Fix a long-standing bug in the math around continue_processing

src/RunState.cc

@@ -527,12 +527,13 @@ void continue_processing()
 		detail::current_wallclock = util::current_time(true);
 		}
 
-	--_processing_suspended;
+	if ( _processing_suspended > 0 )
+		--_processing_suspended;
 	}
 
 bool is_processing_suspended()
 	{
-	return _processing_suspended;
+	return _processing_suspended > 0;
 	}
 
 	} // namespace zeek::run_state

testing/btest/Baseline/core.suspend_processing.suspension-stack/output

@@ -0,0 +1,6 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+F
+F
+T
+F
+F

testing/btest/core/suspend_processing/suspension-stack.zeek

@@ -0,0 +1,31 @@
+# @TEST-DOC: Test that chains of suspend_processing/continue_processing report the correct suspension status
+# @TEST-EXEC: zeek %INPUT >output
+# @TEST-EXEC: btest-diff output
+
+event zeek_init()
+{
+# Paired suspend/continue should unsuspend.
+suspend_processing();
+continue_processing();
+print is_processing_suspended(); # F
+
+# Another continue after unsuspending shouldn't cause it to be suspended.
+continue_processing();
+print is_processing_suspended(); # F
+
+# Test suspend "stack" by suspending twice
+suspend_processing();
+suspend_processing();
+
+# First continue should still be suspended
+continue_processing();
+print is_processing_suspended(); # T
+
+# Second continue should break the suspension
+continue_processing();
+print is_processing_suspended(); # F
+
+# Third continue should still be marked as not suspended.
+continue_processing();
+print is_processing_suspended(); # F
+}