[Pkg-tcltk-devel] Bug#462409: Tcl_DecrRefCount () SIGSEGVs on a result of Tcl_NewDictObj ()

[Ivan Shmakov]

Package: tcl8.5-dev
Version: 8.5.0-2
Severity: minor

	The test program below catches a SIGSEGV when trying to
	Tcl_DecrRefCount () on a Tcl `dict' object:

$ make CFLAGS=-g\ -Wall test LDFLAGS=-ltcl8.5 
cc -g -Wall  -ltcl8.5  test.c   -o test
$ command time ./test 
Tcl_NewObj () => 0x804a2f8
trying Tcl_IncrRefCount (), Tcl_DecrRefCount ()... done
Tcl_NewIntObj () => 0x804a2f8
trying Tcl_IncrRefCount (), Tcl_DecrRefCount ()... done
Tcl_NewStringObj () => 0x804a2f8
trying Tcl_IncrRefCount (), Tcl_DecrRefCount ()... done
Tcl_NewDictObj () => 0x804a2f8
trying Tcl_IncrRefCount (), Tcl_DecrRefCount ()... Command terminated by signal 11
0.00user 0.00system 0:00.00elapsed 0%CPU (0avgtext+0avgdata 0maxresident)k
0inputs+0outputs (0major+221minor)pagefaults 0swaps
$ 

	I see no mention of such a behaviour as an appropriate one in
	the documentation as well.

$ cat test.c 

#include <stdio.h>

#include <tcl8.5/tcl.h>

void
refcount_test (const char *fname, Tcl_Obj *o)
{
  printf ("%s () => %p\n", fname, o);
  fputs ("trying Tcl_IncrRefCount (), Tcl_DecrRefCount ()... ", stdout);
  fflush (stdout);
  Tcl_IncrRefCount (o);
  Tcl_DecrRefCount (o);
  fputs ("done\n", stdout);
}

int
main ()
{
  refcount_test ("Tcl_NewObj",
		 Tcl_NewObj ());
  refcount_test ("Tcl_NewIntObj",
		 Tcl_NewIntObj (123));
  refcount_test ("Tcl_NewStringObj",
		 Tcl_NewStringObj ("test", -1));
  refcount_test ("Tcl_NewDictObj",
		 Tcl_NewDictObj ());

  /* . */
  return 0;
}
$