http2,tls: account for buffered data before creating socket wraps

lib/_tls_wrap.js

@@ -479,7 +479,11 @@ function TLSSocket(socket, opts) {
   this[kPendingSession] = null;
 
   let wrap;
-  if ((socket instanceof net.Socket && socket._handle) || !socket) {
+  // Ideally, the readableLength check would not be necessary, and we would
+  // have a way to handle the buffered data at the C++ StreamBase level.
+  if ((socket instanceof net.Socket &&
+       socket._handle &&
+       socket.readableLength === 0) || !socket) {
     // 1. connected socket
     // 2. no socket, one will be created with net.Socket().connect
     wrap = socket;

lib/internal/http2/core.js

@@ -1122,7 +1122,11 @@ class Http2Session extends EventEmitter {
   constructor(type, options, socket) {
     super();
 
-    if (!socket._handle || !socket._handle.isStreamBase) {
+    // Ideally, the readableLength check would not be necessary, and we would
+    // have a way to handle the buffered data at the C++ StreamBase level.
+    if (!socket._handle ||
+        !socket._handle.isStreamBase ||
+        socket.readableLength > 0) {
       socket = new JSStreamSocket(socket);
     }
 

test/parallel/test-http2-autoselect-protocol.js

@@ -0,0 +1,72 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const net = require('net');
+const http = require('http');
+const http2 = require('http2');
+
+// Example test for HTTP/1 vs HTTP/2 protocol autoselection.
+// Refs: https://github.com/nodejs/node/issues/34532
+
+const h1Server = http.createServer(common.mustCall((req, res) => {
+  res.end('HTTP/1 Response');
+}));
+
+const h2Server = http2.createServer(common.mustCall((req, res) => {
+  res.end('HTTP/2 Response');
+}));
+
+const rawServer = net.createServer(common.mustCall(function listener(socket) {
+  const data = socket.read(3);
+
+  if (!data) { // Repeat until data is available
+    socket.once('readable', () => listener(socket));
+    return;
+  }
+
+  // Put the data back, so the real server can handle it:
+  socket.unshift(data);
+
+  if (data.toString('ascii') === 'PRI') { // Very dumb preface check
+    h2Server.emit('connection', socket);
+  } else {
+    h1Server.emit('connection', socket);
+  }
+}, 2));
+
+rawServer.listen(common.mustCall(() => {
+  const { port } = rawServer.address();
+
+  let done = 0;
+  {
+    // HTTP/2 Request
+    const client = http2.connect(`http://localhost:${port}`);
+    const req = client.request({ ':path': '/' });
+    req.end();
+
+    let content = '';
+    req.setEncoding('utf8');
+    req.on('data', (chunk) => content += chunk);
+    req.on('end', common.mustCall(() => {
+      assert.strictEqual(content, 'HTTP/2 Response');
+      if (++done === 2) rawServer.close();
+      client.close();
+    }));
+  }
+
+  {
+    // HTTP/1 Request
+    http.get(`http://localhost:${port}`, common.mustCall((res) => {
+      let content = '';
+      res.setEncoding('utf8');
+      res.on('data', (chunk) => content += chunk);
+      res.on('end', common.mustCall(() => {
+        assert.strictEqual(content, 'HTTP/1 Response');
+        if (++done === 2) rawServer.close();
+      }));
+    }));
+  }
+}));

test/parallel/test-tls-generic-stream-unshift.js

@@ -0,0 +1,43 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const fixtures = require('../common/fixtures');
+const makeDuplexPair = require('../common/duplexpair');
+const assert = require('assert');
+const { TLSSocket, connect } = require('tls');
+
+const key = fixtures.readKey('agent1-key.pem');
+const cert = fixtures.readKey('agent1-cert.pem');
+const ca = fixtures.readKey('ca1-cert.pem');
+
+const { clientSide, serverSide } = makeDuplexPair();
+
+const clientTLS = connect({
+  socket: clientSide,
+  ca,
+  host: 'agent1'  // Hostname from certificate
+});
+
+let serverTLS;
+serverSide.once('data', common.mustCall((chunk) => {
+  serverSide.unshift(chunk);
+  serverTLS = new TLSSocket(serverSide, {
+    isServer: true,
+    key,
+    cert,
+    ca
+  });
+}));
+
+assert.strictEqual(clientTLS.connecting, false);
+
+clientTLS.on('secureConnect', common.mustCall(() => {
+  clientTLS.write('foobar', common.mustCall(() => {
+    assert(serverTLS);
+    assert.strictEqual(serverTLS.read().toString(), 'foobar');
+    assert.strictEqual(clientTLS._handle.writeQueueSize, 0);
+  }));
+  assert.ok(clientTLS._handle.writeQueueSize > 0);
+}));