When session.destroy() is called from a 'stream' handler, MakeCallback drains nextTick while nghttp2 is still inside mem_recv. Session close is deferred for that window (from #64166), so later HEADERS in the same receive buffer created C++ streams without a JS wrapper / onread. Subsequent DATA delivery hit:

Assertion failed: onread->IsFunction()
  <- StreamBase::CallJSOnreadMethod
  <- Http2StreamListener::OnStreamRead
  <- Http2Session::OnDataChunkReceived

Changes

1. Do not create streams while the session is closing (OnBeginHeadersCallback) — RST with NGHTTP2_CANCEL instead.
2. If on_headers runs after JS destroy, destroy the C++ handle (mirrors the existing session.closed path).
3. Defensive: drop DATA when onread is not a function rather than aborting.
4. Regression test exercising concurrent POSTs with session.destroy() from the stream handler.

Test plan

• New test/parallel/test-http2-session-destroy-stream-handler.js (40 rounds × 8 concurrent POSTs)

Fixes #64850

AI/LLM disclosure

• AI coding tools (including Grok and/or Codex agent-assisted editing) were used to help draft or modify code and this PR description.
• I reviewed the complete change, understand the reasoning, and added the regression test listed above.
• This submission is original work of authorship under the project CLA / contributor terms; AI output was not pasted unreviewed.