merge segfault fix for [43acb96e678a66ef]: avoid access to freed memory in TpoolRelease

Author: sebres

generic/threadPoolCmd.c

@@ -674,7 +674,9 @@ TpoolCancelObjCmd(
 		    tpoolPtr->workTail = rPtr->prevPtr;
 		}
 		SetResult(NULL, rPtr); /* Just to free the result */
-		ckfree(rPtr->script);
+		if (rPtr->script) {
+		    ckfree(rPtr->script);
+		}
 		ckfree((char *)rPtr);
 		Tcl_ListObjAppendElement(interp, doneList, wObjv[ii]);
 		break;
@@ -1239,6 +1241,7 @@ TpoolWorker(
 	Tcl_MutexUnlock(&tpoolPtr->mutex);
 	TpoolEval(interp, rPtr->script, rPtr->scriptLen, rPtr);
 	ckfree(rPtr->script);
+	rPtr->script = NULL;
 	Tcl_MutexLock(&tpoolPtr->mutex);
 	if (!rPtr->detached) {
 	    int isNew;
@@ -1715,8 +1718,11 @@ TpoolRelease(
      * Cleanup jobs posted but never completed.
      */
 
-    for (rPtr = tpoolPtr->workHead; rPtr; rPtr = rPtr->nextPtr) {
-	ckfree(rPtr->script);
+    for (rPtr = tpoolPtr->workHead; rPtr; rPtr = tpoolPtr->workHead) {
+	tpoolPtr->workHead = rPtr->nextPtr;
+	if (rPtr->script) {
+	    ckfree(rPtr->script);
+	}
 	ckfree((char *)rPtr);
     }
     Tcl_MutexFinalize(&tpoolPtr->mutex);