Possible NULL pointer dereference in nxt_cache_wake_handler()

[Andrew Clayton]

So in src/nxt_cache.c we have the following function

static void                                                                     
nxt_cache_wake_handler(nxt_thread_t *thr, void *obj, void *data)                
{                                                                               
    nxt_cache_t             *cache;                                             
    nxt_work_handler_t      handler;                                            
    nxt_cache_query_t       *q;                                                 
    nxt_cache_query_wait_t  *qw;                                                
                                                                                
    qw = obj;                                                                   
    q = qw->query;                                                              
    cache = qw->cache;                                                          
                                                                                
    nxt_cache_lock(cache);                                                      
                                                                                
    handler = nxt_cache_node_test(cache, q);                                    
                                                                                
    if (handler != NULL) {                                                      
        nxt_cache_query_wait_free(cache, qw);                                   
                                                                                
    } else {                                                                    
        /* Wait again. */                                                       
        qw->next = q->node->waiting;                                            
        q->node->waiting = qw;                                                  
    }                                                                           
                                                                                
    nxt_cache_unlock(cache);                                                    
                                                                                
    handler(thr, q, NULL);                                                      
}

We set handler then check if it's NULL. However even if it is NULL we
still call it with

    handler(thr, q, NULL);

Or am I missing something?

Andrew