i think the patch may be as below, am i do right ?

in lib/url.c

static bool
ConnectionExists(struct SessionHandle *data,
                 struct connectdata *needle,
                 struct connectdata **usethis)
{
  long i;
  struct connectdata *check;
  bool canPipeline = IsPipeliningPossible(data);

  for(i=0; i< data->state.connc->num; i++) {
    bool match = FALSE;
    size_t pipeLen = 0;
    /*
     * Note that if we use a HTTP proxy, we check connections to that
     * proxy and not to the actual remote server.
     */
    check = data->state.connc->connects[i];
- if(!check)
+ if(!check || check->inuse)
      /* NULL pointer means not filled-in entry */
      continue;

    pipeLen = check->send_pipe->size + check->recv_pipe->size;

2008/6/18 Daniel Stenberg <daniel_at_haxx.se>:

> On Tue, 17 Jun 2008, ??? wrote:
>
> recently, i'm testing curl-7.18.2 + libevent-1.4.4, using multi interface
>> of curl and epoll of libevent
>>
>
> Pipelining enabled I presume? Can you provide a full source code to an app
> that repeats your problems? It would make it so much easier...
>
> 1. easyhandle A reach CURLM_STATE_PERFORM state, and do
>> Curl_removeHandleFromPipeline
>> 2. easyhandle B do Curl_connect(), and in the ConnectionExists() function,
>> it call Curl_disconnect(), and free the pipe which easyhandle A is using.
>>
>
> Why does it call disconnect? It's only supposed to do that if it deems the
> connection "dead". Are you saying it thinks that wrongly?
>
> 3. easyhandle A reach CURLM_STATE_DONE state, do
>> Curl_removeHandleFromPipeline again (A access the pipe, which is free by
>> disconnect()), so it become some times segment fault, some times dead loop
>>
>
> Right, the disconnect seems to be done inproperly. I think perhaps the
> check->inuse boolean should be checked before SocketIsDead() is called on
> it, since if it actually is in use the SocketIsDead() function will cause a
> false positive... Can you figure out any details on why it disconnects and
> what we can fix to make it not do it for this case of yours?
>
> --
>
> / daniel.haxx.se
>

-- 
dengminwen_at_gmail.com