osd: call deref_object_state on recheck_state mismatch in remove_object_from_state

When recheck_state != *object_state, the old object_state reference should be
released via deref_object_state() instead of raw ref_count--. Otherwise, if the
old state has no remaining objects (object_count == 0) and this was its last
reference, it would never be erased from pg.state_dict, leaking memory and state
dictionary entries.

src/osd/osd_primary.cpp

@@ -776,7 +776,7 @@ bool osd_t::remove_object_from_state(object_id & oid, pg_osd_set_state_t **objec
     {
         if (recheck_state)
             recheck_state->ref_count++;
-        (*object_state)->ref_count--;
+        deref_object_state(pg, object_state, true);
         *object_state = recheck_state;
         return false;
     }

src/osd/osd_primary_subops.cpp

@@ -875,8 +875,8 @@ void osd_t::submit_primary_rollback_subops(osd_op_t *cur_op, const osd_num_t* os
 
 void osd_t::pg_cancel_write_queue(pg_t & pg, osd_op_t *first_op, object_id oid, int retval)
 {
-    auto st_it = pg.write_queue.lower_bound(oid), it = st_it;
-    if (it == pg.write_queue.end() || it->first != oid || it->second != first_op)
+    auto st_it = pg.write_queue.find(oid), it = st_it;
+    if (it == pg.write_queue.end() || it->second != first_op)
     {
         // Write queue doesn't match the first operation.
         // first_op is a leftover operation from the previous peering of the same PG.