BUG/MEDIUM: h2: Don't forget to set h2s->cs to NULL after having free'd cs.

In h2c_frt_stream_new, if we failed to create the stream for some reason,
don't forget to set h2s->cs to NULL before calling h2s_destroy(), otherwise
h2s_destroy() will call h2s_close(), which will attempt to access
h2s->cs->flags if it's non-NULL.

This should be backported to 1.9.

src/mux_h2.c

@@ -1027,6 +1027,7 @@ static struct h2s *h2c_frt_stream_new(struct h2c *h2c, int id)
  out_free_cs:
 	h2c->nb_cs--;
 	cs_free(cs);
+	h2s->cs = NULL;
  out_close:
 	h2s_destroy(h2s);
  out: