Be even more paranoid about oc->objhead pointers.

git-svn-id: http://www.varnish-cache.org/svn/trunk/varnish-cache@4492 d4fa192b-c00b-0410-8231-f00ffab90ce4

bin/varnishd/cache_expire.c

@@ -306,6 +306,8 @@ exp_timer(struct sess *sp, void *priv)
 			sp->objhead = oc->objhead;
 			sp->objcore = oc;
 			HSH_DerefObjCore(sp);
+			AZ(sp->objcore);
+			AZ(sp->objhead);
 			sp->wrk->stats.n_vampireobject--;
 		}
 	}

bin/varnishd/cache_hash.c

@@ -547,14 +547,15 @@ HSH_DerefObjCore(struct sess *sp)
 	sp->objcore = NULL;
 
 	Lck_Lock(&oh->mtx);
+	assert(oc->objhead == oh);
 	VTAILQ_REMOVE(&oh->objcs, oc, list);
 	Lck_Unlock(&oh->mtx);
+	oc->objhead = NULL;
 	assert(oh->refcnt > 0);
 	FREE_OBJ(oc);
 	sp->wrk->stats.n_objectcore--;
-	if (hash->deref(oh))
-		return;
-	HSH_DeleteObjHead(sp->wrk, oh);
+	if (!hash->deref(oh))
+		HSH_DeleteObjHead(sp->wrk, oh);
 }
 
 /*******************************************************************

bin/varnishd/storage_persistent.c

@@ -674,7 +674,6 @@ SMP_Fixup(struct sess *sp, struct objhead *oh, struct objcore *oc)
 	/* refcnt is one because the object is in the hash */
 	oc->obj->refcnt = 1;
 	oc->obj->objcore = oc;
-	oc->objhead = oh;
 	oc->obj->ban = oc->ban;
 
 	sg->nfixed++;