Http2Stream.SendDataAsync can throw NullReferenceException when the stream completes during a credit wait #136841

Hit a NullReferenceException from Http2Stream.SendDataAsync on 10.0.14, linux-x64, in a gRPC client stream (Grpc.Net.Client 2.85.0) that the server ends with trailers while the client is still writing and out of stream credit:

System.NullReferenceException: Object reference not set to an instance of an object.
   at System.Net.Http.Http2Connection.Http2Stream.SendDataAsync(ReadOnlyMemory`1 buffer, CancellationToken cancellationToken)
   at Grpc.Net.Client.Internal.StreamExtensions.WriteMessageAsync[TMessage](...)

Reading the source, I think it's this: SendDataAsync sets up _creditWaiter under _creditSyncObject, leaves the lock, then reads _creditWaiter again for the await (L1294-L1312). Complete() on another thread can null it under that same lock in between (L391-L399). Same code on main.

Complete() only runs once the request content returned, so this needs a write still going after the content ended. Grpc.Net.Client does that when a call ends (grpc/grpc-dotnet#2787). Could be you consider that the content's bug and not yours, fair enough, but a local copy of the waiter would turn the NRE into the usual cancellation. Locally we also saw the write hang instead, I think when it takes the lock after Complete() and waits on a fresh waiter, but that part is a guess from the source.

It is a timing race: about 1 in 70 runs of our test under CPU load, never on an idle box. No standalone repro yet; the failing test is here, and we work around it by holding the content open until the write returns (tcortega/Whatsmeow.NET#73). Happy to try a smaller repro if that helps.