[4.1] ea101c7 Postpone calling VBT_wait until after V1P_Process

[PÃ¥l Hermunn Johansen]

commit ea101c7312d785670093b51aa55241de458366d9
Author: Dag Haavi Finstad <daghf at varnish-software.com>
Date:   Mon Mar 14 14:22:41 2016 +0100

    Postpone calling VBT_wait until after V1P_Process
    
    Fixes a bug where we wait for an event to fire on the backend socket
    prior to passing the request body.
    
    The VBT_Wait call is now handled in vbe_dir_finish.
    
    Test case by thomaslc
    
    Fixes: #1806

diff --git a/bin/varnishd/cache/cache_backend.c b/bin/varnishd/cache/cache_backend.c
index 48e3e97..039d3b2 100644
--- a/bin/varnishd/cache/cache_backend.c
+++ b/bin/varnishd/cache/cache_backend.c
@@ -296,8 +296,6 @@ vbe_dir_http1pipe(const struct director *d, struct req *req, struct busyobj *bo)
 	} else {
 		i = V1F_SendReq(req->wrk, bo, &v1a.bereq, 1);
 		VSLb_ts_req(req, "Pipe", W_TIM_real(req->wrk));
-		if (vbc->state == VBC_STATE_STOLEN)
-			VBT_Wait(req->wrk, vbc);
 		if (i == 0)
 			V1P_Process(req, vbc->fd, &v1a);
 		VSLb_ts_req(req, "PipeSess", W_TIM_real(req->wrk));
diff --git a/bin/varnishtest/tests/r01806.vtc b/bin/varnishtest/tests/r01806.vtc
new file mode 100644
index 0000000..5d2b376
--- /dev/null
+++ b/bin/varnishtest/tests/r01806.vtc
@@ -0,0 +1,33 @@
+varnishtest "#1806: return pipe w/ STOLEN connection"
+
+server s1 {
+	rxreq
+	expect req.url == "/pass-me"
+	txresp -body "I was PASSed\n"
+
+	rxreq
+	expect req.url == "/pipe-me"
+	txresp -body "I was PIPEd\n"
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_recv {
+		if (req.url == "/pipe-me") {
+			return (pipe);
+		}
+
+		return (pass);
+	}
+} -start
+
+varnish v1 -cliok "param.set debug +syncvsl"
+
+client c1 {
+	txreq -url /pass-me
+	rxresp
+	expect resp.status == 200
+
+	txreq -req POST -url /pipe-me -body "asdf"
+	rxresp
+	expect resp.status == 200
+} -run