Skip to content

Spinquic: Assert FrameCount == 0 in QuicPacketBuilderFinalize when Datagram is NULL with frames pending #6215

Description

Bug

QuicPacketBuilderFinalize can reach its final QuicPacketBuilderValidate with Builder->Datagram == NULL but Builder->Metadata->FrameCount != 0, tripping the assert FrameCount == 0 (packet_builder.c:83) and aborting (Debug).

The early-exit block in Finalize only unwinds frame state when Datagram != NULL; when it's entered with Datagram == NULL && FrameCount != 0 (and FlushBatchedDatagrams, TotalCountDatagrams != 0), it goto Exit without resetting FrameCount, then SendBatch + validate fails.

Stack (Debug)

quic_bugcheck            packet_builder.c:83  ("Builder->Metadata->FrameCount == 0")
QuicPacketBuilderValidate  packet_builder.c:83
QuicPacketBuilderFinalize  packet_builder.c:1085
QuicSendFlush              send.c:1469

Repro

Debug + ASAN Stress/spinquic (linux, io_uring). Surfaced by SpinQuic settings-randomization coverage (#6204); appears to be a pre-existing core send-path bug, not caused by that PR.

Metadata

Metadata

Labels

Area: CoreRelated to the shared, core protocol logic

Type

Projects

Status
No status

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions