zyearn commented on a change in pull request #1156:
URL: https://github.com/apache/incubator-brpc/pull/1156#discussion_r452020252



##########
File path: src/butil/iobuf.cpp
##########
@@ -366,9 +366,13 @@ inline IOBuf::Block* share_tls_block() {
     }
     IOBuf::Block* new_block = NULL;
     if (b) {
-        new_block = b->portal_next;
-        b->dec_ref();
-        --tls_data.num_blocks;
+        new_block = b;
+        while (new_block && new_block->full()) {
+            IOBuf::Block* const saved_next = new_block->portal_next;
+            new_block->dec_ref();

Review comment:
       一个可能的场景是:
   1)不断调IOBuf::push_back(c),它的实现是拿到tls head 
block,然后在下一个位置将c写进入,假设当前的c写入后使得该block变满
   2)某处调用release_tls_block或者release_tls_block_chain,把某个block 
b2还给tls,此时tls的数据是b2 -> b(之前那块满的)
   3)继续调IOBuf::push_back,写到了b2后面,b2满后,会拿b2的next block返回,此时没有判断full,就把b返回了
   4)IOBuf::push_back往一个满的block中写入数据
   
   对应的UT加好了




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@brpc.apache.org
For additional commands, e-mail: dev-h...@brpc.apache.org

Reply via email to