From 916e20ce85612305c7c747ce224652e26eb73bc5 Mon Sep 17 00:00:00 2001
From: Dominik Picheta <dominik@cloudflare.com>
Date: Wed, 3 Jul 2024 14:00:03 +0000
Subject: [PATCH] Fixes Socket::startTls assert failure when request IoContext
 ends.

---
 src/workerd/api/sockets.c++ | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/workerd/api/sockets.c++ b/src/workerd/api/sockets.c++
index 76973ad0a71..d7faf1c05f6 100644
--- a/src/workerd/api/sockets.c++
+++ b/src/workerd/api/sockets.c++
@@ -339,7 +339,11 @@ jsg::Ref<Socket> Socket::startTls(jsg::Lock& js, jsg::Optional<TlsOptions> tlsOp
       }
     }
 
-    // All non-secure sockets should have a tlsStarter.
+    // All non-secure sockets should have a tlsStarter. Though since tlsStarter is an IoOwn, if
+    // the request's IoContext has ended then `tlsStarter` will be null. This can happen if the
+    // flush operation is taking a particularly long time (EW-8538), so we throw a JSG error if
+    // that's the case.
+    JSG_REQUIRE(*tlsStarter != nullptr, "The request has finished before startTls completed.");
     auto secureStream = KJ_ASSERT_NONNULL(*tlsStarter)(acceptedHostname).then(
       [stream = connectionStream->addWrappedRef()]() mutable -> kj::Own<kj::AsyncIoStream> {
         return kj::mv(stream);