Try to close the #1449 race definitively.

bin/varnishd/cache/cache_expire.c

@@ -137,7 +137,7 @@ EXP_Inject(struct objcore *oc, struct lru *lru, double when)
 
 	AZ(oc->flags & (OC_F_OFFLRU | OC_F_INSERT | OC_F_MOVE));
 	AZ(oc->flags & OC_F_DYING);
-	AZ(oc->flags & OC_F_BUSY);
+	// AN(oc->flags & OC_F_BUSY);
 
 	if (lru == NULL)
 		lru = oc_getlru(oc);

bin/varnishd/cache/cache_fetch.c

@@ -565,9 +565,10 @@ vbf_stp_condfetch(struct worker *wrk, struct busyobj *bo)
 	obj->gzip_stop = bo->ims_obj->gzip_stop;
 
 	AZ(WS_Overflowed(bo->ws_o));
-	if (bo->do_stream)
+	if (bo->do_stream) {
+		HSH_Unbusy(&wrk->stats, obj->objcore);
 		VBO_setstate(bo, BOS_STREAM);
-	HSH_Unbusy(&wrk->stats, obj->objcore);
+	}
 
 	st = NULL;
 	al = 0;
@@ -596,6 +597,9 @@ vbf_stp_condfetch(struct worker *wrk, struct busyobj *bo)
 	if (bo->failed)
 		return (F_STP_FAIL);
 
+	if (!bo->do_stream)
+		HSH_Unbusy(&wrk->stats, obj->objcore);
+
 	assert(al == bo->ims_obj->len);
 	assert(obj->len == al);
 	EXP_Rearm(bo->ims_obj, bo->ims_obj->exp.t_origin, 0, 0, 0);
@@ -802,6 +806,7 @@ VBF_Fetch(struct worker *wrk, struct req *req, struct objcore *oc,
 
 	bo = VBO_GetBusyObj(wrk, req);
 	CHECK_OBJ_NOTNULL(bo, BUSYOBJ_MAGIC);
+	THR_SetBusyobj(bo);
 
 	switch(mode) {
 	case VBF_PASS:		how = "pass"; break;
@@ -853,7 +858,12 @@ VBF_Fetch(struct worker *wrk, struct req *req, struct objcore *oc,
 		VBO_waitstate(bo, BOS_REQ_DONE);
 	} else {
 		VBO_waitstate(bo, BOS_STREAM);
-		assert(bo->state != BOS_FAILED || (oc->flags & OC_F_FAILED));
+		if (bo->state == BOS_FAILED) {
+			AN((oc->flags & OC_F_FAILED));
+		} else {
+			AZ(bo->fetch_objcore->flags & OC_F_BUSY);
+		}
 	}
+	THR_SetBusyobj(NULL);
 	VBO_DerefBusyObj(wrk, &bo);
 }

bin/varnishd/cache/cache_hash.c

@@ -672,9 +672,17 @@ HSH_Unbusy(struct dstat *ds, struct objcore *oc)
 	oh = oc->objhead;
 	CHECK_OBJ(oh, OBJHEAD_MAGIC);
 
+	AN(oc->methods);
 	AN(oc->flags & OC_F_BUSY);
 	assert(oh->refcnt > 0);
 
+	if (!(oc->flags & OC_F_PRIVATE)) {
+		BAN_NewObjCore(oc);
+		EXP_Insert(oc);
+		AN(oc->flags & OC_F_EXP);
+		AN(oc->ban);
+	}
+
 	/* XXX: pretouch neighbors on oh->objcs to prevent page-on under mtx */
 	Lck_Lock(&oh->mtx);
 	assert(oh->refcnt > 0);
@@ -685,12 +693,6 @@ HSH_Unbusy(struct dstat *ds, struct objcore *oc)
 	if (oh->waitinglist != NULL)
 		hsh_rush(ds, oh);
 	Lck_Unlock(&oh->mtx);
-	if (!(oc->flags & OC_F_PRIVATE) && oc->methods != NULL) {
-		BAN_NewObjCore(oc);
-		EXP_Insert(oc);
-		AN(oc->flags & OC_F_EXP);
-		AN(oc->ban);
-	}
 }
 
 /*---------------------------------------------------------------------