1577577 - Assertion failure: self->mExpectedPushPromiseID || self->mExpectedHeaderID, at netwerk/protocol/http/Http2Session.cpp:2474

Status: RESOLVED INACTIVE

(Core :: Networking: HTTP, defect, P2)

Description

[Christian Holler (:decoder)]

The attached testcase asserts on mozilla-central revision 993cf82f6bbf (build with --enable-tests --enable-address-sanitizer --disable-jemalloc --enable-optimize=-O2 --enable-fuzzing --enable-debug).

For detailed crash information, see attachment.

To reproduce the issue, perform the following steps:

1. Download the attached testcase, save as "test.bin".
   2a. Build with --enable-fuzzing (requires Clang and ASan, also build gtests using ./mach gtest dontruntests).
   2b. Alternatively you can download builds from TC using python -mfuzzfetch -a --fuzzing --tests gtest (see https://github.com/MozillaSecurity/fuzzfetch).
2. Run MOZ_RUN_GTEST=1 LIBFUZZER=1 FUZZER=NetworkHttp2 objdir/dist/bin/firefox test.bin

This is one of the frequent assertions that we need to fix before we can do more debug testing.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Honza Bambas (:mayhemer)]

This one looks bad. Adding Dragana in case she can see something easily here. Otherwise, we should assess how serious this assertion is and rather handle it gracefully as a possible protocol error or ignore.

Comment 4

[Valentin Gosu [:valentin] (he/him)]

Fixed by disabling HTTP/2 push in bug 1915848.