Tcl Source Code

The following script produces a segmentation fault:

apply {{} {
    set item hello
    lassign $item one item
    dict update item item item two two {}
}}

Good test case and patch. In 8.6 and trunk.

Slightly simpler test script:

    proc t {} {lassign {} item; dict update item item item two two {}}
    t

My suspicion is that the initial loop in INST_DICT_UPDATE_START isn't robust against dictPtr being free()d while it's looping, and [lassign] contributes by only by putting a value in $item with low refcount.

The attached patch eliminates the segfault with this test script, but I haven't tested it any further: