ITS#9564 lmdb: fix race condition freeing spilled pages at end of transaction

diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 33a73028deb6fdc80c50818f0e1bdfa224ce2b40..90282cfc4f6d86324b68c7ff1cc4f60b9a38414f 100644 (file)
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -3413,6 +3413,7 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
 
                txn->mt_numdbs = 0;
                txn->mt_flags = MDB_TXN_FINISHED;
+               mdb_midl_free(txn->mt_spill_pgs);
 
                if (!txn->mt_parent) {
                        mdb_midl_shrink(&txn->mt_free_pgs);
@@ -3434,7 +3435,6 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
                        mdb_midl_free(txn->mt_free_pgs);
                        free(txn->mt_u.dirty_list);
                }
-               mdb_midl_free(txn->mt_spill_pgs);
 
                mdb_midl_free(pghead);
        }