From b08fa491c9f3d6059a26663f72633d2f66f35f4b Mon Sep 17 00:00:00 2001
From: Craig Tiller <ctiller@google.com>
Date: Tue, 10 May 2016 14:56:05 -0700
Subject: [PATCH] Fix refcounting bugs

---
 src/core/lib/surface/call.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/core/lib/surface/call.c b/src/core/lib/surface/call.c
index 2dea2147cec..7709ef5738e 100644
--- a/src/core/lib/surface/call.c
+++ b/src/core/lib/surface/call.c
@@ -962,6 +962,7 @@ static void post_batch_completion(grpc_exec_ctx *exec_ctx,
                                   batch_control *bctl) {
   grpc_call *call = bctl->call;
   if (bctl->is_notify_tag_closure) {
+    /* unrefs bctl->error */
     grpc_exec_ctx_push(exec_ctx, bctl->notify_tag, bctl->error, NULL);
     gpr_mu_lock(&call->mu);
     bctl->call->used_batches =
@@ -970,6 +971,7 @@ static void post_batch_completion(grpc_exec_ctx *exec_ctx,
     gpr_mu_unlock(&call->mu);
     GRPC_CALL_INTERNAL_UNREF(exec_ctx, call, "completion");
   } else {
+    /* unrefs bctl->error */
     grpc_cq_end_op(exec_ctx, bctl->call->cq, bctl->notify_tag, bctl->error,
                    finish_batch_completion, bctl, &bctl->cq_completion);
   }
@@ -1173,7 +1175,7 @@ static void finish_batch(grpc_exec_ctx *exec_ctx, void *bctlp,
     error = GRPC_ERROR_NONE;
   }
   GRPC_ERROR_UNREF(bctl->error);
-  bctl->error = error;
+  bctl->error = GRPC_ERROR_REF(error);
   gpr_mu_unlock(&call->mu);
   if (gpr_unref(&bctl->steps_to_complete)) {
     post_batch_completion(exec_ctx, bctl);