fix rare condition where 'key' would already be destroyed while is was needed later on

diff --git a/src/vm.c b/src/vm.c
index 1aaa57eb54bd338bbd2c6ca963764e872ec924ad..073cace2fbdc8a0b2a5a6095b14d7da2eaf54f49 100644 (file)
--- a/src/vm.c
+++ b/src/vm.c
@@ -1075,6 +1075,11 @@ int dontWaitForSwappedKey(redisClient *c, robj *key) {
     listIter li;
     struct dictEntry *de;
 
+    /* The key object might be destroyed when deleted from the c->io_keys
+     * list (and the "key" argument is physically the same object as the
+     * object inside the list), so we need to protect it. */
+    incrRefCount(key);
+
     /* Remove the key from the list of keys this client is waiting for. */
     listRewind(c->io_keys,&li);
     while ((ln = listNext(&li)) != NULL) {
@@ -1095,6 +1100,7 @@ int dontWaitForSwappedKey(redisClient *c, robj *key) {
     if (listLength(l) == 0)
         dictDelete(c->db->io_keys,key);
 
+    decrRefCount(key);
     return listLength(c->io_keys) == 0;
 }