You need to sign in or sign up before continuing.
Commit c8a10631 authored by Pieter Noordhuis's avatar Pieter Noordhuis
Browse files

fix rare condition where 'key' would already be destroyed while is was needed later on

parent 2f996f02
...@@ -1075,6 +1075,11 @@ int dontWaitForSwappedKey(redisClient *c, robj *key) { ...@@ -1075,6 +1075,11 @@ int dontWaitForSwappedKey(redisClient *c, robj *key) {
listIter li; listIter li;
struct dictEntry *de; struct dictEntry *de;
/* The key object might be destroyed when deleted from the c->io_keys
* list (and the "key" argument is physically the same object as the
* object inside the list), so we need to protect it. */
incrRefCount(key);
/* Remove the key from the list of keys this client is waiting for. */ /* Remove the key from the list of keys this client is waiting for. */
listRewind(c->io_keys,&li); listRewind(c->io_keys,&li);
while ((ln = listNext(&li)) != NULL) { while ((ln = listNext(&li)) != NULL) {
...@@ -1095,6 +1100,7 @@ int dontWaitForSwappedKey(redisClient *c, robj *key) { ...@@ -1095,6 +1100,7 @@ int dontWaitForSwappedKey(redisClient *c, robj *key) {
if (listLength(l) == 0) if (listLength(l) == 0)
dictDelete(c->db->io_keys,key); dictDelete(c->db->io_keys,key);
decrRefCount(key);
return listLength(c->io_keys) == 0; return listLength(c->io_keys) == 0;
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment