homepage

With Python 3.0 trunk on Ubuntu Gutsy, IDLE crashs at exit. gdb trace:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1210763072 (LWP 9441)]
0xb79ac133 in Tk_Free3DBorder () from /usr/lib/libtk8.4.so.0
(gdb) where
#0 0xb79ac133 in Tk_Free3DBorder () from /usr/lib/libtk8.4.so.0
#1 0xb7a3cb36 in TkTextFreeTag () from /usr/lib/libtk8.4.so.0
#2 0xb7a2aef1 in ?? () from /usr/lib/libtk8.4.so.0
#3 0x084ade70 in ?? ()
#4 0x084b2410 in ?? ()
#5 0xbfecb248 in ?? ()
#6 0xb798e518 in ?? () from /usr/lib/libtcl8.4.so.0
#7 0xbfecb250 in ?? ()
#8 0x084ade84 in ?? ()
#9 0xbfecb268 in ?? ()
#10 0xb798e518 in ?? () from /usr/lib/libtcl8.4.so.0
#11 0x084ade84 in ?? ()
#12 0x00000001 in ?? ()
#13 0x00000000 in ?? ()

The crash occurs when I close a window if a file was open. I can 
reproduce the crash on Debian Sid, so it's not a problem of an old 
library version.

The bug looks to be specific to Python3 but may comes from Tk and not 
directly from tkinter module. I recompiled Tk with debug symbols to get 
a better backtrace:
malformed bucket chain in Tcl_DeleteHashEntry
Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb7e178c0 (LWP 23520)]
0xb7fd1424 in __kernel_vsyscall ()
(gdb) where
#0 0xb7fd1424 in __kernel_vsyscall ()
#1 0xb7e43640 in raise () from /lib/i686/cmov/libc.so.6
#2 0xb7e45018 in abort () from /lib/i686/cmov/libc.so.6
#3 0xb78c2cff in Tcl_PanicVA () from /usr/lib/libtcl8.4.so.0
#4 0xb78c2d27 in Tcl_Panic () from /usr/lib/libtcl8.4.so.0
#5 0xb78a469d in Tcl_DeleteHashEntry () from /usr/lib/libtcl8.4.so.0
#6 0xb7922c33 in Tk_FreeColor (colorPtr=0x987cfb0)
 at /tmp/tk8.4-8.4.19/unix/../generic/tkColor.c:492
#7 0xb79166cd in Tk_Free3DBorder (border=0x985b830)
 at /tmp/tk8.4-8.4.19/unix/../generic/tk3d.c:440
#8 0xb7938a6e in Tk_FreeOptions (specs=0xb79df240, 
widgRec=0x986f9d8 "", display=0x9733c88,
 needFlags=0) 
at /tmp/tk8.4-8.4.19/unix/../generic/tkOldConfig.c:1039
#9 0xb79984bb in DestroyText (memPtr=0x986f9d8 "")
 at /tmp/tk8.4-8.4.19/unix/../generic/tkText.c:996
#10 0xb78ca115 in Tcl_EventuallyFree () from /usr/lib/libtcl8.4.so.0
#11 0xb7998bae in TextEventProc (clientData=0x986f9d8, 
eventPtr=0xbfcea6bc)
 at /tmp/tk8.4-8.4.19/unix/../generic/tkText.c:1270
#12 0xb7928026 in Tk_HandleEvent (eventPtr=0xbfcea6bc)
 at /tmp/tk8.4-8.4.19/unix/../generic/tkEvent.c:1037
#13 0xb7945c1c in Tk_DestroyWindow (tkwin=0x987d9b0)
 at /tmp/tk8.4-8.4.19/unix/../generic/tkWindow.c:1423
#14 0xb7920020 in Tk_DestroyObjCmd (clientData=0x9735210, 
interp=0x961ea80, objc=2,
 objv=0xbfcea910) at /tmp/tk8.4-8.4.19/unix/../generic/tkCmds.c:471
#15 0xb786e926 in TclEvalObjvInternal () from /usr/lib/libtcl8.4.so.0
#16 0xb786eb79 in Tcl_EvalObjv () from /usr/lib/libtcl8.4.so.0
#17 0xb7b7cc0d in Tkapp_Call (selfptr=0xb7c97918, args=0xb6da1e4c)
 at /home/haypo/prog/py3k/Modules/_tkinter.c:1241
#18 0x0812121d in PyCFunction_Call (func=0xb7bfc6cc, arg=0xb6da1e4c, 
kw=0x0)
 at Objects/methodobject.c:81
#19 0x080942e4 in call_function (pp_stack=0xbfceab38, oparg=2) at 
Python/ceval.c:3398
#20 0x08091027 in PyEval_EvalFrameEx (f=0x9a4f6dc, throwflag=0) at 
Python/ceval.c:2205
(...)
And the Python backtrace:
(gdb) pystack
/home/haypo/prog/py3k/Lib/tkinter/__init__.py (1929): destroy
/home/haypo/prog/py3k/Lib/tkinter/__init__.py (1928): destroy
/home/haypo/prog/py3k/Lib/tkinter/__init__.py (1928): destroy
/home/haypo/prog/py3k/Lib/idlelib/WindowList.py (70): destroy
/home/haypo/prog/py3k/Lib/idlelib/EditorWindow.py (887): _close
/home/haypo/prog/py3k/Lib/idlelib/PyShell.py (260): _close
/home/haypo/prog/py3k/Lib/idlelib/FileList.py (41): open
/home/haypo/prog/py3k/Lib/idlelib/PyShell.py (1382): main
Tools/scripts/idle (5): <module>
So if I add the source code to the trace:
---------------------------------------------------------------
/home/haypo/prog/py3k/Lib/tkinter/__init__.py (1929): destroy
 def destroy(self):
 """Destroy this and all descendants widgets."""
 for c in list(self.children.values()): c.destroy()
 self.tk.call('destroy', self._w)
 if self._name in self.master.children: <~~~ HERE
 del self.master.children[self._name]
 Misc.destroy(self)
/home/haypo/prog/py3k/Lib/tkinter/__init__.py (1928): destroy
 def destroy(self):
 """Destroy this and all descendants widgets."""
 for c in list(self.children.values()): c.destroy()
 self.tk.call('destroy', self._w) <~~~ HERE
 if self._name in self.master.children:
 del self.master.children[self._name]
 Misc.destroy(self)
/home/haypo/prog/py3k/Lib/tkinter/__init__.py (1928): destroy
 def destroy(self):
 """Destroy this and all descendants widgets."""
 for c in list(self.children.values()): c.destroy()
 self.tk.call('destroy', self._w) <~~~ HERE
 if self._name in self.master.children:
 del self.master.children[self._name]
 Misc.destroy(self)
/home/haypo/prog/py3k/Lib/idlelib/WindowList.py (70): destroy
 def destroy(self):
 registry.delete(self)
 Toplevel.destroy(self)
 # If this is Idle's last window then quit the mainloop
 # (Needed for clean exit on Windows 98)
 if not registry.dict: <~~~ HERE
 self.quit()
/home/haypo/prog/py3k/Lib/idlelib/EditorWindow.py (887): _close
 def _close(self):
 (...)
 self.per.close()
 self.per = None
 self.top.destroy()
 if self.close_hook: <~~~ HERE
 # unless override: unregister from flist, terminate if last 
window
 self.close_hook()
(...)
---------------------------------------------------------------
Hum, the Python line numbers are maybe invalid.

After long random investigation, I found idle_crash_1.py can reproduce
the crash. And I noticed in idle_crash_2.py WidgetRedirector#dispatch,
last element of args cannot be printed. Here is result.
10
0 -foreground
1 black
2 -selectforeground
3 black
4 -selectbackground
5 black
6 -background
7 black
8 -insertbackground
9 Traceback (most recent call last):
 File "c.py", line 52, in <module>
 selectbackground=color,
 File "e:\python-dev\py3k\lib\tkinter\__init__.py", line 1199, in configure
 return self._configure('configure', cnf, kw)
 File "e:\python-dev\py3k\lib\tkinter\__init__.py", line 1190, in
_configure
 self.tk.call(_flatten((self._w, cmd)) + self._options(cnf))
_tkinter.TclError
And I found this crash can be fixed by reverting r57540. This revision
was applied to fix issue1028, but I think we should solve this issue in
different way.

Can I revert r57540 and reopen issue1028?

> Can I revert r57540 and reopen issue1028?
Would it be possible to revert and fix the issue in the same 
commit? :-)

Sorry, I cannot reproduce the bug described in issue1028, so it's
difficult for me.

Fixed in r67256. I heard last RC will be released at this Wed, I think
segfault is not good for it.