[fuzzing] Fix a case whereby a call can become permanently stuck after deadline expiry (#34681)

Co-authored-by: ctiller <ctiller@users.noreply.github.com>

src/core/lib/channel/promise_based_filter.cc

@@ -720,7 +720,7 @@ void BaseCallData::ReceiveMessage::OnComplete(absl::Status status) {
       Crash(absl::StrFormat("ILLEGAL STATE: %s", StateString(state_)));
     case State::kForwardedBatchNoPipe:
       state_ = State::kBatchCompletedNoPipe;
-      return;
+      break;
     case State::kForwardedBatch:
       state_ = State::kBatchCompleted;
       break;
@@ -783,6 +783,8 @@ void BaseCallData::ReceiveMessage::Done(const ServerMetadata& metadata,
       }
     } break;
     case State::kBatchCompletedNoPipe:
+      state_ = State::kBatchCompletedButCancelledNoPipe;
+      break;
     case State::kBatchCompletedButCancelled:
     case State::kBatchCompletedButCancelledNoPipe:
       Crash(absl::StrFormat("ILLEGAL STATE: %s", StateString(state_)));

test/core/end2end/fuzzers/client_fuzzer_corpus/6262489504350208

@@ -0,0 +1,54 @@
+network_input {
+  input_segments {
+    segments {
+      repeated_zeros: 67108864
+    }
+  }
+}
+api_actions {
+  create_call {
+    method {
+      value: "B"
+    }
+    host {
+      value: "B"
+    }
+    timeout: -2
+  }
+}
+api_actions {
+  get_target {
+  }
+}
+api_actions {
+  disable_tracer: "\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177\177"
+}
+api_actions {
+  queue_batch {
+    operations {
+    }
+    operations {
+      receive_message {
+      }
+    }
+    operations {
+      flags: 8192
+    }
+    operations {
+      receive_status_on_client {
+      }
+    }
+  }
+}
+event_engine_actions {
+  assign_ports: 0
+  assign_ports: 0
+  connections {
+  }
+}
+config_vars {
+  verbosity: "\177\177"
+  experiments: 8863084066665136128
+}
+channel_args {
+}