diff options
Diffstat (limited to 'doc/interp.n')
| -rw-r--r-- | doc/interp.n | 402 |
1 files changed, 306 insertions, 96 deletions
diff --git a/doc/interp.n b/doc/interp.n index bbe7826..c753ee9 100644 --- a/doc/interp.n +++ b/doc/interp.n @@ -1,5 +1,6 @@ '\" '\" Copyright (c) 1995-1996 Sun Microsystems, Inc. +'\" Copyright (c) 2004 Donal K. Fellows '\" '\" See the file "license.terms" for information on usage and redistribution '\" of this file, and for a DISCLAIMER OF ALL WARRANTIES. @@ -11,15 +12,14 @@ .SH NAME interp \- Create and manipulate Tcl interpreters .SH SYNOPSIS -\fBinterp \fIoption \fR?\fIarg arg ...\fR? +\fBinterp \fIsubcommand \fR?\fIarg arg ...\fR? .BE - .SH DESCRIPTION .PP -This command makes it possible to create one or more new Tcl +This command makes it possible to create one or more new Tcl interpreters that co-exist with the creating interpreter in the same application. The creating interpreter is called the \fImaster\fR -and the new interpreter is called a \fIslave\fR. +and the new interpreter is called a \fIslave\fR. A master can create any number of slaves, and each slave can itself create additional slaves for which it is master, resulting in a hierarchy of interpreters. @@ -32,7 +32,11 @@ a command in a slave interpreter which, when invoked, causes a command to be invoked in its master interpreter or in another slave interpreter. The only other connections between interpreters are through environment variables (the \fBenv\fR variable), which are -normally shared among all interpreters in the application. Note that the +normally shared among all interpreters in the application, +.VS 8.5 +and by resource limit exceeded callbacks. +.VE 8.5 +Note that the name space for files (such as the names returned by the \fBopen\fR command) is no longer shared between interpreters. Explicit commands are provided to share files and to transfer references to open files from one interpreter @@ -45,7 +49,6 @@ scripts without fear of them damaging other interpreters or the application's environment. For example, all IO channel creation commands and subprocess creation commands are made inaccessible to safe interpreters. -.VS See \fBSAFE INTERPRETERS\fR below for more information on what features are present in a safe interpreter. The dangerous functionality is not removed from the safe interpreter; @@ -53,10 +56,9 @@ instead, it is \fIhidden\fR, so that only trusted interpreters can obtain access to it. For a detailed explanation of hidden commands, see \fBHIDDEN COMMANDS\fR, below. The alias mechanism can be used for protected communication (analogous to a -kernel call) between a slave interpreter and its master. -See \fBALIAS INVOCATION\fR, below, for more details +kernel call) between a slave interpreter and its master. +See \fBALIAS INVOCATION\fR, below, for more details on how the alias mechanism works. -.VE .PP A qualified interpreter name is a proper Tcl lists containing a subset of its ancestors in the interpreter hierarchy, terminated by the string naming the @@ -78,7 +80,7 @@ Both restrictions are motivated by safety concerns. The \fBinterp\fR command is used to create, delete, and manipulate slave interpreters, and to share or transfer channels between interpreters. It can have any of several forms, depending -on the \fIoption\fR argument: +on the \fIsubcommand\fR argument: .TP \fBinterp\fR \fBalias\fR \fIsrcPath\fR \fIsrcToken\fR Returns a Tcl list whose elements are the \fItargetCmd\fR and @@ -102,7 +104,9 @@ may be anywhere in the hierarchy of interpreters under the interpreter invoking the command. \fISrcPath\fR and \fIsrcCmd\fR identify the source of the alias. \fISrcPath\fR is a Tcl list whose elements select a particular -interpreter. For example, ``\fBa b\fR'' identifies an interpreter +interpreter. For example, +.QW "\fBa b\fR" +identifies an interpreter \fBb\fR, which is a slave of interpreter \fBa\fR, which is a slave of the invoking interpreter. An empty list specifies the interpreter invoking the command. \fIsrcCmd\fR gives the name of a new @@ -116,7 +120,7 @@ already exist; it is not created by this command. The alias arranges for the given target command to be invoked in the target interpreter whenever the given source command is invoked in the source interpreter. See \fBALIAS INVOCATION\fR below for -more details. +more details. The command returns a token that uniquely identifies the command created \fIsrcCmd\fR, even if the command is renamed afterwards. The token may but does not have to be equal to \fIsrcCmd\fR. @@ -124,16 +128,26 @@ does not have to be equal to \fIsrcCmd\fR. \fBinterp\fR \fBaliases \fR?\fIpath\fR? This command returns a Tcl list of the tokens of all the source commands for aliases defined in the interpreter identified by \fIpath\fR. The tokens -correspond to the values returned when -the aliases were created (which may not be the same +correspond to the values returned when +the aliases were created (which may not be the same as the current names of the commands). .TP +\fBinterp bgerror \fIpath\fR ?\fIcmdPrefix\fR? +.VS 8.5 +This command either gets or sets the current background error handler +for the interpreter identified by \fIpath\fR. If \fIcmdPrefix\fR is +absent, the current background error handler is returned, and if it is +present, it is a list of words (of minimum length one) that describes +what to set the interpreter's background error to. See the +\fBBACKGROUND ERROR HANDLING\fR section for more details. +.VE 8.5 +.TP \fBinterp\fR \fBcreate \fR?\fB\-safe\fR? ?\fB\-\|\-\fR? ?\fIpath\fR? Creates a slave interpreter identified by \fIpath\fR and a new command, called a \fIslave command\fR. The name of the slave command is the last component of \fIpath\fR. The new slave interpreter and the slave command are created in the interpreter identified by the path obtained by removing -the last component from \fIpath\fR. For example, if \fIpath is \fBa b +the last component from \fIpath\fR. For example, if \fIpath\fR is \fBa b c\fR then a new slave interpreter and slave command named \fBc\fR are created in the interpreter identified by the path \fBa b\fR. The slave command may be used to manipulate the new interpreter as @@ -152,6 +166,44 @@ given name already exists in this master. The initial recursion limit of the slave interpreter is set to the current recursion limit of its parent interpreter. .TP +\fBinterp\fR \fBdebug \fIpath\fR ?\fI\-frame\fR ?\fIbool\fR?? +. +Controls whether frame-level stack information is captured in the +slave interpreter identified by \fIpath\fR. If no arguments are +given, option and current setting are returned. If \fI\-frame\fR +is given, the debug setting is set to the given boolean if provided +and the current setting is returned. +This only effects the output of \fBinfo frame\fR, in that exact +frame-level information for command invocation at the bytecode level +is only captured with this setting on. +.PP +.RS +For example, with code like +.PP +.CS +\fBproc\fR mycontrol {... script} { + ... + \fBuplevel\fR 1 $script + ... +} + +\fBproc\fR dosomething {...} { + ... + mycontrol { + somecode + } +} +.CE +.PP +the standard setting will provide a relative line number for the +command \fBsomecode\fR and the relevant frame will be of type +\fBeval\fR. With frame-debug active on the other hand the tracking +extends so far that the system will be able to determine the file and +absolute line number of this command, and return a frame of type +\fBsource\fR. This more exact information is paid for with slower +execution of all commands. +.RE +.TP \fBinterp\fR \fBdelete \fR?\fIpath ...?\fR Deletes zero or more interpreters given by the optional \fIpath\fR arguments, and for each interpreter, it also deletes its slaves. The @@ -163,9 +215,9 @@ exists, the command raises an error. This command concatenates all of the \fIarg\fR arguments in the same fashion as the \fBconcat\fR command, then evaluates the resulting string as a Tcl script in the slave interpreter identified by \fIpath\fR. The result -of this evaluation (including error information such as the \fBerrorInfo\fR -and \fBerrorCode\fR variables, if an error occurs) is returned to the -invoking interpreter. +of this evaluation (including all \fBreturn\fR options, +such as \fB\-errorinfo\fR and \fB\-errorcode\fR information, if an +error occurs) is returned to the invoking interpreter. Note that the script will be executed in the current context stack frame of the \fIpath\fR interpreter; this is so that the implementations (in a master interpreter) of aliases in a slave interpreter can execute scripts in @@ -173,10 +225,9 @@ the slave that find out information about the slave's current state and stack frame. .TP \fBinterp exists \fIpath\fR -Returns \fB1\fR if a slave interpreter by the specified \fIpath\fR +Returns \fB1\fR if a slave interpreter by the specified \fIpath\fR exists in this master, \fB0\fR otherwise. If \fIpath\fR is omitted, the invoking interpreter is used. -.VS "" BR .TP \fBinterp expose \fIpath\fR \fIhiddenName\fR ?\fIexposedCmdName\fR? Makes the hidden command \fIhiddenName\fR exposed, eventually bringing @@ -191,11 +242,11 @@ Hidden commands are explained in more detail in \fBHIDDEN COMMANDS\fR, below. \fBinterp\fR \fBhide\fR \fIpath\fR \fIexposedCmdName\fR ?\fIhiddenCmdName\fR? Makes the exposed command \fIexposedCmdName\fR hidden, renaming it to the hidden command \fIhiddenCmdName\fR, or keeping the same name if -\fIhiddenCmdName\fR is not given, in the interpreter denoted +\fIhiddenCmdName\fR is not given, in the interpreter denoted by \fIpath\fR. If a hidden command with the targeted name already exists, this command fails. -Currently both \fIexposedCmdName\fR and \fIhiddenCmdName\fR can +Currently both \fIexposedCmdName\fR and \fIhiddenCmdName\fR can not contain namespace qualifiers, or an error is raised. Commands to be hidden by \fBinterp hide\fR are looked up in the global namespace even if the current namespace is not the global one. This @@ -207,21 +258,41 @@ Hidden commands are explained in more detail in \fBHIDDEN COMMANDS\fR, below. Returns a list of the names of all hidden commands in the interpreter identified by \fIpath\fR. .TP -\fBinterp\fR \fBinvokehidden\fR \fIpath\fR ?\fB-global\fR? \fIhiddenCmdName\fR ?\fIarg ...\fR? +\fBinterp\fR \fBinvokehidden\fR \fIpath\fR ?\fI\-option ...\fR? \fIhiddenCmdName\fR ?\fIarg ...\fR? Invokes the hidden command \fIhiddenCmdName\fR with the arguments supplied in the interpreter denoted by \fIpath\fR. No substitutions or evaluation -are applied to the arguments. -If the \fB-global\fR flag is present, the hidden command is invoked at the +are applied to the arguments. Three \fI\-option\fRs are supported, all +of which start with \fB\-\fR: \fB\-namespace\fR (which takes a single +argument afterwards, \fInsName\fR), \fB\-global\fR, and \fB\-\|\-\fR. +If the \fB\-namespace\fR flag is present, the hidden command is invoked in +the namespace called \fInsName\fR in the target interpreter. +If the \fB\-global\fR flag is present, the hidden command is invoked at the global level in the target interpreter; otherwise it is invoked at the current call frame and can access local variables in that and outer call frames. +The \fB\-\|\-\fR flag allows the \fIhiddenCmdName\fR argument to start with a +.QW \- +character, and is otherwise unnecessary. +If both the \fB\-namespace\fR and \fB\-global\fR flags are present, the +\fB\-namespace\fR flag is ignored. +Note that the hidden command will be executed (by default) in the +current context stack frame of the \fIpath\fR interpreter. Hidden commands are explained in more detail in \fBHIDDEN COMMANDS\fR, below. -.VE +.TP +\fBinterp\fR \fBlimit\fR \fIpath\fR \fIlimitType\fR ?\fI\-option\fR? ?\fIvalue\fR \fI...\fR? +.VS 8.5 +Sets up, manipulates and queries the configuration of the resource +limit \fIlimitType\fR for the interpreter denoted by \fIpath\fR. If +no \fI\-option\fR is specified, return the current configuration of the +limit. If \fI\-option\fR is the sole argument, return the value of that +option. Otherwise, a list of \fI\-option\fR/\fIvalue\fR argument pairs +must supplied. See \fBRESOURCE LIMITS\fR below for a more detailed +explanation of what limits and options are supported. +.VE 8.5 .TP \fBinterp issafe\fR ?\fIpath\fR? Returns \fB1\fR if the interpreter identified by the specified \fIpath\fR is safe, \fB0\fR otherwise. -.VS "" BR .TP \fBinterp marktrusted\fR \fIpath\fR Marks the interpreter identified by \fIpath\fR as trusted. Does @@ -229,7 +300,6 @@ not expose the hidden commands. This command can only be invoked from a trusted interpreter. The command has no effect if the interpreter identified by \fIpath\fR is already trusted. -.VE .TP \fBinterp\fR \fBrecursionlimit\fR \fIpath\fR ?\fInewlimit\fR? Returns the maximum allowable nesting depth for the interpreter @@ -239,14 +309,16 @@ of more than \fInewlimit\fR calls to \fBTcl_Eval()\fR and related procedures in that interpreter will return an error. The \fInewlimit\fR value is also returned. The \fInewlimit\fR value must be a positive integer between 1 and the -maximum value of a non-long integer on the platform. -.sp +maximum value of a non-long integer on the platform. +.RS +.PP The command sets the maximum size of the Tcl call stack only. It cannot by itself prevent stack overflows on the C stack being used by the application. If your machine has a limit on the size of the C stack, you may get stack overflows before reaching the limit set by the command. If this happens, see if there is a mechanism in your system for increasing -the maximum size of the C stack. +the maximum size of the C stack. +.RE .TP \fBinterp\fR \fBshare\fR \fIsrcPath channelId destPath\fR Causes the IO channel identified by \fIchannelId\fR to become shared @@ -293,7 +365,7 @@ The valid forms of this command are: \fIslave \fBaliases\fR Returns a Tcl list whose elements are the tokens of all the aliases in \fIslave\fR. The tokens correspond to the values returned when -the aliases were created (which may not be the same +the aliases were created (which may not be the same as the current names of the commands). .TP \fIslave \fBalias \fIsrcToken\fR @@ -320,19 +392,28 @@ The command returns a token that uniquely identifies the command created \fIsrcCmd\fR, even if the command is renamed afterwards. The token may but does not have to be equal to \fIsrcCmd\fR. .TP +\fIslave \fBbgerror\fR ?\fIcmdPrefix\fR? +.VS 8.5 +This command either gets or sets the current background error handler +for the \fIslave\fR interpreter. If \fIcmdPrefix\fR is +absent, the current background error handler is returned, and if it is +present, it is a list of words (of minimum length one) that describes +what to set the interpreter's background error to. See the +\fBBACKGROUND ERROR HANDLING\fR section for more details. +.VE 8.5 +.TP \fIslave \fBeval \fIarg \fR?\fIarg ..\fR? This command concatenates all of the \fIarg\fR arguments in the same fashion as the \fBconcat\fR command, then evaluates the resulting string as a Tcl script in \fIslave\fR. -The result of this evaluation (including error information -such as the \fBerrorInfo\fR and \fBerrorCode\fR variables, if an +The result of this evaluation (including all \fBreturn\fR options, +such as \fB\-errorinfo\fR and \fB\-errorcode\fR information, if an error occurs) is returned to the invoking interpreter. Note that the script will be executed in the current context stack frame of \fIslave\fR; this is so that the implementations (in a master interpreter) of aliases in a slave interpreter can execute scripts in the slave that find out information about the slave's current state and stack frame. -.VS "" BR .TP \fIslave \fBexpose \fIhiddenName \fR?\fIexposedCmdName\fR? This command exposes the hidden command \fIhiddenName\fR, eventually bringing @@ -344,12 +425,12 @@ fails. For more details on hidden commands, see \fBHIDDEN COMMANDS\fR, below. .TP \fIslave \fBhide \fIexposedCmdName\fR ?\fIhiddenCmdName\fR? -This command hides the exposed command \fIexposedCmdName\fR, renaming it to +This command hides the exposed command \fIexposedCmdName\fR, renaming it to the hidden command \fIhiddenCmdName\fR, or keeping the same name if the argument is not given, in the \fIslave\fR interpreter. If a hidden command with the targeted name already exists, this command fails. -Currently both \fIexposedCmdName\fR and \fIhiddenCmdName\fR can +Currently both \fIexposedCmdName\fR and \fIhiddenCmdName\fR can not contain namespace qualifiers, or an error is raised. Commands to be hidden are looked up in the global namespace even if the current namespace is not the global one. This @@ -360,27 +441,46 @@ For more details on hidden commands, see \fBHIDDEN COMMANDS\fR, below. \fIslave \fBhidden\fR Returns a list of the names of all hidden commands in \fIslave\fR. .TP -\fIslave \fBinvokehidden\fR ?\fB-global\fR \fIhiddenName \fR?\fIarg ..\fR? +\fIslave \fBinvokehidden\fR ?\fI\-option ...\fR? \fIhiddenName \fR?\fIarg ..\fR? This command invokes the hidden command \fIhiddenName\fR with the supplied arguments, in \fIslave\fR. No substitutions or evaluations are -applied to the arguments. -If the \fB-global\fR flag is given, the command is invoked at the global +applied to the arguments. Three \fI\-option\fRs are supported, all +of which start with \fB\-\fR: \fB\-namespace\fR (which takes a single +argument afterwards, \fInsName\fR), \fB\-global\fR, and \fB\-\|\-\fR. +If the \fB\-namespace\fR flag is given, the hidden command is invoked in +the specified namespace in the slave. +If the \fB\-global\fR flag is given, the command is invoked at the global level in the slave; otherwise it is invoked at the current call frame and can access local variables in that or outer call frames. +The \fB\-\|\-\fR flag allows the \fIhiddenCmdName\fR argument to start with a +.QW \- +character, and is otherwise unnecessary. +If both the \fB\-namespace\fR and \fB\-global\fR flags are given, the +\fB\-namespace\fR flag is ignored. +Note that the hidden command will be executed (by default) in the +current context stack frame of \fIslave\fR. For more details on hidden commands, see \fBHIDDEN COMMANDS\fR, below. -.VE .TP \fIslave \fBissafe\fR Returns \fB1\fR if the slave interpreter is safe, \fB0\fR otherwise. -.VS "" BR +.TP +\fIslave \fBlimit\fR \fIlimitType\fR ?\fI\-option\fR? ?\fIvalue\fR \fI...\fR? +.VS 8.5 +Sets up, manipulates and queries the configuration of the resource +limit \fIlimitType\fR for the slave interpreter. If no \fI\-option\fR +is specified, return the current configuration of the limit. If +\fI\-option\fR is the sole argument, return the value of that option. +Otherwise, a list of \fI\-option\fR/\fIvalue\fR argument pairs must +supplied. See \fBRESOURCE LIMITS\fR below for a more detailed explanation of +what limits and options are supported. +.VE 8.5 .TP \fIslave \fBmarktrusted\fR Marks the slave interpreter as trusted. Can only be invoked by a trusted interpreter. This command does not expose any hidden commands in the slave interpreter. The command has no effect if the slave is already trusted. -.VE .TP \fIslave\fR \fBrecursionlimit\fR ?\fInewlimit\fR? Returns the maximum allowable nesting depth for the \fIslave\fR interpreter. @@ -389,14 +489,16 @@ set so that nesting of more than \fInewlimit\fR calls to \fBTcl_Eval()\fR and related procedures in \fIslave\fR will return an error. The \fInewlimit\fR value is also returned. The \fInewlimit\fR value must be a positive integer between 1 and the -maximum value of a non-long integer on the platform. -.sp +maximum value of a non-long integer on the platform. +.RS +.PP The command sets the maximum size of the Tcl call stack only. It cannot by itself prevent stack overflows on the C stack being used by the application. If your machine has a limit on the size of the C stack, you may get stack overflows before reaching the limit set by the command. If this happens, see if there is a mechanism in your system for increasing -the maximum size of the C stack. +the maximum size of the C stack. +.RE .SH "SAFE INTERPRETERS" .PP A safe interpreter is one with restricted functionality, so that @@ -422,32 +524,33 @@ A safe interpreter is created with exactly the following set of built-in commands: .DS .ta 1.2i 2.4i 3.6i -\fBafter append array binary -break case catch clock -close concat continue eof -error eval expr fblocked -fcopy fileevent flush for -foreach format gets global -if incr info interp -join lappend lindex linsert -list llength lrange lreplace -lsearch lsort namespace package -pid proc puts read -regexp regsub rename return -scan seek set split -string subst switch tell -time trace unset update -uplevel upvar variable vwait -while\fR +\fBafter\fR \fBappend\fR \fBapply\fR \fBarray\fR +\fBbinary\fR \fBbreak\fR \fBcatch\fR \fBchan\fR +\fBclock\fR \fBclose\fR \fBconcat\fR \fBcontinue\fR +\fBdict\fR \fBeof\fR \fBerror\fR \fBeval\fR +\fBexpr\fR \fBfblocked\fR \fBfcopy\fR \fBfileevent\fR +\fBflush\fR \fBfor\fR \fBforeach\fR \fBformat\fR +\fBgets\fR \fBglobal\fR \fBif\fR \fBincr\fR +\fBinfo\fR \fBinterp\fR \fBjoin\fR \fBlappend\fR +\fBlassign\fR \fBlindex\fR \fBlinsert\fR \fBlist\fR +\fBllength\fR \fBlrange\fR \fBlrepeat\fR \fBlreplace\fR +\fBlsearch\fR \fBlset\fR \fBlsort\fR \fBnamespace\fR +\fBpackage\fR \fBpid\fR \fBproc\fR \fBputs\fR +\fBread\fR \fBregexp\fR \fBregsub\fR \fBrename\fR +\fBreturn\fR \fBscan\fR \fBseek\fR \fBset\fR +\fBsplit\fR \fBstring\fR \fBsubst\fR \fBswitch\fR +\fBtell\fR \fBtime\fR \fBtrace\fR \fBunset\fR +\fBupdate\fR \fBuplevel\fR \fBupvar\fR \fBvariable\fR +\fBvwait\fR \fBwhile\fR .DE -.VS "" BR The following commands are hidden by \fBinterp create\fR when it creates a safe interpreter: .DS .ta 1.2i 2.4i 3.6i -\fBcd encoding exec exit -fconfigure file glob load -open pwd socket source\fR +\fBcd\fR \fBencoding\fR \fBexec\fR \fBexit\fR +\fBfconfigure\fR \fBfile\fR \fBglob\fR \fBload\fR +\fBopen\fR \fBpwd\fR \fBsocket\fR \fBsource\fR +\fBunload\fR .DE These commands can be recreated later as Tcl procedures or aliases, or re-exposed by \fBinterp expose\fR. @@ -456,25 +559,24 @@ The following commands from Tcl's library of support procedures are not present in a safe interpreter: .DS .ta 1.6i 3.2i -\fBauto_exec_ok auto_import auto_load -auto_load_index auto_qualify unknown\fR +\fBauto_exec_ok\fR \fBauto_import\fR \fBauto_load\fR +\fBauto_load_index\fR \fBauto_qualify\fR \fBunknown\fR .DE Note in particular that safe interpreters have no default \fBunknown\fR -command, so Tcl's default autoloading facilities are not available. +command, so Tcl's default autoloading facilities are not available. Autoload access to Tcl's commands that are normally autoloaded: .DS .ta 2.1i -\fB -auto_mkindex auto_mkindex_old -auto_reset history -parray pkg_mkIndex -::pkg::create ::safe::interpAddToAccessPath -::safe::interpCreate ::safe::interpConfigure -::safe::interpDelete ::safe::interpFindInAccessPath -::safe::interpInit ::safe::setLogCmd -tcl_endOfWord tcl_findLibrary -tcl_startOfNextWord tcl_startOfPreviousWord -tcl_wordBreakAfter tcl_wordBreakBefore\fR +\fBauto_mkindex\fR \fBauto_mkindex_old\fR +\fBauto_reset\fR \fBhistory\fR +\fBparray\fR \fBpkg_mkIndex\fR +\fB::pkg::create\fR \fB::safe::interpAddToAccessPath\fR +\fB::safe::interpCreate\fR \fB::safe::interpConfigure\fR +\fB::safe::interpDelete\fR \fB::safe::interpFindInAccessPath\fR +\fB::safe::interpInit\fR \fB::safe::setLogCmd\fR +\fBtcl_endOfWord\fR \fBtcl_findLibrary\fR +\fBtcl_startOfNextWord\fR \fBtcl_startOfPreviousWord\fR +\fBtcl_wordBreakAfter\fR \fBtcl_wordBreakBefore\fR .DE can only be provided by explicit definition of an \fBunknown\fR command in the safe interpreter. This will involve exposing the \fBsource\fR @@ -482,7 +584,6 @@ command. This is most easily accomplished by creating the safe interpreter with Tcl's \fBSafe\-Tcl\fR mechanism. \fBSafe\-Tcl\fR provides safe versions of \fBsource\fR, \fBload\fR, and other Tcl commands needed to support autoloading of commands and the loading of packages. -.VE .PP In addition, the \fBenv\fR variable is not present in a safe interpreter, so it cannot share environment variables with other interpreters. The @@ -518,9 +619,10 @@ as they would be for any other command invoked in that interpreter. The command procedure for the source command takes its arguments and merges them with the \fItargetCmd\fR and \fIarg\fRs for the alias to create a new array of arguments. If the words -of \fIsrcCmd\fR were ``\fIsrcCmd arg1 arg2 ... argN\fR'', +of \fIsrcCmd\fR were +.QW "\fIsrcCmd arg1 arg2 ... argN\fR" , the new set of words will be -``\fItargetCmd arg arg ... arg arg1 arg2 ... argN\fR'', +.QW "\fItargetCmd arg arg ... arg arg1 arg2 ... argN\fR" , where \fItargetCmd\fR and \fIarg\fRs are the values supplied when the alias was created. \fITargetCmd\fR is then used to locate a command procedure in the target interpreter, and that command procedure @@ -540,7 +642,6 @@ evaluated or substituted, since this would provide an escape mechanism whereby the slave interpreter could execute arbitrary code in the master. This in turn would compromise the security of the system. -.VS .SH "HIDDEN COMMANDS" .PP Safe interpreters greatly restrict the functionality available to Tcl @@ -608,10 +709,108 @@ Commands to be hidden by \fBinterp hide\fR are looked up in the global namespace even if the current namespace is not the global one. This prevents slaves from fooling a master interpreter into hiding the wrong command, by making the current namespace be different from the global one. -.VE -.SH CREDITS +.SH "RESOURCE LIMITS" +.VS 8.5 .PP -This mechanism is based on the Safe-Tcl prototype implemented +Every interpreter has two kinds of resource limits that may be imposed by any +master interpreter upon its slaves. Command limits (of type \fBcommand\fR) +restrict the total number of Tcl commands that may be executed by an +interpreter (as can be inspected via the \fBinfo cmdcount\fR command), and +time limits (of type \fBtime\fR) place a limit by which execution within the +interpreter must complete. Note that time limits are expressed as +\fIabsolute\fR times (as in \fBclock seconds\fR) and not relative times (as in +\fBafter\fR) because they may be modified after creation. +.PP +When a limit is exceeded for an interpreter, first any handler callbacks +defined by master interpreters are called. If those callbacks increase or +remove the limit, execution within the (previously) limited interpreter +continues. If the limit is still in force, an error is generated at that point +and normal processing of errors within the interpreter (by the \fBcatch\fR +command) is disabled, so the error propagates outwards (building a stack-trace +as it goes) to the point where the limited interpreter was invoked (e.g. by +\fBinterp eval\fR) where it becomes the responsibility of the calling code to +catch and handle. +.SS "LIMIT OPTIONS" +.PP +Every limit has a number of options associated with it, some of which are +common across all kinds of limits, and others of which are particular to the +kind of limit. +.VE 8.5 +.TP +\fB\-command\fR +.VS 8.5 +This option (common for all limit types) specifies (if non-empty) a Tcl script +to be executed in the global namespace of the interpreter reading and writing +the option when the particular limit in the limited interpreter is exceeded. +The callback may modify the limit on the interpreter if it wishes the limited +interpreter to continue executing. If the callback generates an error, it is +reported through the background error mechanism (see \fBBACKGROUND ERROR +HANDLING\fR). Note that the callbacks defined by one interpreter are +completely isolated from the callbacks defined by another, and that the order +in which those callbacks are called is undefined. +.VE 8.5 +.TP +\fB\-granularity\fR +.VS 8.5 +This option (common for all limit types) specifies how frequently (out of the +points when the Tcl interpreter is in a consistent state where limit checking +is possible) that the limit is actually checked. This allows the tuning of how +frequently a limit is checked, and hence how often the limit-checking overhead +(which may be substantial in the case of time limits) is incurred. +.VE 8.5 +.TP +\fB\-milliseconds\fR +.VS 8.5 +This option specifies the number of milliseconds after the moment defined in +the \fB\-seconds\fR option that the time limit will fire. It should only ever +be specified in conjunction with the \fB\-seconds\fR option (whether it was +set previously or is being set this invocation.) +.VE 8.5 +.TP +\fB\-seconds\fR +.VS 8.5 +This option specifies the number of seconds after the epoch (see \fBclock +seconds\fR) that the time limit for the interpreter will be triggered. The +limit will be triggered at the start of the second unless specified at a +sub-second level using the \fB\-milliseconds\fR option. This option may be the +empty string, which indicates that a time limit is not set for the +interpreter. +.VE 8.5 +.TP +\fB\-value\fR +.VS 8.5 +This option specifies the number of commands that the interpreter may execute +before triggering the command limit. This option may be the empty string, +which indicates that a command limit is not set for the interpreter. +.PP +Where an interpreter with a resource limit set on it creates a slave +interpreter, that slave interpreter will have resource limits imposed on it +that are at least as restrictive as the limits on the creating master +interpreter. If the master interpreter of the limited master wishes to relax +these conditions, it should hide the \fBinterp\fR command in the child and +then use aliases and the \fBinterp invokehidden\fR subcommand to provide such +access as it chooses to the \fBinterp\fR command to the limited master as +necessary. +.SH "BACKGROUND ERROR HANDLING" +.PP +When an error happens in a situation where it cannot be reported directly up +the stack (e.g. when processing events in an \fBupdate\fR or \fBvwait\fR call) +the error is instead reported through the background error handling mechanism. +Every interpreter has a background error handler registered; the default error +handler arranges for the \fBbgerror\fR command in the interpreter's global +namespace to be called, but other error handlers may be installed and process +background errors in substantially different ways. +.PP +A background error handler consists of a non-empty list of words to which will +be appended two further words at invocation time. The first word will be the +error message string, and the second will a dictionary of return options (this +is also the sort of information that can be obtained by trapping a normal +error using \fBcatch\fR of course.) The resulting list will then be executed +in the interpreter's global namespace without further substitutions being +performed. +.VE 8.5 +.SH CREDITS +The safe interpreter mechanism is based on the Safe-Tcl prototype implemented by Nathaniel Borenstein and Marshall Rose. .SH EXAMPLES Creating and using an alias for a command in the current interpreter: @@ -621,22 +820,33 @@ set idx [getIndex delta] .CE .PP Executing an arbitrary command in a safe interpreter where every -invokation of \fBlappend\fR is logged: +invocation of \fBlappend\fR is logged: .CS set i [\fBinterp create\fR -safe] \fBinterp hide\fR $i lappend \fBinterp alias\fR $i lappend {} loggedLappend $i proc loggedLappend {i args} { - puts "logged invokation of lappend $args" - # Be extremely careful about command construction - eval [linsert $args 0 \\ - \fBinterp invokehidden\fR $i lappend] + puts "logged invocation of lappend $args" + \fBinterp invokehidden\fR $i lappend {*}$args } \fBinterp eval\fR $i $someUntrustedScript .CE - +.PP +.VS 8.5 +Setting a resource limit on an interpreter so that an infinite loop +terminates. +.CS +set i [\fBinterp create\fR] +\fBinterp limit\fR $i command -value 1000 +\fBinterp eval\fR $i { + set x 0 + while {1} { + puts "Counting up... [incr x]" + } +} +.CE +.VE 8.5 .SH "SEE ALSO" -load(n), safe(n), Tcl_CreateSlave(3) - +bgerror(n), load(n), safe(n), Tcl_CreateSlave(3) .SH KEYWORDS alias, master interpreter, safe interpreter, slave interpreter |