diff options
| author | ericm <ericm> | 2000-01-15 02:52:32 (GMT) |
|---|---|---|
| committer | ericm <ericm> | 2000-01-15 02:52:32 (GMT) |
| commit | eecf4343375af14eedadfc7dfc9d3b1b33491656 (patch) | |
| tree | f0a48e84b923fb854ce92e859f9387305788cda0 /generic/tclVar.c | |
| parent | 91b7d84e6d9216cf464bfb49a3f0721e57362e5e (diff) | |
| download | tcl-eecf4343375af14eedadfc7dfc9d3b1b33491656.zip tcl-eecf4343375af14eedadfc7dfc9d3b1b33491656.tar.gz tcl-eecf4343375af14eedadfc7dfc9d3b1b33491656.tar.bz2 | |
* tests/var.test: Added a test for the array multiple delete
protection in Tcl_UnsetVar2.
* generic/tclVar.c: Added protection in Tcl_UnsetVar2 against
attempts to multiply delete arrays when unsetting them (bug
#3453). This could happen if there was an unset trace on an array
element and the trace proc made a global or upvar link to the
array, and then the array was unset at the global level. See the
bug reference for more information.
Diffstat (limited to 'generic/tclVar.c')
| -rw-r--r-- | generic/tclVar.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/generic/tclVar.c b/generic/tclVar.c index 252da01..277247e 100644 --- a/generic/tclVar.c +++ b/generic/tclVar.c @@ -14,7 +14,7 @@ * See the file "license.terms" for information on usage and redistribution * of this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tclVar.c,v 1.14 1999/10/05 22:45:40 hobbs Exp $ + * RCS: @(#) $Id: tclVar.c,v 1.15 2000/01/15 02:52:32 ericm Exp $ */ #include "tclInt.h" @@ -2175,8 +2175,23 @@ Tcl_UnsetVar2(interp, part1, part2, flags) dummyVarPtr = &dummyVar; if (TclIsVarArray(dummyVarPtr) && !TclIsVarUndefined(dummyVarPtr)) { + /* + * Deleting the elements of the array may cause traces to be fired + * on those elements. Before deleting them, bump the reference count + * of the array, so that if those trace procs make a global or upvar + * link to the array, the array is not deleted when the call stack + * gets popped (we will delete the array ourselves later in this + * function). + * + * Bumping the count can lead to the odd situation that elements of the + * array are being deleted when the array still exists, but since the + * array is about to be removed anyway, that shouldn't really matter. + */ + varPtr->refCount++; DeleteArray(iPtr, part1, dummyVarPtr, (flags & (TCL_GLOBAL_ONLY|TCL_NAMESPACE_ONLY)) | TCL_TRACE_UNSETS); + /* Decr ref count */ + varPtr->refCount--; } if (TclIsVarScalar(dummyVarPtr) && (dummyVarPtr->value.objPtr != NULL)) { |