diff options
| author | dkf <donal.k.fellows@manchester.ac.uk> | 2016-06-23 08:20:16 (GMT) |
|---|---|---|
| committer | dkf <donal.k.fellows@manchester.ac.uk> | 2016-06-23 08:20:16 (GMT) |
| commit | f05e2297802cbc2f12f67acb22ca3680f36d38c8 (patch) | |
| tree | 0c4aafec6a50b5a8c624a647c68791f2bec68ff7 | |
| parent | 5cae882ff3da129b6870bfb5b702e27e3f300d9c (diff) | |
| download | tcl-f05e2297802cbc2f12f67acb22ca3680f36d38c8.zip tcl-f05e2297802cbc2f12f67acb22ca3680f36d38c8.tar.gz tcl-f05e2297802cbc2f12f67acb22ca3680f36d38c8.tar.bz2 | |
[d553228d9f] Stop crashes in [dict update] with low refcount dictionaries.
| -rw-r--r-- | generic/tclExecute.c | 4 | ||||
| -rw-r--r-- | tests/dict.test | 7 |
2 files changed, 11 insertions, 0 deletions
diff --git a/generic/tclExecute.c b/generic/tclExecute.c index d4077f5..38924c6 100644 --- a/generic/tclExecute.c +++ b/generic/tclExecute.c @@ -7706,6 +7706,7 @@ TEBCresume( goto gotError; } } + Tcl_IncrRefCount(dictPtr); if (TclListObjGetElements(interp, OBJ_AT_TOS, &length, &keyPtrPtr) != TCL_OK) { TRACE_ERROR(interp); @@ -7718,6 +7719,7 @@ TEBCresume( if (Tcl_DictObjGet(interp, dictPtr, keyPtrPtr[i], &valuePtr) != TCL_OK) { TRACE_ERROR(interp); + Tcl_DecrRefCount(dictPtr); goto gotError; } varPtr = LOCAL(duiPtr->varIndices[i]); @@ -7734,10 +7736,12 @@ TEBCresume( duiPtr->varIndices[i]) == NULL) { CACHE_STACK_INFO(); TRACE_ERROR(interp); + Tcl_DecrRefCount(dictPtr); goto gotError; } CACHE_STACK_INFO(); } + TclDecrRefCount(dictPtr); TRACE_APPEND(("OK\n")); NEXT_INST_F(9, 0, 0); diff --git a/tests/dict.test b/tests/dict.test index d5406d0..a6b0cb4 100644 --- a/tests/dict.test +++ b/tests/dict.test @@ -2048,6 +2048,13 @@ test dict-24.25 {dict map with huge dict (compiled)} { }} 100000 } 166666666600000 +test dict-25.1 {compiled dict update with low-refcount values [Bug d553228d9f]} { + # Test crashes on failure + apply {{} { + lassign {} item + dict update item item item two two {} + }} +} {} # cleanup ::tcltest::cleanupTests |