Fix off-by-one error that caused crashes. Backport from HEAD.

3 files changed, 25 insertions, 15 deletions

diff --git a/ChangeLog b/ChangeLog
index 82518bb..46a535d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,23 +1,30 @@
+2008-05-07  Donal K. Fellows  <donal.k.fellows@man.ac.uk>
+
+	* generic/tclCompCmds.c (TclCompileDictAppendCmd): Fix silly
+	off-by-one error that caused a crash every time a compiled 'dict
+	append' with more than one value argument was used. Found by Colin
+	McCormack.
+
 2008-04-26  Zoran Vasiljevic <vasiljevic@users.sourceforge.net>
 
-	* generic/tclAsync.c: Tcl_AsyncDelete(): panic if attempt
-	to locate handler token fails. Happens when some other
-	thread attempts to delete somebody else's token.
+	* generic/tclAsync.c: Tcl_AsyncDelete(): panic if attempt to locate
+	handler token fails. Happens when some other thread attempts to delete
+	somebody else's token.
 
-	Also, panic early if we find out the wrong thread attempting
-	to delete the async handler (common trap). As, only the one
-	that created the handler is allowed to delete it.
+	Also, panic early if we find out the wrong thread attempting to delete
+	the async handler (common trap). As, only the one that created the
+	handler is allowed to delete it.
 
 2008-04-24  Andreas Kupries  <andreask@activestate.com>
 
 	* tests/ioCmd.test: Extended testsuite for reflected channel
-	implementation. Added test cases about how it handles if the rug
-	is pulled out from under a channel (= killing threads,
-	interpreters containing the tcl command for a channel, and channel
-	sitting in a different interpreter/thread.)
+	implementation. Added test cases about how it handles if the rug is
+	pulled out from under a channel (= killing threads, interpreters
+	containing the tcl command for a channel, and channel sitting in a
+	different interpreter/thread.)
 
-	* generic/tclIORChan.c: Fixed the bugs exposed by the new
-	testcases, redone most of the cleanup and exit handling.
+	* generic/tclIORChan.c: Fixed the bugs exposed by the new testcases,
+	redone most of the cleanup and exit handling.
 
 2008-04-15  Andreas Kupries  <andreask@activestate.com>
 
diff --git a/generic/tclCompCmds.c b/generic/tclCompCmds.c
index 9fa3bf6..6a71666 100644
--- a/generic/tclCompCmds.c
+++ b/generic/tclCompCmds.c
@@ -12,7 +12,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclCompCmds.c,v 1.143 2008/03/16 17:00:43 dkf Exp $
+ * RCS: @(#) $Id: tclCompCmds.c,v 1.143.2.1 2008/05/07 10:39:38 dkf Exp $
  */
 
 #include "tclInt.h"
@@ -1215,7 +1215,7 @@ TclCompileDictAppendCmd(
 	tokenPtr = TokenAfter(tokenPtr);
     }
     if (parsePtr->numWords > 4) {
-	TclEmitInstInt1(INST_CONCAT1, parsePtr->numWords-2, envPtr);
+	TclEmitInstInt1(INST_CONCAT1, parsePtr->numWords-3, envPtr);
     }
 
     /*
diff --git a/tests/dict.test b/tests/dict.test
index ce51633..cc861b4 100644
--- a/tests/dict.test
+++ b/tests/dict.test
@@ -9,7 +9,7 @@
 # See the file "license.terms" for information on usage and redistribution
 # of this file, and for a DISCLAIMER OF ALL WARRANTIES.
 #
-# RCS: @(#) $Id: dict.test,v 1.24 2008/03/16 17:00:44 dkf Exp $
+# RCS: @(#) $Id: dict.test,v 1.24.2.1 2008/05/07 10:39:40 dkf Exp $
 
 if {[lsearch [namespace children] ::tcltest] == -1} {
     package require tcltest 2
@@ -414,6 +414,9 @@ test dict-13.9 {dict append command: write failure} {
     catch {unset dictVar}
     set result
 } {1 {can't set "dictVar": variable is array}}
+test dict-13.10 {compiled dict command: crash case} {
+    apply {{} {dict append dictVar a o k}}
+} {a ok}
 
 test dict-14.1 {dict for command: syntax} {
     list [catch {dict for} msg] $msg