quic: SIGSEGV on exit after a client writes to a unidirectional stream on an h3 session

[trivikr]

Version

main

Platform

N/A

Subsystem

quic

What steps will reproduce the bug?

import { readFileSync } from 'node:fs';
import { createPrivateKey } from 'node:crypto';
import { listen, connect } from 'node:quic';

// in the repo, the keys are in test/fixtures/keys
const key = createPrivateKey(readFileSync('/path/to/key.pem'));
const cert = readFileSync('/path/to/cert.pem');

// ALPN defaults to 'h3'.
const endpoint = await listen(() => {}, { sni: { '*': { keys: [key], certs: [cert] } } });
const session = await connect(endpoint.address, { servername: 'localhost', verifyPeer: 'manual' });

const stream = await session.createUnidirectionalStream();
stream.writer.writeSync('x');

await endpoint.destroy();
console.log('reached end of script');

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

exit code 0 with no crash.

The client opens a plain unidirectional stream on an HTTP/3 connection, which is not a valid h3 stream, so the server should treat it as a protocol error or discard it, and either way tear down cleanly.

What do you see instead?

reached end of script
zsh: segmentation fault (core dumped)  ../node/node --experimental-quic --no-warnings repro.js

The script runs to completion and prints reached end of script, then the process dies with SIGSEGV instead of exiting 0. The crash is therefore after endpoint.destroy() has resolved, during process teardown, not inside any QUIC call the script awaits. Nothing is reported on the JS side: no error, no rejection, no warning.

Additional information

Observations:

• ALPN must be h3. With a custom ALPN (alpn: ['test-proto']) the same script exits cleanly, and the stream is delivered to onstream as expected.
• The write is required. Dropping stream.writer.writeSync('x') makes it exit cleanly.
• onstream is irrelevant: it crashes whether or not the server registers one. That distinguishes it from quic: crash when incoming unidirectional stream has no onstream handler #64030, which required no onstream and a non-h3 ALPN, and was fixed in July.
• Teardown is what surfaces it. endpoint.destroy() alone is enough, and close() on both sides also crashes. With no teardown the process just hangs on open handles.
• On h3 the stream never reaches JavaScript, since nghttp3 consumes non-request streams internally, so no JS-visible stream object is involved.

[trivikr]

Noticed while reviewing #65335 (comment)