bugfix: SIGSEGV in receiveuntil __gc on aborted multipart upload.

read_error_retval_handler calls finalize_read_part directly when
the receiveuntil iterator's recv errors. That clears u->buf_in
but leaves cp->upstream live with cp->state > 0. Later GC fires
cleanup_compiled_pattern -> read_prepare, which derefs the
now-NULL u->buf_in.

Mirror tcp_finalize's cp->upstream = NULL detach so __gc's
existing `if (u != NULL)` guard short-circuits.

Author: climagabriel

src/ngx_http_lua_socket_tcp.c

@@ -4203,6 +4203,12 @@ ngx_http_lua_socket_tcp_finalize_read_part(ngx_http_request_t *r,
         ngx_memzero(&u->buffer, sizeof(ngx_buf_t));
     }
 
+    /* mirror tcp_finalize: detach cp so its __gc is safe */
+    if (u->input_filter_ctx != NULL && u->input_filter_ctx != u) {
+        ((ngx_http_lua_socket_compiled_pattern_t *)
+         u->input_filter_ctx)->upstream = NULL;
+    }
+
     if (u->raw_downstream || u->body_downstream) {
         if (r->connection->read->timer_set) {
             ngx_del_timer(r->connection->read);