Bug #112427 for Tk: Invalid write when grep used in Tk::Entry validatecommand

Hi, We are currently developing a Perl/Tk application, which crashes with a "malloc(): memory corruption" error when a specific button is pressed. This button sets the value of an Entry widget's textvariable, which is then validated against a list using grep(). When running with valgrind, this button press causes an "Invalid Write" in already freed memory. I've narrowed it down to the following code, which does not crash but results in the same memory error being reported by valgrind: ======================================================================== use Tk; use strict; use warnings; use constant MAX => 330; my $listref = []; for (my $i = 0; $i < MAX; $i++) { push @{$listref}, "string $i"; } my $mw = MainWindow->new; my $tv = "Original"; my $fr = $mw->Frame()->pack; my $entry = $fr->Entry(-textvariable=>\$tv)->pack; $fr->Button(-text=>'Button',-command=>sub{$tv = "string 4";})->pack; $entry->configure(-validate=>'key', -validatecommand=>[\&test, $listref]); MainLoop; sub test { my ($listref, $new) = @_; my $num = grep (/^\Q$new\E/, @{$listref}); return $num == 1; } ======================================================================== This is the error valgrind reports: ==11007== Invalid write of size 8 ==11007== at 0x4B6C1D: Perl_pp_sassign (pp_hot.c:232) ==11007== by 0x4B6595: Perl_runops_standard (run.c:41) ==11007== by 0x43C4ED: Perl_call_sv (perl.c:2774) ==11007== by 0x5F40180: LangCallCallback (pTkCallback.c:200) ==11007== by 0x6D998E8: Tcl_EvalObjEx (tkGlue.c:4349) ==11007== by 0x6DB32CB: ButtonWidgetObjCmd (tkButton.c:890) ==11007== by 0x6D9441D: Call_Tk (tkGlue.c:2260) ==11007== by 0x6D887E3: XS_Tk_WidgetMethod (Tk.xs:488) ==11007== by 0x4BD6F9: Perl_pp_entersub (pp_hot.c:3270) ==11007== by 0x4B6595: Perl_runops_standard (run.c:41) ==11007== by 0x43C4ED: Perl_call_sv (perl.c:2774) ==11007== by 0x5F401B9: LangCallCallback (pTkCallback.c:215) ==11007== Address 0x67db0b8 is 8 bytes inside a block of size 2,672 free'd ==11007== at 0x4C2BE1F: realloc (vg_replace_malloc.c:785) ==11007== by 0x4989C9: Perl_safesysrealloc (util.c:270) ==11007== by 0x4B4C81: Perl_av_extend_guts (av.c:159) ==11007== by 0x4EFAB2: Perl_stack_grow (scope.c:36) ==11007== by 0x4BE0C7: Perl_pp_padsv (pp_hot.c:402) ==11007== by 0x4B6595: Perl_runops_standard (run.c:41) ==11007== by 0x43C4ED: Perl_call_sv (perl.c:2774) ==11007== by 0x5F40180: LangCallCallback (pTkCallback.c:200) ==11007== by 0x6D9525D: LangDoCallback (tkGlue.c:1925) ==11007== by 0x952377E: EntryValidateChange (tkEntry.c:3483) ==11007== by 0x9524D01: EntrySetValue (tkEntry.c:2536) ==11007== by 0x952500E: EntryTextVarProc (tkEntry.c:3350) ==11007== Block was alloc'd at ==11007== at 0x4C2BE1F: realloc (vg_replace_malloc.c:785) ==11007== by 0x4989C9: Perl_safesysrealloc (util.c:270) ==11007== by 0x4B4C81: Perl_av_extend_guts (av.c:159) ==11007== by 0x4EFAB2: Perl_stack_grow (scope.c:36) ==11007== by 0x4B6797: Perl_pp_const (pp_hot.c:43) ==11007== by 0x4B6595: Perl_runops_standard (run.c:41) ==11007== by 0x43C4ED: Perl_call_sv (perl.c:2774) ==11007== by 0x43E78A: Perl_call_list (perl.c:4943) ==11007== by 0x41D858: S_process_special_blocks (op.c:8891) ==11007== by 0x434E09: Perl_newATTRSUB_x (op.c:8820) ==11007== by 0x438AF3: Perl_utilize (op.c:6043) ==11007== by 0x46CFD3: Perl_yyparse (perly.y:351) ==11007== I am using Perl 5.22.1 x86_64-linux-thread-multi and Tk 804.033 (from Debian Testing). Similar errors are reported by valgrind (however, starting at different minimum values of MAX) under: * Perl 5.10.1 i386-linux-thread-multi and Tk 804.02853 (from CentOS) * Perl 5.18.4 x86_64-linux-thread-multi and Tk 804.031 (from Fedora 21) -- Christian Fibich, MSc Research and Development Department of Embedded Systems University of Applied Sciences Technikum Wien Hoechstaedtplatz 6, 1200 Vienna, Austria T: +43 1 3334077-303 E: christian.fibich@technikum-wien.at I: embsys.technikum-wien.at I: www.technikum-wien.at