[Xotcl] xotcl crash

[Stefan Sobernig]

> Message: 1
> Date: Fri, 24 Jul 2009 10:21:04 +0200
> From: Gustaf Neumann <neumann at wu.ac.at>
> Subject: Re: [Xotcl] xotcl crash
> To: Tibichte <zak at isa-software.com>
> Cc: xotcl at alice.wu-wien.ac.at
> Message-ID: <4A696EF0.7010906 at wu.ac.at>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
>  > 2- This forwarding method causes xotcl to crash:
>  >
>  > obj forward f2 list {%@end 13}  %self  %1
>  >
>  > ? { obj f2 1 2 3 }
>
> There is a bug in the current xotcl versions when both
> %@end and %1 is used, which will be fixed in the next release.
> The %1 means that the first argument from the provided
> argument list (here "1") will be placed at the given
> position. The argument is consumed and the remaining
> arguments (here "2" and "3") are appended to the arguments
> from the forward definition. S
The fact that %1 consumes = mutates the caller arg list and the %@POS
substitution operates on the mutated state of the resulting (=final)
list (kind of) made me think. And ... I guess I found the culprit of
this crashy interaction (see the patch attached):

once %1 consumes the first element of the caller arg list, the
currently arg handling mechanism for forwards counts %1 as an extra
arg in the overall arg list erroneously. however, it is rather a
placeholder for an already counted arg (=the first in the caller arg
list). This +1 overestimation in the internal assembly of the final
arg list led to a memory access violation for the %@POS substitution
under end offsets (end, end-1, end-2; in the Tcl sense of the word)
because end offsets require a correct total args count internally
(which used to report +1).

as for the patch: it is a minor and fairly non-invasive change. all
regression tests pass, i added some extra cases to test for the %1 +
%@POS-under-end-offsets interaction. the patch can be applied to the
a xotcl-1.6.3 source snapshot.

cheers
//stefan