[Bug-1630262]: segfault when deleting lines with peer text widgets

5 files changed, 181 insertions, 8 deletions

diff --git a/ChangeLog b/ChangeLog
index 3673abf..be731ca 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2012-01-??  Francois Vogel  <fvogelnew1@free.fr>
+
+	* generic/tkText.c:      [Bug-1630262]: segfault when deleting lines
+	* generic/tkTextBTree.c  with peer text widgets
+	* generic/tkTextDisp.c
+	* tests/text.test
+
 2012-01-29  Jan Nijtmans  <nijtmans@users.sf.net>
 
 	* win/tkImgPhoto.c: [Bug 3480634]: PNG Images missing in menus on Mac
diff --git a/generic/tkText.c b/generic/tkText.c
index d050170..18cbcf4 100644
--- a/generic/tkText.c
+++ b/generic/tkText.c
@@ -3097,6 +3097,11 @@ DeleteIndexRange(
 		resetView = 1;
 		line = line1;
 		byteIndex = tPtr->topIndex.byteIndex;
+            } else {
+                /*
+                 * Deletion range starts after the top line. This peers's view
+                 * will not need to be reset. Nothing to do.
+                 */
 	    }
 	} else if (index2.linePtr == tPtr->topIndex.linePtr) {
 	    /*
@@ -3113,6 +3118,11 @@ DeleteIndexRange(
 	    } else {
 		byteIndex -= (index2.byteIndex - index1.byteIndex);
 	    }
+        } else {
+            /*
+             * Deletion range ends before the top line. This peers's view
+             * will not need to be reset. Nothing to do.
+             */
 	}
 	if (resetView) {
 	    lineAndByteIndex[resetViewCount] = line;
@@ -3157,14 +3167,43 @@ DeleteIndexRange(
 	    TkTextIndex indexTmp;
 
 	    if (tPtr == textPtr) {
-		if (viewUpdate) {
+                if (viewUpdate) {
+                    /*
+                     * line cannot be before -startline of textPtr because
+                     * this line corresponds to an index which is necessarily
+                     * between "1.0" and "end" relative to textPtr.
+                     * Therefore no need to clamp line to the -start/-end
+                     * range.
+                     */
+
 		    TkTextMakeByteIndex(sharedTextPtr->tree, textPtr, line,
 			    byteIndex, &indexTmp);
 		    TkTextSetYView(tPtr, &indexTmp, 0);
 		}
 	    } else {
-		TkTextMakeByteIndex(sharedTextPtr->tree, NULL, line,
+                TkTextMakeByteIndex(sharedTextPtr->tree, tPtr, line,
 			byteIndex, &indexTmp);
+                /*
+                 * line may be before -startline of tPtr and must be
+                 * clamped to -startline before providing it to
+                 * TkTextSetYView otherwise lines before -startline
+                 * would be displayed.
+                 * There is no need to worry about -endline however,
+                 * because the view will only be reset if the deletion
+                 * involves the TOP line of the screen
+                 */
+
+                if (tPtr->start != NULL) {
+                    int start;
+                    TkTextIndex indexStart;
+
+                    start = TkBTreeLinesTo(NULL, tPtr->start);
+                    TkTextMakeByteIndex(sharedTextPtr->tree, NULL, start,
+			    0, &indexStart);
+                    if (TkTextIndexCmp(&indexTmp, &indexStart) < 0) {
+                        indexTmp = indexStart;
+                    }
+                }
 		TkTextSetYView(tPtr, &indexTmp, 0);
 	    }
 	}
diff --git a/generic/tkTextBTree.c b/generic/tkTextBTree.c
index 0038e64..005ce46 100644
--- a/generic/tkTextBTree.c
+++ b/generic/tkTextBTree.c
@@ -662,12 +662,12 @@ AdjustStartEndRefs(
 	if (textPtr->start != NULL) {
 	    count--;
 	    treePtr->startEnd[count] = textPtr->start;
-	    treePtr->startEndRef[count] = treePtr->sharedTextPtr->peers;
+	    treePtr->startEndRef[count] = textPtr;
 	}
 	if (textPtr->end != NULL) {
 	    count--;
 	    treePtr->startEnd[count] = textPtr->end;
-	    treePtr->startEndRef[count] = treePtr->sharedTextPtr->peers;
+	    treePtr->startEndRef[count] = textPtr;
 	}
     }
 }
@@ -1609,7 +1609,7 @@ TkBTreeFindLine(
     }
 
     /*
-     * Check for the any start/end offset for this text widget.
+     * Check for any start/end offset for this text widget.
      */
 
     if (textPtr != NULL) {
@@ -1993,6 +1993,11 @@ TkBTreeLinesTo(
     }
     if (textPtr != NULL && textPtr->start != NULL) {
 	index -= TkBTreeLinesTo(NULL, textPtr->start);
+        if (index < 0) {
+            /* One should panic here!
+            Tcl_Panic("TkBTreeLinesTo: linePtr comes before -startline");
+             */
+        }
     }
     return index;
 }
diff --git a/generic/tkTextDisp.c b/generic/tkTextDisp.c
index 5f30b11..f674b75 100644
--- a/generic/tkTextDisp.c
+++ b/generic/tkTextDisp.c
@@ -3219,6 +3219,34 @@ TextInvalidateLineMetrics(
     int fromLine;
     TextDInfo *dInfoPtr = textPtr->dInfoPtr;
 
+    /*
+     * All lines to invalidate must be inside the -startline/-endline range.
+     */
+
+    if (linePtr != NULL) {
+        int start;
+        TkTextLine *toLinePtr;
+        if (textPtr->start != NULL) {
+            fromLine = TkBTreeLinesTo(NULL, linePtr);
+            start = TkBTreeLinesTo(NULL, textPtr->start);
+            if (fromLine < start) {
+                lineCount -= start - fromLine;
+                linePtr = textPtr->start;
+            }
+        }
+        if (textPtr->end != NULL) {
+            int count = 0;
+            toLinePtr = linePtr;
+            while (count < lineCount && toLinePtr != NULL) {
+                toLinePtr = TkBTreeNextLine(textPtr, toLinePtr);
+                count++;
+            }
+            if (toLinePtr == NULL) {
+                lineCount = count;
+            }
+        }
+    }
+
     if (linePtr != NULL) {
 	int counter = lineCount;
 
@@ -3229,7 +3257,7 @@ TextInvalidateLineMetrics(
 	 */
 
 	TkBTreeLinePixelEpoch(textPtr, linePtr) = 0;
-	while (counter > 0 && linePtr != 0) {
+	while (counter > 0 && linePtr != NULL) {
 	    linePtr = TkBTreeNextLine(textPtr, linePtr);
 	    if (linePtr != NULL) {
 		TkBTreeLinePixelEpoch(textPtr, linePtr) = 0;
@@ -3244,7 +3272,7 @@ TextInvalidateLineMetrics(
 	 * more lines than is strictly necessary (but the examination of the
 	 * extra lines should be quick, since their pixelCalculationEpoch will
 	 * be up to date). However, to keep track of that would require more
-	 * complex record-keeping that what we have.
+	 * complex record-keeping than what we have.
 	 */
 
 	if (dInfoPtr->lineUpdateTimer == NULL) {
diff --git a/tests/text.test b/tests/text.test
index 44a3065..52689ba 100644
--- a/tests/text.test
+++ b/tests/text.test
@@ -11,7 +11,7 @@ eval tcltest::configure $argv
 tcltest::loadTestedCommands
 namespace import -force tcltest::test
 
-# Create entries in the option database to be sure that geometry options
+# Create entries in the odeption database to be sure that geometry options
 # like border width have predictable values.
 
 option add *Text.borderWidth 2
@@ -3622,6 +3622,100 @@ test text-32.1 {peer widget -start, -end and selection} {
     set res
 } {{10.0 20.0} {6.0 16.0} {6.0 11.0} {1.0 6.0} {1.0 2.0} {} {10.0 20.0}}
 
+test text-32.2 {peer widget -start, -end and deletion (bug 1630262)} -setup {
+    destroy .t .pt
+    set res {}
+} -body {
+    text .t
+    .t peer create .pt
+    for {set i 1} {$i < 100} {incr i} {
+      .t insert end "Line $i\n"
+    }
+    .t configure -startline 5
+    # none of the following delete shall crash
+    # (all did before fixing bug 1630262)
+    # 1. delete on the same line: line1 == line2 in DeleteIndexRange,
+    #    and resetView is true neither for .t not for .pt
+    .pt delete 2.0 2.2
+    # 2. delete just one line: line1 < line2 in DeleteIndexRange,
+    #    and resetView is true only for .t, not for .pt
+    .pt delete 2.0 3.0
+    # 3. delete several lines: line1 < line2 in DeleteIndexRange,
+    #    and resetView is true only for .t, not for .pt
+    .pt delete 2.0 5.0
+    # 4. delete to the end line: line1 < line2 in DeleteIndexRange,
+    #    and resetView is true only for .t, not for .pt
+    .pt delete 2.0 end
+    # this test succeeds provided there is no crash
+    set res 1
+} -cleanup {
+    destroy .pt
+} -result {1}
+
+test text-32.3 {peer widget -start, -end and deletion (bug 1630262)} -setup {
+    destroy .t .pt
+    set res {}
+} -body {
+    text .t
+    .t peer create .pt
+    for {set i 1} {$i < 100} {incr i} {
+      .t insert end "Line $i\n"
+    }
+    .t configure -startline 5
+    .pt configure -startline 3
+    # the following delete shall not crash
+    # (it did before fixing bug 1630262)
+    .pt delete 2.0 3.0
+    # moreover -startline shall be correct
+    # (was wrong before fixing bug 1630262)
+    lappend res [.t cget -start] [.pt cget -start]
+} -cleanup {
+    destroy .pt
+} -result {4 3}
+
+test text-32.4 {peer widget -start, -end and deletion (bug 1630262)} -setup {
+    destroy .t .pt
+    set res {}
+} -body {
+    text .t
+    .t peer create .pt
+    for {set i 1} {$i < 100} {incr i} {
+      .t insert end "Line $i\n"
+    }
+    .t configure -startline 5 -endline 15
+    .pt configure -startline 8 -endline 12
+    # .pt now shows a range entirely inside the range of .pt
+    # from .t, delete lines located after [.pt cget -end]
+    .t delete 9.0 10.0
+    # from .t, delete lines straddling [.pt cget -end]
+    .t delete 6.0 9.0
+    lappend res [.t cget -start] [.t cget -end] [.pt cget -start] [.pt cget -end]
+    .t configure -startline 5 -endline 12
+    .pt configure -startline 8 -endline 12
+    # .pt now shows again a range entirely inside the range of .pt
+    # from .t, delete lines located before [.pt cget -start]
+    .t delete 2.0 3.0
+    # from .t, delete lines straddling [.pt cget -start]
+    .t delete 2.0 5.0
+    lappend res [.t cget -start] [.t cget -end] [.pt cget -start] [.pt cget -end]
+    .t configure -startline 22 -endline 31
+    .pt configure -startline 42 -endline 51
+    # .t now shows a range entirely before the range of .pt
+    # from .t, delete some lines, then do it from .pt
+    .t delete 2.0 3.0
+    .t delete 2.0 5.0
+    .pt delete 2.0 5.0
+    lappend res [.t cget -start] [.t cget -end] [.pt cget -start] [.pt cget -end]
+    .t configure -startline 55 -endline 75
+    .pt configure -startline 60 -endline 70
+    # .pt now shows a range entirely inside the range of .t
+    # from .t, delete a range straddling the entire range of .pt
+    .t delete 3.0 18.0
+    lappend res [.t cget -start] [.t cget -end] [.pt cget -start] [.pt cget -end]
+} -cleanup {
+    destroy .pt
+} -result {5 11 8 10 5 8 6 8 22 27 38 44 55 60 57 57}
+
 test text-33.1 {widget dump -command alters tags} {
     .t delete 1.0 end
     .t insert end "abc\n" a "---" {} "def" b "   \n" {} "ghi\n" c