http2: wait for secureConnect before initializing

Fixes: #32922

lib/_tls_wrap.js

@@ -464,6 +464,7 @@ function TLSSocket(socket, opts) {
   this._securePending = false;
   this._newSessionPending = false;
   this._controlReleased = false;
+  this.secureConnecting = true;
   this._SNICallback = null;
   this.servername = null;
   this.alpnProtocol = null;
@@ -1026,6 +1027,7 @@ function onServerSocketSecure() {
 
   if (!this.destroyed && this._releaseControl()) {
     debug('server emit secureConnection');
+    this.secureConnecting = false;
     this._tlsOptions.server.emit('secureConnection', this);
   }
 }

lib/internal/http2/core.js

@@ -1152,7 +1152,7 @@ class Http2Session extends EventEmitter {
       socket.disableRenegotiation();
 
     const setupFn = setupHandle.bind(this, socket, type, options);
-    if (socket.connecting) {
+    if (socket.connecting || socket.secureConnecting) {
       const connectEvent =
         socket instanceof tls.TLSSocket ? 'secureConnect' : 'connect';
       socket.once(connectEvent, () => {

test/internet/test-http2-issue-32922.js

@@ -0,0 +1,80 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const http2 = require('http2');
+const net = require('net');
+
+const {
+  HTTP2_HEADER_PATH,
+} = http2.constants;
+
+// Create a normal session, as a control case
+function normalSession(cb) {
+  http2.connect('https://google.com', (clientSession) => {
+    let error = null;
+    const req = clientSession.request({ [HTTP2_HEADER_PATH]: '/' });
+    req.on('error', (err) => {
+      error = err;
+    });
+    req.on('response', (_headers) => {
+      req.on('data', (_chunk) => { });
+      req.on('end', () => {
+        clientSession.close();
+        return cb(error);
+      });
+    });
+  });
+}
+normalSession(common.mustCall(function(err) {
+  assert.ifError(err);
+}));
+
+// Create a session using a socket that has not yet finished connecting
+function socketNotFinished(done) {
+  const socket2 = net.connect(443, 'google.com');
+  http2.connect('https://google.com', { socket2 }, (clientSession) => {
+    let error = null;
+    const req = clientSession.request({ [HTTP2_HEADER_PATH]: '/' });
+    req.on('error', (err) => {
+      error = err;
+    });
+    req.on('response', (_headers) => {
+      req.on('data', (_chunk) => { });
+      req.on('end', () => {
+        clientSession.close();
+        socket2.destroy();
+        return done(error);
+      });
+    });
+  });
+}
+socketNotFinished(common.mustCall(function(err) {
+  assert.ifError(err);
+}));
+
+// Create a session using a socket that has finished connecting
+function socketFinished(done) {
+  const socket = net.connect(443, 'google.com', () => {
+    http2.connect('https://google.com', { socket }, (clientSession) => {
+      let error = null;
+      const req = clientSession.request({ [HTTP2_HEADER_PATH]: '/' });
+      req.on('error', (err) => {
+        error = err;
+      });
+      req.on('response', (_headers) => {
+        req.on('data', (_chunk) => { });
+        req.on('end', () => {
+          clientSession.close();
+          return done(error);
+        });
+      });
+    });
+  });
+}
+socketFinished(common.mustCall(function(err) {
+  assert.ifError(err);
+}));