From c8e3d65affc560d3053066d562920223e1780d89 Mon Sep 17 00:00:00 2001
From: pooryorick <com.digitalsmarties@pooryorick.com>
Date: Wed, 1 Nov 2017 21:05:32 +0000
Subject: [PATCH 0652/1800] Fix bug 3c32a3f8bd, segmentation fault in
 TclOO.c/ReleaseClassContents() for a class mixed into one of its instances.

---
 generic/tclOO.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/generic/tclOO.c b/generic/tclOO.c
index e9ef2ce29..51731d3d1 100644
--- a/generic/tclOO.c
+++ b/generic/tclOO.c
@@ -1006,8 +1006,18 @@ ReleaseClassContents(
 	    }
 	    for(j=0 ; j<instancePtr->mixins.num ; j++) {
 		Class *mixin = instancePtr->mixins.list[j];
+		Class *nextMixin = NULL;
 		if (mixin == clsPtr) {
-		    instancePtr->mixins.list[j] = NULL;
+		    if (j < instancePtr->mixins.num - 1) {
+			nextMixin = instancePtr->mixins.list[j+1];
+		    }
+		    if (j == 0) {
+			instancePtr->mixins.num = 0;
+			instancePtr->mixins.list = NULL;
+		    } else {
+			instancePtr->mixins.list[j-1] = nextMixin;
+		    }
+		    instancePtr->mixins.num -= 1;
 		}
 	    }
 	    if (instancePtr != NULL && !IsRoot(instancePtr)) {
@@ -1181,7 +1191,8 @@ ObjectNamespaceDeleted(
 	if ((((Command *)oPtr->command)->flags && CMD_IS_DELETED)) {
 	    /*
 	     * Namespace deletion must have been triggered by a trace on command
-	     * deletion , meaning that 
+	     * deletion , meaning that ObjectRenamedTrace() is eventually going
+	     * to be called .
 	     */
 	    deleteAlreadyInProgress = 1;
 	}
-- 
2.19.1