[master] f7cc84a7c Fix request body reference count assertion

[Nils Goroll]

commit f7cc84a7ce699e068997d77f35118925fef8481d
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Sat Oct 10 12:58:17 2020 +0200

    Fix request body reference count assertion
    
    Test case by Reza, thank you
    
    Fixes #3433
    Closes #3434

diff --git a/bin/varnishd/cache/cache_req_body.c b/bin/varnishd/cache/cache_req_body.c
index a3a771163..ecb78d769 100644
--- a/bin/varnishd/cache/cache_req_body.c
+++ b/bin/varnishd/cache/cache_req_body.c
@@ -268,8 +268,9 @@ VRB_Free(struct req *req)
 
 	r = HSH_DerefObjCore(req->wrk, &req->body_oc, 0);
 
-	// a busyobj may have gained a reference
-	assert (r == 0 || r == 1);
+
+	// each busyobj may have gained a reference
+	assert (r <= req->restarts + 1);
 }
 
 /*----------------------------------------------------------------------
diff --git a/bin/varnishtest/tests/r03433.vtc b/bin/varnishtest/tests/r03433.vtc
new file mode 100644
index 000000000..0ebbb5d9b
--- /dev/null
+++ b/bin/varnishtest/tests/r03433.vtc
@@ -0,0 +1,41 @@
+varnishtest "req.body and restarts"
+
+server s1 -repeat 4 {
+	rxreq
+	txresp -bodylen 1000
+} -start
+
+varnish v1 -vcl+backend {
+	import std;
+	import vtc;
+
+	sub vcl_recv {
+		std.cache_req_body(1MB);
+		return (hash);
+	}
+
+	sub vcl_backend_response {
+		set beresp.ttl = 0.1s;
+	}
+
+	sub vcl_deliver {
+		if (!req.restarts) {
+			set req.url = "/2";
+			return (restart);
+		}
+	}
+} -start
+
+client c1 {
+	txreq -req PUT -url /1 -bodylen 250000
+	rxresp
+	expect resp.status == 200
+
+	delay 0.2
+
+	txreq -req PUT -url /1 -bodylen 250000
+	rxresp
+	expect resp.status == 200
+} -run
+
+delay 0.2