Issue 16547: IDLE raises an exception in tkinter after fresh file's text has been rendered

IDLE crashes due to what seems to be a use-after-free bug. Opening a file from the 'Open...'-menu leads to a segfault after the text has been rendered. It seems this can be reproduced 100% of the time if the file is big (e.g. 150kb) and the window receives events (clicks...) while the colorization is going on.

I've been able to reproduce this behaviour on MacOS 10.6 (3.2, 3.3 and 3.4a) and Windows 7 (3.3) but not on Fedora 17.

Python 3.4.0a0 (default:a728056347ec, Nov 23 2012, 19:52:20) 
[GCC 4.2.1 (Apple Inc. build 5664)] on darwin




I'll attach a backtrace and a malloc_history (from a different trace). Any guidance on further debugging on this?

using NSZombieEnabled and MallocStackLoggingNoCompact we can see the use-after-free behaviour

On Mac, which version of Tk are you using? IDLE is known to have problems on Mac with Tk. See http://www.python.org/download/mac/tcltk/

You can disable colorization with the undocumented Ctrl+/ key combination. Does the crash still occur with the colorizer disabled before opening the file?

I am unable to reproduce this bug on Arch Linux.

From the backtrace it shows you are linking with the Apple-supplied Tk (/System/Library/Frameworks/Tk.framework/Versions/8.5/Tk) framework. The Apple-supplied Tk 8.5 in OS X 10.6 was the first release of the Cocoa Aqua Tk. It has proven to be unusable with Python Tkinter and IDLE.  There have been numerous Python issues opened about it.  If you wish to use Tkinter on OS X 10.6, you should either supply and link with a different Tk 8.5, such as the ActiveState Tcl 8.5 or one you build yourself (either Cocoa, Carbon, or X11) or, if you don't need 64-bit support, link with the Apple-supplied Carbon Tk 8.4.  See http://www.python.org/download/mac/tcltk/ for current recommendations.

That said, it wouldn't explain crashes on Windows (can you produce a trace  for that?) and there's no guarantee you won't run into other bugs using a more recent Tk on OS X.  But you'll most likely be wasting your time if you try to debug anything with the Apple Tk 8.5 in 10.6.  Any Tk problems you find should be reported on one of the Tcl/Tk mailing lists, for example, the Mac-specific Tcl list (most easily accessed here: http://dir.gmane.org/gmane.comp.lang.tcl.mac) or the Tk bug tracker (http://tcl.sourceforge.net).

Unless there is evidence that Python is doing something wrong and you can provide a reproducible test case, this issue should be closed.

Switching to ActiveState's TCL fixes the problem on MacOS 10.6

I won't be able to produce a trace for a debug-build on Windows; attaching a semi-useless trace anyway.

On windows, IDLE only crashes if executed via pythonw.exe; if executed under python.exe, the attached traceback is dumped to stderr

Lukas, thank you for your persistence in trying to resolve this issue. 

The Windows traceback is interesting. I am wondering if a "race" condition may be causing this bug. Callbacks from the Tcl interpreter eventloop back into Python may be ordered improperly.

Also, IDLE crashing with pythonw.exe is due to issue13582.

self.io is set to null before the colorization is finished. When IDLE's text-window is closed, the AttributeErrors printed to stderr cause IDLE to crash due to #13582.

One can also trigger the exceptions on any other OS as described in OP. While #13582 is an issue of it's own, this is still a race condition to be considered :-)

I was able to trigger this problem on 2.7 as well. Changing type to behavior as the core interpreter is not crashing.

Lukas, the only way I can trigger the traceback is by closing the editor while the colorizer is still colorizing. Clicking randomly on the editor itself did not trigger the bug. Can you clarify what you meant when you said "window receives events (clicks...)"?


Closing the window place a <<close-window>> event on the Tk event queue.
Calling .update() causes Tk to process all events in the queue, including callbacks into IDLE. As a result, closing a window can trigger a few different use-after-free conditions.

I managed to trigger two of these in the __init__ of PyShellEditorWindow in Lib/idlelib/PyShell.py. The self.io reference can be set to None during EditorWindow.__init__(self, *args) or during self.restore_file_breaks().

The Lib/idlelib/ColorDelegator.py also has a .update() in its recolorize_main loop.

@Roger: Triggering the segfault on MacOS 10.6 requires some interaction with the text-window while the text is being rendered. This includes moving the window or just clicking into it's canvas. Carefully leaving the window alone while colorization is going on avoids the segfault thereafter. My guess is that TK's event queue gets upset; the segfault was fixed when switching to ActiveState TK.

The error cannot be reproduced on 2.7, 3.3 or 3.4 because the problem has been fixed with 1e5e497ee33b (issue 17614)

type: crash -> behavior
stage: needs patch

messages: + msg176445

messages: + msg176444

messages: + msg176308