Leave bo->fetch_objcore intact, even as the refcount moves to the object.

bin/varnishd/cache/cache_busyobj.c

@@ -159,7 +159,7 @@ void
 VBO_DerefBusyObj(struct worker *wrk, struct busyobj **pbo)
 {
 	struct busyobj *bo;
-	struct objcore *oc;
+	struct objcore *oc = NULL;
 	unsigned r;
 
 	CHECK_OBJ_ORNULL(wrk, WORKER_MAGIC);
@@ -167,9 +167,10 @@ VBO_DerefBusyObj(struct worker *wrk, struct busyobj **pbo)
 	bo = *pbo;
 	*pbo = NULL;
 	CHECK_OBJ_NOTNULL(bo, BUSYOBJ_MAGIC);
+	CHECK_OBJ_ORNULL(bo->fetch_objcore, OBJCORE_MAGIC);
 	CHECK_OBJ_ORNULL(bo->fetch_obj, OBJECT_MAGIC);
-	if (bo->fetch_obj != NULL) {
-		oc = bo->fetch_obj->objcore;
+	if (bo->fetch_objcore != NULL) {
+		oc = bo->fetch_objcore;
 		CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
 		CHECK_OBJ_NOTNULL(oc->objhead, OBJHEAD_MAGIC);
 		Lck_Lock(&oc->objhead->mtx);
@@ -177,7 +178,6 @@ VBO_DerefBusyObj(struct worker *wrk, struct busyobj **pbo)
 		r = --bo->refcount;
 		Lck_Unlock(&oc->objhead->mtx);
 	} else {
-		oc = NULL;
 		Lck_Lock(&bo->mtx);
 		assert(bo->refcount > 0);
 		r = --bo->refcount;
@@ -190,9 +190,9 @@ VBO_DerefBusyObj(struct worker *wrk, struct busyobj **pbo)
 	VSLb(bo->vsl, SLT_End, "%s", "");
 	VSL_Flush(bo->vsl, 0);
 
-	if (oc != NULL) {
+	if (bo->fetch_objcore != NULL) {
 		AN(wrk);
-		(void)HSH_Deref(&wrk->stats, NULL, &bo->fetch_obj);
+		(void)HSH_Deref(&wrk->stats, bo->fetch_objcore, NULL);
 	}
 
 	VCL_Rel(&bo->vcl);

bin/varnishd/cache/cache_fetch.c

@@ -345,6 +345,7 @@ vbf_stp_fetch(struct worker *wrk, struct busyobj *bo)
 
 	AZ(bo->stats);
 	bo->stats = &wrk->stats;
+	AN(bo->fetch_objcore);
 	obj = STV_NewObject(bo, bo->storage_hint, l, nhttp);
 	if (obj == NULL) {
 		/*

bin/varnishd/cache/cache_req_fsm.c

@@ -162,6 +162,7 @@ cnt_deliver(struct worker *wrk, struct req *req)
 	CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
 	CHECK_OBJ_NOTNULL(req->obj, OBJECT_MAGIC);
 	CHECK_OBJ_NOTNULL(req->obj->objcore, OBJCORE_MAGIC);
+	CHECK_OBJ_NOTNULL(req->obj->objcore->objhead, OBJHEAD_MAGIC);
 	CHECK_OBJ_NOTNULL(req->vcl, VCL_CONF_MAGIC);
 
 	assert(req->obj->objcore->refcnt > 0);
@@ -288,9 +289,10 @@ cnt_error(struct worker *wrk, struct req *req)
 	AZ(bo->stats);
 	bo->stats = &wrk->stats;
 	bo->fetch_objcore = HSH_Private(wrk);
-	req->obj = STV_NewObject(bo,
+	bo->fetch_obj = STV_NewObject(bo,
 	    TRANSIENT_STORAGE, cache_param->http_resp_size,
 	    (uint16_t)cache_param->http_max_hdr);
+	req->obj = bo->fetch_obj;
 	bo->stats = NULL;
 	if (req->obj == NULL) {
 		req->doclose = SC_OVERLOAD;
@@ -305,7 +307,6 @@ cnt_error(struct worker *wrk, struct req *req)
 	}
 	CHECK_OBJ_NOTNULL(req->obj, OBJECT_MAGIC);
 	AZ(req->objcore);
-	AZ(bo->fetch_objcore);
 	req->obj->vxid = bo->vsl->wid;
 	req->obj->exp.entered = req->t_req;
 
@@ -320,6 +321,9 @@ cnt_error(struct worker *wrk, struct req *req)
 	http_PrintfHeader(h, "Date: %s", date);
 	http_SetHeader(h, "Server: Varnish");
 
+	CHECK_OBJ_NOTNULL(req->obj, OBJECT_MAGIC);
+	HSH_Ref(req->obj->objcore);
+
 	if (req->err_reason != NULL)
 		http_PutResponse(h, req->err_reason);
 	else
@@ -331,11 +335,12 @@ cnt_error(struct worker *wrk, struct req *req)
 		wrk->handling = VCL_RET_DELIVER;
 
 	if (wrk->handling == VCL_RET_RESTART) {
-		HSH_Drop(wrk, &req->obj);
 		VBO_DerefBusyObj(wrk, &req->busyobj);
+		HSH_Drop(wrk, &req->obj);
 		req->req_step = R_STP_RESTART;
 		return (REQ_FSM_MORE);
 	}
+	CHECK_OBJ_NOTNULL(req->obj, OBJECT_MAGIC);
 
 	/* We always close when we take this path */
 	req->doclose = SC_TX_ERROR;
@@ -345,8 +350,10 @@ cnt_error(struct worker *wrk, struct req *req)
 	req->err_code = 0;
 	req->err_reason = NULL;
 	http_Teardown(bo->bereq);
+	CHECK_OBJ_NOTNULL(req->obj, OBJECT_MAGIC);
 	VBO_DerefBusyObj(wrk, &req->busyobj);
 	req->req_step = R_STP_DELIVER;
+	CHECK_OBJ_NOTNULL(req->obj, OBJECT_MAGIC);
 	return (REQ_FSM_MORE);
 }
 

bin/varnishd/storage/stevedore.c

@@ -288,7 +288,6 @@ STV_MkObject(struct stevedore *stv, struct busyobj *bo,
 	bo->stats->n_object++;
 
 	o->objcore = bo->fetch_objcore;
-	bo->fetch_objcore = NULL;     /* refcnt follows pointer. */
 	if (!(o->objcore->flags & OC_F_PRIVATE))
 		BAN_NewObjCore(o->objcore);