BUG/MEDIUM: h2: Don't destroy the h2s if it still has a cs attached.
In h2_deferred_shut, if we're done sending the shutr/shutw, don't destroy
the h2s if it still has a conn_stream attached, or the conn_stream may try
to access it again.
diff --git a/src/mux_h2.c b/src/mux_h2.c
index 6403b02..dc28b12 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -3016,7 +3016,7 @@
h2_do_shutr(h2s);
if (h2s->st == H2_SS_CLOSED &&
- !((h2s->flags & (H2_SF_BLK_MBUSY | H2_SF_BLK_MROOM | H2_SF_BLK_MFCTL))))
+ !((h2s->flags & (H2_SF_BLK_MBUSY | H2_SF_BLK_MROOM | H2_SF_BLK_MFCTL))) && !h2s->cs)
h2s_destroy(h2s);
return NULL;
}