? src/gmon.out
? src/squid.22337.kandy.txt
? src/squid.22337.kandy.xml
? src/squid.22401.kandy.txt
? src/squid.22401.kandy.xml
? src/squid.28865.kandy.xml
? src/squid.28892.kandy.txt
? src/squid.28892.kandy.xml
? src/trace.1.txt
? src/trace.2.txt
Index: src/client_side.cc
===================================================================
RCS file: /server/cvs-server/squid/squid3/src/client_side.cc,v
retrieving revision 1.733
diff -u -r1.733 client_side.cc
--- src/client_side.cc	2 Sep 2006 09:31:29 -0000	1.733
+++ src/client_side.cc	15 Sep 2006 06:53:36 -0000
@@ -2705,7 +2705,7 @@
     ConnStateData *conn = data;
     debug(33, 3) ("requestTimeout: FD %d: lifetime is expired.\n", fd);
 
-    if (fd_table[fd].wstate) {
+    if (fd_table[fd].wstate.active) {
         /* FIXME: If this code is reinstated, check the conn counters,
          * not the fd table state
          */
Index: src/comm.cc
===================================================================
RCS file: /server/cvs-server/squid/squid3/src/comm.cc,v
retrieving revision 1.423
diff -u -r1.423 comm.cc
--- src/comm.cc	3 Sep 2006 21:05:20 -0000	1.423
+++ src/comm.cc	15 Sep 2006 06:53:38 -0000
@@ -911,29 +911,27 @@
 static void
 CommWriteStateCallbackAndFree(int fd, comm_err_t code)
 {
-    CommWriteStateData *CommWriteState = fd_table[fd].wstate;
     CWCB *callback = NULL;
     void *cbdata;
-    fd_table[fd].wstate = NULL;
 
-    if (CommWriteState == NULL)
+
+    if (fd_table[fd].wstate.active == 0)
         return;
 
-    if (CommWriteState->free_func) {
-        FREE *free_func = CommWriteState->free_func;
-        void *free_buf = CommWriteState->buf;
-        CommWriteState->free_func = NULL;
-        CommWriteState->buf = NULL;
+    if (fd_table[fd].wstate.free_func) {
+        FREE *free_func = fd_table[fd].wstate.free_func;
+        void *free_buf = fd_table[fd].wstate.buf;
+        fd_table[fd].wstate.free_func = NULL;
+        fd_table[fd].wstate.buf = NULL;
         free_func(free_buf);
     }
 
-    callback = CommWriteState->handler;
-    CommWriteState->handler = NULL;
-
-    if (callback && cbdataReferenceValidDone(CommWriteState->handler_data, &cbdata))
-        callback(fd, CommWriteState->buf, CommWriteState->offset, code, cbdata);
-
-    comm_write_pool->free(CommWriteState);
+    callback = fd_table[fd].wstate.handler;
+    fd_table[fd].wstate.handler = NULL;
+    fd_table[fd].wstate.active = 0;
+    if (callback && cbdataReferenceValidDone(fd_table[fd].wstate.handler_data, &cbdata))
+        callback(fd, fd_table[fd].wstate.buf, fd_table[fd].wstate.offset, code, cbdata);
+    /* fd_table[fd].wstate may be set by the callback function */
 }
 
 /* Return the local port associated with fd. */
@@ -2079,30 +2077,30 @@
  * free_func is used to free the passed buffer when the write has completed.
  */
 void
-comm_old_write(int fd, const char *buf, int size, CWCB * handler, void *handler_data, FREE * free_func) {
-    CommWriteStateData *state = fd_table[fd].wstate;
+comm_old_write(int fd, const char *buf, int size, CWCB * handler, void *handler_data, FREE * free_func)
+{
+    CommWriteStateData *state = &fd_table[fd].wstate;
 
     assert(!fd_table[fd].flags.closing);
 
     debug(5, 5) ("comm_write: FD %d: sz %d: hndl %p: data %p.\n",
                  fd, size, handler, handler_data);
 
-    if (NULL != state) {
+    if (state->active) {
         /* This means that the write has been scheduled, but has not
          * triggered yet 
          */
-        fatalf ("comm_write: fd_table[%d].wstate != NULL\n", fd);
-        comm_write_pool->free(state);
-        fd_table[fd].wstate = NULL;
+        fatalf ("comm_write: fd_table[%d].wstate.active != 0\n", fd);
+	bzero(state, sizeof(*state));
     }
 
-    fd_table[fd].wstate = state = (CommWriteStateData *)comm_write_pool->alloc();
     state->buf = (char *) buf;
     state->size = size;
     state->offset = 0;
     state->handler = handler;
     state->handler_data = cbdataReference(handler_data);
     state->free_func = free_func;
+    state->active = 1;
     commSetSelect(fd, COMM_SELECT_WRITE, commHandleWrite, state, 0);
 }
 
Index: src/comm.h
===================================================================
RCS file: /server/cvs-server/squid/squid3/src/comm.h,v
retrieving revision 1.26
diff -u -r1.26 comm.h
--- src/comm.h	12 Aug 2006 01:43:11 -0000	1.26
+++ src/comm.h	15 Sep 2006 06:53:38 -0000
@@ -29,6 +29,7 @@
 
 struct _CommWriteStateData
 {
+    int active;
     char *buf;
     size_t size;
     off_t offset;
Index: src/fde.h
===================================================================
RCS file: /server/cvs-server/squid/squid3/src/fde.h,v
retrieving revision 1.10
diff -u -r1.10 fde.h
--- src/fde.h	6 Dec 2005 23:03:34 -0000	1.10
+++ src/fde.h	15 Sep 2006 06:53:38 -0000
@@ -124,7 +124,7 @@
     void *timeout_data;
     void *lifetime_data;
     close_handler *closeHandler;        /* linked list */
-    CommWriteStateData *wstate;        /* State data for comm_write */
+    CommWriteStateData wstate;        /* State data for comm_write */
     READ_HANDLER *read_method;
     WRITE_HANDLER *write_method;
 #if USE_SSL