Detach a write request from its handle before the completion notify (#310)

[EdmondDantes]

Fixes #310. io_pipe_write_cb cleared req->io after notifying the handle's listeners, and a listener that disposes the request inside the notify and submits the next write there (true-async-server's log sink) frees it at once; the next request takes the same address, and the store after the notify cleared io on that in-flight request, whose completion then dereferenced a NULL handle. The request is now detached before the notify, which keeps what e821878 added the store for: a dispose after a later resume does not read a closed handle. The awaited io_pipe_writev_cb path had the same order and gets the same change.

Evidence:

• sapi/asynctest/tests/test_write_resubmit.c (true-async/php-src, branch asynctest-write-resubmit): SIGSEGV 3 of 3 on ef85610, passes 3 of 3 here; the test skips itself if the allocator does not reuse the address, and it did not skip. listen_pause, listen_uaf and timer_overflow pass here.
• true-async-server core/030 built with --enable-http-server-test-hooks: SIGSEGV 2 of 2 direct runs and 3 of 3 under run-tests on ef85610, passes 5 of 5 here.
• php-async phpt: 1214 of 1220, 98 skipped; the 6 failures include php-src helpers through ../../../../, which misses when ext/async is a symlink, as on Pause a stopped listen event instead of accepting through it (#305) #306.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!