Avoid panic if director is already finalized for invalid range after …

…rollback

Fixes #4164

bin/varnishd/cache/cache_fetch.c

@@ -499,7 +499,8 @@ vbf_stp_startfetch(struct worker *wrk, struct busyobj *bo)
 		bo->htc->doclose = SC_RESP_CLOSE;
 
 	if (VRG_CheckBo(bo) < 0) {
-		VDI_Finish(bo);
+		if (bo->director_state != DIR_S_NULL)
+			VDI_Finish(bo);
 		return (F_STP_ERROR);
 	}
 

bin/varnishtest/tests/r04164.vtc

@@ -0,0 +1,26 @@
+varnishtest "pass, rollback, invalid range"
+
+server s1 {
+	rxreq
+	expect req.url == "/baz"
+	txresp -status 400
+} -start
+
+varnish v1 -vcl+backend {
+	import std;
+
+	sub vcl_recv {
+		return (pass);
+	}
+	sub vcl_backend_response {
+		std.rollback(bereq);
+		return (retry);
+	}
+} -start
+
+client c1 {
+	txreq -url "/baz" -hdr "range: 42"
+	rxresp
+} -run
+
+server s1 -wait