[chttp2] Fix fuzzer found crash (#32696)

<!--

If you know who should review your pull request, please assign it to
that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the
appropriate
lang label.

-->

src/core/ext/filters/client_channel/subchannel.cc

@@ -920,7 +920,8 @@ bool Subchannel::PublishTransportLocked() {
   // Construct channel stack.
   ChannelStackBuilderImpl builder("subchannel", GRPC_CLIENT_SUBCHANNEL,
                                   connecting_result_.channel_args);
-  builder.SetTransport(connecting_result_.transport);
+  // Builder takes ownership of transport.
+  builder.SetTransport(std::exchange(connecting_result_.transport, nullptr));
   if (!CoreConfiguration::Get().channel_init().CreateStack(&builder)) {
     return false;
   }
@@ -933,9 +934,6 @@ bool Subchannel::PublishTransportLocked() {
             key_.ToString().c_str(), StatusToString(error).c_str());
     return false;
   }
-  // Release the ownership since it is now owned by the connected filter in the
-  // channel stack (published).
-  connecting_result_.transport = nullptr;
   RefCountedPtr<channelz::SocketNode> socket =
       std::move(connecting_result_.socket_node);
   connecting_result_.Reset();

test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-5024669712646144

@@ -0,0 +1,34 @@
+actions {
+  create_channel {
+    target: "unix::p,,1,,,,::, H?:::c238:::::;::::::"
+    channel_args {
+      key: "grpc.default_authority"
+      str: "[[[[[[[[[[[[[[[E[[[[[[[[[[[[[[[[[[[[[[0<[2]<[d[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[\000"
+    }
+    channel_creds {
+      ssl_channel_creds {
+      }
+    }
+    channel_actions {
+      add_n_bytes_writable: 26888
+      add_n_bytes_readable: 8589934592
+    }
+    channel_actions {
+      add_n_bytes_readable: 26888
+      wait_ms: 1
+    }
+  }
+}
+actions {
+  get_target {
+  }
+}
+actions {
+  create_server {
+  }
+}
+actions {
+  check_connectivity: true
+}
+actions {
+}

test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-5916612266688512.fuzz

@@ -0,0 +1,249 @@
+actions {
+  create_server {
+  }
+}
+actions {
+  create_channel {
+    target: "unix::p,,2,,,,,,,,,,,,,,,,,,(:,,,6,,,,,,,,,,,,,,,,,,(:,,,6,,,,,,,,,,,,\314\272,,,,,,}\177\177\017,,,1,,,,,,,,,,,,,,,,,,(:,,,6,,,,,,,,,,,,,,,,,,(:,,,6,,,,,,,,,,,,,,,,,,,,,,,(:,,,6,,,,,,,,,,,,,,,6,grpc.internal.channel_credentials,,,,,,,,:"
+    channel_args {
+      key: "grpc.default_authority"
+      str: ""
+    }
+    channel_args {
+      key: "grpc.min_reconnect_backoff_ms"
+    }
+    channel_creds {
+      composite_channel_creds {
+        channel_creds {
+          composite_channel_creds {
+            channel_creds {
+              composite_channel_creds {
+                channel_creds {
+                  composite_channel_creds {
+                    channel_creds {
+                      ssl_channel_creds {
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+    channel_actions {
+      add_n_bytes_writable: 122045790683136
+      add_n_bytes_readable: 89
+    }
+  }
+}
+actions {
+  create_call {
+    method {
+      value: "ht_p"
+    }
+    timeout: 7012449
+  }
+}
+actions {
+  get_target {
+  }
+}
+actions {
+  ping {
+  }
+}
+actions {
+  change_active_call {
+  }
+}
+actions {
+  queue_batch {
+  }
+}
+actions {
+  get_target {
+  }
+}
+actions {
+  ping {
+  }
+}
+actions {
+  check_connectivity: true
+}
+actions {
+  create_call {
+    propagation_mask: 7995396
+    method {
+      value: "\001\n"
+    }
+    timeout: 67108864
+  }
+}
+actions {
+  cancel_call {
+  }
+}
+actions {
+  change_active_call {
+  }
+}
+actions {
+  create_call {
+    propagation_mask: 96
+    method {
+      value: "ht-tp"
+    }
+    timeout: 6383104
+  }
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}
+actions {
+}