use-after-free when a nested any_completion_handler is destroyed without being invoked

[biljazovic]

Example:

int main() {
  asio::cancellation_signal sig;

  asio::any_completion_handler<void()> inner(
    asio::bind_allocator(std::pmr::polymorphic_allocator<char>{}, []() {}));

  asio::any_completion_handler<void()> outer(
    asio::bind_cancellation_slot(sig.slot(), std::move(inner)));

  return 0;
}

See ASAN report: https://godbolt.org/z/5sTY9PPr5.
any_completion_handler_impl::destroy() uses handler's associated allocator after destroying the handler. This diff fixes the issue:

   void destroy()
   {
     deleter d{
         (get_associated_allocator)(handler_,
           asio::recycling_allocator<void>())};

-    d(this);
+    std::unique_ptr<any_completion_handler_impl, deleter> ptr(this, d);
+    Handler handler(static_cast<Handler&&>(handler_));
+    ptr.reset();
   }

Thanks