Fix cork() closing a WebSocket that was upgraded asynchronously (#1929)

cork() detected an in-handler upgrade with `this != newCorkedSocket`, but
us_socket_context_adopt_socket() reallocs the poll and returns the same pointer
when the WebSocket extension is not larger than the HttpResponse extension. The
upgrade then went undetected and cork() ran its HTTP connection-close logic on
the now-WebSocket socket, closing it right after open. Also compare the socket
context, which always changes on upgrade.

Author: MeredithRodneyMcKay

src/HttpResponse.h

@@ -532,6 +532,9 @@ struct HttpResponse : public AsyncSocket<SSL> {
     HttpResponse *cork(MoveOnlyFunction<void()> &&handler) {
         if (!Super::isCorked() && Super::canCork()) {
             LoopData *loopData = Super::getLoopData();
+            /* Remember our socket context so we can detect a WebSocket upgrade in the
+             * handler even when the poll realloc kept our address (see below). */
+            struct us_socket_context_t *preCorkContext = us_socket_context(SSL, (struct us_socket_t *) this);
             Super::cork();
             handler();
 
@@ -552,7 +555,11 @@ struct HttpResponse : public AsyncSocket<SSL> {
 
             /* If we are no longer an HTTP socket then early return the new "this".
              * We don't want to even overwrite timeout as it is set in upgrade already. */
-            if (this != newCorkedSocket) {
+            /* The pointer check alone is not enough: us_socket_context_adopt_socket() can
+             * realloc the poll in place, leaving the upgraded WebSocket at our old address
+             * (this == newCorkedSocket). The socket context always changes on upgrade. */
+            if (this != newCorkedSocket ||
+                us_socket_context(SSL, (struct us_socket_t *) newCorkedSocket) != preCorkContext) {
                 return static_cast<HttpResponse *>(newCorkedSocket);
             }