Tcl Source Code

Ticket Change Details
Login
Overview

Artifact ID: 6183532f3e2e19116a12f43e2049f9d35204d6d8
Ticket: 578155d5a19b348dc1a9fe96cc2c067a59326a89
Very rare bug (segfault) if set variable (with error case) using self-releasable object as new value
User & Date: sebres 2017-07-12 20:04:15
Changes

  1. icomment:
    Although the emphasis was "only once" referenced, but it is not always the case: the object newValue can be referenced twice or more (newValue->refCount > 1) and described situation can nevertheless still occur, if we've something like this:
    <code><pre>
    set X [list [list 1st-list $newValue] [list 2nd-list $newValue] ...]
    call-something-that-set-var ::missing::namespace::var [call-something-unset-X-and-return-its-value X]
    </pre></code>
    I think this example describes the issue very good.
    
    Thus my proposal to solve it (resp. to workaround it) using:
    <pre><code>
    <b style="color:green">+     int freeNewVal = (newValuePtr->refCount == 0);</b>
    
         part1 = TclGetString(part1Ptr);
         part2 = ((part2Ptr == NULL) ? NULL : TclGetString(part2Ptr));
      
         varPtr = TclObjLookupVar(interp, part1Ptr, part2, flags, "set",
                /*createPart1*/ 1, /*createPart2*/ 1, &arrayPtr);
         if (varPtr == NULL) {
    <b style="color:red">-        if (newValuePtr->refCount == 0) {</b>
    <b style="color:green">+        if (freeNewVal) {</b>
                 Tcl_DecrRefCount(newValuePtr);
             }
             return NULL;
         }
    </code></pre>
    
  2. login: "sebres"
  3. mimetype: "text/x-fossil-wiki"