Bogdan Nicula's second test case (posted Sun, 08 Oct 2006) converted to test

case 535 and it now runs fine. Again a problem with the pipelining code not
taking all possible (error) conditions into account.

3 files changed, 19 insertions, 7 deletions

diff --git a/lib/multi.c b/lib/multi.c
index ad6bebca0..48863c8e6 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -1081,9 +1081,14 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
       break;
 
     case CURLM_STATE_WAITPERFORM:
-      infof(easy->easy_handle, "Connection #%d: recv pipe size = %d\n",
+#ifdef CURLDEBUG
+      infof(easy->easy_handle, "Conn %d recv pipe %d inuse %d athead %d\n",
             easy->easy_conn->connectindex,
-            easy->easy_conn->recv_pipe->size);
+            easy->easy_conn->recv_pipe->size,
+            easy->easy_conn->readchannel_inuse,
+            Curl_isHandleAtHead(easy->easy_handle,
+                                easy->easy_conn->recv_pipe));
+#endif
       /* Wait for our turn to PERFORM */
       if (!easy->easy_conn->readchannel_inuse &&
           Curl_isHandleAtHead(easy->easy_handle,
diff --git a/lib/url.c b/lib/url.c
index 7bcb9822c..3e2e37179 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -1840,7 +1840,7 @@ void Curl_addHandleToPipeline(struct SessionHandle *data,
 }
 
 
-void Curl_removeHandleFromPipeline(struct SessionHandle *handle,
+int Curl_removeHandleFromPipeline(struct SessionHandle *handle,
                                    struct curl_llist *pipe)
 {
   struct curl_llist_element *curr;
@@ -1849,10 +1849,11 @@ void Curl_removeHandleFromPipeline(struct SessionHandle *handle,
   while (curr) {
     if (curr->ptr == handle) {
       Curl_llist_remove(pipe, curr, NULL);
-      break;
+      return 1; /* we removed a handle */
     }
     curr = curr->next;
   }
+  return 0;
 }
 
 #if 0
@@ -3975,8 +3976,14 @@ CURLcode Curl_done(struct connectdata **connp,
 
   conn->bits.done = TRUE; /* called just now! */
 
-  /* cleanups done even if the connection is re-used */
+  if(Curl_removeHandleFromPipeline(data, conn->recv_pipe) &&
+     conn->readchannel_inuse)
+    conn->readchannel_inuse--;
+  if(Curl_removeHandleFromPipeline(data, conn->send_pipe) &&
+     conn->writechannel_inuse)
+    conn->writechannel_inuse--;
 
+  /* cleanups done even if the connection is re-used */
   if(data->reqdata.rangestringalloc) {
     free(data->reqdata.range);
     data->reqdata.rangestringalloc = FALSE;
diff --git a/lib/url.h b/lib/url.h
index e1754c333..83706fd73 100644
--- a/lib/url.h
+++ b/lib/url.h
@@ -64,8 +64,8 @@ int Curl_doing_getsock(struct connectdata *conn,
 
 void Curl_addHandleToPipeline(struct SessionHandle *handle,
                               struct curl_llist *pipe);
-void Curl_removeHandleFromPipeline(struct SessionHandle *handle,
-                                   struct curl_llist *pipe);
+int Curl_removeHandleFromPipeline(struct SessionHandle *handle,
+                                  struct curl_llist *pipe);
 bool Curl_isHandleAtHead(struct SessionHandle *handle,
                          struct curl_llist *pipe);