Commit c8a10631 authored by Pieter Noordhuis's avatar Pieter Noordhuis
Browse files

fix rare condition where 'key' would already be destroyed while is was needed later on

parent 2f996f02
......@@ -1075,6 +1075,11 @@ int dontWaitForSwappedKey(redisClient *c, robj *key) {
listIter li;
struct dictEntry *de;
/* The key object might be destroyed when deleted from the c->io_keys
* list (and the "key" argument is physically the same object as the
* object inside the list), so we need to protect it. */
incrRefCount(key);
/* Remove the key from the list of keys this client is waiting for. */
listRewind(c->io_keys,&li);
while ((ln = listNext(&li)) != NULL) {
......@@ -1095,6 +1100,7 @@ int dontWaitForSwappedKey(redisClient *c, robj *key) {
if (listLength(l) == 0)
dictDelete(c->db->io_keys,key);
decrRefCount(key);
return listLength(c->io_keys) == 0;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment