Index: generic/tclExecute.c
===================================================================
RCS file: /cvsroot/tcl/tcl/generic/tclExecute.c,v
retrieving revision 1.259
diff -u -r1.259 tclExecute.c
--- generic/tclExecute.c	20 Feb 2007 23:24:03 -0000	1.259
+++ generic/tclExecute.c	28 Feb 2007 16:57:43 -0000
@@ -5787,11 +5787,12 @@
 
     {
 	int opnd, i, length, length2, allocdict;
-	Tcl_Obj **keyPtrPtr, **varIdxPtrPtr, *dictPtr;
+	Tcl_Obj **keyPtrPtr, **varIdxPtrPtr, *dictPtr, *copyObj;
 	Var *varPtr;
 	char *part1;
 
     case INST_DICT_UPDATE_START:
+	copyObj = TclListObjCopy(NULL, *tosPtr);
 	opnd = TclGetUInt4AtPtr(pc+1);
 	varPtr = &(compiledLocals[opnd]);
 	part1 = varPtr->name;
@@ -5812,7 +5813,7 @@
 	}
 	if (Tcl_ListObjGetElements(interp, *(tosPtr - 1), &length,
 			&keyPtrPtr) != TCL_OK ||
-		Tcl_ListObjGetElements(interp, *tosPtr, &length2,
+		Tcl_ListObjGetElements(interp, copyObj, &length2,
 			&varIdxPtrPtr) != TCL_OK) {
 	    goto dictUpdateStartFailed;
 	}
@@ -5840,12 +5841,14 @@
 		    valPtr, TCL_LEAVE_ERR_MSG) == NULL) {
 		CACHE_STACK_INFO();
 	    dictUpdateStartFailed:
+		Tcl_DecrRefCount(copyObj);
 		cleanup = 2;
 		result = TCL_ERROR;
 		goto checkForCatch;
 	    }
 	    CACHE_STACK_INFO();
 	}
+	Tcl_DecrRefCount(copyObj);
 	NEXT_INST_F(5, 2, 0);
 
     case INST_DICT_UPDATE_END:
@@ -5866,11 +5869,13 @@
 	if (dictPtr == NULL) {
 	    NEXT_INST_F(5, 2, 0);
 	}
+	copyObj = TclListObjCopy(NULL, *tosPtr);
 	if (Tcl_DictObjSize(interp, dictPtr, &length) != TCL_OK ||
 		Tcl_ListObjGetElements(interp, *(tosPtr - 1), &length,
 			&keyPtrPtr) != TCL_OK ||
-		Tcl_ListObjGetElements(interp, *tosPtr, &length2,
+		Tcl_ListObjGetElements(interp, copyObj, &length2,
 			&varIdxPtrPtr) != TCL_OK) {
+	    Tcl_DecrRefCount(copyObj);
 	    cleanup = 2;
 	    result = TCL_ERROR;
 	    goto checkForCatch;
@@ -5904,6 +5909,7 @@
 		Tcl_DictObjPut(interp, dictPtr, keyPtrPtr[i], valPtr);
 	    }
 	}
+	Tcl_DecrRefCount(copyObj);
 	if (TclIsVarDirectWritable(varPtr)) {
 	    Tcl_IncrRefCount(dictPtr);
 	    Tcl_DecrRefCount(varPtr->value.objPtr);
