Fix a bug where the buffers are freed too early when a handler is removed or replaced

transport/src/main/java/io/netty/channel/DefaultChannelPipeline.java

@@ -598,9 +598,22 @@ final class DefaultChannelPipeline implements ChannelPipeline {
         }
     }
 
-    private void callAfterRemove(ChannelHandlerContext ctx) {
+    private void callAfterRemove(final ChannelHandlerContext ctx) {
+        final ChannelHandler handler = ctx.handler();
+
+        // Notify the complete removal.
+        try {
+            handler.afterRemove(ctx);
+        } catch (Throwable t) {
+            throw new ChannelPipelineException(
+                    ctx.handler().getClass().getName() +
+                    ".afterRemove() has thrown an exception.", t);
+        }
+
         // Free all buffers before completing removal.
-        ChannelHandler handler = ctx.handler();
+        ctx.executor().execute(new Runnable() {
+            @Override
+            public void run() {
                 if (handler instanceof ChannelInboundHandler) {
                     try {
                         ((ChannelInboundHandler) handler).freeInboundBuffer(ctx);
@@ -615,15 +628,8 @@ final class DefaultChannelPipeline implements ChannelPipeline {
                         notifyHandlerException(e);
                     }
                 }
-
-        // Notify the complete removal.
-        try {
-            handler.afterRemove(ctx);
-        } catch (Throwable t) {
-            throw new ChannelPipelineException(
-                    ctx.handler().getClass().getName() +
-                    ".afterRemove() has thrown an exception.", t);
             }
+        });
     }
 
     @Override