fix(h2): do not rewind kPendingIdx past in-flight requests (#5408)

When two requests are multiplexed on one HTTP/2 session and one stream
is closed by the server before response headers, finalizeRequest(true)
unconditionally reset kPendingIdx back to kRunningIdx while the other
request was still in flight. Once the surviving request finalized,
kRunningIdx advanced past kPendingIdx, leaving a nulled queue slot that
Client[kDestroy] later splices and calls errorRequest on, crashing the
process with 'TypeError: Cannot read properties of null (reading
'onResponseError')'.

Only reset kPendingIdx when it has actually fallen behind kRunningIdx,
which is the invariant the reset was added to restore in #5090.

Fixes: #5404

Signed-off-by: Minh Le <ducminhldm@gmail.com>

Author: DucMinhNe

lib/dispatcher/client-h2.js

@@ -744,7 +744,7 @@ function writeH2 (client, request) {
     requestFinalized = true
     client[kQueue][client[kRunningIdx]++] = null
 
-    if (resetPendingIdx) {
+    if (resetPendingIdx && client[kPendingIdx] < client[kRunningIdx]) {
       client[kPendingIdx] = client[kRunningIdx]
     }
 

test/http2-destroy-after-failed-stream.js

@@ -0,0 +1,40 @@
+'use strict'
+
+const { test } = require('node:test')
+const assert = require('node:assert')
+const { createServer } = require('node:http2')
+const { once } = require('node:events')
+const { setTimeout: sleep } = require('node:timers/promises')
+const { Agent } = require('..')
+
+test('closing dispatcher after one multiplexed stream failed pre-response does not crash', async (t) => {
+  const server = createServer()
+  server.on('stream', async (stream, headers) => {
+    if (headers[':path'] === '/slow') {
+      await sleep(50)
+      stream.respond({ ':status': 200 })
+      stream.end('slow')
+    } else {
+      stream.close()
+    }
+  })
+  server.listen(0)
+  await once(server, 'listening')
+  t.after(() => server.close())
+
+  const origin = `http://localhost:${server.address().port}`
+  const dispatcher = new Agent({ connections: 1, useH2c: true })
+
+  const slow = dispatcher
+    .request({ origin, path: '/slow', method: 'GET' })
+    .then((res) => res.body.text())
+
+  await assert.rejects(
+    dispatcher.request({ origin, path: '/bad', method: 'GET' }),
+    { name: 'InformationalError' }
+  )
+
+  assert.strictEqual(await slow, 'slow')
+
+  await dispatcher.close()
+})