Skip to content
Browse files

fix rare condition where 'key' would already be destroyed while is wa…

…s needed later on
  • Loading branch information...
1 parent b25b61e commit d8f25ce3ac7538a757ab2a1d17907d98c38c1adb @pietern pietern committed Jul 22, 2010
Showing with 9 additions and 3 deletions.
  1. +9 −3 redis.c
View
12 redis.c
@@ -9870,6 +9870,11 @@ static int dontWaitForSwappedKey(redisClient *c, robj *key) {
listIter li;
struct dictEntry *de;
+ /* The key object might be destroyed when deleted from the c->io_keys
+ * list (and the "key" argument is physically the same object as the
+ * object inside the list), so we need to protect it. */
+ incrRefCount(key);
+
/* Remove the key from the list of keys this client is waiting for. */
listRewind(c->io_keys,&li);
while ((ln = listNext(&li)) != NULL) {
@@ -9878,18 +9883,19 @@ static int dontWaitForSwappedKey(redisClient *c, robj *key) {
break;
}
}
- assert(ln != NULL);
+ redisAssert(ln != NULL);
/* Remove the client form the key => waiting clients map. */
de = dictFind(c->db->io_keys,key);
- assert(de != NULL);
+ redisAssert(de != NULL);
l = dictGetEntryVal(de);
ln = listSearchKey(l,c);
- assert(ln != NULL);
+ redisAssert(ln != NULL);
listDelNode(l,ln);
if (listLength(l) == 0)
dictDelete(c->db->io_keys,key);
+ decrRefCount(key);
return listLength(c->io_keys) == 0;
}

0 comments on commit d8f25ce

Please sign in to comment.
Something went wrong with that request. Please try again.