From b896711fc692c02e8f2e857abaa3b8890d84b6f0 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@gmail.com>
Date: Wed, 6 Sep 2023 15:53:04 +0200
Subject: [PATCH] tag/Pool: fix crash in tag_pool_put_item()

Regression by commit 76bdfabcc56c618d8562a7a6f5ccbfd169b97813
---
 src/tag/Pool.cxx | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/tag/Pool.cxx b/src/tag/Pool.cxx
index 34a689541..e27ee539d 100644
--- a/src/tag/Pool.cxx
+++ b/src/tag/Pool.cxx
@@ -142,14 +142,17 @@ tag_pool_put_item(TagItem *item) noexcept
 		return;
 
 	auto &list = tag_value_list(item->type, item->value);
-	for (auto i = list.before_begin(), n = std::next(i);; i = n) {
-		assert(n != list.end());
-		auto &s = *n++;
+	for (auto i = list.before_begin();;) {
+		const auto n = std::next(i);
+		auto &s = *n;
+		assert(i != list.end());
 
 		if (&s == slot) {
 			list.erase_after(i);
 			DeleteVarSize(slot);
 			return;
 		}
+
+		i = n;
 	}
 }