Prevent unsafe ChannelFutures from being passed to a pipeline

transport/src/main/java/io/netty/channel/ChannelFuture.java

@@ -322,4 +322,12 @@ public interface ChannelFuture {
      *         the specified time limit
      */
     boolean awaitUninterruptibly(long timeoutMillis);
+
+    /**
+     * A {@link ChannelFuture} which is not allowed to be sent to {@link ChannelPipeline} due to
+     * implementation details.
+     */
+    interface Unsafe extends ChannelFuture {
+        // Tag interface
+    }
 }

transport/src/main/java/io/netty/channel/DefaultChannelPipeline.java

@@ -858,6 +858,12 @@ public class DefaultChannelPipeline implements ChannelPipeline {
             throw new IllegalArgumentException(String.format(
                     "future.channel does not match: %s (expected: %s)", future.channel(), channel()));
         }
+        if (future.isDone()) {
+            throw new IllegalArgumentException("future already done");
+        }
+        if (future instanceof ChannelFuture.Unsafe) {
+            throw new IllegalArgumentException("internal use only future not allowed");
+        }
     }
 
     private DefaultChannelHandlerContext firstInboundContext() {

transport/src/main/java/io/netty/channel/VoidChannelFuture.java

@@ -1,14 +1,8 @@
 package io.netty.channel;
 
-import io.netty.logging.InternalLogger;
-import io.netty.logging.InternalLoggerFactory;
-
 import java.util.concurrent.TimeUnit;
 
-public class VoidChannelFuture implements ChannelFuture {
-
-    private static final InternalLogger logger =
-        InternalLoggerFactory.getInstance(VoidChannelFuture.class);
+public class VoidChannelFuture implements ChannelFuture.Unsafe {
 
     private final Channel channel;