Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Greater protection against double TclFreeObj() calls in TCL_MEM_DEBUG mode. |
|---|---|
| Downloads: | Tarball | ZIP archive | SQL archive |
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA1: |
081509f92652bb4331d66e650540f6ae |
| User & Date: | dgp 2013-03-11 17:40:14 |
Context
|
2013-03-11
| ||
| 19:06 | 3606391 trace.test test independence. check-in: 47cb241e14 user: dgp tags: trunk | |
| 17:40 | Greater protection against double TclFreeObj() calls in TCL_MEM_DEBUG mode. check-in: 081509f926 user: dgp tags: trunk | |
| 17:37 | Greater protection against double TclFreeObj() calls in TCL_MEM_DEBUG mode. check-in: 3474bcc2db user: dgp tags: core-8-5-branch | |
| 12:55 | 3607246,3607372 Unbalanced refcounts of literals in the global literal table. check-in: c440d13b97 user: dgp tags: trunk | |
Changes
Changes to generic/tclObj.c.
| ︙ | ︙ | |||
1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 |
/*
* This macro declares a variable, so must come here...
*/
ObjInitDeletionContext(context);
if (objPtr->refCount < -1) {
Tcl_Panic("Reference count for %p was negative", objPtr);
}
/*
* Invalidate the string rep first so we can use the bytes value for our
* pointer chain, and signal an obj deletion (as opposed to shimmering)
* with 'length == -1'.
*/
| > > > > > > > > > > > > | 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 |
/*
* This macro declares a variable, so must come here...
*/
ObjInitDeletionContext(context);
/*
* Check for a double free of the same value. This is slightly tricky
* because it is customary to free a Tcl_Obj when its refcount falls
* either from 1 to 0, or from 0 to -1. Falling from -1 to -2, though,
* and so on, is always a sign of a botch in the caller.
*/
if (objPtr->refCount < -1) {
Tcl_Panic("Reference count for %p was negative", objPtr);
}
/*
* Now, in case we just approved drop from 1 to 0 as acceptable, make
* sure we do not accept a second free when falling from 0 to -1.
* Skip that possibility so any double free will trigger the panic.
*/
objPtr->refCount = -1;
/*
* Invalidate the string rep first so we can use the bytes value for our
* pointer chain, and signal an obj deletion (as opposed to shimmering)
* with 'length == -1'.
*/
|
| ︙ | ︙ |