[master] eafe825 Fix a race (detected with Fryer and diagnosed by Martin) when we clear req->wrk on a busy-waiting request.

[Poul-Henning Kamp]

commit eafe8253d0d0ff04049b6da71b577a15bee9f893
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Thu Oct 3 10:31:47 2013 +0000

    Fix a race (detected with Fryer and diagnosed by Martin) when we
    clear req->wrk on a busy-waiting request.

diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index 90af1fc..61b6621 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -492,7 +492,6 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp,
 		    req, w_list);
 		if (DO_DEBUG(DBG_WAITINGLIST))
 			VSLb(req->vsl, SLT_Debug, "on waiting list <%p>", oh);
-		req->wrk = NULL;
 	} else {
 		if (DO_DEBUG(DBG_WAITINGLIST))
 			VSLb(req->vsl, SLT_Debug, "hit busy obj <%p>", oh);
@@ -506,6 +505,7 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp,
 	 * calls us again
 	 */
 	req->hash_objhead = oh;
+	req->wrk = NULL;
 	Lck_Unlock(&oh->mtx);
 	return (HSH_BUSY);
 }
diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
index 812759c..9807836 100644
--- a/bin/varnishd/cache/cache_req_fsm.c
+++ b/bin/varnishd/cache/cache_req_fsm.c
@@ -882,10 +882,10 @@ CNT_Request(struct worker *wrk, struct req *req)
 		 */
 		VSLb(req->vsl, SLT_End, "%s", "");
 		req->vsl->wid = 0;
+		req->wrk = NULL;
 	}
 
-	req->wrk = NULL;
-
+	AZ(req->wrk);
 	assert(WRW_IsReleased(wrk));
 	return (nxt);
 }