[master] 1cb0471 Make sure we have copied all we need from the req.* http structure for the bg-fetch, before we release the request to carry on.

[Poul-Henning Kamp]

commit 1cb047172faed3c38bc8d0cd0fad8af249a3302a
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Thu Jan 2 16:02:15 2014 +0000

    Make sure we have copied all we need from the req.* http structure
    for the bg-fetch, before we release the request to carry on.
    
    Fixes	#1399

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index c2bdb32..9e82921 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -50,6 +50,7 @@ vbf_release_req(struct busyobj *bo)
 	assert(bo->state == BOS_INVALID);
 	AN(bo->req);
 	bo->req = NULL;
+	http_CopyHome(bo->bereq);
 	VBO_setstate(bo, BOS_REQ_DONE);
 }
 
diff --git a/bin/varnishtest/tests/r01399.vtc b/bin/varnishtest/tests/r01399.vtc
new file mode 100644
index 0000000..d2ea1d0
--- /dev/null
+++ b/bin/varnishtest/tests/r01399.vtc
@@ -0,0 +1,49 @@
+varnishtest "1399 race issue with bg-fetches"
+
+server s1 {
+	rxreq
+	txresp -bodylen 1
+
+	sema r1 sync 2
+
+	# Delay here, to stall the bgfetch for a while, to give the req time to finish
+	# delivery and cleanup up struct req
+	delay 2
+
+	# Shut the connection to force the bgfetch to retry
+	close
+	accept
+
+	# And see if it has all its marbles still...
+	rxreq
+	expect req.url == "/"
+	txresp -bodylen 2
+
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_backend_response {
+		set beresp.ttl = 2s;
+		set beresp.grace = 1800s;
+	}
+} -start
+
+client c1 {
+	txreq 
+	rxresp
+	expect resp.http.content-length == 1
+
+} -run
+
+# 3 is longer than the ttl, in order to kick off the bgfetch
+delay 3
+
+client c1 {
+	txreq 
+	rxresp
+	expect resp.http.content-length == 1
+	sema r1 sync 2
+} -run
+
+# Wait for the server to not explode
+server s1 -wait