"doc/GetsetCommand.html" did not exist on "73287b2b576fa6a1ff1b61467286cbd5458881d2"
Commit d8f25ce3 authored by Pieter Noordhuis's avatar Pieter Noordhuis
Browse files

fix rare condition where 'key' would already be destroyed while is was needed later on

parent b25b61eb
......@@ -9870,6 +9870,11 @@ static int dontWaitForSwappedKey(redisClient *c, robj *key) {
listIter li;
struct dictEntry *de;
/* The key object might be destroyed when deleted from the c->io_keys
* list (and the "key" argument is physically the same object as the
* object inside the list), so we need to protect it. */
incrRefCount(key);
/* Remove the key from the list of keys this client is waiting for. */
listRewind(c->io_keys,&li);
while ((ln = listNext(&li)) != NULL) {
......@@ -9878,18 +9883,19 @@ static int dontWaitForSwappedKey(redisClient *c, robj *key) {
break;
}
}
assert(ln != NULL);
redisAssert(ln != NULL);
/* Remove the client form the key => waiting clients map. */
de = dictFind(c->db->io_keys,key);
assert(de != NULL);
redisAssert(de != NULL);
l = dictGetEntryVal(de);
ln = listSearchKey(l,c);
assert(ln != NULL);
redisAssert(ln != NULL);
listDelNode(l,ln);
if (listLength(l) == 0)
dictDelete(c->db->io_keys,key);
decrRefCount(key);
return listLength(c->io_keys) == 0;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment