hash: Dropping an objcore does not rush the waiting list

Rushing the waiting list because an objcore was dropped is a source
of spurious wakeups and in the case where the dropped objcore was not
attached to a busyobj, a guarantee to wake up rush_exponent tasks from
the head of the waiting list to have them back soon after at the tail.

Assertions are now ensuring that only "un-busied" objcores are dropped
or rushed.

With the removal of spurious wake ups also goes the removal of useful
opportunistic rushes. For cacheable objects this is solved by waking
up all requests.

bin/varnishd/cache/cache_hash.c

@@ -677,7 +677,8 @@ hsh_rush1(const struct worker *wrk, struct objcore *oc, struct rush *r)
 	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
 	Lck_AssertHeld(&oh->mtx);
 
-	max = cache_param->rush_exponent;
+	AZ(oc->flags & OC_F_BUSY);
+	max = oc->flags ? cache_param->rush_exponent : INT_MAX;
 	assert(max > 0);
 
 	for (i = 0; i < max; i++) {
@@ -1143,12 +1144,11 @@ HSH_DerefObjCore(struct worker *wrk, struct objcore **ocp)
 	r = --oc->refcnt;
 	if (!r)
 		VTAILQ_REMOVE(&oh->objcs, oc, hsh_list);
-	hsh_rush1(wrk, oc, &rush);
 	Lck_Unlock(&oh->mtx);
-	hsh_rush2(wrk, &rush);
 	if (r != 0)
 		return (r);
 
+	AZ(oc->flags & OC_F_BUSY);
 	AZ(oc->exp_flags);
 
 	BAN_DestroyObj(oc);
@@ -1174,6 +1174,7 @@ hsh_deref_objhead_unlock(struct worker *wrk, struct objhead **poh,
 
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	TAKE_OBJ_NOTNULL(oh, poh, OBJHEAD_MAGIC);
+	CHECK_OBJ_ORNULL(oc, OBJCORE_MAGIC);
 
 	Lck_AssertHeld(&oh->mtx);