More deref-reduction:

VRY only needs req, not sess.
Overlooked some lingering sp->wrk's in HSH_Lookup()

bin/varnishd/cache/cache.h

@@ -954,8 +954,8 @@ void RES_BuildHttp(const struct sess *sp);
 void RES_WriteObj(struct sess *sp);
 
 /* cache_vary.c */
-struct vsb *VRY_Create(const struct sess *sp, const struct http *hp);
-int VRY_Match(const struct sess *sp, const uint8_t *vary);
+struct vsb *VRY_Create(struct req *sp, const struct http *hp);
+int VRY_Match(struct req *, const uint8_t *vary);
 void VRY_Validate(const uint8_t *vary);
 
 /* cache_vcl.c */

bin/varnishd/cache/cache_center.c

@@ -784,7 +784,7 @@ cnt_prepfetch(struct sess *sp, struct worker *wrk, struct req *req)
 	/* Create Vary instructions */
 	if (req->objcore != NULL) {
 		CHECK_OBJ_NOTNULL(req->objcore, OBJCORE_MAGIC);
-		vary = VRY_Create(sp, bo->beresp);
+		vary = VRY_Create(req, bo->beresp);
 		if (vary != NULL) {
 			varyl = VSB_len(vary);
 			assert(varyl > 0);

bin/varnishd/cache/cache_hash.c

@@ -302,9 +302,9 @@ HSH_Lookup(struct sess *sp)
 	AN(hash);
 
 	hsh_prealloc(wrk);
-	memcpy(sp->wrk->nobjhead->digest, req->digest, sizeof req->digest);
+	memcpy(wrk->nobjhead->digest, req->digest, sizeof req->digest);
 	if (cache_param->diag_bitmap & 0x80000000)
-		hsh_testmagic(sp->wrk->nobjhead->digest);
+		hsh_testmagic(wrk->nobjhead->digest);
 
 	if (req->hash_objhead != NULL) {
 		/*
@@ -339,21 +339,21 @@ HSH_Lookup(struct sess *sp)
 				continue;
 
 			if (oc->busyobj->vary != NULL &&
-			    !VRY_Match(sp, oc->busyobj->vary))
+			    !VRY_Match(req, oc->busyobj->vary))
 				continue;
 
 			busy_oc = oc;
 			continue;
 		}
 
-		o = oc_getobj(&sp->wrk->stats, oc);
+		o = oc_getobj(&wrk->stats, oc);
 		CHECK_OBJ_NOTNULL(o, OBJECT_MAGIC);
 
 		if (o->exp.ttl <= 0.)
 			continue;
 		if (BAN_CheckObject(o, sp))
 			continue;
-		if (o->vary != NULL && !VRY_Match(sp, o->vary))
+		if (o->vary != NULL && !VRY_Match(req, o->vary))
 			continue;
 
 		/* If still valid, use it */
@@ -390,14 +390,14 @@ HSH_Lookup(struct sess *sp)
 	    && (busy_oc != NULL		/* Somebody else is already busy */
 	    || !VDI_Healthy(req->director, sp))) {
 					/* Or it is impossible to fetch */
-		o = oc_getobj(&sp->wrk->stats, grace_oc);
+		o = oc_getobj(&wrk->stats, grace_oc);
 		CHECK_OBJ_NOTNULL(o, OBJECT_MAGIC);
 		oc = grace_oc;
 	}
 	req->objcore = NULL;
 
 	if (oc != NULL && !req->hash_always_miss) {
-		o = oc_getobj(&sp->wrk->stats, oc);
+		o = oc_getobj(&wrk->stats, oc);
 		CHECK_OBJ_NOTNULL(o, OBJECT_MAGIC);
 		assert(oc->objhead == oh);
 
@@ -414,11 +414,11 @@ HSH_Lookup(struct sess *sp)
 	if (busy_oc != NULL) {
 		/* There are one or more busy objects, wait for them */
 		if (req->esi_level == 0) {
-			CHECK_OBJ_NOTNULL(sp->wrk->nwaitinglist,
+			CHECK_OBJ_NOTNULL(wrk->nwaitinglist,
 			    WAITINGLIST_MAGIC);
 			if (oh->waitinglist == NULL) {
-				oh->waitinglist = sp->wrk->nwaitinglist;
-				sp->wrk->nwaitinglist = NULL;
+				oh->waitinglist = wrk->nwaitinglist;
+				wrk->nwaitinglist = NULL;
 			}
 			VTAILQ_INSERT_TAIL(&oh->waitinglist->list, sp, list);
 		}

bin/varnishd/cache/cache_vary.c

@@ -60,7 +60,7 @@
 #include "vend.h"
 
 struct vsb *
-VRY_Create(const struct sess *sp, const struct http *hp)
+VRY_Create(struct req *req, const struct http *hp)
 {
 	char *v, *p, *q, *h, *e;
 	struct vsb *sb, *sbh;
@@ -79,7 +79,7 @@ VRY_Create(const struct sess *sp, const struct http *hp)
 	AN(sbh);
 
 	if (*v == ':') {
-		VSLb(sp->req->vsl, SLT_Error,
+		VSLb(req->vsl, SLT_Error,
 		    "Vary header had extra ':', fix backend");
 		v++;
 	}
@@ -97,7 +97,7 @@ VRY_Create(const struct sess *sp, const struct http *hp)
 		    (char)(1 + (q - p)), (int)(q - p), p, 0);
 		AZ(VSB_finish(sbh));
 
-		if (http_GetHdr(sp->req->http, VSB_data(sbh), &h)) {
+		if (http_GetHdr(req->http, VSB_data(sbh), &h)) {
 			AZ(vct_issp(*h));
 			/* Trim trailing space */
 			e = strchr(h, '\0');
@@ -175,9 +175,9 @@ vry_cmp(const uint8_t *v1, const uint8_t *v2)
 }
 
 int
-VRY_Match(const struct sess *sp, const uint8_t *vary)
+VRY_Match(struct req *req, const uint8_t *vary)
 {
-	uint8_t *vsp = sp->req->vary_b;
+	uint8_t *vsp = req->vary_b;
 	char *h, *e;
 	unsigned lh, ln;
 	int i, retval = 1, oflo = 0;
@@ -188,7 +188,7 @@ VRY_Match(const struct sess *sp, const uint8_t *vary)
 		if (i == 1) {
 			/* Build a new entry */
 
-			i = http_GetHdr(sp->req->http,
+			i = http_GetHdr(req->http,
 			    (const char*)(vary+2), &h);
 			if (i) {
 				/* Trim trailing space */
@@ -204,8 +204,8 @@ VRY_Match(const struct sess *sp, const uint8_t *vary)
 
 			/* Length of the entire new vary entry */
 			ln = 2 + vary[2] + 2 + (lh == 0xffff ? 0 : lh);
-			if (vsp + ln >= sp->req->vary_e) {
-				vsp = sp->req->vary_b;
+			if (vsp + ln >= req->vary_e) {
+				vsp = req->vary_b;
 				oflo = 1;
 			}
 
@@ -213,7 +213,7 @@ VRY_Match(const struct sess *sp, const uint8_t *vary)
 			 * We MUST have space for one entry and the end marker
 			 * after it, which prevents old junk from confusing us
 			 */
-			assert(vsp + ln + 2 < sp->req->vary_e);
+			assert(vsp + ln + 2 < req->vary_e);
 
 			vbe16enc(vsp, (uint16_t)lh);
 			memcpy(vsp + 2, vary + 2, vary[2] + 2);
@@ -231,20 +231,20 @@ VRY_Match(const struct sess *sp, const uint8_t *vary)
 		vsp += vry_len(vsp);
 		vary += vry_len(vary);
 	}
-	if (vsp + 3 > sp->req->vary_e)
+	if (vsp + 3 > req->vary_e)
 		oflo = 1;
 
 	if (oflo) {
 		/* XXX: Should log this */
-		vsp = sp->req->vary_b;
+		vsp = req->vary_b;
 	}
 	vsp[0] = 0xff;
 	vsp[1] = 0xff;
 	vsp[2] = 0;
 	if (oflo)
-		sp->req->vary_l = NULL;
+		req->vary_l = NULL;
 	else
-		sp->req->vary_l = vsp + 3;
+		req->vary_l = vsp + 3;
 	return (retval);
 }