From a6c191c2eaf0913d127c222ce898b9d4ae052550 Mon Sep 17 00:00:00 2001
From: sebres <sebres@users.sourceforge.net>
Date: Thu, 30 Jul 2015 13:02:49 +0000
Subject: Fix bug [f00009f7ce]: memory (object) leaks in
 TclNativeCreateNativeRep for windows platform (erroneous Tcl_IncrRefCount
 removed)

---
 win/tclWinFile.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/win/tclWinFile.c b/win/tclWinFile.c
index a5b14b4..5ee73d5 100755
--- a/win/tclWinFile.c
+++ b/win/tclWinFile.c
@@ -2911,19 +2911,15 @@ TclNativeCreateNativeRep(
 	 */
 
 	validPathPtr = Tcl_FSGetTranslatedPath(NULL, pathPtr);
-	if (validPathPtr == NULL) {
-	    return NULL;
-	}
     } else {
 	/*
 	 * Make sure the normalized path is set.
 	 */
 
 	validPathPtr = Tcl_FSGetNormalizedPath(NULL, pathPtr);
-	if (validPathPtr == NULL) {
-	    return NULL;
-	}
-	Tcl_IncrRefCount(validPathPtr);
+    }
+    if (validPathPtr == NULL) {
+	return NULL;
     }
 
     str = Tcl_GetString(validPathPtr);
-- 
cgit v0.12


From 0b6ed354d13eb319d021e3907230bc8841c3e336 Mon Sep 17 00:00:00 2001
From: Miguel Sofer <miguel.sofer@gmail.com>
Date: Thu, 30 Jul 2015 18:10:39 +0000
Subject: add comment to flag Tcl_Panic as no-return for Coverity Scan static
 analyzer

---
 generic/tclPanic.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/generic/tclPanic.c b/generic/tclPanic.c
index 2a453b9..851695f 100644
--- a/generic/tclPanic.c
+++ b/generic/tclPanic.c
@@ -141,7 +141,14 @@ Tcl_PanicVA(
  *----------------------------------------------------------------------
  */
 
-	/* ARGSUSED */
+/* ARGSUSED */
+
+/*
+ * The following comment is here so that Coverity's static analizer knows that
+ * a Tcl_Panic() call can never return and avoids lots of false positives.
+ */
+
+/* coverity[+kill] */
 void
 Tcl_Panic(
     const char *format,
-- 
cgit v0.12


From f4fe4153ee639bd944a102e1921f0f5fdc6b7939 Mon Sep 17 00:00:00 2001
From: sebres <sebres@users.sourceforge.net>
Date: Thu, 30 Jul 2015 18:22:27 +0000
Subject: Fix bug [f00009f7ce]: memory (object) leaks in
 TclNativeCreateNativeRep for windows platform: missing decrement of refCount,
 because of confusing differently behavior Tcl_FSGetTranslatedPath vs
 Tcl_FSGetNormalizedPath.

---
 win/tclWinFile.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/win/tclWinFile.c b/win/tclWinFile.c
index 5ee73d5..6b9d373 100755
--- a/win/tclWinFile.c
+++ b/win/tclWinFile.c
@@ -2897,7 +2897,7 @@ ClientData
 TclNativeCreateNativeRep(
     Tcl_Obj *pathPtr)
 {
-    WCHAR *nativePathPtr;
+    WCHAR *nativePathPtr = NULL;
     const char *str;
     Tcl_Obj *validPathPtr;
     size_t len;
@@ -2911,15 +2911,21 @@ TclNativeCreateNativeRep(
 	 */
 
 	validPathPtr = Tcl_FSGetTranslatedPath(NULL, pathPtr);
+	if (validPathPtr == NULL) {
+	    return NULL;
+	}
+	/* refCount of validPathPtr was already incremented in Tcl_FSGetTranslatedPath */
     } else {
 	/*
 	 * Make sure the normalized path is set.
 	 */
 
 	validPathPtr = Tcl_FSGetNormalizedPath(NULL, pathPtr);
-    }
-    if (validPathPtr == NULL) {
-	return NULL;
+	if (validPathPtr == NULL) {
+	    return NULL;
+	}
+	/* validPathPtr returned from Tcl_FSGetNormalizedPath is owned by Tcl, so incr refCount here */
+	Tcl_IncrRefCount(validPathPtr);
     }
 
     str = Tcl_GetString(validPathPtr);
@@ -2927,7 +2933,7 @@ TclNativeCreateNativeRep(
 
     if (strlen(str)!=(unsigned int)len) {
 	/* String contains NUL-bytes. This is invalid. */
-	return 0;
+	goto done;
     }
     /* For a reserved device, strip a possible postfix ':' */
     len = WinIsReserved(str);
@@ -2936,13 +2942,13 @@ TclNativeCreateNativeRep(
 	 * 0xC0 0x80 (== overlong NUL). See bug [3118489]: NUL in filenames */
 	len = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, str, -1, 0, 0);
 	if (len==0) {
-	    return 0;
+	    goto done;
 	}
     }
     /* Overallocate 6 chars, making some room for extended paths */
     wp = nativePathPtr = ckalloc( (len+6) * sizeof(WCHAR) );
     if (nativePathPtr==0) {
-      return 0;
+      goto done;
     }
     MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, str, -1, nativePathPtr, len+1);
     /*
@@ -2993,6 +2999,10 @@ TclNativeCreateNativeRep(
 	}
 	++wp;
     }
+
+  done:
+    
+    TclDecrRefCount(validPathPtr);
     return nativePathPtr;
 }
 
-- 
cgit v0.12


From 90beed4f41bb6f76ff5be10d80bd8c0e0e91cadb Mon Sep 17 00:00:00 2001
From: Miguel Sofer <miguel.sofer@gmail.com>
Date: Thu, 30 Jul 2015 18:57:30 +0000
Subject: remove self-assignment - found by Coverity

---
 generic/tclExecute.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/generic/tclExecute.c b/generic/tclExecute.c
index ae11f7a..b3f0c4d 100644
--- a/generic/tclExecute.c
+++ b/generic/tclExecute.c
@@ -2920,7 +2920,6 @@ TEBCresume(
 		 * stack-allocated parameter, update the stack pointers.
 		 */
 
-		esPtr = iPtr->execEnvPtr->execStackPtr;
 		TD = (TEBCdata *) (((Tcl_Obj **)TD) + moved);
 
 		catchTop += moved;
@@ -8251,6 +8250,7 @@ TEBCresume(
 #undef auxObjList
 #undef catchTop
 #undef TCONST
+#undef esPtr
 
 static int
 FinalizeOONext(
-- 
cgit v0.12


From b62b6bd4906dcb1c89be74a7dd5c4951f4d7da70 Mon Sep 17 00:00:00 2001
From: Miguel Sofer <miguel.sofer@gmail.com>
Date: Thu, 30 Jul 2015 22:56:57 +0000
Subject: remove unnecessary checks found by coverity

---
 generic/tclCompCmds.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/generic/tclCompCmds.c b/generic/tclCompCmds.c
index 6a22a30..041694f 100644
--- a/generic/tclCompCmds.c
+++ b/generic/tclCompCmds.c
@@ -2704,13 +2704,9 @@ CompileEachloopCmd(
     
     done:
     if (code == TCL_ERROR) {
-	if (infoPtr) {
-	    FreeForeachInfo(infoPtr);
-	}
-    }
-    if (varListObj) {
-	Tcl_DecrRefCount(varListObj);
+	FreeForeachInfo(infoPtr);
     }
+    Tcl_DecrRefCount(varListObj);
     return code;
 }
 
-- 
cgit v0.12


From 743ef38cdc29e8283156168d9a3dfef0af5ac8ba Mon Sep 17 00:00:00 2001
From: Miguel Sofer <miguel.sofer@gmail.com>
Date: Fri, 31 Jul 2015 00:01:52 +0000
Subject: fix typo found by Coverity; no effect on "most" platforms (is there
 anyone where it would matter?)

---
 generic/tclFileName.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/generic/tclFileName.c b/generic/tclFileName.c
index a7251bb..39bac99 100644
--- a/generic/tclFileName.c
+++ b/generic/tclFileName.c
@@ -821,10 +821,10 @@ Tcl_FSJoinToPath(
 	return TclJoinPath(2, pair);
     } else {
 	int elemc = objc + 1;
-	Tcl_Obj *ret, **elemv = ckalloc(elemc*sizeof(Tcl_Obj **));
+	Tcl_Obj *ret, **elemv = ckalloc(elemc*sizeof(Tcl_Obj *));
 
 	elemv[0] = pathPtr;
-	memcpy(elemv+1, objv, objc*sizeof(Tcl_Obj **));
+	memcpy(elemv+1, objv, objc*sizeof(Tcl_Obj *));
 	ret = TclJoinPath(elemc, elemv);
 	ckfree(elemv);
 	return ret;
-- 
cgit v0.12


From f795c9e1311790997cc6d659ebfff0c54d0a0a92 Mon Sep 17 00:00:00 2001
From: Miguel Sofer <miguel.sofer@gmail.com>
Date: Fri, 31 Jul 2015 22:05:20 +0000
Subject: fix off-by-one possible buffer overrun when looking for encodings;
 found by coverity

---
 unix/tclUnixInit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/unix/tclUnixInit.c b/unix/tclUnixInit.c
index 520c8e5..5fc0035 100644
--- a/unix/tclUnixInit.c
+++ b/unix/tclUnixInit.c
@@ -602,7 +602,7 @@ SearchKnownEncodings(
     int left = 0;
     int right = sizeof(localeTable)/sizeof(LocaleTable);
 
-    while (left <= right) {
+    while (left < right) {
 	int test = (left + right)/2;
 	int code = strcmp(localeTable[test].lang, encoding);
 
-- 
cgit v0.12


From 33a7feeefdbe3e76e6e2b4757933356f3b0660ca Mon Sep 17 00:00:00 2001
From: Miguel Sofer <miguel.sofer@gmail.com>
Date: Sat, 1 Aug 2015 19:00:39 +0000
Subject: explicitly ignore Tcl_PushCallFrame and TclPushStackFrame return
 value - it is always TCL_OK. Inconsistency found by coverity (CID 1251197)

---
 generic/tclBasic.c        | 12 ++----------
 generic/tclNamesp.c       | 12 +++---------
 generic/tclOOBasic.c      |  6 +-----
 generic/tclOODefineCmds.c |  6 +-----
 generic/tclOOMethod.c     |  5 +----
 generic/tclProc.c         |  7 ++-----
 generic/tclTest.c         |  6 +-----
 7 files changed, 11 insertions(+), 43 deletions(-)

diff --git a/generic/tclBasic.c b/generic/tclBasic.c
index c9b37b2..a09bf10 100644
--- a/generic/tclBasic.c
+++ b/generic/tclBasic.c
@@ -472,7 +472,6 @@ Tcl_CreateInterp(void)
 #endif /* TCL_COMPILE_STATS */
     char mathFuncName[32];
     CallFrame *framePtr;
-    int result;
 
     TclInitSubsystems();
 
@@ -642,11 +641,8 @@ Tcl_CreateInterp(void)
 
     /* This is needed to satisfy GCC 3.3's strict aliasing rules */
     framePtr = ckalloc(sizeof(CallFrame));
-    result = Tcl_PushCallFrame(interp, (Tcl_CallFrame *) framePtr,
+    (void) Tcl_PushCallFrame(interp, (Tcl_CallFrame *) framePtr,
 	    (Tcl_Namespace *) iPtr->globalNsPtr, /*isProcCallFrame*/ 0);
-    if (result != TCL_OK) {
-	Tcl_Panic("Tcl_CreateInterp: failed to push the root stack frame");
-    }
     framePtr->objc = 0;
 
     iPtr->framePtr = framePtr;
@@ -6518,11 +6514,7 @@ TclObjInvokeNamespace(
      * command.
      */
 
-    result = TclPushStackFrame(interp, &framePtr, nsPtr, /*isProcFrame*/0);
-    if (result != TCL_OK) {
-	return TCL_ERROR;
-    }
-
+    (void) TclPushStackFrame(interp, &framePtr, nsPtr, /*isProcFrame*/0);
     result = TclObjInvoke(interp, objc, objv, flags);
 
     TclPopStackFrame(interp);
diff --git a/generic/tclNamesp.c b/generic/tclNamesp.c
index 91239f0..dfab185 100644
--- a/generic/tclNamesp.c
+++ b/generic/tclNamesp.c
@@ -3309,11 +3309,8 @@ NRNamespaceEvalCmd(
 
     /* This is needed to satisfy GCC 3.3's strict aliasing rules */
     framePtrPtr = &framePtr;
-    result = TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
+    (void) TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
 	    namespacePtr, /*isProcCallFrame*/ 0);
-    if (result != TCL_OK) {
-	return TCL_ERROR;
-    }
 
     if (iPtr->ensembleRewrite.sourceObjs == NULL) {
 	framePtr->objc = objc;
@@ -3730,7 +3727,7 @@ NRNamespaceInscopeCmd(
     Tcl_Namespace *namespacePtr;
     CallFrame *framePtr, **framePtrPtr;
     register Interp *iPtr = (Interp *) interp;
-    int i, result;
+    int i;
     Tcl_Obj *cmdObjPtr;
 
     if (objc < 3) {
@@ -3752,11 +3749,8 @@ NRNamespaceInscopeCmd(
 
     framePtrPtr = &framePtr;		/* This is needed to satisfy GCC's
 					 * strict aliasing rules. */
-    result = TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
+    (void) TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
 	    namespacePtr, /*isProcCallFrame*/ 0);
-    if (result != TCL_OK) {
-	return result;
-    }
 
     if (iPtr->ensembleRewrite.sourceObjs == NULL) {
 	framePtr->objc = objc;
diff --git a/generic/tclOOBasic.c b/generic/tclOOBasic.c
index 0b0516b..8cb80e5 100644
--- a/generic/tclOOBasic.c
+++ b/generic/tclOOBasic.c
@@ -402,7 +402,6 @@ TclOO_Object_Eval(
     register const int skip = Tcl_ObjectContextSkippedArgs(context);
     CallFrame *framePtr, **framePtrPtr = &framePtr;
     Tcl_Obj *scriptPtr;
-    int result;
     CmdFrame *invoker;
 
     if (objc-1 < skip) {
@@ -415,11 +414,8 @@ TclOO_Object_Eval(
      * command(s).
      */
 
-    result = TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
+    (void) TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
 	    Tcl_GetObjectNamespace(object), 0);
-    if (result != TCL_OK) {
-	return TCL_ERROR;
-    }
     framePtr->objc = objc;
     framePtr->objv = objv;	/* Reference counts do not need to be
 				 * incremented here. */
diff --git a/generic/tclOODefineCmds.c b/generic/tclOODefineCmds.c
index 5a6c0ad..c3184be 100644
--- a/generic/tclOODefineCmds.c
+++ b/generic/tclOODefineCmds.c
@@ -646,7 +646,6 @@ InitDefineContext(
     Tcl_Obj *const objv[])
 {
     CallFrame *framePtr, **framePtrPtr = &framePtr;
-    int result;
 
     if (namespacePtr == NULL) {
 	Tcl_SetObjResult(interp, Tcl_NewStringObj(
@@ -658,11 +657,8 @@ InitDefineContext(
 
     /* framePtrPtr is needed to satisfy GCC 3.3's strict aliasing rules */
 
-    result = TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
+    (void) TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
 	    namespacePtr, FRAME_IS_OO_DEFINE);
-    if (result != TCL_OK) {
-	return TCL_ERROR;
-    }
     framePtr->clientData = oPtr;
     framePtr->objc = objc;
     framePtr->objv = objv;	/* Reference counts do not need to be
diff --git a/generic/tclOOMethod.c b/generic/tclOOMethod.c
index e18eeec..34fa108 100644
--- a/generic/tclOOMethod.c
+++ b/generic/tclOOMethod.c
@@ -875,11 +875,8 @@ PushMethodCallFrame(
      * This operation may fail.
      */
 
-    result = TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
+    (void) TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
 	    (Tcl_Namespace *) nsPtr, FRAME_IS_PROC|FRAME_IS_METHOD);
-    if (result != TCL_OK) {
-	goto failureReturn;
-    }
 
     fdPtr->framePtr->clientData = contextPtr;
     fdPtr->framePtr->objc = objc;
diff --git a/generic/tclProc.c b/generic/tclProc.c
index 7bf63c2..02bda51 100644
--- a/generic/tclProc.c
+++ b/generic/tclProc.c
@@ -1642,12 +1642,9 @@ TclPushProcCallFrame(
      */
 
     framePtrPtr = &framePtr;
-    result = TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
+    (void) TclPushStackFrame(interp, (Tcl_CallFrame **) framePtrPtr,
 	    (Tcl_Namespace *) nsPtr,
 	    (isLambda? (FRAME_IS_PROC|FRAME_IS_LAMBDA) : FRAME_IS_PROC));
-    if (result != TCL_OK) {
-	return result;
-    }
 
     framePtr->objc = objc;
     framePtr->objv = objv;
@@ -2055,7 +2052,7 @@ TclProcCompileProc(
 	    procPtr->numCompiledLocals = procPtr->numArgs;
 	}
 
-	TclPushStackFrame(interp, &framePtr, (Tcl_Namespace *) nsPtr,
+	(void) TclPushStackFrame(interp, &framePtr, (Tcl_Namespace *) nsPtr,
 		/* isProcCallFrame */ 0);
 
 	/*
diff --git a/generic/tclTest.c b/generic/tclTest.c
index 19a9033..650e363 100644
--- a/generic/tclTest.c
+++ b/generic/tclTest.c
@@ -4671,7 +4671,6 @@ TestgetvarfullnameCmd(
     Tcl_Namespace *namespacePtr;
     Tcl_CallFrame *framePtr;
     Tcl_Var variable;
-    int result;
 
     if (objc != 3) {
 	Tcl_WrongNumArgs(interp, 1, objv, "name scope");
@@ -4699,11 +4698,8 @@ TestgetvarfullnameCmd(
 	if (namespacePtr == NULL) {
 	    return TCL_ERROR;
 	}
-	result = TclPushStackFrame(interp, &framePtr, namespacePtr,
+	(void) TclPushStackFrame(interp, &framePtr, namespacePtr,
 		/*isProcCallFrame*/ 0);
-	if (result != TCL_OK) {
-	    return result;
-	}
     }
 
     variable = Tcl_FindNamespaceVar(interp, name, NULL,
-- 
cgit v0.12


From 29603179f48fc0e6920e78398c477f40d0fb4421 Mon Sep 17 00:00:00 2001
From: dkf <donal.k.fellows@manchester.ac.uk>
Date: Sat, 1 Aug 2015 19:37:04 +0000
Subject: Fix Coverity CID 1251203: break vs continue in for-step clause

---
 generic/tclCompile.c |  2 +-
 tests/for.test       | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/generic/tclCompile.c b/generic/tclCompile.c
index 824276c..478881d 100644
--- a/generic/tclCompile.c
+++ b/generic/tclCompile.c
@@ -4101,7 +4101,7 @@ TclEmitInvoke(
 	    && auxContinuePtr->expandTarget == envPtr->expandCount-expandCount) {
 	auxContinuePtr = NULL;
     } else {
-	continueRange = auxBreakPtr - envPtr->exceptAuxArrayPtr;
+	continueRange = auxContinuePtr - envPtr->exceptAuxArrayPtr;
     }
 
     if (auxBreakPtr != NULL || auxContinuePtr != NULL) {
diff --git a/tests/for.test b/tests/for.test
index 8abd270..cd34781 100644
--- a/tests/for.test
+++ b/tests/for.test
@@ -1184,6 +1184,46 @@ test for-7.24 {Bug 3614226: ensure that continue from expanded command only clea
 	expr {$end - $tmp}
     }} {return -level 0 -code continue}
 } 0
+
+test for-8.0 {Coverity CID 1251203: break vs continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; list a [eval {}]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {6 5 3}
+test for-8.1 {Coverity CID 1251203: break vs continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i;list a [eval break]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.2 {Coverity CID 1251203: break vs continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i;list a [eval continue]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
 
 # cleanup
 ::tcltest::cleanupTests
-- 
cgit v0.12


From 034f00bf1ba81be55756adc152834ef9660ba9a9 Mon Sep 17 00:00:00 2001
From: dkf <donal.k.fellows@manchester.ac.uk>
Date: Sun, 2 Aug 2015 12:22:02 +0000
Subject: Fix more problems with break and continue in for-step clauses.

---
 generic/tclCompile.c |  21 +++++----
 tests/for.test       | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 137 insertions(+), 10 deletions(-)

diff --git a/generic/tclCompile.c b/generic/tclCompile.c
index 478881d..f62ec14 100644
--- a/generic/tclCompile.c
+++ b/generic/tclCompile.c
@@ -4083,16 +4083,6 @@ TclEmitInvoke(
      * calls from inside a [for] increment clause).
      */
 
-    rangePtr = TclGetInnermostExceptionRange(envPtr, TCL_BREAK, &auxBreakPtr);
-    if (rangePtr == NULL || rangePtr->type != LOOP_EXCEPTION_RANGE) {
-	auxBreakPtr = NULL;
-    } else if (auxBreakPtr->stackDepth == envPtr->currStackDepth-wordCount
-	    && auxBreakPtr->expandTarget == envPtr->expandCount-expandCount) {
-	auxBreakPtr = NULL;
-    } else {
-	breakRange = auxBreakPtr - envPtr->exceptAuxArrayPtr;
-    }
-
     rangePtr = TclGetInnermostExceptionRange(envPtr, TCL_CONTINUE,
 	    &auxContinuePtr);
     if (rangePtr == NULL || rangePtr->type != LOOP_EXCEPTION_RANGE) {
@@ -4104,6 +4094,17 @@ TclEmitInvoke(
 	continueRange = auxContinuePtr - envPtr->exceptAuxArrayPtr;
     }
 
+    rangePtr = TclGetInnermostExceptionRange(envPtr, TCL_BREAK, &auxBreakPtr);
+    if (rangePtr == NULL || rangePtr->type != LOOP_EXCEPTION_RANGE) {
+	auxBreakPtr = NULL;
+    } else if (auxContinuePtr == NULL
+	    && auxBreakPtr->stackDepth == envPtr->currStackDepth-wordCount
+	    && auxBreakPtr->expandTarget == envPtr->expandCount-expandCount) {
+	auxBreakPtr = NULL;
+    } else {
+	breakRange = auxBreakPtr - envPtr->exceptAuxArrayPtr;
+    }
+
     if (auxBreakPtr != NULL || auxContinuePtr != NULL) {
 	loopRange = TclCreateExceptRange(LOOP_EXCEPTION_RANGE, envPtr);
 	ExceptionRangeStarts(envPtr, loopRange);
diff --git a/tests/for.test b/tests/for.test
index cd34781..6c710bb 100644
--- a/tests/for.test
+++ b/tests/for.test
@@ -1224,6 +1224,132 @@ test for-8.2 {Coverity CID 1251203: break vs continue in for-step clause} {
 	list $i $j $k
     }}
 } {1 1 3}
+test for-8.3 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; break} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.4 {continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; continue} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+test for-8.5 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; list a [break]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.6 {continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; list a [continue]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+test for-8.7 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i;eval break} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.8 {continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i;eval continue} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+test for-8.9 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    for {set i 0} {$i < 5} {incr i;eval break} {
+		incr j
+	    }
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.10 {continue in for-step clause} knownBug {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    for {set i 0} {$i < 5} {incr i;eval continue} {
+		incr j
+	    }
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+test for-8.11 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    for {set i 0} {$i < 5} {incr i;break} {
+		incr j
+	    }
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.12 {continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    for {set i 0} {$i < 5} {incr i;continue} {
+		incr j
+	    }
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
 
 # cleanup
 ::tcltest::cleanupTests
-- 
cgit v0.12


From 93b515b360554cec015664179980a7a550f13ae8 Mon Sep 17 00:00:00 2001
From: dkf <donal.k.fellows@manchester.ac.uk>
Date: Sun, 2 Aug 2015 16:17:00 +0000
Subject: And another problem with continue in for-step clauses, this time a
 problem in how TEBC handled an edge case in the semantics.

---
 generic/tclExecute.c | 25 ++++++++++++++++---------
 tests/for.test       |  2 +-
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/generic/tclExecute.c b/generic/tclExecute.c
index b3f0c4d..2fa0928 100644
--- a/generic/tclExecute.c
+++ b/generic/tclExecute.c
@@ -758,7 +758,7 @@ static Tcl_Obj *	ExecuteExtendedUnaryMathOp(int opcode,
 			    Tcl_Obj *valuePtr);
 static void		FreeExprCodeInternalRep(Tcl_Obj *objPtr);
 static ExceptionRange *	GetExceptRangeForPc(const unsigned char *pc,
-			    int catchOnly, ByteCode *codePtr);
+			    int searchMode, ByteCode *codePtr);
 static const char *	GetSrcInfoForPc(const unsigned char *pc,
 			    ByteCode *codePtr, int *lengthPtr,
 			    const unsigned char **pcBeg, int *cmdIdxPtr);
@@ -7955,7 +7955,7 @@ TEBCresume(
 	}
 #endif
 	if ((result == TCL_CONTINUE) || (result == TCL_BREAK)) {
-	    rangePtr = GetExceptRangeForPc(pc, /*catchOnly*/ 0, codePtr);
+	    rangePtr = GetExceptRangeForPc(pc, result, codePtr);
 	    if (rangePtr == NULL) {
 		TRACE_APPEND(("no encl. loop or catch, returning %s\n",
 			StringForResultCode(result)));
@@ -8116,7 +8116,7 @@ TEBCresume(
 #endif
 	    goto abnormalReturn;
 	}
-	rangePtr = GetExceptRangeForPc(pc, /*catchOnly*/ 1, codePtr);
+	rangePtr = GetExceptRangeForPc(pc, TCL_ERROR, codePtr);
 	if (rangePtr == NULL) {
 	    /*
 	     * This is only possible when compiling a [catch] that sends its
@@ -10129,14 +10129,16 @@ GetSrcInfoForPc(
 
 static ExceptionRange *
 GetExceptRangeForPc(
-    const unsigned char *pc, /* The program counter value for which to
+    const unsigned char *pc,	/* The program counter value for which to
 				 * search for a closest enclosing exception
 				 * range. This points to a bytecode
 				 * instruction in codePtr's code. */
-    int catchOnly,		/* If 0, consider either loop or catch
-				 * ExceptionRanges in search. If nonzero
+    int searchMode,		/* If TCL_BREAK, consider either loop or catch
+				 * ExceptionRanges in search. If TCL_ERROR
 				 * consider only catch ranges (and ignore any
-				 * closer loop ranges). */
+				 * closer loop ranges). If TCL_CONTINUE, look
+				 * for loop ranges that define a continue
+				 * point or a catch range. */
     ByteCode *codePtr)		/* Points to the ByteCode in which to search
 				 * for the enclosing ExceptionRange. */
 {
@@ -10162,8 +10164,13 @@ GetExceptRangeForPc(
 	start = rangePtr->codeOffset;
 	if ((start <= pcOffset) &&
 		(pcOffset < (start + rangePtr->numCodeBytes))) {
-	    if ((!catchOnly)
-		    || (rangePtr->type == CATCH_EXCEPTION_RANGE)) {
+	    if (rangePtr->type == CATCH_EXCEPTION_RANGE) {
+		return rangePtr;
+	    }
+	    if (searchMode == TCL_BREAK) {
+		return rangePtr;
+	    }
+	    if (searchMode == TCL_CONTINUE && rangePtr->continueOffset != -1){
 		return rangePtr;
 	    }
 	}
diff --git a/tests/for.test b/tests/for.test
index 6c710bb..1a65274 100644
--- a/tests/for.test
+++ b/tests/for.test
@@ -1314,7 +1314,7 @@ test for-8.9 {break in for-step clause} {
 	list $i $j $k
     }}
 } {2 1 3}
-test for-8.10 {continue in for-step clause} knownBug {
+test for-8.10 {continue in for-step clause} {
     apply {{} {
 	for {set k 0} {$k < 3} {incr k} {
 	    set j 0
-- 
cgit v0.12


From 9d7f20adc5589f9e8b3f6b0475b78e313db90ce5 Mon Sep 17 00:00:00 2001
From: dkf <donal.k.fellows@manchester.ac.uk>
Date: Mon, 3 Aug 2015 07:17:27 +0000
Subject: Backport the fixes to handling of continue in for-step clauses.

---
 generic/tclExecute.c |  38 +++++++-----
 tests/for.test       | 166 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 189 insertions(+), 15 deletions(-)

diff --git a/generic/tclExecute.c b/generic/tclExecute.c
index b9415e5..553abed 100644
--- a/generic/tclExecute.c
+++ b/generic/tclExecute.c
@@ -615,7 +615,7 @@ static void		DeleteExecStack(ExecStack *esPtr);
 static void		DupExprCodeInternalRep(Tcl_Obj *srcPtr,
 			    Tcl_Obj *copyPtr);
 static void		FreeExprCodeInternalRep(Tcl_Obj *objPtr);
-static ExceptionRange *	GetExceptRangeForPc(unsigned char *pc, int catchOnly,
+static ExceptionRange *	GetExceptRangeForPc(unsigned char *pc, int searchMode,
 			    ByteCode *codePtr);
 static const char *	GetSrcInfoForPc(unsigned char *pc, ByteCode *codePtr,
 			    int *lengthPtr);
@@ -7347,7 +7347,7 @@ TclExecuteByteCode(
 	}
 #endif
 	if ((result == TCL_CONTINUE) || (result == TCL_BREAK)) {
-	    rangePtr = GetExceptRangeForPc(pc, /*catchOnly*/ 0, codePtr);
+	    rangePtr = GetExceptRangeForPc(pc, result, codePtr);
 	    if (rangePtr == NULL) {
 		TRACE_APPEND(("no encl. loop or catch, returning %s\n",
 			StringForResultCode(result)));
@@ -7453,7 +7453,7 @@ TclExecuteByteCode(
 #endif
 	    goto abnormalReturn;
 	}
-	rangePtr = GetExceptRangeForPc(pc, /*catchOnly*/ 1, codePtr);
+	rangePtr = GetExceptRangeForPc(pc, TCL_ERROR, codePtr);
 	if (rangePtr == NULL) {
 	    /*
 	     * This is only possible when compiling a [catch] that sends its
@@ -7944,13 +7944,14 @@ GetSrcInfoForPc(
  *	ExceptionRange.
  *
  * Results:
- *	In the normal case, catchOnly is 0 (false) and this procedure returns
- *	a pointer to the most closely enclosing ExceptionRange structure
- *	regardless of whether it is a loop or catch exception range. This is
- *	appropriate when processing a TCL_BREAK or TCL_CONTINUE, which will be
- *	"handled" either by a loop exception range or a closer catch range. If
- *	catchOnly is nonzero, this procedure ignores loop exception ranges and
- *	returns a pointer to the closest catch range. If no matching
+ *	If the searchMode is TCL_ERROR, this procedure ignores loop exception
+ *	ranges and returns a pointer to the closest catch range. If the
+ *	searchMode is TCL_BREAK, this procedure returns a pointer to the most
+ *	closely enclosing ExceptionRange regardless of whether it is a loop or
+ *	catch exception range. If the searchMode is TCL_CONTINUE, this
+ *	procedure returns a pointer to the most closely enclosing
+ *	ExceptionRange (of any type) skipping only loop exception ranges if
+ *	they don't have a sensible continueOffset defined. If no matching
  *	ExceptionRange is found that encloses pc, a NULL is returned.
  *
  * Side effects:
@@ -7965,10 +7966,12 @@ GetExceptRangeForPc(
 				 * search for a closest enclosing exception
 				 * range. This points to a bytecode
 				 * instruction in codePtr's code. */
-    int catchOnly,		/* If 0, consider either loop or catch
-				 * ExceptionRanges in search. If nonzero
+    int searchMode,		/* If TCL_BREAK, consider either loop or catch
+				 * ExceptionRanges in search. If TCL_ERROR
 				 * consider only catch ranges (and ignore any
-				 * closer loop ranges). */
+				 * closer loop ranges). If TCL_CONTINUE, look
+				 * for loop ranges that define a continue
+				 * point or a catch range. */
     ByteCode *codePtr)		/* Points to the ByteCode in which to search
 				 * for the enclosing ExceptionRange. */
 {
@@ -7994,8 +7997,13 @@ GetExceptRangeForPc(
 	start = rangePtr->codeOffset;
 	if ((start <= pcOffset) &&
 		(pcOffset < (start + rangePtr->numCodeBytes))) {
-	    if ((!catchOnly)
-		    || (rangePtr->type == CATCH_EXCEPTION_RANGE)) {
+	    if (rangePtr->type == CATCH_EXCEPTION_RANGE) {
+		return rangePtr;
+	    }
+	    if (searchMode == TCL_BREAK) {
+		return rangePtr;
+	    }
+	    if (searchMode == TCL_CONTINUE && rangePtr->continueOffset != -1){
 		return rangePtr;
 	    }
 	}
diff --git a/tests/for.test b/tests/for.test
index 8f19e9f..a0eeff6 100644
--- a/tests/for.test
+++ b/tests/for.test
@@ -811,6 +811,172 @@ test for-6.18 {Tcl_ForObjCmd: for command result} {
     1 {invoked "continue" outside of a loop} \
     ]
 
+test for-8.0 {Coverity CID 1251203: break vs continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; list a [eval {}]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {6 5 3}
+test for-8.1 {Coverity CID 1251203: break vs continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i;list a [eval break]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.2 {Coverity CID 1251203: break vs continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i;list a [eval continue]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+test for-8.3 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; break} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.4 {continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; continue} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+test for-8.5 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; list a [break]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.6 {continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i; list a [continue]} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+test for-8.7 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i;eval break} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.8 {continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    list a [\
+	    for {set i 0} {$i < 5} {incr i;eval continue} {
+		incr j
+	    }]
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+test for-8.9 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    for {set i 0} {$i < 5} {incr i;eval break} {
+		incr j
+	    }
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.10 {continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    for {set i 0} {$i < 5} {incr i;eval continue} {
+		incr j
+	    }
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+test for-8.11 {break in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    for {set i 0} {$i < 5} {incr i;break} {
+		incr j
+	    }
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {2 1 3}
+test for-8.12 {continue in for-step clause} {
+    apply {{} {
+	for {set k 0} {$k < 3} {incr k} {
+	    set j 0
+	    for {set i 0} {$i < 5} {incr i;continue} {
+		incr j
+	    }
+	    incr i
+	}
+	list $i $j $k
+    }}
+} {1 1 3}
+
 
 # cleanup
 ::tcltest::cleanupTests
-- 
cgit v0.12


From 4e411a89fe3bb8d47bf960e738a5b484b53b2757 Mon Sep 17 00:00:00 2001
From: dkf <donal.k.fellows@manchester.ac.uk>
Date: Mon, 3 Aug 2015 07:18:13 +0000
Subject: Fix the documentation comment.

---
 generic/tclExecute.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/generic/tclExecute.c b/generic/tclExecute.c
index 2fa0928..8ada6d2 100644
--- a/generic/tclExecute.c
+++ b/generic/tclExecute.c
@@ -10112,13 +10112,14 @@ GetSrcInfoForPc(
  *	ExceptionRange.
  *
  * Results:
- *	In the normal case, catchOnly is 0 (false) and this procedure returns
- *	a pointer to the most closely enclosing ExceptionRange structure
- *	regardless of whether it is a loop or catch exception range. This is
- *	appropriate when processing a TCL_BREAK or TCL_CONTINUE, which will be
- *	"handled" either by a loop exception range or a closer catch range. If
- *	catchOnly is nonzero, this procedure ignores loop exception ranges and
- *	returns a pointer to the closest catch range. If no matching
+ *	If the searchMode is TCL_ERROR, this procedure ignores loop exception
+ *	ranges and returns a pointer to the closest catch range. If the
+ *	searchMode is TCL_BREAK, this procedure returns a pointer to the most
+ *	closely enclosing ExceptionRange regardless of whether it is a loop or
+ *	catch exception range. If the searchMode is TCL_CONTINUE, this
+ *	procedure returns a pointer to the most closely enclosing
+ *	ExceptionRange (of any type) skipping only loop exception ranges if
+ *	they don't have a sensible continueOffset defined. If no matching
  *	ExceptionRange is found that encloses pc, a NULL is returned.
  *
  * Side effects:
-- 
cgit v0.12