[http] Use a copy of nsHttpConnectionInfo.

The root cause in this bug is that the connection info used by
'SpdyConnectTransaction' is the same instance as the connection info in
'nsHttpTransaction', so we should clone it and let 'SpdyConnectTransaction' use
the cloned one.

2 files changed, 8 insertions, 7 deletions

diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp
index 717db8a58..30670895a 100644
--- a/netwerk/protocol/http/Http2Session.cpp
+++ b/netwerk/protocol/http/Http2Session.cpp
@@ -3531,17 +3531,18 @@ Http2Session::UnRegisterTunnel(Http2Stream *aTunnel)
 }
 
 void
-Http2Session::CreateTunnel(nsHttpTransaction *trans,
-                           nsHttpConnectionInfo *ci,
-                           nsIInterfaceRequestor *aCallbacks)
+Http2Session::CreateTunnel(nsHttpTransaction* trans,
+                           nsHttpConnectionInfo* ci,
+                           nsIInterfaceRequestor* aCallbacks)
 {
   LOG(("Http2Session::CreateTunnel %p %p make new tunnel\n", this, trans));
   // The connect transaction will hold onto the underlying http
   // transaction so that an auth created by the connect can be mappped
   // to the correct security callbacks
 
+  RefPtr<nsHttpConnectionInfo> clone(ci->Clone());
   RefPtr<SpdyConnectTransaction> connectTrans =
-    new SpdyConnectTransaction(ci, aCallbacks, trans->Caps(), trans, this);
+    new SpdyConnectTransaction(clone, aCallbacks, trans->Caps(), trans, this);
   AddStream(connectTrans, nsISupportsPriority::PRIORITY_NORMAL, false, nullptr);
   Http2Stream *tunnel = mStreamTransactionHash.Get(connectTrans);
   MOZ_ASSERT(tunnel);
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index 76e0a4ad9..e7f3ca0ef 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -2030,9 +2030,9 @@ nsHttpTransaction::DisableSpdy()
 {
     mCaps |= NS_HTTP_DISALLOW_SPDY;
     if (mConnInfo) {
-        // This is our clone of the connection info, not the persistent one that
-        // is owned by the connection manager, so we're safe to change this here
-        mConnInfo->SetNoSpdy(true);
+        RefPtr<nsHttpConnectionInfo> connInfo = mConnInfo->Clone();
+        connInfo->SetNoSpdy(true);
+        mConnInfo.swap(connInfo);
     }
 }