Always release req before calling SES_Delete()

Split SES_Handle() and SES_ScheduleReq().

bin/varnishd/cache/cache.h

@@ -928,7 +928,7 @@ void SES_Delete(struct sess *sp, const char *reason, double now);
 void SES_Charge(struct worker *, struct req *);
 struct sesspool *SES_NewPool(struct pool *pp, unsigned pool_no);
 void SES_DeletePool(struct sesspool *sp);
-int SES_Schedule(struct sess *sp);
+int SES_ScheduleReq(struct req *);
 void SES_Handle(struct sess *sp, double now);
 struct req *SES_GetReq(struct sess *sp);
 void SES_ReleaseReq(struct req *);

bin/varnishd/cache/cache_center.c

@@ -207,6 +207,8 @@ cnt_wait(struct sess *sp, struct worker *wrk, struct req *req)
 		}
 	}
 	SES_Charge(wrk, req);
+	AZ(req->vcl);
+	SES_ReleaseReq(req);
 	SES_Delete(sp, why, now);
 	return (1);
 }
@@ -295,6 +297,8 @@ cnt_sess_done(struct sess *sp, struct worker *wrk, struct req *req)
 
 	if (sp->fd < 0) {
 		wrk->stats.sess_closed++;
+		AZ(req->vcl);
+		SES_ReleaseReq(req);
 		SES_Delete(sp, NULL, NAN);
 		return (SESS_DONE_RET_GONE);
 	}

bin/varnishd/cache/cache_hash.c

@@ -469,7 +469,6 @@ hsh_rush(struct dstat *ds, struct objhead *oh)
 {
 	unsigned u;
 	struct req *req;
-	struct sess *sp;
 	struct waitinglist *wl;
 
 	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
@@ -482,11 +481,9 @@ hsh_rush(struct dstat *ds, struct objhead *oh)
 			break;
 		CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
 		AZ(req->wrk);
-		sp = req->sp;
-		CHECK_OBJ_NOTNULL(sp, SESS_MAGIC);
 		VTAILQ_REMOVE(&wl->list, req, w_list);
-		DSL(0x20, SLT_Debug, sp->vsl_id, "off waiting list");
-		if (SES_Schedule(sp)) {
+		DSL(0x20, SLT_Debug, req->sp->vsl_id, "off waiting list");
+		if (SES_ScheduleReq(req)) {
 			/*
 			 * We could not schedule the session, leave the
 			 * rest on the busy list.

bin/varnishd/cache/cache_session.c

@@ -169,14 +169,17 @@ SES_pool_accept_task(struct worker *wrk, void *arg)
 }
 
 /*--------------------------------------------------------------------
- * Schedule a session back on a work-thread from its pool
+ * Schedule a request back on a work-thread from its sessions pool
  */
 
 int
-SES_Schedule(struct sess *sp)
+SES_ScheduleReq(struct req *req)
 {
+	struct sess *sp;
 	struct sesspool *pp;
 
+	CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
+	sp = req->sp;
 	CHECK_OBJ_NOTNULL(sp, SESS_MAGIC);
 	pp = sp->sesspool;
 	CHECK_OBJ_NOTNULL(pp, SESSPOOL_MAGIC);
@@ -188,13 +191,8 @@ SES_Schedule(struct sess *sp)
 	if (Pool_Task(pp->pool, &sp->task, POOL_QUEUE_FRONT)) {
 		VSC_C_main->client_drop_late++;
 		sp->t_idle = VTIM_real();
-		if (sp->req != NULL && sp->req->vcl != NULL) {
-			/*
-			 * A session parked on a busy object can come here
-			 * after it wakes up.  Loose the VCL reference.
-			 */
-			VCL_Rel(&sp->req->vcl);
-		}
+		AN (req->vcl);
+		VCL_Rel(&req->vcl);
 		SES_Delete(sp, "dropped", sp->t_idle);
 		return (1);
 	}
@@ -208,10 +206,22 @@ SES_Schedule(struct sess *sp)
 void
 SES_Handle(struct sess *sp, double now)
 {
+	struct sesspool *pp;
 
+	CHECK_OBJ_NOTNULL(sp, SESS_MAGIC);
+	pp = sp->sesspool;
+	CHECK_OBJ_NOTNULL(pp, SESSPOOL_MAGIC);
+	AN(pp->pool);
+	AZ(sp->req);
+	sp->task.func = ses_pool_task;
+	sp->task.priv = sp;
 	sp->sess_step = S_STP_NEWREQ;
 	sp->t_rx = now;
-	(void)SES_Schedule(sp);
+	if (Pool_Task(pp->pool, &sp->task, POOL_QUEUE_FRONT)) {
+		VSC_C_main->client_drop_late++;
+		sp->t_idle = VTIM_real();
+		SES_Delete(sp, "dropped", sp->t_idle);
+	}
 }
 
 /*--------------------------------------------------------------------
@@ -248,6 +258,7 @@ SES_Delete(struct sess *sp, const char *reason, double now)
 	struct sesspool *pp;
 
 	CHECK_OBJ_NOTNULL(sp, SESS_MAGIC);
+	AZ(sp->req);
 	pp = sp->sesspool;
 	CHECK_OBJ_NOTNULL(pp, SESSPOOL_MAGIC);
 	AN(pp->pool);
@@ -259,11 +270,6 @@ SES_Delete(struct sess *sp, const char *reason, double now)
 	assert(!isnan(sp->t_open));
 	assert(sp->fd < 0);
 
-	if (sp->req != NULL) {
-		AZ(sp->req->vcl);
-		SES_ReleaseReq(sp->req);
-	}
-
 	if (*sp->addr == '\0')
 		strcpy(sp->addr, "-");
 	if (*sp->port == '\0')