Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Greater protection against double TclFreeObj() calls in TCL_MEM_DEBUG mode. |
|---|---|
| Downloads: | Tarball | ZIP archive | SQL archive |
| Timelines: | family | ancestors | descendants | both | core-8-5-branch |
| Files: | files | file ages | folders |
| SHA1: |
3474bcc2db25867644c44fcfba5deebd |
| User & Date: | dgp 2013-03-11 17:37:15 |
Context
|
2013-03-11
| ||
| 19:05 | 3606391 trace.test test independence check-in: b94141ae1d user: dgp tags: core-8-5-branch | |
| 17:40 | Greater protection against double TclFreeObj() calls in TCL_MEM_DEBUG mode. check-in: 081509f926 user: dgp tags: trunk | |
| 17:37 | Greater protection against double TclFreeObj() calls in TCL_MEM_DEBUG mode. check-in: 3474bcc2db user: dgp tags: core-8-5-branch | |
|
2013-03-06
| ||
| 21:54 | Cleaner error handling in fixempties(). check-in: 8577d952c4 user: dgp tags: core-8-5-branch | |
Changes
Changes to generic/tclObj.c.
| ︙ | ︙ | |||
1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 |
/*
* This macro declares a variable, so must come here...
*/
ObjInitDeletionContext(context);
if (objPtr->refCount < -1) {
Tcl_Panic("Reference count for %lx was negative", objPtr);
}
/* Invalidate the string rep first so we can use the bytes value
* for our pointer chain, and signal an obj deletion (as opposed
* to shimmering) with 'length == -1' */
TclInvalidateStringRep(objPtr);
objPtr->length = -1;
| > > > > > > > > > > > > | 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 |
/*
* This macro declares a variable, so must come here...
*/
ObjInitDeletionContext(context);
/*
* Check for a double free of the same value. This is slightly tricky
* because it is customary to free a Tcl_Obj when its refcount falls
* either from 1 to 0, or from 0 to -1. Falling from -1 to -2, though,
* and so on, is always a sign of a botch in the caller.
*/
if (objPtr->refCount < -1) {
Tcl_Panic("Reference count for %lx was negative", objPtr);
}
/*
* Now, in case we just approved drop from 1 to 0 as acceptable, make
* sure we do not accept a second free when falling from 0 to -1.
* Skip that possibility so any double free will trigger the panic.
*/
objPtr->refCount = -1;
/* Invalidate the string rep first so we can use the bytes value
* for our pointer chain, and signal an obj deletion (as opposed
* to shimmering) with 'length == -1' */
TclInvalidateStringRep(objPtr);
objPtr->length = -1;
|
| ︙ | ︙ |