CURLMOPT_PUSHFUNCTION issues on Ubuntu 24.04 (Curl 8.5.0)

[iluuu1994]

Description

See GH-16704. These tests fail yet again... They have also started leaking recently.

• ext/curl/tests/bug77535.phpt now segfaults
• ext/curl/tests/curl_pushfunction_trampoline.phpt did not previously seem to call the trampoline function. I don't understand enough about curl to judge what is the correct behavior, so I'll let somebody else handle this.

PHP Version

master, very likely same on older branches

Operating System

Ubuntu 24.04

[cmb69]

Local results of the four serverpush tests (termsig -1073741819 means segfault):

master, cURL 8.9.1, nghttp2 1.63.0

TEST 1/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug76675.phpt]
========DIFF========
001- (Received \d+)+
001+
========DONE========
FAIL Bug #76675 (Segfault with H2 server push write/writeheader handlers) [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug76675.phpt]
TEST 2/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug77535.phpt]
========DIFF========
     Start handle request.
002+ Detected memory leaks!
003+ Dumping objects ->
004+ Zend\zend_alloc.c(3280) : {34736} normal block at 0x00000242D539D410, 664 bytes long.
005+  Data: < K, B     5 B   > C0 4B 2C D5 42 02 00 00 80 D5 35 D5 42 02 00 00
006+ Zend\zend_alloc.c(3280) : {34627} normal block at 0x00000242D52615C0, 344 bytes long.
007+  Data: <                > 02 00 00 00 08 0B 00 C0 06 00 00 00 00 00 00 00
008+ Zend\zend_alloc.c(3280) : {34625} normal block at 0x00000242D51FB970, 344 bytes long.
009+  Data: <                > 02 00 00 00 08 0F 00 C0 05 00 00 00 00 00 00 00
010+ Zend\zend_alloc.c(3280) : {34616} normal block at 0x00000242D51FB690, 664 bytes long.
011+  Data: <  & B       B   > C0 00 26 D5 42 02 00 00 80 DA F0 D4 42 02 00 00
012+ Zend\zend_alloc.c(3280) : {34612} normal block at 0x00000242D51FB4F0, 344 bytes long.
013+  Data: <                > 01 00 00 00 08 1B 00 C0 03 00 00 00 00 00 00 00
014+ Zend\zend_alloc.c(3280) : {34610} normal block at 0x00000242D4FE5E70, 152 bytes long.
015+  Data: <  ! B           > 20 F8 21 D5 42 02 00 00 00 00 00 00 00 00 00 00
016+ Zend\zend_alloc.c(3280) : {34606} normal block at 0x00000242D515F3E0, 72 bytes long.
017+  Data: <                > 03 00 00 00 08 07 00 C0 01 00 00 00 00 00 00 00
018+ Object dump complete.
========DONE========
FAIL Bug #77535 (Invalid callback, h2 server push) [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug77535.phpt]
TEST 3/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction.phpt]
========DIFF========
     Array
     (
003-     [0] => main response
004-     [1] => pushed response
003+     [0] =>
004+     [1] =>
     )
========DONE========
FAIL Test CURLMOPT_PUSHFUNCTION [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction.phpt]
TEST 4/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction_trampoline.phpt]
========DIFF========
001+ Trampoline for trampoline
     Array
     (
003-     [0] => main response
004-     [1] => pushed response
004+     [0] =>
005+     [1] =>
     )
========DONE========
FAIL Test trampoline for curl option CURLMOPT_PUSHFUNCTION [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction_trampoline.phpt]

master, cURL 8.7.1, nghttp2 1.62.1

PASS Bug #76675 (Segfault with H2 server push write/writeheader handlers) [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug76675.phpt]
TEST 2/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug77535.phpt]
========DIFF========
001- Start handle request.
001+ Termsig=-1073741819
========DONE========
FAIL Bug #77535 (Invalid callback, h2 server push) [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug77535.phpt]
TEST 3/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction.phPASS Test CURLMOPT_PUSHFUNCTION [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction.phpt]
TEST 4/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction_trampoline.phpt]
========DIFF========
001+ Trampoline for trampoline
     Array
     (
         [0] => main response
--
========DONE========
FAIL Test trampoline for curl option CURLMOPT_PUSHFUNCTION [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction_trampoline.phpt]

Apparently, there have been relevant changes in cURL and/or nghttp2. Will do some further checking.

[cmb69]

cURL 8.11.0 has the same results as cURL 8.9.1 (both with nghttp2 1.63.0). cURL 8.7.1 with nghttp2 1.63.0 has the same results as with nghttp2 1.62.1, so these are likely cURL issues (although we build libcurl against shared nghttp2, so cannot exclude nghttp2 issues completely).

Oh, just noticed that this might actually be related to libssh2 1.10.0 vs 1.11.1. So built master against the stable dependencies (which are behind),

and got

PASS Bug #76675 (Segfault with H2 server push write/writeheader handlers) [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug76675.phpt]
TEST 2/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug77535.phpt]
========DIFF========
     Start handle request.
002+ Detected memory leaks!
003+ Dumping objects ->
004+ Zend\zend_alloc.c(3280) : {34642} normal block at 0x000001275E5D3200, 664 bytes long.
005+  Data: <  [^'     _^'   > A0 DF 5B 5E 27 01 00 00 10 81 5F 5E 27 01 00 00
006+ Zend\zend_alloc.c(3280) : {34536} normal block at 0x000001275E566BD0, 344 bytes long.
007+  Data: <                > 02 00 00 00 08 0B 00 C0 06 00 00 00 00 00 00 00
008+ Zend\zend_alloc.c(3280) : {34534} normal block at 0x000001275E566A30, 344 bytes long.
009+  Data: <                > 02 00 00 00 08 0F 00 C0 05 00 00 00 00 00 00 00
010+ Zend\zend_alloc.c(3280) : {34525} normal block at 0x000001275E4E0E80, 664 bytes long.
011+  Data: < UV^'      ^'   > 80 55 56 5E 27 01 00 00 90 C1 20 5E 27 01 00 00
012+ Zend\zend_alloc.c(3280) : {34521} normal block at 0x000001275E4E0CE0, 344 bytes long.
013+  Data: <                > 01 00 00 00 08 1B 00 C0 03 00 00 00 00 00 00 00
014+ Zend\zend_alloc.c(3280) : {34519} normal block at 0x000001275E2CFAB0, 152 bytes long.
015+  Data: <  N^'           > D0 0A 4E 5E 27 01 00 00 00 00 00 00 00 00 00 00
016+ Zend\zend_alloc.c(3280) : {34515} normal block at 0x000001275E444610, 72 bytes long.
017+  Data: <                > 03 00 00 00 08 07 00 C0 01 00 00 00 00 00 00 00
018+ Object dump complete.
========DONE========
FAIL Bug #77535 (Invalid callback, h2 server push) [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\bug77535.phpt]
TEST 3/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction.phPASS Test CURLMOPT_PUSHFUNCTION [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction.phpt]
TEST 4/4 [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction_trampoline.phpt]
========DIFF========
001+ Trampoline for trampoline
     Array
     (
         [0] => main response
--
========DONE========
FAIL Test trampoline for curl option CURLMOPT_PUSHFUNCTION [C:\php-sdk\phpdev\vs17\x64\php-src\ext\curl\tests\curl_pushfunction_trampoline.phpt]

Given that master-stable is basically the same as 8.3-stable, and with PHP 8.3 all three tests (_trampoline.phpt has been added later) succeed, there is likely something wrong in php-src.

[cmb69]

Re bug77535.phpt: noticed a segfault with PHP 8.4, but a mem leak with master (same dependencies); did a bisect and ended at a totally unrelated commit; did it again – another unrelated commit. Found that it's flaky (sometimes segfaults, sometimes you see the leaks). Might be an API misuse from our side.

[cmb69]

It seems to me that #16732 fixes the segfaults and memory leaks (works for me locally). At least, that needs to be fixed anyway.

• ext/curl/tests/curl_pushfunction_trampoline.phpt did not previously seem to call the trampoline function.

If "pushed response" is received, the server had pushed, and as such the CURLMOPT_PUSHFUNCTION should have been called. It has not, however, since the test was skipped because "test may crash with curl < 8.1.0" (ubuntu-20.04 has cURL 7.81.0-1ubuntu1.18).

[iluuu1994]

Thank you Christoph for taking care of this!