I don't understand this error, nor do I understand why it build nghttp2 again here since it is supposed to be cached... :-/

Mixing clang and GCC also doesn't look right, does it?

      C compiler:     clang
      CFLAGS:         -fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g
      LDFLAGS:        -fsanitize=address,undefined -fno-sanitize-recover=undefined,integer
      C++ compiler:   g++-8
      CXXFLAGS:       -g -O2
      CXXCPP:         g++-8 -E
      C preprocessor: clang -E

Exactly, that's the side-effect of nghttp2 getting built (again) with the setup that is meant only for the curl build. I tried to setup so that the nghttp2 build would remain cached and thus not having to get rebuilt so that the CFLAGS + clang settings wouldn't be used in the nghttp2 build...

Ah, you want to reuse the build from previous jobs? Aren't the builds run in parallel on different machines? I thought any caching was only best-effort, but maybe I don't understand how Travis works well enough yet.

right, well obviously it didn't work so I need to come up with a way that makes the sanitizer stuff only affect the curl build and not the other ones...

CXX="g++-8" CC="gcc-8" CFLAGS="" LDFLAGS="" LIBS="" ./configure maybe for nghttp2 etc.?

Excellent suggestion. Rebased and squashed to make it easier to review.