fix for [Bug 2662380], crash caused by appending to a variable with a write trace that unsets it

2 files changed, 9 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 14fb1e4..e90ee9d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2011-04-13  Miguel Sofer  <msofer@users.sf.net>
+
+	* generic/tclVar.c: fix for [Bug 2662380], crash caused by
+	appending to a variable with a write trace that unsets it.
+
 2011-04-12  Don Porter  <dgp@users.sourceforge.net>
 
 	* generic/tclStringObj.c:	Repair corruption in [string reverse]
diff --git a/generic/tclVar.c b/generic/tclVar.c
index 9815469..a1885b5 100644
--- a/generic/tclVar.c
+++ b/generic/tclVar.c
@@ -2554,13 +2554,14 @@ Tcl_AppendObjCmd(
 	    /*
 	     * Note that we do not need to increase the refCount of the Var
 	     * pointers: should a trace delete the variable, the return value
-	     * of TclPtrSetVar will be NULL, and we will not access the
-	     * variable again.
+	     * of TclPtrSetVar will be NULL or emptyObjPtr, and we will not
+	     * access the variable again.
 	     */
 
 	    varValuePtr = TclPtrSetVar(interp, varPtr, arrayPtr, objv[1],
 		    NULL, objv[i], TCL_APPEND_VALUE|TCL_LEAVE_ERR_MSG, -1);
-	    if (varValuePtr == NULL) {
+	    if ((varValuePtr == NULL) ||
+		    (varValuePtr == ((Interp *) interp)->emptyObjPtr)) {
 		return TCL_ERROR;
 	    }
 	}