From 63a7c7f90e255567b8c5b74d12701325a969ce8e Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Thu, 19 Nov 2020 18:19:29 +0000
Subject: [PATCH] [http] Use a copy of nsHttpConnectionInfo.

The root cause in this bug is that the connection info used by
'SpdyConnectTransaction' is the same instance as the connection info in
'nsHttpTransaction', so we should clone it and let 'SpdyConnectTransaction' use
the cloned one.
---
 netwerk/protocol/http/Http2Session.cpp      | 9 +++++----
 netwerk/protocol/http/nsHttpTransaction.cpp | 6 +++---
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp
index 717db8a58f..30670895ad 100644
--- a/netwerk/protocol/http/Http2Session.cpp
+++ b/netwerk/protocol/http/Http2Session.cpp
@@ -3531,17 +3531,18 @@ Http2Session::UnRegisterTunnel(Http2Stream *aTunnel)
 }
 
 void
-Http2Session::CreateTunnel(nsHttpTransaction *trans,
-                           nsHttpConnectionInfo *ci,
-                           nsIInterfaceRequestor *aCallbacks)
+Http2Session::CreateTunnel(nsHttpTransaction* trans,
+                           nsHttpConnectionInfo* ci,
+                           nsIInterfaceRequestor* aCallbacks)
 {
   LOG(("Http2Session::CreateTunnel %p %p make new tunnel\n", this, trans));
   // The connect transaction will hold onto the underlying http
   // transaction so that an auth created by the connect can be mappped
   // to the correct security callbacks
 
+  RefPtr<nsHttpConnectionInfo> clone(ci->Clone());
   RefPtr<SpdyConnectTransaction> connectTrans =
-    new SpdyConnectTransaction(ci, aCallbacks, trans->Caps(), trans, this);
+    new SpdyConnectTransaction(clone, aCallbacks, trans->Caps(), trans, this);
   AddStream(connectTrans, nsISupportsPriority::PRIORITY_NORMAL, false, nullptr);
   Http2Stream *tunnel = mStreamTransactionHash.Get(connectTrans);
   MOZ_ASSERT(tunnel);
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index 76e0a4ad9c..e7f3ca0eff 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -2030,9 +2030,9 @@ nsHttpTransaction::DisableSpdy()
 {
     mCaps |= NS_HTTP_DISALLOW_SPDY;
     if (mConnInfo) {
-        // This is our clone of the connection info, not the persistent one that
-        // is owned by the connection manager, so we're safe to change this here
-        mConnInfo->SetNoSpdy(true);
+        RefPtr<nsHttpConnectionInfo> connInfo = mConnInfo->Clone();
+        connInfo->SetNoSpdy(true);
+        mConnInfo.swap(connInfo);
     }
 }