http2: don't call into JS from GC

Calling into JS land from GC is not allowed, so delay
the resolution of pending pings when a session is destroyed.

Backport-PR-URL: #18050
Backport-PR-URL: #20456
PR-URL: #17183
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>

Author: addaleax

src/node_http2.cc

@@ -406,7 +406,11 @@ void Http2Session::Close() {
 
   while (!outstanding_pings_.empty()) {
     Http2Session::Http2Ping* ping = PopPing();
-    ping->Done(false);
+    // Since this method may be called from GC, calling into JS directly
+    // is not allowed.
+    env()->SetImmediate([](Environment* env, void* data) {
+      static_cast<Http2Session::Http2Ping*>(data)->Done(false);
+    }, static_cast<void*>(ping));
   }
 
   Stop();