind TAB_$tabIndex <ButtonRelease> p
        incr tabIndex 1
        incr pos 20
    }
}
p
# ---