http2: check if stream is not destroyed before sending trailers

Fixes: #22855
Backport-PR-URL: #22850
PR-URL: #22896
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: mcollina

lib/internal/http2/core.js

@@ -1475,6 +1475,14 @@ function afterShutdown() {
 }
 
 functionfinishSendTrailers(stream,headersList){
+// The stream might be destroyed and in that case
+// there is nothing to do.
+// This can happen because finishSendTrailers is
+// scheduled via setImmediate.
+if(stream.destroyed){
+return;
+}
+
 stream[kState].flags&=~STREAM_FLAGS_HAS_TRAILERS;
 
 constret=stream[kHandle].trailers(headersList);

test/parallel/test-http2-compat-socket-destroy-delayed.js

@@ -0,0 +1,42 @@
+'use strict';
+
+constcommon=require('../common');
+const{ mustCall }=common;
+
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+consthttp2=require('http2');
+constassert=require('assert');
+
+const{
+HTTP2_HEADER_PATH,
+HTTP2_HEADER_METHOD,
+}=http2.constants;
+
+// This tests verifies that calling `req.socket.destroy()` via
+// setImmediate does not crash.
+// Fixes https://github.com/nodejs/node/issues/22855.
+
+constapp=http2.createServer(mustCall((req,res)=>{
+res.end('hello');
+setImmediate(()=>req.socket.destroy());
+}));
+
+app.listen(0,mustCall(()=>{
+constsession=http2.connect(`http://localhost:${app.address().port}`);
+constrequest=session.request({
+[HTTP2_HEADER_PATH]: '/',
+[HTTP2_HEADER_METHOD]: 'get'
+});
+request.once('response',mustCall((headers,flags)=>{
+letdata='';
+request.on('data',(chunk)=>{data+=chunk;});
+request.on('end',mustCall(()=>{
+assert.strictEqual(data,'hello');
+session.close();
+app.close();
+}));
+}));
+request.end();
+}));