[BUG] Clear a detached easy handle before freeing it

curl_easy_cleanup documents that it can reach the application: "Occasionally
you may get your progress callback or header callback called from within
curl_easy_cleanup (if previously set for the handle using curl_easy_setopt)",
for protocols that need a command and response before disconnecting.

By then the event handler is gone. The only shared_ptr to it is captured in the
completion callback that SendRequest builds, Cleanup swaps that out and runs
it, and it is released when Cleanup returns. The write, header and read
callbacks all dispatch through the raw pointer the operation keeps, so the one
libcurl says it may call is the one with nothing behind it.

Clearing the handle first takes the callbacks and their data off it, so freeing
it cannot reach anything the client has let go of, and the header list is freed
after that because libcurl does not copy it and the clear is what stops it
being read.

This runs on the background thread with the handle detached, which is what the
version removed from Cleanup earlier on this branch could not say: that one ran
on whichever thread cancelled, against a handle the multi handle still held.

Measured on 8.14.1 over HTTP, neither curl_multi_remove_handle nor
curl_easy_cleanup reaches a callback once the transfer has finished, and
removing a handle from a live transfer reaches the progress callback once. So
nothing here is what stops a failure today over HTTP. What it stops is the
call libcurl reserves the right to make.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

Author: thc1006

ext/src/http/client/curl/http_client_curl.cc

@@ -49,21 +49,30 @@ namespace curl
 
 namespace
 {
-// The easy handle goes first. libcurl does not copy the header list, so it is in use for as long
-// as anything is still transferring on the handle that points at it.
+// Only ever called with the handle detached, either because it has been given back or because
+// the multi handle that held it has been cleaned up.
+//
+// The reset clears the callbacks and the pointers they are given, so that freeing the handle
+// cannot reach the operation or the event handler the caller has let go of by then. The header
+// list goes next, because libcurl does not copy it and the reset is what stops it being read.
 void ReleaseCurlResource(HttpCurlEasyResource &resource) noexcept
 {
   if (nullptr != resource.easy_handle)
   {
-    curl_easy_cleanup(resource.easy_handle);
-    resource.easy_handle = nullptr;
+    curl_easy_reset(resource.easy_handle);
   }
 
   if (nullptr != resource.headers_chunk)
   {
     curl_slist_free_all(resource.headers_chunk);
     resource.headers_chunk = nullptr;
   }
+
+  if (nullptr != resource.easy_handle)
+  {
+    curl_easy_cleanup(resource.easy_handle);
+    resource.easy_handle = nullptr;
+  }
 }
 }  // namespace