bryancall opened a new pull request, #14001: URL: https://github.com/apache/trafficserver/pull/14001
When an HTTP/3 client closed its connection with requests still in flight, traffic_server could crash. QPACK hands a finished header decode back by scheduling an event to the header handler inside the stream's transaction, and nothing withdrew that event when the transaction was deleted first, so it ran against a transaction that no longer existed. Under sustained h3 load this happened on almost every run. QPACK now delivers each result through a small continuation it keeps on a list until it runs, and implements `QPACK::cancel()`, which was declared but never defined. `cancel()` withdraws any result still queued for the stream and drops a blocked decode for it, and the header handler calls it from its destructor. QPACK also frees whatever is still queued or blocked when it is destroyed. `decode()` and `cancel()` document and assert that they run on the thread the result is delivered on, and the QPACK unit tests now start their decodes there. New unit tests cover a cancel before and after delivery, a cancel leaving another stream's result alone, the report from a decoder that has already failed, and a cancelled blocked decode giving up its blocked-stream slot. Each of them fails against a `cancel()` that does nothing. The destructor call itself is covered by an ASAN build under h3 load rather than a unit test, because the header handler only exists inside an `Http3Transaction`: the crash reproduced on every run before this change and on none of 36 runs after it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
