[Bug 3598580]: Tcl_ListObjReplace may release deleted elements too early

Tests!?  Where are the tests!?!

They are in test listobj-11.1

2 files changed, 9 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 204275f..728b677 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-12-27  Jan Nijtmans  <nijtmans@users.sf.net>
+
+	* generic/tclListObj.c: [Bug 3598580]: Tcl_ListObjReplace may release
+	deleted elements too early
+
 2012-12-21  Jan Nijtmans  <nijtmans@users.sf.net>
 
 	* unix/dltest/pkgb.c:  Turn pkgb.so into a Tcl9 interoperability test
diff --git a/generic/tclListObj.c b/generic/tclListObj.c
index fffe6a2..b4af98a 100644
--- a/generic/tclListObj.c
+++ b/generic/tclListObj.c
@@ -655,6 +655,10 @@ Tcl_ListObjReplace(interp, listPtr, first, count, objc, objv)
 	count = 0;
     }
     
+    for (i = 0;  i < objc;  i++) {
+	Tcl_IncrRefCount(objv[i]);
+    }
+
     numRequired = (numElems - count + objc);
     if (numRequired <= listRepPtr->maxElemCount) {
 	/*
@@ -689,7 +693,6 @@ Tcl_ListObjReplace(interp, listPtr, first, count, objc, objv)
 
 	for (i = 0, j = first;  i < objc;  i++, j++) {
             elemPtrs[j] = objv[i];
-            Tcl_IncrRefCount(objv[i]);
         }
 
 	/*
@@ -745,7 +748,6 @@ Tcl_ListObjReplace(interp, listPtr, first, count, objc, objv)
 
 	for (i = 0, j = first;  i < objc;  i++, j++) {
 	    newPtrs[j] = objv[i];
-	    Tcl_IncrRefCount(objv[i]);
 	}
 
 	listRepPtr->elemCount = numRequired;