summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorjan.nijtmans <nijtmans@users.sourceforge.net>2013-01-03 09:22:04 (GMT)
committerjan.nijtmans <nijtmans@users.sourceforge.net>2013-01-03 09:22:04 (GMT)
commite59a5820dfdb6c77acd3497b07b8236b51bd04d8 (patch)
tree99d1350d9b02e0dce0351536547cc0c340bde3b8
parent3f4534b92ba967574dc4106bc346ccbbfed9d638 (diff)
downloadtcl-e59a5820dfdb6c77acd3497b07b8236b51bd04d8.zip
tcl-e59a5820dfdb6c77acd3497b07b8236b51bd04d8.tar.gz
tcl-e59a5820dfdb6c77acd3497b07b8236b51bd04d8.tar.bz2
test case for bug-3598580: Tcl_ListObjReplace may release deleted elements too early
-rw-r--r--generic/tclTestObj.c11
-rw-r--r--tests/listObj.test4
2 files changed, 15 insertions, 0 deletions
diff --git a/generic/tclTestObj.c b/generic/tclTestObj.c
index a55704a..8e9dc93 100644
--- a/generic/tclTestObj.c
+++ b/generic/tclTestObj.c
@@ -736,6 +736,17 @@ TestobjCmd(clientData, interp, objc, objv)
}
SetVarToObj(destIndex, varPtr[varIndex]);
Tcl_SetObjResult(interp, varPtr[destIndex]);
+ } else if (strcmp(subCmd, "bug3598580") == 0) {
+ Tcl_Obj *listObjPtr, *elemObjPtr;
+ if (objc != 2) {
+ goto wrongNumArgs;
+ }
+ elemObjPtr = Tcl_NewIntObj(123);
+ listObjPtr = Tcl_NewListObj(1, &elemObjPtr);
+ /* Replace the single list element through itself, nonsense but legal. */
+ Tcl_ListObjReplace(interp, listObjPtr, 0, 1, 1, &elemObjPtr);
+ Tcl_SetObjResult(interp, listObjPtr);
+ return TCL_OK;
} else if (strcmp(subCmd, "convert") == 0) {
char *typeName;
if (objc != 4) {
diff --git a/tests/listObj.test b/tests/listObj.test
index aa319bb..390ee64 100644
--- a/tests/listObj.test
+++ b/tests/listObj.test
@@ -181,6 +181,10 @@ test listobj-9.1 {UpdateStringOfList} {
string length [list foo\x00help]
} 8
+test listobj-11.1 {bug 3598580} {
+ testobj bug3598580
+} 123
+
# cleanup
::tcltest::cleanupTests
return