http2: guard against null stream/req in OnStreamAfterReqFinished

When a stream is destroyed while a synchronous write is in flight
from StreamPipe::ProcessData, ReportWritesToJSStreamListener::
OnStreamAfterReqFinished can be called with a null stream_ or a
null req_wrap, causing a null pointer dereference. This race
becomes more likely with larger HTTP/2 windows (e.g., #38426)
because more data is in flight during session teardown.

Add early-return guards for both cases to prevent the crash.

Refs: #38426
Refs: #56825
Signed-off-by: Matteo Collina <hello@matteocollina.com>

Author: mcollina

src/stream_base.cc

@@ -752,6 +752,8 @@ void CustomBufferJSListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
 void ReportWritesToJSStreamListener::OnStreamAfterReqFinished(
     StreamReq* req_wrap, int status) {
   StreamBase* stream = static_cast<StreamBase*>(stream_);
+  if (stream == nullptr) return;
+  if (req_wrap == nullptr) return;
   Environment* env = stream->stream_env();
   if (!env->can_call_into_js()) return;
   AsyncWrap* async_wrap = req_wrap->GetAsyncWrap();