From 04847e469db03faa027794a0aba5a111dd1d6990 Mon Sep 17 00:00:00 2001
From: fvogel <fvogelnew1@free.fr>
Date: Mon, 26 Jun 2017 12:48:04 +0000
Subject: Fix [62c5b7a1d7]: [text] segfaults on replace. Patch from Christian
 Werner.

---
 generic/tkText.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/generic/tkText.c b/generic/tkText.c
index 6ff1db9..e0dcc50 100644
--- a/generic/tkText.c
+++ b/generic/tkText.c
@@ -1491,6 +1491,7 @@ TextWidgetObjCmd(
 		     * Move the insertion position to the correct place.
 		     */
 
+                    indexFromPtr = TkTextGetIndexFromObj(interp, textPtr, objv[2]);
 		    TkTextIndexForwChars(NULL, indexFromPtr,
 			    deleteInsertOffset, &index, COUNT_INDICES);
 		    TkBTreeUnlinkSegment(textPtr->insertMarkPtr,
-- 
cgit v0.12


From 84ef069edd615d0e09b0be93b26b9d9a0e6545fa Mon Sep 17 00:00:00 2001
From: fvogel <fvogelnew1@free.fr>
Date: Mon, 26 Jun 2017 12:56:34 +0000
Subject: Added test text-8.27 for non-regression against the crash
 [62c5b7a1d7]

---
 tests/text.test | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tests/text.test b/tests/text.test
index edd2a6e..42b6114 100644
--- a/tests/text.test
+++ b/tests/text.test
@@ -1577,6 +1577,16 @@ test text-8.26 {TextWidgetCmd procedure, "replace" option crash} -setup {
 } -cleanup {
     destroy .tt
 } -result {}
+test text-8.27 {TextWidgetCmd procedure, "replace" option crash} -setup {
+    text .tt
+} -body {
+    .tt insert 0.0 \na
+    for {set i 0} {$i < 2} {incr i} {
+        .tt replace 2.0 3.0 b
+    }
+} -cleanup {
+    destroy .tt
+} -result {}
 
 
 test text-9.1 {TextWidgetCmd procedure, "get" option} -setup {
-- 
cgit v0.12