Index: store_dir_coss.c
===================================================================
RCS file: /server/cvs-server/squid/squid/src/fs/coss/store_dir_coss.c,v
retrieving revision 1.48
diff -u -r1.48 store_dir_coss.c
--- store_dir_coss.c	5 Jul 2006 06:52:12 -0000	1.48
+++ store_dir_coss.c	9 Jul 2006 12:09:29 -0000
@@ -209,6 +209,10 @@
     debug(1, 1) ("storeCossRemove: %x: %d/%d\n", e, (int) e->swap_dirn, (e) e->swap_filen);
 #endif
     CossIndexNode *coss_node = e->repl.data;
+    /* Do what the LRU and HEAP repl policies do.. */
+    if (e->repl.data == NULL) {
+        return;
+    }
     assert(sd->index == e->swap_dirn);
     assert(e->swap_filen >= 0);
     e->repl.data = NULL;
Index: store_io_coss.c
===================================================================
RCS file: /server/cvs-server/squid/squid/src/fs/coss/store_io_coss.c,v
retrieving revision 1.23
diff -u -r1.23 store_io_coss.c
--- store_io_coss.c	5 Jul 2006 06:52:12 -0000	1.23
+++ store_io_coss.c	9 Jul 2006 12:09:30 -0000
@@ -956,6 +956,7 @@
     /* Fill in details */
     op->type = COSS_OP_READ;
     op->sio = sio;
+    cbdataLock(op->sio);
     op->requestlen = cstate->requestlen;
     op->requestoffset = cstate->requestoffset;
     op->reqdiskoffset = cstate->reqdiskoffset;
@@ -970,8 +971,8 @@
 storeCossCompleteReadOp(CossInfo * cs, CossReadOp * op, int error)
 {
     storeIOState *sio = op->sio;
-    STRCB *callback = sio->read.callback;
-    void *callback_data = sio->read.callback_data;
+    STRCB *callback = NULL;
+    void *callback_data = NULL;
     CossState *cstate = sio->fsstate;
     ssize_t rlen = -1;
     char *p;
@@ -979,13 +980,15 @@
 
     debug(79, 3) ("storeCossCompleteReadOp: op %p, op dependencies satisfied, completing\n", op);
 
-    assert(callback);
-    assert(callback_data);
     assert(storeCossGetPendingReloc(cs, sio->swap_filen) == NULL);
     /* and make sure we aren't on a pending op list! */
     assert(op->pr == NULL);
     /* Is the callback still valid? If so; copy the data and callback */
-    if (cbdataValid(callback_data) && cbdataValid(sio)) {
+    if (cbdataValid(sio) && cbdataValid(sio->read.callback_data)) {
+        callback = sio->read.callback;
+        callback_data = sio->read.callback_data;
+        assert(callback);
+        assert(callback_data);
 	sio->read.callback = NULL;
 	sio->read.callback_data = NULL;
 	if (error == 0) {
@@ -1001,6 +1004,8 @@
 	}
 	callback(callback_data, cstate->requestbuf, rlen);
     }
+    cbdataUnlock(sio); /* sio could have been freed here */
+    op->sio = NULL;
     /* Remove from the operation list */
     dlinkDelete(&op->node, &cs->pending_ops);