tls: fix segfault on destroy after partial read

OnRead() calls into JS land which can result in the SSL context object
being destroyed on return. Check that `ssl_ != nullptr` afterwards.
Fixes: #11885
PR-URL: #11898
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: bnoordhuis

src/tls_wrap.cc

@@ -426,6 +426,12 @@ void TLSWrap::ClearOut() {
 memcpy(buf.base, current, avail);
 OnRead(avail, &buf);
 
+// Caveat emptor: OnRead() calls into JS land which can result in
+// the SSL context object being destroyed. We have to carefully
+// check that ssl_ != nullptr afterwards.
+if (ssl_ == nullptr)
+return;
+
  read -= avail;
  current += avail;
  }

test/parallel/test-tls-socket-destroy.js

@@ -0,0 +1,36 @@
+'use strict';
+
+constcommon=require('../common');
+
+if(!common.hasCrypto){
+common.skip('missing crypto');
+return;
+}
+
+constfs=require('fs');
+constnet=require('net');
+consttls=require('tls');
+
+constkey=fs.readFileSync(common.fixturesDir+'/keys/agent1-key.pem');
+constcert=fs.readFileSync(common.fixturesDir+'/keys/agent1-cert.pem');
+constsecureContext=tls.createSecureContext({ key, cert });
+
+constserver=net.createServer(common.mustCall((conn)=>{
+constoptions={isServer: true, secureContext, server };
+constsocket=newtls.TLSSocket(conn,options);
+socket.once('data',common.mustCall(()=>{
+socket._destroySSL();// Should not crash.
+server.close();
+}));
+}));
+
+server.listen(0,function(){
+constoptions={
+port: this.address().port,
+rejectUnauthorized: false,
+};
+tls.connect(options,function(){
+this.write('*'.repeat(1<<20));// Write more data than fits in a frame.
+this.on('error',this.destroy);// Server closes connection on us.
+});
+});