summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--generic/tclCmdIL.c8
-rw-r--r--generic/tclStringObj.c2
2 files changed, 10 insertions, 0 deletions
diff --git a/generic/tclCmdIL.c b/generic/tclCmdIL.c
index 02e5812..b303bb6 100644
--- a/generic/tclCmdIL.c
+++ b/generic/tclCmdIL.c
@@ -2025,6 +2025,14 @@ Tcl_JoinObjCmd(
resObjPtr = Tcl_NewObj();
for (i = 0; i < listLen; i++) {
if (i > 0) {
+
+ /*
+ * NOTE: This code is relying on Tcl_AppendObjToObj() **NOT**
+ * to shimmer joinObjPtr. If it did, then the case where
+ * objv[1] and objv[2] are the same value would not be safe.
+ * Accessing elemPtrs would crash.
+ */
+
Tcl_AppendObjToObj(resObjPtr, joinObjPtr);
}
Tcl_AppendObjToObj(resObjPtr, elemPtrs[i]);
diff --git a/generic/tclStringObj.c b/generic/tclStringObj.c
index 86f0c62..67e86c5 100644
--- a/generic/tclStringObj.c
+++ b/generic/tclStringObj.c
@@ -1261,6 +1261,8 @@ Tcl_AppendUnicodeToObj(
* Side effects:
* The string rep of appendObjPtr is appended to the string
* representation of objPtr.
+ * IMPORTANT: This routine does not and MUST NOT shimmer appendObjPtr.
+ * Callers are counting on that.
*
*----------------------------------------------------------------------
*/