Handle reffing when a cancel or bind gets stuck in the waiting queue
diff --git a/src/core/transport/chttp2_transport.c b/src/core/transport/chttp2_transport.c
index 07c5b0b..d9c712c 100644
--- a/src/core/transport/chttp2_transport.c
+++ b/src/core/transport/chttp2_transport.c
@@ -1162,6 +1162,13 @@
   if (op->bind_pollset) {
     add_to_pollset_locked(t, op->bind_pollset);
   }
+
+  if (op->on_consumed) {
+    op_closure c;
+    c.cb = op->on_consumed;
+    c.user_data = op->on_consumed_user_data;
+    schedule_cb(t, c, 1);    
+  }
 }
 
 static void perform_op(grpc_transport *gt, grpc_stream *gs,
diff --git a/src/core/transport/transport.c b/src/core/transport/transport.c
index e0dca22..a9948cd 100644
--- a/src/core/transport/transport.c
+++ b/src/core/transport/transport.c
@@ -103,6 +103,9 @@
   if (op->recv_ops) {
     op->on_done_recv(op->recv_user_data, 0);
   }
+  if (op->on_consumed) {
+    op->on_consumed(op->on_consumed_user_data, 0);
+  }
 }
 
 void grpc_transport_op_add_cancellation(grpc_transport_op *op,
diff --git a/src/core/transport/transport.h b/src/core/transport/transport.h
index 521d74c..7f60fdc 100644
--- a/src/core/transport/transport.h
+++ b/src/core/transport/transport.h
@@ -64,6 +64,9 @@
 
 /* Transport op: a set of operations to perform on a transport */
 typedef struct grpc_transport_op {
+  void (*on_consumed)(void *user_data, int success);
+  void *on_consumed_user_data;
+
   grpc_stream_op_buffer *send_ops;
   int is_last_send;
   void (*on_done_send)(void *user_data, int success);