diff --git a/netwerk/protocol/http/TunnelUtils.cpp b/netwerk/protocol/http/TunnelUtils.cpp
index 4cc24a07f..71adef9d7 100644
--- a/netwerk/protocol/http/TunnelUtils.cpp
+++ b/netwerk/protocol/http/TunnelUtils.cpp
@@ -23,6 +23,7 @@
 #include "nsNetCID.h"
 #include "nsServiceManagerUtils.h"
 #include "nsComponentManagerUtils.h"
+#include "nsSocketTransport2.h"
 
 namespace mozilla {
 namespace net {
@@ -130,6 +131,19 @@ TLSFilterTransaction::Close(nsresult aReason)
   }
   mTransaction->Close(aReason);
   mTransaction = nullptr;
+
+  RefPtr<NullHttpTransaction> baseTrans(do_QueryReferent(mWeakTrans));
+  SpdyConnectTransaction *trans = baseTrans
+    ? baseTrans->QuerySpdyConnectTransaction()
+    : nullptr;
+
+  LOG(("TLSFilterTransaction::Close %p aReason=%" PRIx32 " trans=%p\n",
+       this, static_cast<uint32_t>(aReason), trans));
+
+  if (trans) {
+    trans->Close(aReason);
+    trans = nullptr;
+  }
 }
 
 nsresult
@@ -190,8 +204,15 @@ TLSFilterTransaction::OnReadSegment(const char *aData,
       // mTransaction ReadSegments actually obscures this code, so
       // keep it in a member var for this::ReadSegments to insepct. Similar
       // to nsHttpConnection::mSocketOutCondition
-      mReadSegmentBlocked = (PR_GetError() == PR_WOULD_BLOCK_ERROR);
-      return mReadSegmentBlocked ? NS_BASE_STREAM_WOULD_BLOCK : NS_ERROR_FAILURE;
+      PRErrorCode code = PR_GetError();
+      mReadSegmentBlocked = (code == PR_WOULD_BLOCK_ERROR);
+      if (mReadSegmentBlocked) {
+        return NS_BASE_STREAM_WOULD_BLOCK;
+      }
+
+      nsresult rv = ErrorAccordingToNSPR(code);
+      Close(rv);
+      return rv;
     }
     aCount -= written;
     aData += written;
@@ -273,10 +294,13 @@ TLSFilterTransaction::OnWriteSegment(char *aData,
   mFilterReadCode = NS_OK;
   int32_t bytesRead = PR_Read(mFD, aData, aCount);
   if (bytesRead == -1) {
-    if (PR_GetError() == PR_WOULD_BLOCK_ERROR) {
+    PRErrorCode code = PR_GetError();
+    if (code == PR_WOULD_BLOCK_ERROR) {
       return NS_BASE_STREAM_WOULD_BLOCK;
     }
-    return NS_ERROR_FAILURE;
+    nsresult rv = ErrorAccordingToNSPR(code);
+    Close(rv);
+    return rv;
   }
   *outCountRead = bytesRead;
 
@@ -675,10 +699,12 @@ TLSFilterTransaction::TakeSubTransactions(
 }
 
 nsresult
-TLSFilterTransaction::SetProxiedTransaction(nsAHttpTransaction *aTrans)
+TLSFilterTransaction::SetProxiedTransaction(nsAHttpTransaction *aTrans,
+                                            nsAHttpTransaction *aSpdyConnectTransaction)
 {
-  LOG(("TLSFilterTransaction::SetProxiedTransaction [this=%p] aTrans=%p\n",
-       this, aTrans));
+  LOG(("TLSFilterTransaction::SetProxiedTransaction [this=%p] aTrans=%p, "
+       "aSpdyConnectTransaction=%p\n",
+       this, aTrans, aSpdyConnectTransaction));
 
   mTransaction = aTrans;
   nsCOMPtr<nsIInterfaceRequestor> callbacks;
@@ -688,6 +714,8 @@ TLSFilterTransaction::SetProxiedTransaction(nsAHttpTransaction *aTrans)
     secCtrl->SetNotificationCallbacks(callbacks);
   }
 
+  mWeakTrans = do_GetWeakReference(aSpdyConnectTransaction);
+
   return NS_OK;
 }
 
@@ -1075,7 +1103,7 @@ SpdyConnectTransaction::MapStreamToHttpConnection(nsISocketTransport *aTransport
   if (mForcePlainText) {
       mTunneledConn->ForcePlainText();
   } else {
-    mTunneledConn->SetupSecondaryTLS();
+    mTunneledConn->SetupSecondaryTLS(this);
     mTunneledConn->SetInSpdyTunnel(true);
   }
 
diff --git a/netwerk/protocol/http/TunnelUtils.h b/netwerk/protocol/http/TunnelUtils.h
index 20cfaf7ee..7e491a0d7 100644
--- a/netwerk/protocol/http/TunnelUtils.h
+++ b/netwerk/protocol/http/TunnelUtils.h
@@ -121,7 +121,8 @@ public:
   nsresult CommitToSegmentSize(uint32_t size, bool forceCommitment) override;
   nsresult GetTransactionSecurityInfo(nsISupports **) override;
   nsresult NudgeTunnel(NudgeTunnelCallback *callback);
-  nsresult SetProxiedTransaction(nsAHttpTransaction *aTrans);
+  MOZ_MUST_USE nsresult SetProxiedTransaction(nsAHttpTransaction *aTrans,
+                                              nsAHttpTransaction *aSpdyConnectTransaction = nullptr);
   void     newIODriver(nsIAsyncInputStream *aSocketIn,
                        nsIAsyncOutputStream *aSocketOut,
                        nsIAsyncInputStream **outSocketIn,
@@ -153,6 +154,7 @@ private:
 
 private:
   RefPtr<nsAHttpTransaction> mTransaction;
+  nsWeakPtr mWeakTrans; // SpdyConnectTransaction *
   nsCOMPtr<nsISupports> mSecInfo;
   nsCOMPtr<nsITimer> mTimer;
   RefPtr<NudgeTunnelCallback> mNudgeCallback;
diff --git a/netwerk/protocol/http/nsHttpConnection.cpp b/netwerk/protocol/http/nsHttpConnection.cpp
index 8ccba76e2..71a08e177 100644
--- a/netwerk/protocol/http/nsHttpConnection.cpp
+++ b/netwerk/protocol/http/nsHttpConnection.cpp
@@ -639,7 +639,9 @@ nsHttpConnection::Activate(nsAHttpTransaction *trans, uint32_t caps, int32_t pri
     }
 
     if (mTLSFilter) {
-        mTLSFilter->SetProxiedTransaction(trans);
+        RefPtr<NullHttpTransaction> baseTrans(do_QueryReferent(mWeakTrans));
+        rv = mTLSFilter->SetProxiedTransaction(trans, baseTrans);
+        NS_ENSURE_SUCCESS(rv, rv);
         mTransaction = mTLSFilter;
     }
 
@@ -1979,7 +1981,7 @@ nsHttpConnection::OnSocketReadable()
             // negotiation are known (which is determined from the write path).
             // If the server speaks SPDY it is likely the readable data here is
             // a spdy settings frame and without NPN it would be misinterpreted
-            // as HTTP/*
+            // as HTTP
 
             LOG(("nsHttpConnection::OnSocketReadable %p return due to inactive "
                  "tunnel setup but incomplete NPN state\n", this));
@@ -2019,12 +2021,14 @@ nsHttpConnection::OnSocketReadable()
 }
 
 void
-nsHttpConnection::SetupSecondaryTLS()
+nsHttpConnection::SetupSecondaryTLS(nsAHttpTransaction *aSpdyConnectTransaction)
 {
     MOZ_ASSERT(PR_GetCurrentThread() == gSocketThread);
     MOZ_ASSERT(!mTLSFilter);
-    LOG(("nsHttpConnection %p SetupSecondaryTLS %s %d\n",
-         this, mConnInfo->Origin(), mConnInfo->OriginPort()));
+    LOG(("nsHttpConnection %p SetupSecondaryTLS %s %d "
+         "aSpdyConnectTransaction=%p\n",
+         this, mConnInfo->Origin(), mConnInfo->OriginPort(),
+         aSpdyConnectTransaction));
 
     nsHttpConnectionInfo *ci = nullptr;
     if (mTransaction) {
@@ -2041,6 +2045,7 @@ nsHttpConnection::SetupSecondaryTLS()
     if (mTransaction) {
         mTransaction = mTLSFilter;
     }
+    mWeakTrans = do_GetWeakReference(aSpdyConnectTransaction);
 }
 
 void
diff --git a/netwerk/protocol/http/nsHttpConnection.h b/netwerk/protocol/http/nsHttpConnection.h
index 08eea1de2..ce7523eb5 100644
--- a/netwerk/protocol/http/nsHttpConnection.h
+++ b/netwerk/protocol/http/nsHttpConnection.h
@@ -202,7 +202,7 @@ public:
     static nsresult MakeConnectString(nsAHttpTransaction *trans,
                                       nsHttpRequestHead *request,
                                       nsACString &result);
-    void    SetupSecondaryTLS();
+    void    SetupSecondaryTLS(nsAHttpTransaction *aSpdyConnectTransaction = nullptr);
     void    SetInSpdyTunnel(bool arg);
 
     // Check active connections for traffic (or not). SPDY connections send a
@@ -281,6 +281,7 @@ private:
     // transaction is open, otherwise it is null.
     RefPtr<nsAHttpTransaction>    mTransaction;
     RefPtr<TLSFilterTransaction>  mTLSFilter;
+    nsWeakPtr                     mWeakTrans; // SpdyConnectTransaction *
 
     RefPtr<nsHttpHandler>         mHttpHandler; // keep gHttpHandler alive