added comment

src/ca/access.cpp

@@ -588,6 +588,8 @@ extern "C" int epicsShareAPI ca_add_masked_array_event (
                 *monixptr = pTmp;
             }
             pTmp->begin ( tmpType, count, mask );
+            // dont touch pTmp after this because
+            // the first callback might have canceled it
             return ECA_NORMAL;
         }
         else {

src/ca/oldAccess.h

@@ -350,8 +350,10 @@ inline oldSubscription::oldSubscription  (
 inline void oldSubscription::begin  ( unsigned type, 
               arrayElementCount nElem, unsigned mask )
 {
-    this->chan.subscribe ( type, nElem, mask, *this, this->id );
     this->subscribed = true;
+    this->chan.subscribe ( type, nElem, mask, *this, this->id );
+    // dont touch this pointer after this point because the
+    // 1st update callback might cancel the subscription
 }
 
 inline void oldSubscription::destroy ()