http3: accept a QPACK field section with no field lines; node:quic sends none for empty hints, or for empty trailers after headers - #46012

Origin. Found while testing node:quic. No user reported it. node:quic, fetch over HTTP/3 and Bun.serve HTTP/3 are experimental. The frame came from Bun's own node:quic sender. I did not look for other stacks that write it.

Reproduction. A node:quic server answers /open with headers and one chunk and does not end it. It answers /hello with hello, endSync(), and this.sendTrailers({}) from onwanttrailers. A client reads both on one session.

Bun 1.4.2 and main:
origin: onwanttrailers, this.id=4, this === /open stream: false
client: /open (id 0) ENDED with "first chunk of /open"
client: /hello body "hello"

this PR: the /open line is absent.

The same happens with fetch(url, { protocol: "http3" }) as the client: the next read() of the open body resolves done: true.

Node v26.12.0. Built from source with QUIC enabled (nghttp3 1.18.0). Same server callbacks, frames from qlog:

server: onwanttrailers on stream 0; sendTrailers({}) = true
server: second sendTrailers = false
RESULT: stream ended=true body="hello" client ontrailers calls=0 client session=open
server-sent STREAM frames on stream 0: off=0 len=12 fin=false | off=12 len=0 fin=true

• sendInformationalHeaders({}) returns true and writes nothing.
• A Node client of a Bun 1.4.2 server gets ontrailers {} and keeps the session. So Node decodes the block and never sends it.
• This PR, lsquic log of the same stream: shutdown; how: 1, have to create a separate STREAM frame with FIN flag in it. The peer logs received stream frame, offset 12, len 0; fin: 1.

Mixed versions. Server calls sendTrailers({}) with a second stream open.

Sender rule. put_header_block decides for the live call and for the queue of a stream that is not open yet. It leaves the frame out on a bidirectional stream whose send side is not ended and not reset. Trailers also need a header block that lsquic took before, because lsquic resets a request stream whose FIN comes before one. Anywhere else the call goes to lsquic_stream_send_headers as before.

The reason for the rule is the peer: a decoder that fails the block closes the connection, and released Bun is such a peer. Node v26.12.0 writes the same bytes (above).

"Both calls" are sendInformationalHeaders({}) and sendTrailers({}). An INITIAL-kind block keeps its frame. lsquic resets a stream that ends with no header block, and Node writes DATA with no HEADERS for sendHeaders({}), which closes the connection. Since #46021 a session that is not HTTP/3 throws ERR_INVALID_STATE for every header call, so the rule has no HTTP/3 condition.

Measurements. Release builds of main at 0c864a0, without and with this diff, on the same machine.

• node:quic sendHeaders, block with fields: +8 instructions per call for a block queued before the stream opens (140 to 148), +9 on an open stream (153 to 162 headers, 146 to 155 trailers). gdb step count inside QuicStreamPrototype__sendHeaders, two runs each.
• QPACK decode: +0 instructions per block when a field line follows the prefix (449 to 449, 919 to 919), +2 when a read ends at the prefix (1694 to 1696). 1,000,000 decodes each, release flags, user-space instruction counter. Measured at 017b243 with the same patch code.
• release text: +272 bytes (.text 81,905,509 to 81,905,781). The stripped binary stays at 107,497,184 bytes. QuicStreamPrototype__sendHeaders 1182 to 1254 bytes, bind_raw 1194 to 1307, parse_header_prefix 971 to 977. QuicStream 216 to 216 bytes: the new flag fills padding. pending_headers element 32 to 32 bytes.
• host functions +0, FFI symbols +0.
• decoder differential: both decoders in one process, fed as lsquic feeds them. Every 2-byte and 3-byte block in every split, with an empty and a non-empty dynamic table: 3,064 of 134,479,872 decodes differ. 3,000,000 uniform random blocks of 4 to 12 bytes (seed 20261020), both tables: 8 of 6,000,000 differ. Every difference is a block that is only its prefix, with Required Insert Count 0: ERROR to DONE with no headers. 0 other differences. Half of those blocks have the Sign bit set. ls-qpack already accepts that prefix when a field line follows it (00 80 d1).
• the 28 cases: 7 need only src/ (they fail with src/ from main), 16 need only the patch (they fail with the patch dropped), 5 need neither and pin behavior that must not change. 23 fail on main and on Bun 1.4.2. One fetch case with a content-length passes in some runs without the patch.
• each condition of put_header_block has a case that fails without it: the two cases with sendTrailers({}) as the first block, the unidirectional case, and the cases after the FIN and after a reset.
• call orders equal to Node v26.12.0: 12 of 20 (Bun 1.4.2 and main: 6 of 20). Measured on the first version of this PR. The change since then is in the orders with trailers before headers, which differ from Node before and after. Connection aborts for sendTrailers({}): 1 to 0.

The 8 orders that still differ are the same with trailers that have fields: sendTrailers() while body bytes wait in the writer drops them, pendingTrailers alone does not ask for trailers (its setter does not set wantsTrailers), and trailers before headers.

Not in this PR.

• A block with no field lines that is the first block of a stream is still written: sendHeaders({}), createBidirectionalStream({ headers: {} }), and sendTrailers({}) before sendHeaders(). A released Bun peer closes the connection on it. Node has no behavior to copy: it writes DATA with no HEADERS for sendHeaders({}), and it leaves the stream open for the trailers.
• A first block with no fields is delivered as it is: onheaders({}) in node:quic, HTTP3ProtocolError for that fetch, 404 from Bun.serve. The two cases with sendTrailers({}) as the first block expect the node:quic answer. node:quic: reject RFC 9114 malformed H3 field sections with H3_MESSAGE_ERROR #35732 rejects such a block in node:quic, so the PR that lands second updates those two cases. The Bun.serve case accepts any 4xx status: Bun.serve http3: 501 or 400 before the router for a request line the HTTP/2 listener refuses #45357 and Bun.serve HTTP/3: validate :path and :authority before building req.url #37600 answer 400. http3: enforce the remaining request field-section rules and harden the HTTP/1 request writer #37649 rejects such a request with H3_MESSAGE_ERROR on the connection, and that case changes with it.
• A header block that has fields is refused while lsquic holds an earlier block that waits for flow control (lsquic_stream.c:4137). sendTrailers({ "x-t": "1" }) returns false there, and the stream stays open until the session times out. A block queued before the stream opens is dropped in that state. Main does the same. Bun.serve(http3): resend the final header block that lsquic refuses behind a pending 100 Continue #42805 resends such a block for Bun.serve.
• A trailer block that has fields can land inside the last DATA frame. With 24 concurrent responses of up to 60 kB, 3 of 480 streams end with the 17 bytes of the block in the body and no trailers event, on main and on this PR. lsquic closes the open DATA frame over the buffered block (close HQ frame type 0x0 of size 18). An earlier report covers it.
• A stream that is open when the peer closes the connection still ends cleanly (node:quic: a stream read ends cleanly when the peer closes the connection with an error #45500, and node:quic: give a stream still open at connection close the connection's error #45741 is the open PR for it). After the close, fetch opens a second connection (http(h3): do not replay a non-idempotent request that was already sent #42579 is the open PR about a request that is sent again). This PR removes one cause of the close.
• A QPACK decoder failure still closes the whole connection. node:quic(h3): scope malformed-message failures to one stream instead of CONNECTION_CLOSE #35762 scopes malformed messages to one stream.
• The upstream comment that lsqpack.ts links lists two more inputs that ls-qpack refuses: a field name of length zero, and an integer with continuation octets that add nothing. This PR leaves both. The first is a malformed message.
• ls-hpack has a similar check for HTTP/2: a block that holds only a table size update is an error (lshpack.c:1733). This PR does not change HTTP/2. node:http2: end the stream with an empty DATA frame when sendTrailers() encodes no fields #37951 is the open PR for the sender rule in node:http2.
• A node:quic server sometimes announces a second session for one fetch connection. That session has no requests and closes at once (4 of 600 rounds on main, 5 of 600 here). The fetch cases record the requests of each session and do not count sessions.

Upstream. ls-qpack master is the pinned commit 9156770 and has the same code. No upstream issue exists for it. A comment on litespeedtech/ls-qpack#90 (comment) lists the input as refused. The report is not filed. This program shows it on ls-qpack master:

/* cc -I. -Ideps/xxhash repro.c lsqpack.c deps/xxhash/xxhash.c -o repro && ./repro */
lsqpack_enc_preinit(&enc, NULL);
lsqpack_enc_start_header(&enc, 0, 0);
prefix_sz = lsqpack_enc_end_header(&enc, block, sizeof(block), &hflags);   /* 2 bytes: 00 00 */
lsqpack_dec_init(&dec, NULL, 0, 0, &hset_if, 0);
st = lsqpack_dec_header_in(&dec, &hblock, 0, prefix_sz, &p, prefix_sz, dec_buf, &dec_buf_sz);
/* st == LQRHS_ERROR. With the patch: LQRHS_DONE, no headers. */

Self-review. Two runs raised 28 and 18 concerns. 42 are addressed in the code, the tests or this text. The other 4 ask for a tracker for defects that this PR leaves: the upstream report above, and three bullets of "Not in this PR" (the refused block with fields, the trailer block in a DATA frame, the second session). None is filed.

Tests.

• Sender cases: sendTrailers() with {}, { name: undefined } and { name: [] } from onwanttrailers (returns true, then false), pendingTrailers = {}, sendInformationalHeaders({}), both calls behind a header block that waits for flow control, and blocks queued before the stream opens. Each reads the stream until it is closed and checks that no trailers event arrived.
• Cases for the conditions of the rule: a unidirectional stream, after resetStream(), after the FIN, after a reset that reached the peer, and sendTrailers({}) as the first block (open stream and queue).
• Decoder cases: a block with no field lines after the headers, after the body and as the first block, received by a node:quic client, a node:quic server, fetch and Bun.serve. A second response stays open during each case and completes after it, which proves that the connection survived.
• With the ASAN lane environment (leak detection on), quic-stream.test.ts passes in 3 of 3 runs, and serve-http3.test.ts passes 81 of 82. The other one starts a child process, and in this container a process with leak detection on takes 5 s to exit, which is the whole budget of that test.
• Under CPU load, 25 of 25 runs of the new quic-stream.test.ts cases and 10 of 10 runs of the serve-http3.test.ts cases pass.
• 231 of 235 ported test-quic-* files pass on the debug build, run 4 at a time. test-quic-h3-stream-idle-timeout and test-quic-stream-idle-timeout need node:stream/iter. test-quic-session-initial-rtt has a 10 ms bound that a debug build misses. The fourth is one of the test-quic-callback-error-* files, which fail at random on the debug build (3 and 6 of 20 runs for two of them). Their sessions are not HTTP/3 and send no header block.
• fetch-http3-adversarial.test.ts: 8 concurrent POST /echo with 4 MB bodies exceeds 5 s in some runs of the whole file on the debug build, also with src/ from main.

Related. #35762, #35732, #37649, #37600, #45357, #45741, #42579, #42805, #37951, #45941. #42892 changes the same lines of stream.rs. #41337 and #44800 fix an lsquic leak that the first version of the test helper ran into.