Use correct argc/argv for cleanup when loading AOF

src/aof.c

@@ -284,9 +284,11 @@ int loadAppendOnlyFile(char *filename) {
         /* The fake client should not have a reply */
         redisAssert(fakeClient->bufpos == 0 && listLength(fakeClient->reply) == 0);
 
-        /* Clean up, ready for the next command */
+        /* Clean up. Command code may have changed argv/argc so we use the
-        for (j = 0; j < argc; j++) decrRefCount(argv[j]);
+         * argv/argc of the client instead of the local variables. */
-        zfree(argv);
+        for (j = 0; j < fakeClient->argc; j++)
+            decrRefCount(fakeClient->argv[j]);
+        zfree(fakeClient->argv);
     }
 
     /* This point can only be reached when EOF is reached without errors.

tests/integration/aof.tcl

@@ -83,4 +83,22 @@ tags {"aof"} {
             assert_equal "" [$client get bar]
         }
     }
+
+    ## Test that SPOP (that modifies the client its argc/argv) is correctly free'd
+    create_aof {
+        append_to_aof [formatCommand sadd set foo]
+        append_to_aof [formatCommand sadd set bar]
+        append_to_aof [formatCommand spop set]
+    }
+
+    start_server_aof [list dir $server_path] {
+        test "AOF+SPOP: Server should have been started" {
+            assert_equal 1 [is_alive $srv]
+        }
+
+        test "AOF+SPOP: Set should have 1 member" {
+            set client [redis [dict get $srv host] [dict get $srv port]]
+            assert_equal 1 [$client scard set]
+        }
+    }
 }