[release/7.0] Fix WebProxy Race Condition Issue (#75246)

* Update: Fix Race Condition Issue

* Update: Review changes

* Update: Review change

Co-authored-by: Miha Zupan <mihazupan.zupan1@gmail.com>

* Update: Add comment to volatile field

Co-authored-by: Stephen Toub <stoub@microsoft.com>

* Update src/libraries/System.Net.WebProxy/src/System/Net/WebProxy.cs

Co-authored-by: Karel Zikmund <karelz@microsoft.com>

Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>
Co-authored-by: Miha Zupan <mihazupan.zupan1@gmail.com>
Co-authored-by: Stephen Toub <stoub@microsoft.com>
Co-authored-by: Karel Zikmund <karelz@microsoft.com>

Author: 5 people

src/libraries/System.Net.WebProxy/src/System/Net/WebProxy.cs

@@ -8,6 +8,7 @@
 using System.Globalization;
 using System.Runtime.Serialization;
 using System.Text.RegularExpressions;
+using System.Threading;
 
 namespace System.Net
 {
@@ -127,10 +128,9 @@ public bool UseDefaultCredentials
 
         private void UpdateRegexList()
         {
-            Regex[]? regexBypassList = null;
             if (_bypassList is ChangeTrackingArrayList bypassList)
             {
-                bypassList.IsChanged = false;
+                Regex[]? regexBypassList = null;
                 if (bypassList.Count > 0)
                 {
                     regexBypassList = new Regex[bypassList.Count];
@@ -139,9 +139,14 @@ private void UpdateRegexList()
                         regexBypassList[i] = new Regex((string)bypassList[i]!, RegexOptions.IgnoreCase | RegexOptions.CultureInvariant);
                     }
                 }
-            }
 
-            _regexBypassList = regexBypassList;
+                _regexBypassList = regexBypassList;
+                bypassList.IsChanged = false;
+            }
+            else
+            {
+                _regexBypassList = null;
+            }
         }
 
         private bool IsMatchInBypassList(Uri input)
@@ -219,7 +224,10 @@ public ChangeTrackingArrayList() { }
 
             public ChangeTrackingArrayList(ICollection c) : base(c) { }
 
-            public bool IsChanged { get; set; }
+            // While this type isn't intended to be mutated concurrently with reads, non-concurrent updates
+            // to the list might result in lazy initialization, and it's possible concurrent HTTP requests could race
+            // to trigger that initialization.
+            public volatile bool IsChanged;
 
             // Override the methods that can add, remove, or change the regexes in the bypass list.
             // Methods that only read (like CopyTo, BinarySearch, etc.) and methods that reorder