Remote connection closed when stepping backwards

I made a recording with rr record ./mach run then navigating to file:///tmp/bug1252511.html until it seg faulted. I then replayed the recording, continued to the seg fault, did rn get to the seg fault again, then rn to step to the previous line, and then rr said "Remote connection closed"

If I preattach to the rr process, I get this stack:
#0 0x00007f47d2e2e816 in __memcpy_sse2_unaligned () from /lib64/libc.so.6
#1 0x000000000072c81d in rr::Task::write_bytes_helper (this=0x860dea0, addr=..., buf_size=1048576, buf=0x8005c10, ok=0x0)

at /home/sfink/src/rr/src/Task.cc:1880

#2 0x0000000000718087 in rr::Session::finish_initializing (this=0x7ebab40) at /home/sfink/src/rr/src/Session.cc:375
#3 0x00000000006dc3c8 in rr::ReplaySession::clone (this=0x7ebab40) at /home/sfink/src/rr/src/ReplaySession.cc:154
#4 0x00000000006f167a in rr::ReplayTimeline::seek_to_before_key (this=0x7ffc7be367d0, key=...)

at /home/sfink/src/rr/src/ReplayTimeline.cc:315

#5 0x00000000006f5eec in rr::ReplayTimeline::reverse_singlestep(rr::ReplayTimeline::Mark const&, rr::TaskishUidrr::Task const&, long, std::function<bool (rr::ReplayTask*)> const&, std::function<bool ()> const&) (this=0x7ffc7be367d0, origin=...,

step_tuid=..., step_ticks=489259560, stop_filter=..., interrupt_check=...) at /home/sfink/src/rr/src/ReplayTimeline.cc:1056

#6 0x00000000006f7ab9 in rr::ReplayTimeline::reverse_singlestep(rr::TaskishUidrr::Task const&, long, std::function<bool (rr::ReplayTask*)> const&, std::function<bool ()> const&) (this=0x7ffc7be367d0, tuid=..., tuid_ticks=489259560, stop_filter=...,

interrupt_check=...) at /home/sfink/src/rr/src/ReplayTimeline.cc:1329

#7 0x0000000000654a68 in rr::GdbServer::debug_one_step (this=0x7ffc7be36790, last_resume_request=...)

at /home/sfink/src/rr/src/GdbServer.cc:1017

#8 0x0000000000655c2d in rr::GdbServer::serve_replay (this=0x7ffc7be36790, flags=...)

at /home/sfink/src/rr/src/GdbServer.cc:1257

#9 0x00000000006da702 in rr::replay (trace_dir="", flags=...) at /home/sfink/src/rr/src/ReplayCommand.cc:397
#10 0x00000000006dafde in rr::ReplayCommand::run (this=0xa055b0 rr::ReplayCommand::singleton,

args=std::vector of length 0, capacity 4) at /home/sfink/src/rr/src/ReplayCommand.cc:504

#11 0x0000000000743da5 in main (argc=4, argv=0x7ffc7be37078) at /home/sfink/src/rr/src/main.cc:270

This is with rr 8fc5abc0b9896540f03540be8a01ebeb7cd73838

Reproduce the failure with the reported rr recording and reverse-stepping sequence. Start by examining Task.cc:1880, Session.cc:375, ReplaySession.cc:154, and ReplayTimeline.cc:315, 1056, and 1329, following the stack through GdbServer.cc:1017. Done means stepping backwards through the reproduced crash no longer closes the remote connection.