Modules: fixed double-free in shared dict update with eviction.

[xeioex]

When updating an existing key's string value in a shared dictionary with timeout and evict enabled, ngx_js_dict_alloc() could trigger ngx_js_dict_evict() if the zone was full. Since the node being updated was still in the expire tree, eviction could free it. The subsequent ngx_slab_free_locked() call in the update path then freed the already-freed string data, causing the "chunk is already free" alert followed by a segfault.

The issue was more likely to occur when the zone fills to capacity and eviction is triggered during the update path.

This closes #1036 issue on Github.

[VadimZhestikov]

May be it would be nice add extra regression test for the third change, covering keys()/items()/size() with expired-but-not-yet-reclaimed entries, ideally for both njs and qjs paths. Otherwise looks good.

[VadimZhestikov]

Looks good

[xeioex]

@VadimZhestikov

May be it would be nice add extra regression test for the third change, covering keys()/items()/size() with expired-but-not-yet-reclaimed entries,

Yes, I considered it and decided not to add more tests as existing tests

 like(http_get('/keys?dict=foo'), qr/empty/, 'foo keys after expire');
  like(http_get('/keys?dict=bar'), qr/FOO\,FOO2/, 'bar keys after a delay');
  like(http_get('/size?dict=foo'), qr/size: 0/, 'no of items in foo after expire');
  like(http_get('/items?dict=bar'), qr/FOO,zzz|FOO2,aaa/, 'bar items');

already cover what we need the most. expired-but-not-yet-reclaimed - is hard to observe the internal state of whether nodes were reclaimed or just skipped.