From 8e2facbfb8cb7ded4e916786d087c455ddabfc96 Mon Sep 17 00:00:00 2001
From: lwkienun <lwkienun@126.com>
Date: Sat, 15 Jun 2019 12:11:37 +0800
Subject: [PATCH] fix crash of sharedata by incref before sharedated.monitor
 return cobj to client.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

crash occr analise:
1.sharedated.update call many times in a short time(eg:3 times) to change a same name conf value to a->b->c->d.
2.sharedated sending 3 response  to monitoring clients。a->b and b->c and c->d.
3.if b is destroyed and it's memory is reallocated and rewrited when client process the first message a->b, client's call lbox will crash.

solution:
conf b must be keeped before message(a->b) is processed by inc it's ref.
Any return value from host to client must use incref before send to client.
---
 lualib/skynet/sharedata.lua | 1 +
 service/sharedatad.lua      | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/lualib/skynet/sharedata.lua b/lualib/skynet/sharedata.lua
index b955bd90..be62f67d 100644
--- a/lualib/skynet/sharedata.lua
+++ b/lualib/skynet/sharedata.lua
@@ -18,6 +18,7 @@ local function monitor(name, obj, cobj)
 			break
 		end
 		sd.update(obj, newobj)
+		skynet.send(service, "lua", "confirm" , newobj)
 	end
 	if cache[name] == obj then
 		cache[name] = nil
diff --git a/service/sharedatad.lua b/service/sharedatad.lua
index d7439493..622180f1 100644
--- a/service/sharedatad.lua
+++ b/service/sharedatad.lua
@@ -118,6 +118,7 @@ function CMD.update(name, t, ...)
 	if watch then
 		sharedata.host.markdirty(oldcobj)
 		for _,response in pairs(watch) do
+			sharedata.host.incref(newobj)
 			response(true, newobj)
 		end
 	end
@@ -138,6 +139,7 @@ end
 function CMD.monitor(name, obj)
 	local v = assert(pool[name])
 	if obj ~= v.obj then
+		sharedata.host.incref(v.obj)
 		return v.obj
 	end