DF-5677 / fix.diff
--- a/sys/libprop/prop_object.c +++ b/sys/libprop/prop_object.c @@ -1045,7 +1057,13 @@ parent = po; atomic_inc_32(&po->po_refcnt); } - _PROP_ASSERT(parent); + /* + * If the first iteration broke out (another holder raced a retain, + * or the object freed itself outright), nothing was walked and + * there is no parent to emergency-free. + */ + if (parent == NULL) + return; /* One object was just freed. */ po = parent; (*po->po_type->pot_emergency_free)(parent); |