Bug#1107827: https: ./methods/connect.cc:892: virtual bool TlsFd::HasPending(): Assertion `ssl' failed.

Package: apt
Version: 3.0.2
Severity: normal

Hi,

I'm upgrading a system from bookworm to trixie:
After changing the sources.list and an apt-get update, I install dpkg
and apt from the target suite, and then run an apt-get dist-upgrade.

During the fetching process of that dist-upgrade, https fails:
 https: ./methods/connect.cc:892: virtual bool TlsFd::HasPending(): Assertion `ssl' failed.
 E: Method https has died unexpectedly!
 E: Sub-process https received signal 6.

So this is with a new apt (and its direct dependencies), but the rest of
the system is still a bookworm.

It's reproducible; not quite all the time, but reasonably often
  apt-get clean -y; apt-get  dist-upgrade -d -y
results in that assertion error.

This is the backtrace:

Program terminated with signal SIGABRT, Aborted.
#0  0x00007f2520c9e95c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) bt
#0  0x00007f2520c9e95c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007f2520c49cc2 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007f2520c324ac in abort () from /lib/x86_64-linux-gnu/libc.so.6
#3  0x00007f2520c32420 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x000055e09ec9c7de in TlsFd::HasPending (this=0x55e0c752a6c0) at ./methods/connect.cc:890
#5  TlsFd::HasPending (this=0x55e0c752a6c0) at ./methods/connect.cc:890
#6  0x000055e09eca025e in HttpServerState::Go (this=this@entry=0x55e0c73a82e0, ToFile=ToFile@entry=true, Req=...) at ./methods/http.cc:774
#7  0x000055e09eca085b in HttpServerState::RunData (this=0x55e0c73a82e0, Req=...) at ./methods/http.cc:635
#8  0x000055e09ecb7689 in BaseHttpMethod::Loop (this=this@entry=0x7ffc66ccaf90) at ./methods/basehttp.cc:781
#9  0x000055e09ec96c4e in main (argv=<optimized out>) at ./methods/http.cc:1051


and a bt full:

(gdb) bt full
#0  0x00007f2520c9e95c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#1  0x00007f2520c49cc2 in raise () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#2  0x00007f2520c324ac in abort () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#3  0x00007f2520c32420 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#4  0x000055e09ec9c7de in TlsFd::HasPending (this=0x55e0c752a6c0) at ./methods/connect.cc:890
        buf = <optimized out>
        __PRETTY_FUNCTION__ = <optimized out>
#5  TlsFd::HasPending (this=0x55e0c752a6c0) at ./methods/connect.cc:890
        buf = 0 '\000'
        __PRETTY_FUNCTION__ = <optimized out>
#6  0x000055e09eca025e in HttpServerState::Go (this=this@entry=0x55e0c73a82e0, ToFile=ToFile@entry=true, Req=...) at ./methods/http.cc:774
        ServerPending = <optimized out>
        rfds = {fds_bits = {8, 0 <repeats 15 times>}}
        wfds = {fds_bits = {16, 0 <repeats 15 times>}}
        MaxFd = <optimized out>
        tv = {tv_sec = 0, tv_usec = 0}
        Res = <optimized out>
        __d = <optimized out>
        __d = <optimized out>
#7  0x000055e09eca085b in HttpServerState::RunData (this=0x55e0c73a82e0, Req=...) at ./methods/http.cc:635
        result = <optimized out>
#8  0x000055e09ecb7689 in BaseHttpMethod::Loop (this=this@entry=0x7ffc66ccaf90) at ./methods/basehttp.cc:781
        Result = <optimized out>
        times = {{tv_sec = 1734098919, tv_usec = 0}, {tv_sec = 1734098919, tv_usec = 0}}
        Result = <optimized out>
        Req = {Major = 1, Minor = 1, Result = 200,
          Code = " OK\000https", '\000' <repeats 11 times>, "0\254\314f\374\177", '\000' <repeats 26 times>, "P\254\314f\374\177", '\000' <repeats 26 times>, "\200CS\307\340U\000\000\020\000\000\000\000\000\000\000\036", '\000' <repeats 15 times>, "0*Q\307\340U\000\000:\000\000\000\000\000\000\000:\000\000\000\000\000\000\000ATION=C\000\000\000\000\000EMENT=C;LC_IELEPHONE=C;LC_MEC_ADDRESS=C;LC_T", '\000' <repeats 112 times>..., TotalFileSize = 69360, DownloadSize = 69360, JunkSize = 0, StartPos = 0, MaximumSize = 1464364, Date = 1734098616,
          haveContent = HaveContent::TRI_TRUE, Encoding = RequestState::Stream, State = RequestState::Data, Location = "", RetryAfter = 0, File = <incomplete type>, Owner = 0x7ffc66ccaf90, Server = 0x55e0c73a82e0}
        Res = <incomplete type>
        FailCounter = <optimized out>
#9  0x000055e09ec96c4e in main (argv=<optimized out>) at ./methods/http.cc:1051
        Binary = ""
(gdb)


This happens with a single source in my sources.lists{,.d}:
  deb https://debian.conova.eu/debian trixie main

Note that this mirror is close and fast, with RTTs sub 1ms, so triggering races
is a possibility.

Cheers,
weasel
-- 
                            |  .''`.       ** Debian **
      Peter Palfrader       | : :' :      The  universal
 https://www.palfrader.org/ | `. `'      Operating System
                            |   `-    https://www.debian.org/