The dereference (req->evcon->http_server) takes place in evhttp_parse_request_line and is a consequence of our hacky but necessary use of the internal function evhttp_parse_firstline_ in the http_request fuzzing harness. The suggested workaround is not aesthetically pleasing, but it successfully avoids the troublesome code path. " http:// HTTP/1.1\n" was a crashing input prior to this workaround.
Backport of core PR19140.
Depends on D9001.