1750978 - Crash in [@ neqo_transport::connection::Connection::input_path]

Status: RESOLVED INCOMPLETE

(Core :: Networking: HTTP, defect, P2)

Description

[Freaked Enough]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/666270cb-ce60-4e6e-9fbf-a74470220119

Reason: SIGSEGV / SEGV_ACCERR

Top 10 frames of crashing thread:

0 None @0x00007fc7a19799c0 
1 libxul.so core::fmt::write library/core/src/fmt/mod.rs:1163
2 libxul.so alloc::fmt::format library/alloc/src/fmt.rs:579
3 libxul.so neqo_transport::connection::Connection::input_path third_party/rust/neqo-transport/src/connection/mod.rs:1346
4 libxul.so neqo_transport::connection::Connection::input third_party/rust/neqo-transport/src/connection/mod.rs:1295
5 libxul.so neqo_transport::connection::Connection::process_input third_party/rust/neqo-transport/src/connection/mod.rs:891
6 libxul.so neqo_http3::connection_client::Http3Client::process_input third_party/rust/neqo-http3/src/connection_client.rs:467
7 libxul.so neqo_http3conn_process_input netwerk/socket/neqo_glue/src/lib.rs:263
8 libxul.so mozilla::net::Http3Session::ProcessInput netwerk/protocol/http/Http3Session.cpp:295
9 libxul.so mozilla::net::Http3Session::RecvData netwerk/protocol/http/Http3Session.cpp:1158

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: HTTP' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The product::component has been changed since the backlog priority was decided, so we're resetting it.
For more information, please visit auto_nag documentation.

Comment 3

[Valentin Gosu [:valentin] (he/him)]

I don't really understand this crash. Could you take a look?

Comment 4

[Dragana Damjanovic [:dragana]]

I am not sure what is happing either.
This crash is for out-of-bound https://crash-stats.mozilla.org/report/index/02708507-0e63-4026-881e-e39750211226
That is the only Linux crash. The other crashes are different.

Keeping needinfo.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a crash signature, thus the bug will be considered confirmed.

Comment 6

[Dragana Damjanovic [:dragana]]

I have opened a neqo issue: https://github.com/mozilla/neqo/issues/1363

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

Often-wildptr crash, low frequency (~4/week).

Interesting because we're seeing wildptr crashes from Rust code

Seems associated with packet.decrypt

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The severity field for this bug is set to S3. However, the bug is flagged with the sec-high keyword.
:valentin, could you consider increasing the severity of this security bug?

For more information, please visit auto_nag documentation.

Comment 9

[Tom Ritter [:tjr]]

While this is still happening, it is on file in neqo and not currently actionable.

Comment 10

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit BugBot documentation.