tm: don't free tm cell still linked in wait timer

- wait timer should do the free
- friendlier handling of situation when modules binding to tm do
  inconsistent unref operations

modules/tm/h_table.c

@@ -40,6 +40,7 @@
 #include "t_reply.h"
 #include "t_cancel.h"
 #include "t_stats.h"
+#include "t_funcs.h"
 #include "h_table.h"
 #include "../../fix_lumps.h" /* free_via_clen_lump */
 #include "timer.h"
@@ -129,6 +130,11 @@ void free_cell_helper(tm_cell_t* dead_cell, int silent, const char *fname, unsig
 		if(likely(silent==0)) {
 			LM_WARN("removed cell %p is still linked in hash table (%s:%u)\n",
 				dead_cell, fname, fline);
+			if(t_on_wait(dead_cell)) {
+				LM_WARN("cell %p is still linked in wait timer (%s:%u)"
+						" - skip freeing now\n", dead_cell, fname, fline);
+				return;
+			}
 		}
 		unlink_timers(dead_cell);
 		remove_from_hash_table_unsafe(dead_cell);

modules/tm/t_funcs.c

@@ -150,6 +150,12 @@ void put_on_wait(  struct cell  *Trans  )
 }
 
 
+int t_on_wait(tm_cell_t *Trans)
+{
+	if(Trans->wait_timer.prev!=NULL || Trans->wait_timer.next!=NULL)
+		return 1;
+	return 0;
+}
 
 /* WARNING: doesn't work from failure route (deadlock, uses t_reply =>
  *  tries to get the reply lock again) */

modules/tm/t_funcs.h

@@ -190,6 +190,7 @@ int get_ip_and_port_from_uri( str* uri , unsigned int *param_ip,
 
 
 void put_on_wait(  struct cell  *Trans  );
+int t_on_wait(tm_cell_t *Trans);
 
 
 int t_relay_to( struct sip_msg  *p_msg ,