Index: includes/update.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/update.inc,v
retrieving revision 1.83
diff -u -p -r1.83 update.inc
--- includes/update.inc	6 Dec 2010 06:57:40 -0000	1.83
+++ includes/update.inc	6 Dec 2010 18:16:25 -0000
@@ -156,6 +156,18 @@ function update_prepare_d7_bootstrap() {
       ),
     );
     update_extra_requirements($requirements);
+
+    // Allow a D6 session to work, since the upgrade has not been performed yet.
+    $d6_session_name = update_get_d6_session_name();
+    if (!empty($_COOKIE[$d6_session_name])) {
+      require_once DRUPAL_ROOT . '/includes/session.inc';
+      $sid = $_COOKIE[$d6_session_name];
+
+      // Respect the D6 sid and read an existing session with it.
+      $_COOKIE[session_name()] = $sid;
+      session_id($sid);
+      _drupal_session_read($sid);
+    }
   }
 
   // Create the registry tables.
@@ -829,6 +841,45 @@ function update_parse_db_url($db_url, $d
 }
 
 /**
+ * Constructs a session name compatible with a D6 environment.
+ *
+ * @return
+ *   D6-compatible session name string.
+ *
+ * @see drupal_settings_initialize()
+ */
+function update_get_d6_session_name() {
+  global $base_url;
+
+  // $cookie_domain may be specifically set in settings.php. Load it here
+  // because $cookie_domain can be overwritten in drupal_settings_initialize().
+  if (file_exists(DRUPAL_ROOT . '/' . conf_path() . '/settings.php')) {
+    include DRUPAL_ROOT . '/' . conf_path() . '/settings.php';
+  }
+
+  if (!empty($cookie_domain)) {
+    // If the user specifies the cookie domain, also use it for session name.
+    $session_name = $cookie_domain;
+  }
+  else {
+    // Otherwise use $base_url as session name, without the protocol
+    // to use the same session identifiers across http and https.
+    list( , $session_name) = explode('://', $base_url, 2);
+  }
+  // To prevent session cookies from being hijacked, a user can configure the
+  // SSL version of their website to only transfer session cookies via SSL by
+  // using PHP's session.cookie_secure setting. The browser will then use two
+  // separate session cookies for the HTTPS and HTTP versions of the site. So we
+  // must use different session identifiers for HTTPS and HTTP to prevent a
+  // cookie collision.
+  if (ini_get('session.cookie_secure')) {
+    $session_name .= 'SSL';
+  }
+
+  return 'SESS' . md5($session_name);
+}
+
+/**
  * Perform one update and store the results for display on finished page.
  *
  * If an update function completes successfully, it should return a message
Index: modules/simpletest/tests/upgrade/upgrade.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/tests/upgrade/upgrade.test,v
retrieving revision 1.10
diff -u -p -r1.10 upgrade.test
--- modules/simpletest/tests/upgrade/upgrade.test	5 Nov 2010 19:05:02 -0000	1.10
+++ modules/simpletest/tests/upgrade/upgrade.test	6 Dec 2010 18:16:25 -0000
@@ -34,6 +34,9 @@ abstract class UpgradePathTestCase exten
   protected function setUp() {
     global $user, $language, $conf;
 
+    // Load the Update API.
+    require_once DRUPAL_ROOT . '/includes/update.inc';
+
     // Reset flags.
     $this->upgradedSite = FALSE;
     $this->upgradeErrors = array();
@@ -106,10 +109,11 @@ abstract class UpgradePathTestCase exten
     drupal_save_session(FALSE);
     $user = db_query('SELECT * FROM {users} WHERE uid = :uid', array(':uid' => 1))->fetchObject();
 
-    // Generate and set a session cookie.
+    // Generate and set a D6-compatible session cookie.
     $this->curlInitialize();
     $sid = drupal_hash_base64(uniqid(mt_rand(), TRUE) . drupal_random_bytes(55));
-    curl_setopt($this->curlHandle, CURLOPT_COOKIE, rawurlencode($this->session_name) . '=' . rawurlencode($sid));
+    $session_name = update_get_d6_session_name();
+    curl_setopt($this->curlHandle, CURLOPT_COOKIE, rawurlencode($session_name) . '=' . rawurlencode($sid));
 
     // Force our way into the session of the child site.
     drupal_save_session(TRUE);