http2: clear the session timeout before marking it destroyed

lib/internal/http2/core.js

@@ -1303,13 +1303,16 @@ function closeSession(session, code, error) {
   debugSessionObj(session, 'start closing/destroying', error);
 
   const state = session[kState];
-  state.flags |= SESSION_FLAGS_DESTROYED;
-  state.destroyCode = code;
 
-  // Clear timeout and remove timeout listeners.
+  // Clear timeout and remove timeout listeners before marking the session
+  // destroyed: setTimeout() is a no-op once destroyed, so the idle timer
+  // would otherwise stay armed and retain the session.
   session.setTimeout(0);
   session.removeAllListeners('timeout');
 
+  state.flags |= SESSION_FLAGS_DESTROYED;
+  state.destroyCode = code;
+
   const socket = session[kSocket];
   const handle = session[kHandle];
 

test/parallel/test-http2-session-timeout-cleared-on-close.js

@@ -0,0 +1,32 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+
+// A destroyed session must not keep its idle timer armed: setTimeout() is a
+// no-op once the session is marked destroyed, so closeSession() has to clear
+// the timer first.
+const server = http2.createServer();
+server.setTimeout(30_000, common.mustNotCall());
+
+server.on('session', common.mustCall((session) => {
+  session.on('close', common.mustCall(() => {
+    assert.strictEqual(session.timeout, 0);
+    server.close();
+  }));
+}));
+
+server.on('stream', common.mustCall((stream) => {
+  stream.respond({ ':status': 200 });
+  stream.end('ok');
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = http2.connect(`http://localhost:${server.address().port}`);
+  const req = client.request();
+  req.resume();
+  req.on('end', common.mustCall(() => client.close()));
+}));