Use HSH_Kill() instead of EXP_Rearm().

bin/varnishd/cache/cache_ban.c

@@ -576,7 +576,8 @@ BAN_CheckObject(struct worker *wrk, struct objcore *oc, struct req *req)
 	} else {
 		VSLb(vsl, SLT_ExpBan, "%u banned lookup", ObjGetXID(wrk, oc));
 		VSC_C_main->bans_obj_killed++;
-		EXP_Rearm(oc, oc->t_origin, 0, 0, 0);	// XXX fake now
+		oc->flags |= OC_F_DYING;
+		EXP_Poke(oc);
 		return (1);
 	}
 }

bin/varnishd/cache/cache_ban_lurker.c

@@ -181,8 +181,7 @@ ban_lurker_test_ban(struct worker *wrk, struct vsl_log *vsl, struct ban *bt,
 			VSLb(vsl, SLT_ExpBan, "%u banned by lurker",
 			    ObjGetXID(wrk, oc));
 
-			EXP_Rearm(oc, oc->t_origin, 0, 0, 0);
-					// XXX ^ fake now
+			HSH_Kill(oc);
 			VSC_C_main->bans_lurker_obj_killed++;
 		} else {
 			if (oc->ban != bd) {

bin/varnishd/cache/cache_expire.c

@@ -121,6 +121,7 @@ exp_mail_it(struct objcore *oc, uint8_t cmds)
 			VSTAILQ_INSERT_TAIL(&exphdl->inbox, oc, exp_list);
 	}
 	oc->exp_flags |= cmds | OC_EF_POSTED;
+	AN(oc->exp_flags & OC_EF_EXP);
 	VSC_C_main->exp_mailed++;
 	AZ(pthread_cond_signal(&exphdl->condvar));
 	Lck_Unlock(&exphdl->mtx);
@@ -311,7 +312,7 @@ exp_expire(struct exp_priv *ep, double now)
 		return (oc->timer_when);
 
 	VSC_C_main->n_expired++;
-	oc->exp_flags &= OC_EF_EXP;
+	oc->exp_flags &= ~OC_EF_EXP;
 
 	if (!(oc->flags & OC_F_DYING))
 		HSH_Kill(oc);

bin/varnishd/cache/cache_fetch.c

@@ -689,7 +689,7 @@ vbf_stp_fetch(struct worker *wrk, struct busyobj *bo)
 	ObjSetState(bo->fetch_objcore, BOS_FINISHED);
 	VSLb_ts_busyobj(bo, "BerespBody", W_TIM_real(wrk));
 	if (bo->stale_oc != NULL)
-		EXP_Rearm(bo->stale_oc, bo->stale_oc->t_origin, 0, 0, 0);
+		HSH_Kill(bo->stale_oc);
 	return (F_STP_DONE);
 }
 
@@ -756,7 +756,7 @@ vbf_stp_condfetch(struct worker *wrk, struct busyobj *bo)
 	if (!bo->do_stream)
 		HSH_Unbusy(wrk, bo->fetch_objcore);
 
-	EXP_Rearm(bo->stale_oc, bo->stale_oc->t_origin, 0, 0, 0);
+	HSH_Kill(bo->stale_oc);
 
 	/* Recycle the backend connection before setting BOS_FINISHED to
 	   give predictable backend reuse behavior for varnishtest */
@@ -882,8 +882,7 @@ vbf_stp_fail(struct worker *wrk, const struct busyobj *bo)
 	if (bo->fetch_objcore->exp_flags & OC_EF_EXP) {
 		/* Already unbusied - expire it */
 		AN(bo->fetch_objcore);
-		EXP_Rearm(bo->fetch_objcore,
-		    bo->fetch_objcore->t_origin, 0, 0, 0);
+		HSH_Kill(bo->fetch_objcore);
 	}
 	wrk->stats->fetch_failed++;
 	ObjSetState(bo->fetch_objcore, BOS_FAILED);

bin/varnishd/cache/cache_hash.c

@@ -654,9 +654,8 @@ HSH_Unbusy(struct worker *wrk, struct objcore *oc)
 
 	if (!(oc->flags & OC_F_PRIVATE)) {
 		BAN_NewObjCore(oc);
-		EXP_Insert(wrk, oc);
-		AN(oc->exp_flags & OC_EF_EXP);
 		AN(oc->ban);
+		EXP_Insert(wrk, oc);
 	}
 
 	/* XXX: pretouch neighbors on oh->objcs to prevent page-on under mtx */
@@ -687,6 +686,7 @@ HSH_Kill(struct objcore *oc)
 	Lck_Lock(&oc->objhead->mtx);
 	oc->flags |= OC_F_DYING;
 	Lck_Unlock(&oc->objhead->mtx);
+	EXP_Poke(oc);
 }
 
 /*====================================================================