taosIterateRef: shall NOT return removed node

src/util/src/tref.c

@@ -280,6 +280,7 @@ void *taosIterateRef(int rsetId, int64_t rid) {
     return NULL;
   }
 
+  void *newP = NULL;
   pSet = tsRefSetList + rsetId;
   taosIncRsetCount(pSet);
   if (pSet->state != TSDB_REF_STATE_ACTIVE) {
@@ -289,6 +290,8 @@ void *taosIterateRef(int rsetId, int64_t rid) {
     return NULL;
   }
 
+  do {
+    newP = NULL;
     int hash = 0;
     if (rid > 0) {
       hash = rid % pSet->max;
@@ -304,6 +307,7 @@ void *taosIterateRef(int rsetId, int64_t rid) {
         uError("rsetId:%d rid:%" PRId64 " not there, quit", rsetId, rid);
         terrno = TSDB_CODE_REF_NOT_EXIST;
         taosUnlockList(pSet->lockedBy+hash);
+        taosDecRsetCount(pSet);
         return NULL;
       }
 
@@ -324,7 +328,6 @@ void *taosIterateRef(int rsetId, int64_t rid) {
       }
     }
 
-  void *newP = NULL;
     if (pNode) {
       pNode->count++;  // acquire it
       newP = pNode->p;
@@ -335,6 +338,8 @@ void *taosIterateRef(int rsetId, int64_t rid) {
     }
 
     if (rid > 0) taosReleaseRef(rsetId, rid);  // release the current one
+    if (pNode) rid = pNode->rid;
+  } while (newP && pNode->removed);
 
   taosDecRsetCount(pSet);