From 6a513d71d369eed56569ff3bf3e05c4f80c2ccae Mon Sep 17 00:00:00 2001 From: dkf Date: Thu, 23 Jun 2016 08:20:16 +0000 Subject: [d553228d9f] Stop crashes in [dict update] with low refcount dictionaries. --- generic/tclExecute.c | 4 ++++ tests/dict.test | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/generic/tclExecute.c b/generic/tclExecute.c index d4077f5..38924c6 100644 --- a/generic/tclExecute.c +++ b/generic/tclExecute.c @@ -7706,6 +7706,7 @@ TEBCresume( goto gotError; } } + Tcl_IncrRefCount(dictPtr); if (TclListObjGetElements(interp, OBJ_AT_TOS, &length, &keyPtrPtr) != TCL_OK) { TRACE_ERROR(interp); @@ -7718,6 +7719,7 @@ TEBCresume( if (Tcl_DictObjGet(interp, dictPtr, keyPtrPtr[i], &valuePtr) != TCL_OK) { TRACE_ERROR(interp); + Tcl_DecrRefCount(dictPtr); goto gotError; } varPtr = LOCAL(duiPtr->varIndices[i]); @@ -7734,10 +7736,12 @@ TEBCresume( duiPtr->varIndices[i]) == NULL) { CACHE_STACK_INFO(); TRACE_ERROR(interp); + Tcl_DecrRefCount(dictPtr); goto gotError; } CACHE_STACK_INFO(); } + TclDecrRefCount(dictPtr); TRACE_APPEND(("OK\n")); NEXT_INST_F(9, 0, 0); diff --git a/tests/dict.test b/tests/dict.test index d5406d0..a6b0cb4 100644 --- a/tests/dict.test +++ b/tests/dict.test @@ -2048,6 +2048,13 @@ test dict-24.25 {dict map with huge dict (compiled)} { }} 100000 } 166666666600000 +test dict-25.1 {compiled dict update with low-refcount values [Bug d553228d9f]} { + # Test crashes on failure + apply {{} { + lassign {} item + dict update item item item two two {} + }} +} {} # cleanup ::tcltest::cleanupTests -- cgit v0.12