[Tcl Bug 2857044]: Corrections following audit of Tcl_ObjType freeing

practises; the typePtr field is now cleared when an object ceases to be of
the type.
Also remove some anachronistic techniques (pointless casts, mixed assignments
and tests, etc.)

7 files changed, 185 insertions, 135 deletions

diff --git a/generic/tk3d.c b/generic/tk3d.c
index 26c8536..393345d 100644
--- a/generic/tk3d.c
+++ b/generic/tk3d.c
@@ -10,7 +10,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tk3d.c,v 1.25 2009/01/09 07:03:31 nijtmans Exp $
+ * RCS: @(#) $Id: tk3d.c,v 1.26 2009/11/21 17:24:42 dkf Exp $
  */
 
 #include "tkInt.h"
@@ -32,6 +32,7 @@ static const char *const reliefStrings[] = {
 static void		BorderInit(TkDisplay *dispPtr);
 static void		DupBorderObjProc(Tcl_Obj *srcObjPtr,
 			    Tcl_Obj *dupObjPtr);
+static void		FreeBorderObj(Tcl_Obj *objPtr);
 static void		FreeBorderObjProc(Tcl_Obj *objPtr);
 static int		Intersect(XPoint *a1Ptr, XPoint *a2Ptr,
 			    XPoint *b1Ptr, XPoint *b2Ptr, XPoint *iPtr);
@@ -73,8 +74,8 @@ const Tcl_ObjType tkBorderObjType = {
  * Side effects:
  *	The border is added to an internal database with a reference count.
  *	For each call to this function, there should eventually be a call to
- *	FreeBorderObjProc so that the database is cleaned up when borders
- *	aren't in use anymore.
+ *	FreeBorderObj so that the database is cleaned up when borders aren't
+ *	in use anymore.
  *
  *----------------------------------------------------------------------
  */
@@ -105,7 +106,7 @@ Tk_Alloc3DBorderFromObj(
 	     * longer in use. Clear the reference.
 	     */
 
-	    FreeBorderObjProc(objPtr);
+	    FreeBorderObj(objPtr);
 	    borderPtr = NULL;
 	} else if ((Tk_Screen(tkwin) == borderPtr->screen)
 		&& (Tk_Colormap(tkwin) == borderPtr->colormap)) {
@@ -118,9 +119,7 @@ Tk_Alloc3DBorderFromObj(
      * The object didn't point to the border that we wanted. Search the list
      * of borders with the same name to see if one of the others is the right
      * one.
-     */
-
-    /*
+     *
      * If the cached value is NULL, either the object type was not a color
      * going in, or the object is a color type but had previously been freed.
      *
@@ -132,7 +131,7 @@ Tk_Alloc3DBorderFromObj(
     if (borderPtr != NULL) {
 	TkBorder *firstBorderPtr = Tcl_GetHashValue(borderPtr->hashPtr);
 
-	FreeBorderObjProc(objPtr);
+	FreeBorderObj(objPtr);
 	for (borderPtr = firstBorderPtr ; borderPtr != NULL;
 		borderPtr = borderPtr->nextPtr) {
 	    if ((Tk_Screen(tkwin) == borderPtr->screen)
@@ -496,13 +495,13 @@ Tk_Free3DBorderFromObj(
     Tcl_Obj *objPtr)		/* The Tcl_Obj * to be freed. */
 {
     Tk_Free3DBorder(Tk_Get3DBorderFromObj(tkwin, objPtr));
-    FreeBorderObjProc(objPtr);
+    FreeBorderObj(objPtr);
 }
 
 /*
  *---------------------------------------------------------------------------
  *
- * FreeBorderObjProc --
+ * FreeBorderObjProc, FreeBorderObj --
  *
  *	This proc is called to release an object reference to a border. Called
  *	when the object's internal rep is released or when the cached
@@ -522,6 +521,14 @@ static void
 FreeBorderObjProc(
     Tcl_Obj *objPtr)		/* The object we are releasing. */
 {
+    FreeBorderObj(objPtr);
+    objPtr->typePtr = NULL;
+}
+
+static void
+FreeBorderObj(
+    Tcl_Obj *objPtr)		/* The object we are releasing. */
+{
     TkBorder *borderPtr = objPtr->internalRep.twoPtrValue.ptr1;
 
     if (borderPtr != NULL) {
@@ -657,12 +664,12 @@ Tk_GetRelief(
 	*reliefPtr = TK_RELIEF_FLAT;
     } else if ((c == 'g') && (strncmp(name, "groove", length) == 0)
 	    && (length >= 2)) {
-        *reliefPtr = TK_RELIEF_GROOVE;
+	*reliefPtr = TK_RELIEF_GROOVE;
     } else if ((c == 'r') && (strncmp(name, "raised", length) == 0)
 	    && (length >= 2)) {
 	*reliefPtr = TK_RELIEF_RAISED;
     } else if ((c == 'r') && (strncmp(name, "ridge", length) == 0)) {
-        *reliefPtr = TK_RELIEF_RIDGE;
+	*reliefPtr = TK_RELIEF_RIDGE;
     } else if ((c == 's') && (strncmp(name, "solid", length) == 0)) {
 	*reliefPtr = TK_RELIEF_SOLID;
     } else if ((c == 's') && (strncmp(name, "sunken", length) == 0)) {
@@ -770,9 +777,8 @@ Tk_Draw3DPolygon(
      */
 
     if ((leftRelief == TK_RELIEF_GROOVE) || (leftRelief == TK_RELIEF_RIDGE)) {
-	int halfWidth;
+	int halfWidth = borderWidth/2;
 
-	halfWidth = borderWidth/2;
 	Tk_Draw3DPolygon(tkwin, drawable, border, pointPtr, numPoints,
 		halfWidth, (leftRelief == TK_RELIEF_GROOVE) ? TK_RELIEF_RAISED
 		: TK_RELIEF_SUNKEN);
@@ -1085,19 +1091,18 @@ ShiftLine(
     XPoint *p3Ptr)		/* Store coords of point on new line here. */
 {
     int dx, dy, dxNeg, dyNeg;
-
-    /*
-     * The table below is used for a quick approximation in computing the new
-     * point. An index into the table is 128 times the slope of the original
-     * line (the slope must always be between 0 and 1). The value of the table
-     * entry is 128 times the amount to displace the new line in y for each
-     * unit of perpendicular distance. In other words, the table maps from the
-     * tangent of an angle to the inverse of its cosine. If the slope of the
-     * original line is greater than 1, then the displacement is done in x
-     * rather than in y.
-     */
-
-    static int shiftTable[129];
+    static int shiftTable[129];	/* Used for a quick approximation in computing
+				 * the new point. An index into the table is
+				 * 128 times the slope of the original line
+				 * (the slope must always be between 0 and 1).
+				 * The value of the table entry is 128 times
+				 * the amount to displace the new line in y
+				 * for each unit of perpendicular distance. In
+				 * other words, the table maps from the
+				 * tangent of an angle to the inverse of its
+				 * cosine. If the slope of the original line
+				 * is greater than 1, then the displacement is
+				 * done in x rather than in y. */
 
     /*
      * Initialize the table if this is the first time it is used.
@@ -1283,7 +1288,7 @@ Tk_Get3DBorderFromObj(
 	    borderPtr = borderPtr->nextPtr) {
 	if ((Tk_Screen(tkwin) == borderPtr->screen)
 		&& (Tk_Colormap(tkwin) == borderPtr->colormap)) {
-	    FreeBorderObjProc(objPtr);
+	    FreeBorderObj(objPtr);
 	    objPtr->internalRep.twoPtrValue.ptr1 = borderPtr;
 	    borderPtr->objRefCount++;
 	    return (Tk_3DBorder) borderPtr;
diff --git a/generic/tkBitmap.c b/generic/tkBitmap.c
index adfb245..14b4985 100644
--- a/generic/tkBitmap.c
+++ b/generic/tkBitmap.c
@@ -11,7 +11,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkBitmap.c,v 1.26 2009/02/27 23:23:36 nijtmans Exp $
+ * RCS: @(#) $Id: tkBitmap.c,v 1.27 2009/11/21 17:24:42 dkf Exp $
  */
 
 #include "tkInt.h"
@@ -110,6 +110,7 @@ static void		BitmapInit(TkDisplay *dispPtr);
 static void		DupBitmapObjProc(Tcl_Obj *srcObjPtr,
 			    Tcl_Obj *dupObjPtr);
 static void		FreeBitmap(TkBitmap *bitmapPtr);
+static void		FreeBitmapObj(Tcl_Obj *objPtr);
 static void		FreeBitmapObjProc(Tcl_Obj *objPtr);
 static TkBitmap *	GetBitmap(Tcl_Interp *interp, Tk_Window tkwin,
 			    const char *name);
@@ -168,7 +169,7 @@ Tk_AllocBitmapFromObj(
     if (objPtr->typePtr != &tkBitmapObjType) {
 	InitBitmapObj(objPtr);
     }
-    bitmapPtr = (TkBitmap *) objPtr->internalRep.twoPtrValue.ptr1;
+    bitmapPtr = objPtr->internalRep.twoPtrValue.ptr1;
 
     /*
      * If the object currently points to a TkBitmap, see if it's the one we
@@ -182,7 +183,7 @@ Tk_AllocBitmapFromObj(
 	     * longer in use. Clear the reference.
 	     */
 
-	    FreeBitmapObjProc(objPtr);
+	    FreeBitmapObj(objPtr);
 	    bitmapPtr = NULL;
 	} else if ((Tk_Display(tkwin) == bitmapPtr->display)
 		&& (Tk_ScreenNumber(tkwin) == bitmapPtr->screenNum)) {
@@ -198,16 +199,16 @@ Tk_AllocBitmapFromObj(
      */
 
     if (bitmapPtr != NULL) {
-	TkBitmap *firstBitmapPtr = (TkBitmap *)
-		Tcl_GetHashValue(bitmapPtr->nameHashPtr);
-	FreeBitmapObjProc(objPtr);
+	TkBitmap *firstBitmapPtr = Tcl_GetHashValue(bitmapPtr->nameHashPtr);
+
+	FreeBitmapObj(objPtr);
 	for (bitmapPtr = firstBitmapPtr; bitmapPtr != NULL;
 		bitmapPtr = bitmapPtr->nextPtr) {
 	    if ((Tk_Display(tkwin) == bitmapPtr->display) &&
 		    (Tk_ScreenNumber(tkwin) == bitmapPtr->screenNum)) {
 		bitmapPtr->resourceRefCount++;
 		bitmapPtr->objRefCount++;
-		objPtr->internalRep.twoPtrValue.ptr1 = (void *) bitmapPtr;
+		objPtr->internalRep.twoPtrValue.ptr1 = bitmapPtr;
 		return bitmapPtr->bitmap;
 	    }
 	}
@@ -218,7 +219,7 @@ Tk_AllocBitmapFromObj(
      */
 
     bitmapPtr = GetBitmap(interp, tkwin, Tcl_GetString(objPtr));
-    objPtr->internalRep.twoPtrValue.ptr1 = (void *) bitmapPtr;
+    objPtr->internalRep.twoPtrValue.ptr1 = bitmapPtr;
     if (bitmapPtr == NULL) {
 	return None;
     }
@@ -318,11 +319,11 @@ GetBitmap(
     nameHashPtr = Tcl_CreateHashEntry(&dispPtr->bitmapNameTable, string,
 	    &isNew);
     if (!isNew) {
-	existingBitmapPtr = (TkBitmap *) Tcl_GetHashValue(nameHashPtr);
+	existingBitmapPtr = Tcl_GetHashValue(nameHashPtr);
 	for (bitmapPtr = existingBitmapPtr; bitmapPtr != NULL;
 		bitmapPtr = bitmapPtr->nextPtr) {
-	    if ( (Tk_Display(tkwin) == bitmapPtr->display) &&
-		    (Tk_ScreenNumber(tkwin) == bitmapPtr->screenNum) ) {
+	    if ((Tk_Display(tkwin) == bitmapPtr->display) &&
+		    (Tk_ScreenNumber(tkwin) == bitmapPtr->screenNum)) {
 		bitmapPtr->resourceRefCount++;
 		return bitmapPtr;
 	    }
@@ -391,7 +392,7 @@ GetBitmap(
 		goto error;
 	    }
 	} else {
-	    predefPtr = (TkPredefBitmap *) Tcl_GetHashValue(predefHashPtr);
+	    predefPtr = Tcl_GetHashValue(predefHashPtr);
 	    width = predefPtr->width;
 	    height = predefPtr->height;
 	    if (predefPtr->native) {
@@ -547,7 +548,7 @@ Tk_NameOfBitmap(
     if (idHashPtr == NULL) {
 	goto unknown;
     }
-    bitmapPtr = (TkBitmap *) Tcl_GetHashValue(idHashPtr);
+    bitmapPtr = Tcl_GetHashValue(idHashPtr);
     return bitmapPtr->nameHashPtr->key.string;
 }
 
@@ -589,7 +590,7 @@ Tk_SizeOfBitmap(
     if (idHashPtr == NULL) {
 	goto unknownBitmap;
     }
-    bitmapPtr = (TkBitmap *) Tcl_GetHashValue(idHashPtr);
+    bitmapPtr = Tcl_GetHashValue(idHashPtr);
     *widthPtr = bitmapPtr->width;
     *heightPtr = bitmapPtr->height;
 }
@@ -626,7 +627,7 @@ FreeBitmap(
 
     Tk_FreePixmap(bitmapPtr->display, bitmapPtr->bitmap);
     Tcl_DeleteHashEntry(bitmapPtr->idHashPtr);
-    prevPtr = (TkBitmap *) Tcl_GetHashValue(bitmapPtr->nameHashPtr);
+    prevPtr = Tcl_GetHashValue(bitmapPtr->nameHashPtr);
     if (prevPtr == bitmapPtr) {
 	if (bitmapPtr->nextPtr == NULL) {
 	    Tcl_DeleteHashEntry(bitmapPtr->nameHashPtr);
@@ -714,7 +715,7 @@ Tk_FreeBitmapFromObj(
 /*
  *---------------------------------------------------------------------------
  *
- * FreeBitmapObjProc --
+ * FreeBitmapObjProc, FreeBitmapObj --
  *
  *	This proc is called to release an object reference to a bitmap.
  *	Called when the object's internal rep is released or when the cached
@@ -734,7 +735,15 @@ static void
 FreeBitmapObjProc(
     Tcl_Obj *objPtr)		/* The object we are releasing. */
 {
-    TkBitmap *bitmapPtr = (TkBitmap *) objPtr->internalRep.twoPtrValue.ptr1;
+    FreeBitmapObj(objPtr);
+    objPtr->typePtr = NULL;
+}
+
+static void
+FreeBitmapObj(
+    Tcl_Obj *objPtr)		/* The object we are releasing. */
+{
+    TkBitmap *bitmapPtr = objPtr->internalRep.twoPtrValue.ptr1;
 
     if (bitmapPtr != NULL) {
 	bitmapPtr->objRefCount--;
@@ -769,10 +778,10 @@ DupBitmapObjProc(
     Tcl_Obj *srcObjPtr,		/* The object we are copying from. */
     Tcl_Obj *dupObjPtr)		/* The object we are copying to. */
 {
-    TkBitmap *bitmapPtr = (TkBitmap *) srcObjPtr->internalRep.twoPtrValue.ptr1;
+    TkBitmap *bitmapPtr = srcObjPtr->internalRep.twoPtrValue.ptr1;
 
     dupObjPtr->typePtr = srcObjPtr->typePtr;
-    dupObjPtr->internalRep.twoPtrValue.ptr1 = (void *) bitmapPtr;
+    dupObjPtr->internalRep.twoPtrValue.ptr1 = bitmapPtr;
 
     if (bitmapPtr != NULL) {
 	bitmapPtr->objRefCount++;
@@ -842,7 +851,7 @@ Tk_GetBitmapFromData(
     dataHashPtr = Tcl_CreateHashEntry(&dispPtr->bitmapDataTable,
 	    (char *) &nameKey, &isNew);
     if (!isNew) {
-	name = (char *) Tcl_GetHashValue(dataHashPtr);
+	name = Tcl_GetHashValue(dataHashPtr);
     } else {
 	dispPtr->bitmapAutoNumber++;
 	sprintf(string, "_tk%d", dispPtr->bitmapAutoNumber);
@@ -920,14 +929,14 @@ GetBitmapFromObj(
 	InitBitmapObj(objPtr);
     }
 
-    bitmapPtr = (TkBitmap *) objPtr->internalRep.twoPtrValue.ptr1;
+    bitmapPtr = objPtr->internalRep.twoPtrValue.ptr1;
     if (bitmapPtr != NULL) {
 	if ((bitmapPtr->resourceRefCount > 0)
 		&& (Tk_Display(tkwin) == bitmapPtr->display)) {
 	    return bitmapPtr;
 	}
 	hashPtr = bitmapPtr->nameHashPtr;
-	FreeBitmapObjProc(objPtr);
+	FreeBitmapObj(objPtr);
     } else {
 	hashPtr = Tcl_FindHashEntry(&dispPtr->bitmapNameTable,
 		Tcl_GetString(objPtr));
@@ -941,10 +950,10 @@ GetBitmapFromObj(
      * more TkBitmap structures. See if any of them will work.
      */
 
-    for (bitmapPtr = (TkBitmap *) Tcl_GetHashValue(hashPtr);
-	    bitmapPtr != NULL;  bitmapPtr = bitmapPtr->nextPtr) {
+    for (bitmapPtr = Tcl_GetHashValue(hashPtr); bitmapPtr != NULL;
+	    bitmapPtr = bitmapPtr->nextPtr) {
 	if (Tk_Display(tkwin) == bitmapPtr->display) {
-	    objPtr->internalRep.twoPtrValue.ptr1 = (void *) bitmapPtr;
+	    objPtr->internalRep.twoPtrValue.ptr1 = bitmapPtr;
 	    bitmapPtr->objRefCount++;
 	    return bitmapPtr;
 	}
@@ -1159,7 +1168,7 @@ TkDebugBitmap(
     resultPtr = Tcl_NewObj();
     hashPtr = Tcl_FindHashEntry(&dispPtr->bitmapNameTable, name);
     if (hashPtr != NULL) {
-	bitmapPtr = (TkBitmap *) Tcl_GetHashValue(hashPtr);
+	bitmapPtr = Tcl_GetHashValue(hashPtr);
 	if (bitmapPtr == NULL) {
 	    Tcl_Panic("TkDebugBitmap found empty hash table entry");
 	}
diff --git a/generic/tkColor.c b/generic/tkColor.c
index 627799e..ccd46e7 100644
--- a/generic/tkColor.c
+++ b/generic/tkColor.c
@@ -11,7 +11,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkColor.c,v 1.20 2009/01/09 07:03:31 nijtmans Exp $
+ * RCS: @(#) $Id: tkColor.c,v 1.21 2009/11/21 17:24:42 dkf Exp $
  */
 
 #include "tkInt.h"
@@ -44,6 +44,7 @@ static Tcl_ThreadDataKey dataKey;
 
 static void		ColorInit(TkDisplay *dispPtr);
 static void		DupColorObjProc(Tcl_Obj *srcObjPtr,Tcl_Obj *dupObjPtr);
+static void		FreeColorObj(Tcl_Obj *objPtr);
 static void		FreeColorObjProc(Tcl_Obj *objPtr);
 static void		InitColorObj(Tcl_Obj *objPtr);
 
@@ -113,7 +114,7 @@ Tk_AllocColorFromObj(
 	     * longer in use. Clear the reference.
 	     */
 
-	    FreeColorObjProc(objPtr);
+	    FreeColorObj(objPtr);
 	    tkColPtr = NULL;
 	} else if ((Tk_Screen(tkwin) == tkColPtr->screen)
 		&& (Tk_Colormap(tkwin) == tkColPtr->colormap)) {
@@ -131,7 +132,7 @@ Tk_AllocColorFromObj(
     if (tkColPtr != NULL) {
 	TkColor *firstColorPtr = Tcl_GetHashValue(tkColPtr->hashPtr);
 
-	FreeColorObjProc(objPtr);
+	FreeColorObj(objPtr);
 	for (tkColPtr = firstColorPtr; tkColPtr != NULL;
 		tkColPtr = tkColPtr->nextPtr) {
 	    if ((Tk_Screen(tkwin) == tkColPtr->screen)
@@ -527,13 +528,13 @@ Tk_FreeColorFromObj(
     Tcl_Obj *objPtr)		/* The Tcl_Obj * to be freed. */
 {
     Tk_FreeColor(Tk_GetColorFromObj(tkwin, objPtr));
-    FreeColorObjProc(objPtr);
+    FreeColorObj(objPtr);
 }
 
 /*
  *---------------------------------------------------------------------------
  *
- * FreeColorObjProc --
+ * FreeColorObjProc, FreeColorObj --
  *
  *	This proc is called to release an object reference to a color. Called
  *	when the object's internal rep is released or when the cached tkColPtr
@@ -553,6 +554,14 @@ static void
 FreeColorObjProc(
     Tcl_Obj *objPtr)		/* The object we are releasing. */
 {
+    FreeColorObj(objPtr);
+    objPtr->typePtr = NULL;
+}
+
+static void
+FreeColorObj(
+    Tcl_Obj *objPtr)		/* The object we are releasing. */
+{
     TkColor *tkColPtr = objPtr->internalRep.twoPtrValue.ptr1;
 
     if (tkColPtr != NULL) {
@@ -668,7 +677,7 @@ Tk_GetColorFromObj(
 	    (tkColPtr != NULL); tkColPtr = tkColPtr->nextPtr) {
 	if ((Tk_Screen(tkwin) == tkColPtr->screen)
 		&& (Tk_Colormap(tkwin) == tkColPtr->colormap)) {
-	    FreeColorObjProc(objPtr);
+	    FreeColorObj(objPtr);
 	    objPtr->internalRep.twoPtrValue.ptr1 = tkColPtr;
 	    tkColPtr->objRefCount++;
 	    return (XColor *) tkColPtr;
diff --git a/generic/tkCursor.c b/generic/tkCursor.c
index f5a4ca4..5ca7b07 100644
--- a/generic/tkCursor.c
+++ b/generic/tkCursor.c
@@ -11,7 +11,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkCursor.c,v 1.22 2009/01/09 07:03:31 nijtmans Exp $
+ * RCS: @(#) $Id: tkCursor.c,v 1.23 2009/11/21 17:24:42 dkf Exp $
  */
 
 #include "tkInt.h"
@@ -42,6 +42,7 @@ static void		CursorInit(TkDisplay *dispPtr);
 static void		DupCursorObjProc(Tcl_Obj *srcObjPtr,
 			    Tcl_Obj *dupObjPtr);
 static void		FreeCursor(TkCursor *cursorPtr);
+static void		FreeCursorObj(Tcl_Obj *objPtr);
 static void		FreeCursorObjProc(Tcl_Obj *objPtr);
 static TkCursor *	TkcGetCursor(Tcl_Interp *interp, Tk_Window tkwin,
 			    const char *name);
@@ -115,7 +116,7 @@ Tk_AllocCursorFromObj(
 	     * longer in use. Clear the reference.
 	     */
 
-	    FreeCursorObjProc(objPtr);
+	    FreeCursorObj(objPtr);
 	    cursorPtr = NULL;
 	} else if (Tk_Display(tkwin) == cursorPtr->display) {
 	    cursorPtr->resourceRefCount++;
@@ -132,7 +133,7 @@ Tk_AllocCursorFromObj(
     if (cursorPtr != NULL) {
 	TkCursor *firstCursorPtr = Tcl_GetHashValue(cursorPtr->hashPtr);
 
-	FreeCursorObjProc(objPtr);
+	FreeCursorObj(objPtr);
 	for (cursorPtr = firstCursorPtr;  cursorPtr != NULL;
 		cursorPtr = cursorPtr->nextPtr) {
 	    if (Tk_Display(tkwin) == cursorPtr->display) {
@@ -240,7 +241,7 @@ TkcGetCursor(
     }
 
     nameHashPtr = Tcl_CreateHashEntry(&dispPtr->cursorNameTable,
-            string, &isNew);
+	    string, &isNew);
     if (!isNew) {
 	existingCursorPtr = Tcl_GetHashValue(nameHashPtr);
 	for (cursorPtr = existingCursorPtr; cursorPtr != NULL;
@@ -274,7 +275,7 @@ TkcGetCursor(
     cursorPtr->hashPtr = nameHashPtr;
     cursorPtr->nextPtr = existingCursorPtr;
     cursorPtr->idHashPtr = Tcl_CreateHashEntry(&dispPtr->cursorIdTable,
-            (char *) cursorPtr->cursor, &isNew);
+	    (char *) cursorPtr->cursor, &isNew);
     if (!isNew) {
 	Tcl_Panic("cursor already registered in Tk_GetCursor");
     }
@@ -340,7 +341,7 @@ Tk_GetCursorFromData(
     dataKey.bg = bg;
     dataKey.display = Tk_Display(tkwin);
     dataHashPtr = Tcl_CreateHashEntry(&dispPtr->cursorDataTable,
-            (char *) &dataKey, &isNew);
+	    (char *) &dataKey, &isNew);
     if (!isNew) {
 	cursorPtr = Tcl_GetHashValue(dataHashPtr);
 	cursorPtr->resourceRefCount++;
@@ -373,7 +374,7 @@ Tk_GetCursorFromData(
     cursorPtr->hashPtr = dataHashPtr;
     cursorPtr->objRefCount = 0;
     cursorPtr->idHashPtr = Tcl_CreateHashEntry(&dispPtr->cursorIdTable,
-            (char *) cursorPtr->cursor, &isNew);
+	    (char *) cursorPtr->cursor, &isNew);
     cursorPtr->nextPtr = NULL;
 
     if (!isNew) {
@@ -550,13 +551,13 @@ Tk_FreeCursorFromObj(
     Tcl_Obj *objPtr)		/* The Tcl_Obj * to be freed. */
 {
     FreeCursor(GetCursorFromObj(tkwin, objPtr));
-    FreeCursorObjProc(objPtr);
+    FreeCursorObj(objPtr);
 }
 
 /*
  *---------------------------------------------------------------------------
  *
- * FreeCursorFromObjProc --
+ * FreeCursorObjProc, FreeCursorObj --
  *
  *	This proc is called to release an object reference to a cursor.
  *	Called when the object's internal rep is released or when the cached
@@ -576,6 +577,14 @@ static void
 FreeCursorObjProc(
     Tcl_Obj *objPtr)		/* The object we are releasing. */
 {
+    FreeCursorObj(objPtr);
+    objPtr->typePtr = NULL;
+}
+
+static void
+FreeCursorObj(
+    Tcl_Obj *objPtr)		/* The object we are releasing. */
+{
     TkCursor *cursorPtr = objPtr->internalRep.twoPtrValue.ptr1;
 
     if (cursorPtr != NULL) {
@@ -714,7 +723,7 @@ GetCursorFromObj(
     for (cursorPtr = Tcl_GetHashValue(hashPtr);
 	    cursorPtr != NULL; cursorPtr = cursorPtr->nextPtr) {
 	if (Tk_Display(tkwin) == cursorPtr->display) {
-	    FreeCursorObjProc(objPtr);
+	    FreeCursorObj(objPtr);
 	    objPtr->internalRep.twoPtrValue.ptr1 = cursorPtr;
 	    cursorPtr->objRefCount++;
 	    return cursorPtr;
diff --git a/generic/tkFont.c b/generic/tkFont.c
index ebd2e3a..21368fc 100644
--- a/generic/tkFont.c
+++ b/generic/tkFont.c
@@ -10,7 +10,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkFont.c,v 1.60 2009/10/21 21:22:26 patthoyts Exp $
+ * RCS: @(#) $Id: tkFont.c,v 1.61 2009/11/21 17:24:42 dkf Exp $
  */
 
 #include "tkInt.h"
@@ -329,6 +329,7 @@ static int		ConfigAttributesObj(Tcl_Interp *interp,
 			    TkFontAttributes *faPtr);
 static void		DupFontObjProc(Tcl_Obj *srcObjPtr, Tcl_Obj *dupObjPtr);
 static int		FieldSpecified(const char *field);
+static void		FreeFontObj(Tcl_Obj *objPtr);
 static void		FreeFontObjProc(Tcl_Obj *objPtr);
 static int		GetAttributeInfoObj(Tcl_Interp *interp,
 			    const TkFontAttributes *faPtr, Tcl_Obj *objPtr);
@@ -1117,7 +1118,7 @@ Tk_AllocFontFromObj(
 	     * longer in use. Clear the reference.
 	     */
 
-	    FreeFontObjProc(objPtr);
+	    FreeFontObj(objPtr);
 	    oldFontPtr = NULL;
 	} else if (Tk_Screen(tkwin) == oldFontPtr->screen) {
 	    oldFontPtr->resourceRefCount++;
@@ -1133,7 +1134,7 @@ Tk_AllocFontFromObj(
     isNew = 0;
     if (oldFontPtr != NULL) {
 	cacheHashPtr = oldFontPtr->cacheHashPtr;
-	FreeFontObjProc(objPtr);
+	FreeFontObj(objPtr);
     } else {
 	cacheHashPtr = Tcl_CreateHashEntry(&fiPtr->fontCache,
 		Tcl_GetString(objPtr), &isNew);
@@ -1297,7 +1298,7 @@ Tk_GetFontFromObj(
 	     * longer in use. Clear the reference.
 	     */
 
-	    FreeFontObjProc(objPtr);
+	    FreeFontObj(objPtr);
 	    fontPtr = NULL;
 	} else if (Tk_Screen(tkwin) == fontPtr->screen) {
 	    return (Tk_Font) fontPtr;
@@ -1311,7 +1312,7 @@ Tk_GetFontFromObj(
 
     if (fontPtr != NULL) {
 	hashPtr = fontPtr->cacheHashPtr;
-	FreeFontObjProc(objPtr);
+	FreeFontObj(objPtr);
     } else {
 	hashPtr = Tcl_FindHashEntry(&fiPtr->fontCache, Tcl_GetString(objPtr));
     }
@@ -1495,7 +1496,7 @@ Tk_FreeFontFromObj(
 /*
  *---------------------------------------------------------------------------
  *
- * FreeFontObjProc --
+ * FreeFontObjProc, FreeFontObj --
  *
  *	This proc is called to release an object reference to a font. Called
  *	when the object's internal rep is released or when the cached fontPtr
@@ -1515,6 +1516,14 @@ static void
 FreeFontObjProc(
     Tcl_Obj *objPtr)		/* The object we are releasing. */
 {
+    FreeFontObj(objPtr);
+    objPtr->typePtr = NULL;
+}
+
+static void
+FreeFontObj(
+    Tcl_Obj *objPtr)		/* The object we are releasing. */
+{
     TkFont *fontPtr = objPtr->internalRep.twoPtrValue.ptr1;
 
     if (fontPtr != NULL) {
diff --git a/generic/tkTextIndex.c b/generic/tkTextIndex.c
index 46a2692..e192962 100644
--- a/generic/tkTextIndex.c
+++ b/generic/tkTextIndex.c
@@ -10,7 +10,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkTextIndex.c,v 1.36 2009/09/07 07:29:04 das Exp $
+ * RCS: @(#) $Id: tkTextIndex.c,v 1.37 2009/11/21 17:24:42 dkf Exp $
  */
 
 #include "default.h"
@@ -66,7 +66,7 @@ static void		UpdateStringOfTextIndex(Tcl_Obj *objPtr);
 	((objPtr)->internalRep.twoPtrValue.ptr1 = (void *) (indexPtr))
 #define SET_INDEXEPOCH(objPtr, epoch) \
 	((objPtr)->internalRep.twoPtrValue.ptr2 = INT2PTR(epoch))
-
+
 /*
  * Define the 'textindex' object type, which Tk uses to represent indices in
  * text widgets internally.
@@ -92,10 +92,11 @@ FreeTextIndexInternalRep(
 	     * The text widget has been deleted and we need to free it now.
 	     */
 
-	    ckfree((char *) (indexPtr->textPtr));
+	    ckfree((char *) indexPtr->textPtr);
 	}
     }
     ckfree((char *) indexPtr);
+    indexObjPtr->typePtr = NULL;
 }
 
 static void
@@ -121,7 +122,7 @@ DupTextIndexInternalRep(
     SET_INDEXEPOCH(copyPtr, epoch);
     copyPtr->typePtr = &tkTextIndexType;
 }
-
+
 /*
  * This will not be called except by TkTextNewIndexObj below. This is because
  * if a TkTextIndex is no longer valid, it is not possible to regenerate the
@@ -153,7 +154,7 @@ SetTextIndexFromAny(
 	    "via TkTextGetIndexFromObj API", -1);
     return TCL_ERROR;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -250,7 +251,7 @@ TkTextGetIndexFromObj(
 
     return MakeObjIndex((cache ? textPtr : NULL), objPtr, &index);
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -295,7 +296,7 @@ TkTextNewIndexObj(
     UpdateStringOfTextIndex(retVal);
     return retVal;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -363,7 +364,7 @@ TkTextMakePixelIndex(
     }
     return TkTextMeasureDown(textPtr, indexPtr, pixelOffset);
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -456,7 +457,7 @@ TkTextMakeByteIndex(
     }
     return indexPtr;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -551,7 +552,7 @@ TkTextMakeCharIndex(
     }
     return indexPtr;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -591,7 +592,7 @@ TkTextIndexToSeg(
     }
     return segPtr;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -624,7 +625,7 @@ TkTextSegToOffset(
     }
     return offset;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -653,7 +654,7 @@ TkTextGetObjIndex(
     return GetIndex(interp, NULL, textPtr, Tcl_GetString(idxObj), indexPtr,
 	    NULL);
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -682,7 +683,7 @@ TkTextSharedGetObjIndex(
     return GetIndex(interp, sharedTextPtr, NULL, Tcl_GetString(idxObj),
 	    indexPtr, NULL);
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -711,7 +712,7 @@ TkTextGetIndex(
 {
     return GetIndex(interp, NULL, textPtr, string, indexPtr, NULL);
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -1006,7 +1007,7 @@ GetIndex(
     Tcl_AppendResult(interp, "bad text index \"", string, "\"", NULL);
     return TCL_ERROR;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -1070,7 +1071,7 @@ TkTextPrintIndex(
     return sprintf(string, "%d.%d",
 	    TkBTreeLinesTo(textPtr, indexPtr->linePtr) + 1, charIndex);
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -1123,7 +1124,7 @@ TkTextIndexCmp(
     }
     return 0;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -1367,7 +1368,7 @@ ForwBack(
     }
     return p;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -1437,7 +1438,7 @@ TkTextIndexForwBytes(
 	dstPtr->linePtr = linePtr;
     }
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -1616,7 +1617,7 @@ TkTextIndexForwChars(
 	ckfree((char *) infoPtr);
     }
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -1813,7 +1814,7 @@ TkTextIndexCount(
     }
     return count;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -1881,7 +1882,7 @@ TkTextIndexBackBytes(
     }
     return 0;
 }
-
+
 /*
  *---------------------------------------------------------------------------
  *
@@ -2096,7 +2097,7 @@ TkTextIndexBackChars(
 	ckfree((char *) infoPtr);
     }
 }
-
+
 /*
  *----------------------------------------------------------------------
  *
@@ -2300,7 +2301,7 @@ StartEnd(
   done:
     return p;
 }
-
+
 /*
  * Local Variables:
  * mode: c
diff --git a/generic/tkUtil.c b/generic/tkUtil.c
index 342020c..e43613e 100644
--- a/generic/tkUtil.c
+++ b/generic/tkUtil.c
@@ -10,7 +10,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkUtil.c,v 1.30 2009/08/09 21:20:33 nijtmans Exp $
+ * RCS: @(#) $Id: tkUtil.c,v 1.31 2009/11/21 17:24:42 dkf Exp $
  */
 
 #include "tkInt.h"
@@ -61,7 +61,7 @@ TkStateParseProc(
 
     register Tk_State *statePtr = (Tk_State *) (widgRec + offset);
 
-    if(value == NULL || *value == 0) {
+    if (value == NULL || *value == 0) {
 	*statePtr = TK_STATE_NULL;
 	return TCL_OK;
     }
@@ -181,7 +181,7 @@ TkOrientParseProc(
 
     register int *orientPtr = (int *) (widgRec + offset);
 
-    if(value == NULL || *value == 0) {
+    if (value == NULL || *value == 0) {
 	*orientPtr = 0;
 	return TCL_OK;
     }
@@ -275,7 +275,7 @@ TkOffsetParseProc(
     tsoffset.flags = 0;
     p = value;
 
-    switch(value[0]) {
+    switch (value[0]) {
     case '#':
 	if (PTR2INT(clientData) & TK_OFFSET_RELATIVE) {
 	    tsoffset.flags = TK_OFFSET_RELATIVE;
@@ -338,7 +338,13 @@ TkOffsetParseProc(
 	tsoffset.flags = TK_OFFSET_CENTER|TK_OFFSET_MIDDLE;
 	goto goodTSOffset;
     }
-    if ((q = strchr(p,',')) == NULL) {
+
+    /*
+     * Check for an extra offset.
+     */
+
+    q = strchr(p, ',');
+    if (q == NULL) {
 	if (PTR2INT(clientData) & TK_OFFSET_INDEX) {
 	    if (Tcl_GetInt(interp, (char *) p, &tsoffset.flags) != TCL_OK) {
 		Tcl_ResetResult(interp);
@@ -349,6 +355,7 @@ TkOffsetParseProc(
 	}
 	goto badTSOffset;
     }
+
     *((char *) q) = 0;
     result = Tk_GetPixels(interp, tkwin, (char *) p, &tsoffset.xoffset);
     *((char *) q) = ',';
@@ -359,14 +366,14 @@ TkOffsetParseProc(
 	return TCL_ERROR;
     }
 
-  goodTSOffset:
     /*
      * Below is a hack to allow the stipple/tile offset to be stored in the
      * internal tile structure. Most of the times, offsetPtr is a pointer to
      * an already existing tile structure. However if this structure is not
-     * already created, we must do it with Tk_GetTile()!!!!;
+     * already created, we must do it with Tk_GetTile()!!!!
      */
 
+  goodTSOffset:
     memcpy(offsetPtr, &tsoffset, sizeof(Tk_TSOffset));
     return TCL_OK;
 
@@ -411,7 +418,7 @@ TkOffsetPrintProc(
 	if (offsetPtr->flags >= INT_MAX) {
 	    return "end";
 	}
-	p = (char *) ckalloc(32);
+	p = ckalloc(32);
 	sprintf(p, "%d", offsetPtr->flags & ~TK_OFFSET_INDEX);
 	*freeProcPtr = TCL_DYNAMIC;
 	return p;
@@ -441,7 +448,7 @@ TkOffsetPrintProc(
 	    return "se";
 	}
     }
-    q = p = (char *) ckalloc(32);
+    q = p = ckalloc(32);
     if (offsetPtr->flags & TK_OFFSET_RELATIVE) {
 	*q++ = '#';
     }
@@ -463,7 +470,7 @@ TkOffsetPrintProc(
 int
 TkPixelParseProc(
     ClientData clientData,	/* If non-NULL, negative values are allowed as
-				 * well */
+				 * well. */
     Tcl_Interp *interp,		/* Interpreter to send results back to */
     Tk_Window tkwin,		/* Window on same display as tile */
     const char *value,		/* Name of image */
@@ -504,7 +511,7 @@ TkPixelPrintProc(
     Tcl_FreeProc **freeProcPtr)	/* not used */
 {
     double *doublePtr = (double *) (widgRec + offset);
-    char *p = (char *) ckalloc(24);
+    char *p = ckalloc(24);
 
     Tcl_PrintDouble(NULL, *doublePtr, p);
     *freeProcPtr = TCL_DYNAMIC;
@@ -709,11 +716,10 @@ Tk_GetScrollInfoObj(
 				 * scroll, if any. */
 {
     int length;
-    const char *arg;
-
-    arg = Tcl_GetStringFromObj(objv[2], &length);
+    const char *arg = Tcl_GetStringFromObj(objv[2], &length);
 
-#define ArgPfxEq(str) ((arg[0]==str[0])&&!strncmp(arg,str,(unsigned)length))
+#define ArgPfxEq(str) \
+	((arg[0] == str[0]) && !strncmp(arg, str, (unsigned)length))
 
     if (ArgPfxEq("moveto")) {
 	if (objc != 4) {
@@ -1034,8 +1040,8 @@ TkBackgroundEvalObjv(
 	Tcl_DecrRefCount(objv[n]);
     }
     if (r == TCL_ERROR) {
-        Tcl_AddErrorInfo(interp, "\n    (background event handler)");
-        Tcl_BackgroundException(interp, r);
+	Tcl_AddErrorInfo(interp, "\n    (background event handler)");
+	Tcl_BackgroundException(interp, r);
     }
 
     Tcl_Release(interp);
@@ -1065,8 +1071,8 @@ TkBackgroundEvalObjv(
  *
  * TkMakeEnsemble --
  *
- *	Create an ensemble from a table of implementation commands.
- *	This may be called recursively to create sub-ensembles.
+ *	Create an ensemble from a table of implementation commands. This may
+ *	be called recursively to create sub-ensembles.
  *
  * Results:
  *	Handle for the ensemble, or NULL if creation of it fails.
@@ -1096,21 +1102,21 @@ TkMakeEnsemble(
 
     namespacePtr = Tcl_FindNamespace(interp, namespace, NULL, 0);
     if (namespacePtr == NULL) {
-        namespacePtr = Tcl_CreateNamespace(interp, namespace, NULL, NULL);
-        if (namespacePtr == NULL) {
-            Tcl_Panic("failed to create namespace \"%s\"", namespace);
-        }
+	namespacePtr = Tcl_CreateNamespace(interp, namespace, NULL, NULL);
+	if (namespacePtr == NULL) {
+	    Tcl_Panic("failed to create namespace \"%s\"", namespace);
+	}
     }
 
     nameObj = Tcl_NewStringObj(name, -1);
     ensemble = Tcl_FindEnsemble(interp, nameObj, 0);
     Tcl_DecrRefCount(nameObj);
     if (ensemble == NULL) {
-        ensemble = Tcl_CreateEnsemble(interp, name,
-	    namespacePtr, TCL_ENSEMBLE_PREFIX);
-        if (ensemble == NULL) {
-            Tcl_Panic("failed to create ensemble \"%s\"", name);
-        }
+	ensemble = Tcl_CreateEnsemble(interp, name, namespacePtr,
+		TCL_ENSEMBLE_PREFIX);
+	if (ensemble == NULL) {
+	    Tcl_Panic("failed to create ensemble \"%s\"", name);
+	}
     }
 
     Tcl_DStringSetLength(&ds, 0);
@@ -1126,15 +1132,15 @@ TkMakeEnsemble(
 
 	nameObj = Tcl_NewStringObj(map[i].name, -1);
 	fqdnObj = Tcl_NewStringObj(Tcl_DStringValue(&ds),
-	    Tcl_DStringLength(&ds));
+		Tcl_DStringLength(&ds));
 	Tcl_AppendStringsToObj(fqdnObj, "::", map[i].name, NULL);
 	Tcl_DictObjPut(NULL, dictObj, nameObj, fqdnObj);
 	if (map[i].proc) {
 	    Tcl_CreateObjCommand(interp, Tcl_GetString(fqdnObj),
-		map[i].proc, clientData, NULL);
+		    map[i].proc, clientData, NULL);
 	} else if (map[i].subensemble) {
 	    TkMakeEnsemble(interp, Tcl_DStringValue(&ds),
-		map[i].name, clientData, map[i].subensemble);
+		    map[i].name, clientData, map[i].subensemble);
 	}
     }
 
@@ -1154,14 +1160,16 @@ TkMakeEnsemble(
  * 	Send a virtual event notification to the specified target window.
  * 	Equivalent to "event generate $target <<$eventName>>"
  *
- * 	Note that we use Tk_QueueWindowEvent, not Tk_HandleEvent,
- * 	so this routine does not reenter the interpreter.
+ * 	Note that we use Tk_QueueWindowEvent, not Tk_HandleEvent, so this
+ * 	routine does not reenter the interpreter.
  *
  *----------------------------------------------------------------------
  */
 
 void
-TkSendVirtualEvent(Tk_Window target, const char *eventName)
+TkSendVirtualEvent(
+    Tk_Window target,
+    const char *eventName)
 {
     union {XEvent general; XVirtualEvent virtual;} event;