diff options
| author | dkf <donal.k.fellows@manchester.ac.uk> | 2016-06-23 08:20:16 (GMT) |
|---|---|---|
| committer | dkf <donal.k.fellows@manchester.ac.uk> | 2016-06-23 08:20:16 (GMT) |
| commit | 6a513d71d369eed56569ff3bf3e05c4f80c2ccae (patch) | |
| tree | 0c4aafec6a50b5a8c624a647c68791f2bec68ff7 | |
| parent | 23df0f8727cefc64cb5b4a6c7a3af518d16fbd7c (diff) | |
| download | tcl-6a513d71d369eed56569ff3bf3e05c4f80c2ccae.zip tcl-6a513d71d369eed56569ff3bf3e05c4f80c2ccae.tar.gz tcl-6a513d71d369eed56569ff3bf3e05c4f80c2ccae.tar.bz2 | |
[d553228d9f] Stop crashes in [dict update] with low refcount dictionaries.
| -rw-r--r-- | generic/tclExecute.c | 4 | ||||
| -rw-r--r-- | tests/dict.test | 7 |
2 files changed, 11 insertions, 0 deletions
diff --git a/generic/tclExecute.c b/generic/tclExecute.c index d4077f5..38924c6 100644 --- a/generic/tclExecute.c +++ b/generic/tclExecute.c @@ -7706,6 +7706,7 @@ TEBCresume( goto gotError; } } + Tcl_IncrRefCount(dictPtr); if (TclListObjGetElements(interp, OBJ_AT_TOS, &length, &keyPtrPtr) != TCL_OK) { TRACE_ERROR(interp); @@ -7718,6 +7719,7 @@ TEBCresume( if (Tcl_DictObjGet(interp, dictPtr, keyPtrPtr[i], &valuePtr) != TCL_OK) { TRACE_ERROR(interp); + Tcl_DecrRefCount(dictPtr); goto gotError; } varPtr = LOCAL(duiPtr->varIndices[i]); @@ -7734,10 +7736,12 @@ TEBCresume( duiPtr->varIndices[i]) == NULL) { CACHE_STACK_INFO(); TRACE_ERROR(interp); + Tcl_DecrRefCount(dictPtr); goto gotError; } CACHE_STACK_INFO(); } + TclDecrRefCount(dictPtr); TRACE_APPEND(("OK\n")); NEXT_INST_F(9, 0, 0); diff --git a/tests/dict.test b/tests/dict.test index d5406d0..a6b0cb4 100644 --- a/tests/dict.test +++ b/tests/dict.test @@ -2048,6 +2048,13 @@ test dict-24.25 {dict map with huge dict (compiled)} { }} 100000 } 166666666600000 +test dict-25.1 {compiled dict update with low-refcount values [Bug d553228d9f]} { + # Test crashes on failure + apply {{} { + lassign {} item + dict update item item item two two {} + }} +} {} # cleanup ::tcltest::cleanupTests |