quic: fix segfault after fragmented client hello

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: #64720
Reviewed-By: Aviv Keller <me@aviv.sh>

Author: pimterry

src/quic/session.cc

@@ -2813,9 +2813,9 @@ bool Session::ReadPacket(const uint8_t* data,
 Debug(this, "Session successfully received %zu-byte packet", len);
 if (!is_destroyed()) [[likely]] {
 STAT_INCREMENT_N(Stats, bytes_received, len);
-// Process deferred operations that couldn't run inside callback
-//scopes (e.g., HTTP/3 GOAWAY handling that calls into JS).
-application().PostReceive();
+// Process deferred application operations after ALPN selection - not
+//necessarily resolved yet as ClientHello can span multiple packets.
+if (has_application()) application().PostReceive();
 // Surface a server session to JS once its ClientHello has been
 // processed (OnSelectAlpn fired: SNI + ALPN are known and reliable).
 // Held first-flight events - including 0-RTT request streams - replay

test/parallel/test-quic-multipacket-clienthello.mjs

@@ -0,0 +1,60 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// A large post-quantum key share splits the ClientHello across QUIC Initial
+// packets. The server must accept the incomplete first packet before ALPN has
+// selected its application, then complete the handshake and process streams.
+
+import{hasQuic,skip,mustCall}from'../common/index.mjs';
+importassertfrom'node:assert';
+import*asfixturesfrom'../common/fixtures.mjs';
+
+if(!hasQuic){
+skip('QUIC is not enabled');
+}
+
+const{ createPrivateKey }=awaitimport('node:crypto');
+const{ listen, connect }=awaitimport('node:quic');
+const{ bytes }=awaitimport('stream/iter');
+
+constkey=createPrivateKey(fixtures.readKey('agent1-key.pem'));
+constcert=fixtures.readKey('agent1-cert.pem');
+constalpn='quic-multipacket-clienthello';
+constgroups='X25519MLKEM768';
+conststreamReceived=Promise.withResolvers();
+
+constendpoint=awaitlisten(mustCall(async(session)=>{
+constinfo=awaitsession.opened;
+assert.strictEqual(session.alpnProtocol,alpn);
+assert.strictEqual(info.cipherVersion,'TLSv1.3');
+
+session.onstream=mustCall(async(stream)=>{
+assert.strictEqual(
+Buffer.from(awaitbytes(stream)).toString(),
+'application event survived',
+);
+stream.writer.endSync();
+awaitstream.closed;
+streamReceived.resolve();
+});
+}),{
+host: '127.0.0.1',
+port: 0,
+alpn: [alpn],
+ groups,
+sni: {'*': {keys: [key],certs: [cert]}},
+});
+
+constsession=awaitconnect(endpoint.address,{
+ alpn,
+ groups,
+servername: 'localhost',
+verifyPeer: 'manual',
+});
+
+awaitsession.opened;
+conststream=awaitsession.createBidirectionalStream({
+body: 'application event survived',
+});
+awaitPromise.all([stream.closed,streamReceived.promise]);
+awaitsession.close();
+awaitendpoint.close();