Fix assertion for PUSH_PROMISE frames

r2 can be either null or not.

Test case by @daghf

Refs #2781

bin/varnishd/http2/cache_http2_proto.c

@@ -305,7 +305,7 @@ h2_rx_push_promise(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	ASSERT_RXTHR(h2);
-	CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC); /* XXX: wasteful allocation? */
+	CHECK_OBJ_ORNULL(r2, H2_REQ_MAGIC);
 	// rfc7540,l,2262,2267
 	return (H2CE_PROTOCOL_ERROR);
 }

bin/varnishtest/tests/t02003.vtc

@@ -173,6 +173,21 @@ client c1 {
 	stream 0 -wait
 } -run
 
+client c1 {
+	stream 0 {
+		rxgoaway
+		expect goaway.err == PROTOCOL_ERROR
+		expect goaway.laststream == 1
+	} -start
+	stream 1 {
+		txreq
+		rxresp
+		delay .1
+		# send a PUSH_PROMISE after a request
+		sendhex "000008 05 00 00000001 0001020304050607"
+	} -start
+} -run
+
 varnish v1 -vsl_catchup
 
 varnish v1 -expect MEMPOOL.req0.live == 0