diff options
author | dkf <donal.k.fellows@manchester.ac.uk> | 2016-06-23 08:21:42 (GMT) |
---|---|---|
committer | dkf <donal.k.fellows@manchester.ac.uk> | 2016-06-23 08:21:42 (GMT) |
commit | ae11b9d9fec0e5b9f209d370fd4bdcf356810087 (patch) | |
tree | a1782bd818ef484be2537ef6d84f6a6f11048537 | |
parent | 50e97b06460f3feb7d2d8f9385441112c513d55d (diff) | |
parent | 6a513d71d369eed56569ff3bf3e05c4f80c2ccae (diff) | |
download | tcl-ae11b9d9fec0e5b9f209d370fd4bdcf356810087.zip tcl-ae11b9d9fec0e5b9f209d370fd4bdcf356810087.tar.gz tcl-ae11b9d9fec0e5b9f209d370fd4bdcf356810087.tar.bz2 |
[d553228d9f] Stop crashes in [dict update] with low refcount dictionaries.
-rw-r--r-- | generic/tclExecute.c | 4 | ||||
-rw-r--r-- | tests/dict.test | 7 |
2 files changed, 11 insertions, 0 deletions
diff --git a/generic/tclExecute.c b/generic/tclExecute.c index cd28a92..3f57333 100644 --- a/generic/tclExecute.c +++ b/generic/tclExecute.c @@ -7706,6 +7706,7 @@ TEBCresume( goto gotError; } } + Tcl_IncrRefCount(dictPtr); if (TclListObjGetElements(interp, OBJ_AT_TOS, &length, &keyPtrPtr) != TCL_OK) { TRACE_ERROR(interp); @@ -7718,6 +7719,7 @@ TEBCresume( if (Tcl_DictObjGet(interp, dictPtr, keyPtrPtr[i], &valuePtr) != TCL_OK) { TRACE_ERROR(interp); + Tcl_DecrRefCount(dictPtr); goto gotError; } varPtr = LOCAL(duiPtr->varIndices[i]); @@ -7734,10 +7736,12 @@ TEBCresume( duiPtr->varIndices[i]) == NULL) { CACHE_STACK_INFO(); TRACE_ERROR(interp); + Tcl_DecrRefCount(dictPtr); goto gotError; } CACHE_STACK_INFO(); } + TclDecrRefCount(dictPtr); TRACE_APPEND(("OK\n")); NEXT_INST_F(9, 0, 0); diff --git a/tests/dict.test b/tests/dict.test index d5406d0..a6b0cb4 100644 --- a/tests/dict.test +++ b/tests/dict.test @@ -2048,6 +2048,13 @@ test dict-24.25 {dict map with huge dict (compiled)} { }} 100000 } 166666666600000 +test dict-25.1 {compiled dict update with low-refcount values [Bug d553228d9f]} { + # Test crashes on failure + apply {{} { + lassign {} item + dict update item item item two two {} + }} +} {} # cleanup ::tcltest::cleanupTests |