[BUG] [CRASH] Crash in RedisJSON during key expiration #1555

We are experiencing crash in Redis when using RedisJSON under heavy load.
The crash consistently happens during key expiration, specifically inside the RedisJSON module while freeing JSON values.

From the stack trace, the crash occurs in:

ijson::value::IValue::drop
rejson::redisjson::type_methods::free

This suggests a potential invalid memory access (NULL dereference or use-after-free) during object destruction.

Environment
Redis version: 7.2.4
RedisJSON (ReJSON): 2.6.10
RediSearch: 2.8.4
OS: Linux (Ubuntu 22.04, kernel 5.15)
Architecture: x86_64

We are using RedisJSON heavily in production with:

Frequent JSON.SET
Frequent JSON.DEL
Extensive use of EXPIRE on JSON keys
RediSearch indexes on JSON documents

The crash occurs during Redis internal expiration cycle (activeExpireCycle), not during direct command execution.

Crash Details
Signal: SIGSEGV (11)
Accessing address: NULL ((nil))
Instruction pointer inside: librejson.so

Key part of stack trace:

ijson::value::IValue::type_
<ijson::value::IValue as Drop>::drop
rejson::redisjson::type_methods::free
freeModuleObject
dictObjectDestructor
dbGenericDelete
deleteExpiredKeyAndPropagate
activeExpireCycle

This indicates the crash happens when Redis calls the module's free callback during key expiration.

Expected Behavior

Redis should safely free expired JSON keys without crashing.

Actual Behavior

Redis crashes with SIGSEGV during expiration of JSON keys.

Full stack trace in attachment..

full_crash.txt