Greater protection against double TclFreeObj() calls in TCL_MEM_DEBUG mode.

FossilOrigin-Name: 3474bcc2db25867644c44fcfba5deebd94aeb1a3

1 files changed, 12 insertions, 0 deletions

diff --git a/generic/tclObj.c b/generic/tclObj.c
index 24b818b..96a4082 100644
--- a/generic/tclObj.c
+++ b/generic/tclObj.c
@@ -1322,9 +1322,21 @@ TclFreeObj(
 
     ObjInitDeletionContext(context);
 
+    /*
+     * Check for a double free of the same value.  This is slightly tricky
+     * because it is customary to free a Tcl_Obj when its refcount falls
+     * either from 1 to 0, or from 0 to -1.  Falling from -1 to -2, though,
+     * and so on, is always a sign of a botch in the caller.
+     */
     if (objPtr->refCount < -1) {
 	Tcl_Panic("Reference count for %lx was negative", objPtr);
     }
+    /*
+     * Now, in case we just approved drop from 1 to 0 as acceptable, make
+     * sure we do not accept a second free when falling from 0 to -1.
+     * Skip that possibility so any double free will trigger the panic.
+     */
+    objPtr->refCount = -1;
 
     /* Invalidate the string rep first so we can use the bytes value 
      * for our pointer chain, and signal an obj deletion (as opposed