From 627cdc07498a58cd32e99460a3ae3ce6b0c9bfdc Mon Sep 17 00:00:00 2001 From: Shengliang Guan Date: Tue, 14 Jul 2020 14:33:55 +0800 Subject: [PATCH] [TD-825] race condtion while free object in cache --- src/util/src/tcache.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/src/util/src/tcache.c b/src/util/src/tcache.c index df63d567c7..6c678c3201 100644 --- a/src/util/src/tcache.c +++ b/src/util/src/tcache.c @@ -453,21 +453,20 @@ void taosCacheRelease(SCacheObj *pCacheObj, void **data, bool _remove) { } else { uDebug("cache:%s, key:%p, %p is released, refcnt:%d", pCacheObj->name, pNode->key, pNode->data, T_REF_VAL_GET(pNode) - 1); + __cache_wr_lock(pCacheObj); + // NOTE: once refcount is decrease, pNode may be freed by other thread immediately. int32_t ref = T_REF_DEC(pNode); - if (inTrashCan) { + if (inTrashCan && (ref == 0)) { // Remove it if the ref count is 0. // The ref count does not need to load and check again after lock acquired, since ref count can not be increased when // the node is in trashcan. - if (ref == 0) { - __cache_wr_lock(pCacheObj); - assert(pNode->pTNodeHeader->pData == pNode); - taosRemoveFromTrashCan(pCacheObj, pNode->pTNodeHeader); - __cache_unlock(pCacheObj); - } - + assert(pNode->pTNodeHeader->pData == pNode); + taosRemoveFromTrashCan(pCacheObj, pNode->pTNodeHeader); } + + __cache_unlock(pCacheObj); } // else { -- GitLab