[PATCH] Deref the old object after finishing with it in cnt_miss()

[Martin Blix Grydeland]

Fixes: #1499
---
 bin/varnishd/cache/cache_req_fsm.c |  2 ++
 bin/varnishtest/tests/r01499.vtc   | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 bin/varnishtest/tests/r01499.vtc

diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
index d465ba4..40c0912 100644
--- a/bin/varnishd/cache/cache_req_fsm.c
+++ b/bin/varnishd/cache/cache_req_fsm.c
@@ -498,6 +498,8 @@ cnt_miss(struct worker *wrk, struct req *req)
 		wrk->stats.cache_miss++;
 		VBF_Fetch(wrk, req, req->objcore, o, VBF_NORMAL);
 		req->req_step = R_STP_FETCH;
+		if (o != NULL)
+			(void)HSH_DerefObj(&wrk->stats, &o);
 		return (REQ_FSM_MORE);
 	case VCL_RET_SYNTH:
 		req->req_step = R_STP_SYNTH;
diff --git a/bin/varnishtest/tests/r01499.vtc b/bin/varnishtest/tests/r01499.vtc
new file mode 100644
index 0000000..7b438b2
--- /dev/null
+++ b/bin/varnishtest/tests/r01499.vtc
@@ -0,0 +1,32 @@
+varnishtest "#1499 - objcore ref leak on IMS update"
+
+server s1 {
+	rxreq
+	txresp -hdr "Etag: foo"
+	rxreq
+	expect req.http.if-none-match == "foo"
+	txresp -hdr "X-Resp: 2"
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_backend_response {
+		set beresp.ttl = 0.0001s;
+		set beresp.grace = 0s;
+		set beresp.keep = 2s;
+	}
+} -start
+
+client c1 {
+	txreq
+	rxresp
+
+	delay 0.5
+
+	txreq
+	rxresp
+	expect resp.http.x-resp == "2"
+} -run
+
+delay 3
+
+varnish v1 -expect n_object == 0
-- 
2.0.0.rc0