Crash in unset traces 3062331

4 files changed, 65 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 6c3dfd2..d865dae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2011-06-17  Don Porter  <dgp@users.sourceforge.net>
+
+	* generic/ttk/ttkTrace.c:	Workaround Bug 3062331.
+	* tests/ttk/ttk.test:
+	* changes:	Updated
+
 2011-06-16  Jan Nijtmans  <nijtmans@users.sf.net>
 
 	* win/tcl.m4: Sync with win/tcl.m4 from Tcl
diff --git a/changes b/changes
index aad0c59..c5d1155 100644
--- a/changes
+++ b/changes
@@ -6778,4 +6778,6 @@ and -to (porter)
 
 2011-06-10 (bug fix)[3175610] incomplete line item refresh (ferrieux)
 
---- Released 8.5.10, June 17, 2011 --- See ChangeLog for details ---
+2011-06-17 (bug fix)[3062331] crash in unset traces (macdonald,porter)
+
+--- Released 8.5.10, June 22, 2011 --- See ChangeLog for details ---
diff --git a/generic/ttk/ttkTrace.c b/generic/ttk/ttkTrace.c
index 0128a1d..f171f3d 100644
--- a/generic/ttk/ttkTrace.c
+++ b/generic/ttk/ttkTrace.c
@@ -44,6 +44,16 @@ VarTraceProc(
      * If the variable is being unset, then re-establish the trace:
      */
     if (flags & TCL_TRACE_DESTROYED) {
+	/*
+	 * If a prior call to Ttk_UntraceVariable() left behind an
+	 * indicator that we wanted this handler to be deleted (see below),
+	 * cleanup the ClientData bits and exit.
+	 */
+	if (tracePtr->interp == NULL) {
+	    Tcl_DecrRefCount(tracePtr->varnameObj);
+	    ckfree((ClientData)tracePtr);
+	    return NULL;
+	}
 	Tcl_TraceVar(interp, name,
 		TCL_GLOBAL_ONLY|TCL_TRACE_WRITES|TCL_TRACE_UNSETS,
 		VarTraceProc, clientData);
@@ -104,6 +114,42 @@ Ttk_TraceHandle *Ttk_TraceVariable(
 void Ttk_UntraceVariable(Ttk_TraceHandle *h)
 {
     if (h) {
+	ClientData cd = NULL;
+
+	/*
+	 * Workaround for Tcl Bug 3062331.  The trace design problem is
+	 * that when variable unset traces fire, Tcl documents that the
+	 * traced variable has already been unset.  It's already gone.
+	 * So from within an unset trace, if you try to call
+	 * Tcl_UntraceVar() on that variable, it will do nothing, because
+	 * the variable by that name can no longer be found.  It's gone.
+	 * This means callers of Tcl_UntraceVar() that might be running
+	 * in response to an unset trace have to handle the possibility
+	 * that their Tcl_UntraceVar() call will do nothing.  In this case,
+	 * we have to support the possibility that Tcl_UntraceVar() will
+	 * leave the trace in place, so we need to leave the ClientData
+	 * untouched so when that trace does fire it will not crash.
+	 */
+
+	/*
+	 * Search the traces on the variable to see if the one we are tasked
+	 * with removing is present.
+	 */
+	while ((cd = Tcl_VarTraceInfo(h->interp, Tcl_GetString(h->varnameObj),
+		0, VarTraceProc, cd)) != NULL) {
+	    if (cd == (ClientData) h) {
+		break;
+	    }
+	}
+	/*
+	 * If the trace we wish to delete is not visible, Tcl_UntraceVar
+	 * will do nothing, so don't try to call it.  Instead set an
+	 * indicator in the Ttk_TraceHandle that we need to cleanup later.
+	 */
+	if (cd == NULL) {
+	    h->interp = NULL;
+	    return;
+	}
 	Tcl_UntraceVar(h->interp, Tcl_GetString(h->varnameObj),
 		TCL_GLOBAL_ONLY|TCL_TRACE_WRITES|TCL_TRACE_UNSETS,
 		VarTraceProc, (ClientData)h);
diff --git a/tests/ttk/ttk.test b/tests/ttk/ttk.test
index ddfaf84..1eec180 100644
--- a/tests/ttk/ttk.test
+++ b/tests/ttk/ttk.test
@@ -555,6 +555,16 @@ test ttk-14.3 "-textvariable in nonexistant namespace" -body {
 } -returnCodes 1 -result {can't trace *: parent namespace doesn't exist} \
   -match glob -cleanup { destroy .tw }
 
+test ttk-15.1 {Bug 3062331} -setup {
+    destroy .b
+} -body {
+    set Y {}
+    ttk::button .b -textvariable Y
+    trace variable Y u "destroy .b"
+    unset Y
+} -cleanup {
+    destroy .b
+} -result {}
 
 ## Test ensemble processing:
 #