But we can do without the struct pool_task in struct sess, because

we can reserve the space on the workspace when needed.

bin/varnishd/cache/cache.h

@@ -657,7 +657,6 @@ struct sess {
 
 	struct sesspool		*sesspool;
 
-	struct pool_task	task;
 	struct waited		waited;
 
 	/* Session related fields ------------------------------------*/

bin/varnishd/cache/cache_acceptor.c

@@ -360,6 +360,8 @@ vca_make_session(struct worker *wrk, void *arg)
 	    sp->client_addr_str, sp->client_port_str, lsockname, laddr, lport,
 	    sp->t_open, sp->fd);
 
+	/* SES_sess_pool_task() must be sceduled with reserved WS */
+	assert(8 == WS_Reserve(sp->ws, 8));
 	wrk->task.func = SES_sess_pool_task;
 	wrk->task.priv = sp;
 }

bin/varnishd/cache/cache_session.c

@@ -132,6 +132,7 @@ SES_sess_pool_task(struct worker *wrk, void *arg)
 
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	CAST_OBJ_NOTNULL(sp, arg, SESS_MAGIC);
+	WS_Release(sp->ws, 0);
 
 	req = SES_GetReq(wrk, sp);
 	CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
@@ -176,10 +177,13 @@ ses_handle(struct waited *wp, enum wait_event ev, double now)
 {
 	struct sess *sp;
 	struct sesspool *pp;
+	struct pool_task *tp;
 
 	CHECK_OBJ_NOTNULL(wp, WAITED_MAGIC);
 	CAST_OBJ_NOTNULL(sp, wp->ptr, SESS_MAGIC);
 
+	AZ(sp->ws->r);
+
 	switch (ev) {
 	case WAITER_TIMEOUT:
 		SES_Delete(sp, SC_RX_TIMEOUT, now);
@@ -191,9 +195,11 @@ ses_handle(struct waited *wp, enum wait_event ev, double now)
 		pp = sp->sesspool;
 		CHECK_OBJ_NOTNULL(pp, SESSPOOL_MAGIC);
 		AN(pp->pool);
-		sp->task.func = SES_sess_pool_task;
-		sp->task.priv = sp;
-		if (Pool_Task(pp->pool, &sp->task, POOL_QUEUE_FRONT))
+		assert(sizeof *tp == WS_Reserve(sp->ws, sizeof *tp));
+		tp = (void*)sp->ws->f;
+		tp->func = SES_sess_pool_task;
+		tp->priv = sp;
+		if (Pool_Task(pp->pool, tp, POOL_QUEUE_FRONT))
 			SES_Delete(sp, SC_OVERLOAD, now);
 		break;
 	case WAITER_CLOSE: