[master] cda192100 We cannot trust the mailcall to be empty just because we got the mutex, for instance the VFP might have nipped out for more storage.

[Poul-Henning Kamp]

commit cda1921004f10d3a56e6e044426473d99c88fa56
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Fri Feb 22 07:47:49 2019 +0000

    We cannot trust the mailcall to be empty just because we got the
    mutex, for instance the VFP might have nipped out for more storage.
    
    Fixes: #2572

diff --git a/bin/varnishd/http2/cache_http2_proto.c b/bin/varnishd/http2/cache_http2_proto.c
index e824eadb8..b7c319102 100644
--- a/bin/varnishd/http2/cache_http2_proto.c
+++ b/bin/varnishd/http2/cache_http2_proto.c
@@ -755,6 +755,8 @@ h2_rx_data(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 		return (H2SE_STREAM_CLOSED); // rfc7540,l,1766,1769
 	}
 	Lck_Lock(&h2->sess->mtx);
+	while (h2->mailcall != NULL && h2->error == 0 && r2->error == 0)
+		AZ(Lck_CondWait(h2->cond, &h2->sess->mtx, 0));
 	AZ(h2->mailcall);
 	h2->mailcall = r2;
 	h2->req0->r_window -= h2->rxf_len;