php#53: Fix socket closure order in both regular and SSL socket implementations

       Apply deferred socket closure mechanism to prevent LibUV race conditions in both xp_socket.c and xp_ssl.c modules. Previously, closesocket() was called before poll_event
       cleanup, causing potential race conditions where LibUV operations could access already-closed socket descriptors.

       Changes:
       - xp_socket.c: Fix php_sockop_close() to transfer socket ownership to LibUV before disposal
       - xp_ssl.c: Apply same fix to php_openssl_sockop_close() with SSL-specific cleanup preserved
       - Move Windows async logic (shutdown/polling) before socket ownership transfer in both modules
       - When poll_event exists, transfer socket via poll_event->socket and ZEND_ASYNC_EVENT_SET_CLOSE_FD flag
       - Call poll_event dispose immediately after flag setting for proper cleanup order
       - libuv_reactor.c: Add libuv_close_poll_handle_cb() with cross-platform fd/socket closure
       - zend_async_API.h: Define ZEND_ASYNC_EVENT_F_CLOSE_FD flag for conditional descriptor closure

       This ensures LibUV completes all pending operations before socket closure across both socket implementations.

Author: EdmondDantes

Zend/zend_async_API.h

@@ -528,6 +528,7 @@ typedef struct {
 
 // Flag indicating that the event has a zend_object reference by extra_offset.
 #define ZEND_ASYNC_EVENT_F_OBJ_REF (1u << 8) /* has zend_object ref */
+#define ZEND_ASYNC_EVENT_F_CLOSE_FD (1u << 9) /* close file descriptor after event cleanup */
 
 #define ZEND_ASYNC_EVENT_REFERENCE_PREFIX ((uint32_t) 0x80) /* prefix for reference structures */
 
@@ -574,6 +575,10 @@ typedef struct {
 
 #define ZEND_ASYNC_EVENT_WITH_OBJECT_REF(ev) ((ev)->flags |= ZEND_ASYNC_EVENT_F_OBJ_REF)
 
+#define ZEND_ASYNC_EVENT_SET_CLOSE_FD(ev) ((ev)->flags |= ZEND_ASYNC_EVENT_F_CLOSE_FD)
+#define ZEND_ASYNC_EVENT_CLR_CLOSE_FD(ev) ((ev)->flags &= ~ZEND_ASYNC_EVENT_F_CLOSE_FD)
+#define ZEND_ASYNC_EVENT_SHOULD_CLOSE_FD(ev) (((ev)->flags & ZEND_ASYNC_EVENT_F_CLOSE_FD) != 0)
+
 // Convert awaitable Zend object to zend_async_event_t pointer
 #define ZEND_ASYNC_EVENT_IS_REFERENCE(ptr) \
 	(*((const uint32_t *) (ptr)) == ZEND_ASYNC_EVENT_REFERENCE_PREFIX)

ext/openssl/xp_ssl.c

@@ -2180,8 +2180,31 @@ static int php_openssl_sockop_close(php_stream *stream, int close_handle) /* {{{
 				} while (n == -1 && php_socket_errno() == EINTR);
 			}
 #endif
-			closesocket(sslsock->s.socket);
-			sslsock->s.socket = SOCK_ERR;
+			/**
+			 * If we are in an async context and there is an active EventLoop, we should not close the
+			 * socket immediately, because there might be pending operations for this socket in the loop.
+			 * Instead, we transfer the ownership of the descriptor to the EventLoop which will close it
+			 * once all pending operations are finished.
+			 */
+			if (sslsock->s.poll_event) {
+				sslsock->s.poll_event->socket = sslsock->s.socket;
+
+				/* Set flag to close descriptor after EventLoop cleanup */
+				ZEND_ASYNC_EVENT_SET_CLOSE_FD(&sslsock->s.poll_event->base);
+				sslsock->s.socket = SOCK_ERR;
+				sslsock->s.poll_event->base.dispose(&sslsock->s.poll_event->base);
+				sslsock->s.poll_event = NULL;
+			} else {
+				/* Just close the socket ourselves immediately */
+				closesocket(sslsock->s.socket);
+				sslsock->s.socket = SOCK_ERR;
+			}
+		}
+	} else {
+		/* Cleanup async event handle before freeing other resources */
+		if (sslsock->s.poll_event) {
+			sslsock->s.poll_event->base.dispose(&sslsock->s.poll_event->base);
+			sslsock->s.poll_event = NULL;
 		}
 	}
 
@@ -2204,12 +2227,6 @@ static int php_openssl_sockop_close(php_stream *stream, int close_handle) /* {{{
 		pefree(sslsock->reneg, php_stream_is_persistent(stream));
 	}
 
-	/* Cleanup async event handle before freeing socket structure */
-	if (sslsock->s.poll_event) {
-		sslsock->s.poll_event->base.dispose(&sslsock->s.poll_event->base);
-		sslsock->s.poll_event = NULL;
-	}
-
 	pefree(sslsock, php_stream_is_persistent(stream));
 
 	return 0;

main/streams/xp_socket.c

@@ -275,20 +275,42 @@ static int php_sockop_close(php_stream *stream, int close_handle)
 			 * We use a small timeout which should encourage the OS to send the data,
 			 * but at the same time avoid hanging indefinitely.
 			 * */
-			do {
-				n = php_pollfd_for_ms(sock->socket, POLLOUT, 500);
-			} while (n == -1 && php_socket_errno() == EINTR);
+			if (ZEND_ASYNC_IS_ACTIVE) {
+				struct timeval tv = {0, 500000}; // 500ms
+				network_async_await_stream_socket(stream, POLLOUT, &tv);
+			} else {
+				do {
+					n = php_pollfd_for_ms(sock->socket, POLLOUT, 500);
+				} while (n == -1 && php_socket_errno() == EINTR);
+			}
 #endif
-			closesocket(sock->socket);
-			sock->socket = SOCK_ERR;
-		}
-
-	}
 
-	/* Cleanup async event handle before freeing socket structure */
-	if (sock->poll_event) {
-		sock->poll_event->base.dispose(&sock->poll_event->base);
-		sock->poll_event = NULL;
+			/**
+			 * If we are in an async context and there is an active EventLoop, we should not close the
+			 * socket immediately, because there might be pending operations for this socket in the loop.
+			 * Instead, we transfer the ownership of the descriptor to the EventLoop which will close it
+			 * once all pending operations are finished.
+			 */
+			if (sock->poll_event) {
+				sock->poll_event->socket = sock->socket;
+
+				/* Set flag to close descriptor after EventLoop leanup */
+				ZEND_ASYNC_EVENT_SET_CLOSE_FD(&sock->poll_event->base);
+				sock->socket = SOCK_ERR;
+				sock->poll_event->base.dispose(&sock->poll_event->base);
+				sock->poll_event = NULL;
+			} else {
+				// Just the socket close ourselves immediately
+				closesocket(sock->socket);
+				sock->socket = SOCK_ERR;
+			}
+		}
+	} else {
+		/* Cleanup async event handle before freeing socket structure */
+		if (sock->poll_event) {
+			sock->poll_event->base.dispose(&sock->poll_event->base);
+			sock->poll_event = NULL;
+		}
 	}
 
 	pefree(sock, php_stream_is_persistent(stream));