Mount namespace can be nil after task exits

Updates #1035

PiperOrigin-RevId: 404017795

runsc/boot/loader.go

@@ -950,7 +950,7 @@ func (l *Loader) executeAsync(args *control.ExecArgs) (kernel.ThreadID, error) {
 	if kernel.VFS2Enabled {
 		// task.MountNamespaceVFS2() does not take a ref, so we must do so ourselves.
 		args.MountNamespaceVFS2 = tg.Leader().MountNamespaceVFS2()
-		if !args.MountNamespaceVFS2.TryIncRef() {
+		if args.MountNamespaceVFS2 == nil || !args.MountNamespaceVFS2.TryIncRef() {
 			return 0, fmt.Errorf("container %q has stopped", args.ContainerID)
 		}
 	} else {

runsc/container/multi_container_test.go

@@ -1624,6 +1624,7 @@ func TestMultiContainerGoferKilled(t *testing.T) {
 	defer cleanup()
 
 	conf := testutil.TestConfig(t)
+	conf.VFS2 = true
 	conf.RootDir = rootDir
 
 	sleep := []string{"sleep", "100"}