Fix race condition in PartGenerator

This commit fixes a race condition in PartGenerator, used by
DefaultPartHttpMessageReader. The condition can occur when a
completion signal comes in, and the state is changed to IdleFileState
at the same time.

Closes gh-28963

spring-web/src/main/java/org/springframework/http/codec/multipart/PartGenerator.java

@@ -746,8 +746,15 @@ final class PartGenerator extends BaseSubscriber<MultipartParser.Token> {
 
 		@Override
 		public void partComplete(boolean finalPart) {
-			this.completed = true;
-			this.finalPart = finalPart;
+			State state = PartGenerator.this.state.get();
+			// writeComplete might have changed our state to IdleFileState
+			if (state != this) {
+				state.partComplete(finalPart);
+			}
+			else {
+				this.completed = true;
+				this.finalPart = finalPart;
+			}
 		}
 
 		public void writeBuffer(DataBuffer dataBuffer) {
@@ -771,14 +778,16 @@ final class PartGenerator extends BaseSubscriber<MultipartParser.Token> {
 
 		private void writeComplete() {
 			IdleFileState newState = new IdleFileState(this);
-			if (this.completed) {
-				newState.partComplete(this.finalPart);
-			}
-			else if (this.disposed) {
+			if (this.disposed) {
 				newState.dispose();
 			}
 			else if (changeState(this, newState)) {
-				requestToken();
+				if (this.completed) {
+					newState.partComplete(this.finalPart);
+				}
+				else {
+					requestToken();
+				}
 			}
 			else {
 				MultipartUtils.closeChannel(this.channel);