Steps to reproduce:
1. Open the attached user's project "UnityHttpMessageHandlerTest.zip"
2. Open the "Assets/Scenes/SampleScene.unity" Scene
3. Enter Play mode
4. Wait 5 seconds
5. Observe the Console window
Actual result: A NullReferenceException is thrown by UnityWebRequest.Abort() when the CancellationToken is cancelled after the UnityHttpMessageHandler request has completed
Expected result: Cancelling the CancellationToken after the request has completed does nothing and no exception is thrown
Reproducible with: 6000.5.0a4, 6000.6.6f1, 6000.7.0b5, 7000.0.0a10
Could not test with: 6000.0.84f1, 6000.3.25f1, 6000.5.0a3 (no "UnityHttpMessageHandler" API)
Testing Environment: Windows 11
Not reproducible on: no other environment tested
Notes:
-UnityHttpMessageHandler.SendAsyncInternal registers UnityWebRequest.Abort() on the caller's CancellationToken and never disposes the CancellationTokenRegistration, so a later cancellation calls Abort() on the already disposed UnityWebRequest
-The exception is thrown from inside CancellationTokenSource.Cancel(), on the thread that cancels the token
-The timer-thread cancellation (CancelAfter) did not log a separate exception in the Console on 6000.5.0a4