Fix a double-close in the server code.

Exposed (I think) now that we properly handle POLLHUP.

src/core/surface/server.c

@@ -291,7 +291,7 @@ static void orphan_channel(channel_data *chand) {
 static void finish_destroy_channel(void *cd, int success) {
   channel_data *chand = cd;
   grpc_server *server = chand->server;
-  grpc_channel_destroy(chand->channel);
+  grpc_channel_internal_unref(chand->channel);
   server_unref(server);
 }
 

src/core/transport/chttp2_transport.c

@@ -191,6 +191,7 @@ struct transport {
   gpr_uint8 writing;
   gpr_uint8 calling_back;
   gpr_uint8 destroying;
+  gpr_uint8 closed;
   error_state error_state;
 
   /* stream indexing */
@@ -416,6 +417,7 @@ static void init_transport(transport *t, grpc_transport_setup_callback setup,
   t->next_stream_id = is_client ? 1 : 2;
   t->last_incoming_stream_id = 0;
   t->destroying = 0;
+  t->closed = 0;
   t->is_client = is_client;
   t->outgoing_window = DEFAULT_WINDOW;
   t->incoming_window = DEFAULT_WINDOW;
@@ -521,6 +523,8 @@ static void destroy_transport(grpc_transport *gt) {
 static void close_transport(grpc_transport *gt) {
   transport *t = (transport *)gt;
   gpr_mu_lock(&t->mu);
+  GPR_ASSERT(!t->closed);
+  t->closed = 1;
   if (t->ep) {
     grpc_endpoint_shutdown(t->ep);
   }