Fix GCHandle leak in OSX SafeDeleteSslContext (#128325)

> [!NOTE]
> This PR was authored with help from GitHub Copilot.

The `GCHandle` allocated in `SafeDeleteSslContext.SslSetConnection` was
never freed, leaking one GCHandle table slot per SSL context on the
legacy macOS SecureTransport path.

Freeing it in `SafeDeleteSslContext.Dispose` races with in-flight native
`Read`/`Write` callbacks (reliably reproduced as a `Debug.Assert` crash
in
`SslStreamSniTest.SslStream_ServerCallbackAndLocalCertificateSelectionSet_Throws`).
Instead, ownership of the handle is moved into `SafeSslHandle` and freed
from its `ReleaseHandle`, which only runs after the ref count hits zero
and the native `SSLContext` is released, so no further callbacks can
fire.

Tested locally on osx-arm64: `System.Net.Security.Unit.Tests` (124) and
`System.Net.Security.Tests` functional (4964) all pass.

Fixes #128136

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Jan Kotas <jkotas@microsoft.com>
Co-authored-by: Miha Zupan <mihazupan.zupan1@gmail.com>

Author: 4 people

src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs

@@ -460,6 +460,13 @@ namespace System.Net
 {
     internal sealed class SafeSslHandle : SafeHandle
     {
+        // Backreference used by AppleCryptoNative_SslSetConnection so native
+        // Read/Write callbacks can resolve the owning SafeDeleteSslContext.
+        // Owned here so the lifetime is tied to ReleaseHandle, which only
+        // runs once all outstanding P/Invokes (and therefore any in-flight
+        // callbacks) have completed.
+        private GCHandle<SafeDeleteSslContext> _connectionGCHandle;
+
         public SafeSslHandle()
             : base(IntPtr.Zero, ownsHandle: true)
         {
@@ -470,10 +477,18 @@ internal SafeSslHandle(IntPtr invalidHandleValue, bool ownsHandle)
         {
         }
 
+        internal void SetConnectionGCHandle(GCHandle<SafeDeleteSslContext> handle)
+        {
+            Debug.Assert(!_connectionGCHandle.IsAllocated, "Connection GCHandle already set");
+            _connectionGCHandle = handle;
+        }
+
         protected override bool ReleaseHandle()
         {
             Interop.CoreFoundation.CFRelease(handle);
             SetHandle(IntPtr.Zero);
+            _connectionGCHandle.Dispose();
+
             return true;
         }
 

src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs

@@ -191,9 +191,10 @@ private static SafeSslHandle CreateSslContext(SslAuthenticationOptions sslAuthen
 
         private void SslSetConnection(SafeSslHandle sslContext)
         {
-            GCHandle handle = GCHandle.Alloc(this, GCHandleType.Weak);
+            var handle = new GCHandle<SafeDeleteSslContext>(this);
+            sslContext.SetConnectionGCHandle(handle);
 
-            Interop.AppleCrypto.SslSetConnection(sslContext, GCHandle.ToIntPtr(handle));
+            Interop.AppleCrypto.SslSetConnection(sslContext, GCHandle<SafeDeleteSslContext>.ToIntPtr(handle));
         }
 
         public override bool IsInvalid => _sslContext?.IsInvalid ?? true;
@@ -220,8 +221,7 @@ protected override void Dispose(bool disposing)
         [UnmanagedCallersOnly]
         private static unsafe int WriteToConnection(IntPtr connection, byte* data, void** dataLength)
         {
-            SafeDeleteSslContext? context = (SafeDeleteSslContext?)GCHandle.FromIntPtr(connection).Target;
-            Debug.Assert(context != null);
+            SafeDeleteSslContext context = GCHandle<SafeDeleteSslContext>.FromIntPtr(connection).Target;
 
             // We don't pool these buffers and we can't because there's a race between their us in the native
             // read/write callbacks and being disposed when the SafeHandle is disposed. This race is benign currently,
@@ -255,8 +255,7 @@ private static unsafe int WriteToConnection(IntPtr connection, byte* data, void*
         [UnmanagedCallersOnly]
         private static unsafe int ReadFromConnection(IntPtr connection, byte* data, void** dataLength)
         {
-            SafeDeleteSslContext? context = (SafeDeleteSslContext?)GCHandle.FromIntPtr(connection).Target;
-            Debug.Assert(context != null);
+            SafeDeleteSslContext context = GCHandle<SafeDeleteSslContext>.FromIntPtr(connection).Target;
 
             try
             {