invalid write while alter vgroup

src/mnode/src/mnodeSdb.c

@@ -389,7 +389,7 @@ void sdbIncRef(void *handle, void *pObj) {
   SSdbTable *pTable = handle;
   int32_t *  pRefCount = (int32_t *)(pObj + pTable->refCountPos);
   atomic_add_fetch_32(pRefCount, 1);
-  if (1) {
+  if (0 && (pTable->tableId == SDB_TABLE_CTABLE || pTable->tableId == SDB_TABLE_DB)) {
     sdbTrace("add ref to table:%s record:%p:%s:%d", pTable->tableName, pObj, sdbGetKeyStrFromObj(pTable, pObj), *pRefCount);
   }
 }
@@ -400,7 +400,7 @@ void sdbDecRef(void *handle, void *pObj) {
   SSdbTable *pTable = handle;
   int32_t *  pRefCount = (int32_t *)(pObj + pTable->refCountPos);
   int32_t    refCount = atomic_sub_fetch_32(pRefCount, 1);
-  if (1) {
+  if (0 && (pTable->tableId == SDB_TABLE_CTABLE || pTable->tableId == SDB_TABLE_DB)) {
     sdbTrace("def ref of table:%s record:%p:%s:%d", pTable->tableName, pObj, sdbGetKeyStrFromObj(pTable, pObj), *pRefCount);
   }
 

src/mnode/src/mnodeVgroup.c

@@ -149,8 +149,16 @@ static int32_t mnodeVgroupActionUpdate(SSdbOper *pOper) {
       }
     }
 
+    void *idPool = pVgroup->idPool;
+    void *tableList = pVgroup->tableList;
+    int32_t oldRefCount = pVgroup->refCount;
+
     memcpy(pVgroup, pNew, sizeof(SVgObj));
+    
     free(pNew);
+    pVgroup->refCount = oldRefCount;
+    pVgroup->idPool = idPool;
+    pVgroup->tableList = tableList;
     
     for (int32_t i = 0; i < pVgroup->numOfVnodes; ++i) {
       SDnodeObj *pDnode = mnodeGetDnode(pVgroup->vnodeGid[i].dnodeId);