Release `TlsServerHandshaker::server_params_` in `ResetSsl()`. `server_params_` is only read during cert selection (`SetTransportParameters / TransportParametersMatch`), so it can be freed once the SSL object is reset, saving ~920 bytes per connection. Protected by quiche_reloadable_flag_quic_reset_server_params_in_reset_ssl. PiperOrigin-RevId: 1000133229

diff --git a/quiche/common/quiche_feature_flags_list.h b/quiche/common/quiche_feature_flags_list.h
index dab5eb6..d0520d8 100755
--- a/quiche/common/quiche_feature_flags_list.h
+++ b/quiche/common/quiche_feature_flags_list.h

@@ -62,6 +62,7 @@
 QUICHE_FLAG(bool, quiche_reloadable_flag_quic_reject_empty_cid_in_ncid, false, true, "If true, QUIC framer will reject NEW_CONNECTION_ID frames with empty connection IDs.")
 QUICHE_FLAG(bool, quiche_reloadable_flag_quic_reject_unusable_ech_config, false, true, "When true, calls SSL_set_reject_unusable_ech_config in TlsClientHandshaker.")
 QUICHE_FLAG(bool, quiche_reloadable_flag_quic_require_handshake_confirmation, true, true, "If true, require handshake confirmation for QUIC connections, functionally disabling 0-rtt handshakes.")
+QUICHE_FLAG(bool, quiche_reloadable_flag_quic_reset_server_params_in_reset_ssl, false, false, "If true, reset server_params_ in TlsServerHandshaker::ResetSsl().")
 QUICHE_FLAG(bool, quiche_reloadable_flag_quic_send_acks_after_on_can_write, false, false, "When true, QuicConnection::OnCanWrite() calls visitor_->OnCanWrite() before SendAllPendingAcks() so outgoing data frames can opportunistically bundle pending ACKs first.")
 QUICHE_FLAG(bool, quiche_reloadable_flag_quic_test_peer_addr_change_after_normalize, false, false, "If true, QuicConnection::ProcessValidatedPacket will use normalized address to test peer address changes.")
 QUICHE_FLAG(bool, quiche_reloadable_flag_quic_testonly_default_false, false, false, "A testonly reloadable flag that will always default to false.")

diff --git a/quiche/quic/core/tls_server_handshaker.cc b/quiche/quic/core/tls_server_handshaker.cc
index 0232356..cc8dd85 100644
--- a/quiche/quic/core/tls_server_handshaker.cc
+++ b/quiche/quic/core/tls_server_handshaker.cc

@@ -1341,6 +1341,10 @@
       .alpn = std::string(Alpn()),
       .sni = std::string(Sni()),
   });
+  if (GetQuicReloadableFlag(quic_reset_server_params_in_reset_ssl)) {
+    QUIC_RELOADABLE_FLAG_COUNT(quic_reset_server_params_in_reset_ssl);
+    server_params_.reset();
+  }
   tls_connection_.ResetSsl();
   ResetCryptoSubstreams();
 }

diff --git a/quiche/quic/core/tls_server_handshaker.h b/quiche/quic/core/tls_server_handshaker.h
index 1740f46..d1d564d 100644
--- a/quiche/quic/core/tls_server_handshaker.h
+++ b/quiche/quic/core/tls_server_handshaker.h

@@ -44,6 +44,9 @@
 #include "quiche/common/platform/api/quiche_reference_counted.h"
 
 namespace quic {
+namespace test {
+class TlsServerHandshakerPeer;
+}  // namespace test
 
 // An implementation of QuicCryptoServerStreamBase which uses
 // TLS 1.3 for the crypto handshake protocol.
@@ -239,6 +242,8 @@
   }
 
  private:
+  friend class test::TlsServerHandshakerPeer;
+
   class QUICHE_EXPORT DecryptCallback : public ProofSource::DecryptCallback {
    public:
     explicit DecryptCallback(TlsServerHandshaker* handshaker);

diff --git a/quiche/quic/core/tls_server_handshaker_test.cc b/quiche/quic/core/tls_server_handshaker_test.cc
index 53c93ce..7ec14a1 100644
--- a/quiche/quic/core/tls_server_handshaker_test.cc
+++ b/quiche/quic/core/tls_server_handshaker_test.cc

@@ -69,6 +69,14 @@
 namespace quic {
 namespace test {
 
+class TlsServerHandshakerPeer {
+ public:
+  static const TransportParameters* GetServerParams(
+      const TlsServerHandshaker* handshaker) {
+    return handshaker->server_params_.get();
+  }
+};
+
 namespace {
 
 const char kServerHostname[] = "test.example.com";
@@ -1776,6 +1784,7 @@
 }
 
 TEST_P(TlsServerHandshakerTest, CachedSslInfoAfterResetSsl) {
+  SetQuicReloadableFlag(quic_reset_server_params_in_reset_ssl, true);
   CompleteCryptoHandshake();
   ExpectHandshakeSuccessful();
 
@@ -1797,6 +1806,7 @@
   // Call ResetSsl. This should cache the SSL info.
   TlsServerHandshaker* handshaker =
       static_cast<TlsServerHandshaker*>(server_stream());
+  EXPECT_NE(TlsServerHandshakerPeer::GetServerParams(handshaker), nullptr);
   handshaker->ResetSsl();
 
   // Verify that the info is still available from the cache.
@@ -1808,6 +1818,7 @@
   EXPECT_EQ(server_stream()->CiphersuiteString(), cipher_string);
   EXPECT_EQ(server_stream()->TlsGroupId(), tls_group_id);
   EXPECT_EQ(server_stream()->TlsGroupString(), tls_group_string);
+  EXPECT_EQ(TlsServerHandshakerPeer::GetServerParams(handshaker), nullptr);
 }
 
 }  // namespace