kill stale oc for backend synth

Fixes #2946 in the sense that we want to treat backend synth like any
other object and kill the stale object it replaces.

The two HSH_Kill calls could also be subsumed in vbf_fetch_thread(),
but after an irc discussion, phk decided that he wanted to aim for even
more consolidation later.

The test checks that we remove the stale_oc, but not when abandoning the
bereq.

bin/varnishd/cache/cache_fetch.c

@@ -776,6 +776,8 @@ vbf_stp_error(struct worker *wrk, struct busyobj *bo)
 	VSB_destroy(&synth_body);
 	HSH_Unbusy(wrk, bo->fetch_objcore);
 	ObjSetState(wrk, bo->fetch_objcore, BOS_FINISHED);
+	if (bo->stale_oc != NULL)
+		HSH_Kill(bo->stale_oc);
 	return (F_STP_DONE);
 }
 

bin/varnishtest/tests/r02946.vtc

+varnishtest "#2946 - objcore leak for backend_synth"
+
+varnish v1 -vcl {
+	backend bad { .host = "${bad_backend}"; }
+
+	sub vcl_backend_error {
+		if (bereq.http.abandon) {
+			return (abandon);
+		}
+		set beresp.status = 200;
+		set beresp.ttl = 0.0001s;
+		set beresp.grace = 1h;
+	}
+} -start
+
+client c1 -repeat 20 -keepalive {
+	txreq
+	rxresp
+	expect resp.status == 200
+
+	delay 0.001
+} -run
+
+delay 2
+
+client c1 {
+	txreq -hdr "abandon: true"
+	rxresp
+	expect resp.status == 200
+	expect resp.http.age > 1
+} -run
+
+varnish v1 -expect n_objectcore == 1