Fix race condition: set _canceled before SignalCore in ProcessWaitState by Copilot · Pull Request #127312 · dotnet/runtime

Copilot · 2026-04-23T07:33:52Z

Description

ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation fails intermittently in CI because _canceled is set after SignalCore(PosixSignal.SIGKILL) returns. The reaping thread triggered by the kill signal can enter ChildReaped and read _canceled == false before the cancellation/timeout path writes true, producing exitStatus.Canceled == false.

Changes

Set _canceled = truebefore calling SignalCore(PosixSignal.SIGKILL) at all call sites (WaitForExitOrKillOnCancellationAsync, WaitForExitOrKillOnTimeoutCore on both Unix and Windows), so the reaping thread always observes the canceled state
Remove volatile from _canceled since the _gate lock acquire in ChildReaped provides the necessary memory barrier on the read side

tmds · 2026-04-23T07:40:54Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock

Suggestion: remove the volatile, don't take a lock, and do this:

waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

dotnet-policy-service · 2026-04-23T07:54:46Z

Tagging subscribers to this area: @dotnet/area-system-diagnostics-process
See info in area-owners.md if you want to be subscribed.

The test ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation was failing intermittently because _canceled was being set outside the _gate lock, while ChildReaped reads it under the lock to build ProcessExitStatus. This caused a race where ChildReaped could read _canceled as false before the cancellation callback set it to true. Changes: - Add Cancel() method to SafeProcessHandle (platform-specific implementations) - On Unix, Cancel() delegates to ProcessWaitState.Cancel() which acquires _gate before setting _canceled, ensuring atomicity with ChildReaped - On Windows, Cancel() wraps the existing SignalCore + Canceled property set - Remove volatile from _canceled field since it's now protected by the lock - Update all call sites to use Cancel() instead of directly setting Canceled Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/d23310ac-167d-4a45-a389-45918504a964 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot

Pull request overview

Fixes an intermittent CI failure by ensuring the “canceled” state is set atomically with process reaping on Unix, eliminating a race between the cancellation/timeout path and ChildReaped exit-status construction.

Changes:

Add a Unix ProcessWaitState.Cancel(SafeProcessHandle) that takes _gate before signaling and setting _canceled.
Introduce platform-specific SafeProcessHandle.Cancel() helpers and route cancellation/timeout call sites through them (or through the wait state on Unix).
Remove volatile from _canceled now that access is lock-protected.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs	Adds lock-protected cancel path and removes `volatile` on `_canceled` to make cancellation state consistent with `ChildReaped`.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.cs	Switches cancellation callback to call the new `Cancel()` helper.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs	Adds `Cancel()` helper and uses it for timeout kill path.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs	Adds `Cancel()` helper that routes through `ProcessWaitState.Cancel`, and updates timeout kill path.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/22fb6e3e-d0e3-4cf8-91b3-5b227dbbc8a4 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

adamsitnik · 2026-04-23T10:44:22Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
Suggestion: remove the volatile, don't take a lock, and do this:
waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

@copilot revert all the changes and implement this suggestion.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e3d7eda5-6eea-46ce-8caf-8dbe57c1b899 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-23T11:21:31Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc7251: set _canceled = true before SignalCore(PosixSignal.SIGKILL) at all call sites (Unix timeout, Unix cancellation, Windows timeout, shared cancellation callback), removed volatile from _canceled. No lock needed. All 561 tests pass.

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc72519. At all 3 call sites, _canceled is now set to true before SignalCore(PosixSignal.SIGKILL), and volatile is removed. All 561 tests pass.

adamsitnik · 2026-04-23T19:55:22Z

/ba-g timeouts are unrelated

Copilot · 2026-04-23T07:33:52Z

Description

ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation fails intermittently in CI because _canceled is set after SignalCore(PosixSignal.SIGKILL) returns. The reaping thread triggered by the kill signal can enter ChildReaped and read _canceled == false before the cancellation/timeout path writes true, producing exitStatus.Canceled == false.

Changes

Set _canceled = truebefore calling SignalCore(PosixSignal.SIGKILL) at all call sites (WaitForExitOrKillOnCancellationAsync, WaitForExitOrKillOnTimeoutCore on both Unix and Windows), so the reaping thread always observes the canceled state
Remove volatile from _canceled since the _gate lock acquire in ChildReaped provides the necessary memory barrier on the read side

tmds · 2026-04-23T07:40:54Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock

Suggestion: remove the volatile, don't take a lock, and do this:

waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

dotnet-policy-service · 2026-04-23T07:54:46Z

Tagging subscribers to this area: @dotnet/area-system-diagnostics-process
See info in area-owners.md if you want to be subscribed.

The test ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation was failing intermittently because _canceled was being set outside the _gate lock, while ChildReaped reads it under the lock to build ProcessExitStatus. This caused a race where ChildReaped could read _canceled as false before the cancellation callback set it to true. Changes: - Add Cancel() method to SafeProcessHandle (platform-specific implementations) - On Unix, Cancel() delegates to ProcessWaitState.Cancel() which acquires _gate before setting _canceled, ensuring atomicity with ChildReaped - On Windows, Cancel() wraps the existing SignalCore + Canceled property set - Remove volatile from _canceled field since it's now protected by the lock - Update all call sites to use Cancel() instead of directly setting Canceled Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/d23310ac-167d-4a45-a389-45918504a964 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot

Pull request overview

Fixes an intermittent CI failure by ensuring the “canceled” state is set atomically with process reaping on Unix, eliminating a race between the cancellation/timeout path and ChildReaped exit-status construction.

Changes:

Add a Unix ProcessWaitState.Cancel(SafeProcessHandle) that takes _gate before signaling and setting _canceled.
Introduce platform-specific SafeProcessHandle.Cancel() helpers and route cancellation/timeout call sites through them (or through the wait state on Unix).
Remove volatile from _canceled now that access is lock-protected.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs	Adds lock-protected cancel path and removes `volatile` on `_canceled` to make cancellation state consistent with `ChildReaped`.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.cs	Switches cancellation callback to call the new `Cancel()` helper.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs	Adds `Cancel()` helper and uses it for timeout kill path.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs	Adds `Cancel()` helper that routes through `ProcessWaitState.Cancel`, and updates timeout kill path.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/22fb6e3e-d0e3-4cf8-91b3-5b227dbbc8a4 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

adamsitnik · 2026-04-23T10:44:22Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
Suggestion: remove the volatile, don't take a lock, and do this:
waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

@copilot revert all the changes and implement this suggestion.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e3d7eda5-6eea-46ce-8caf-8dbe57c1b899 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-23T11:21:31Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc7251: set _canceled = true before SignalCore(PosixSignal.SIGKILL) at all call sites (Unix timeout, Unix cancellation, Windows timeout, shared cancellation callback), removed volatile from _canceled. No lock needed. All 561 tests pass.

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc72519. At all 3 call sites, _canceled is now set to true before SignalCore(PosixSignal.SIGKILL), and volatile is removed. All 561 tests pass.

adamsitnik · 2026-04-23T19:55:22Z

/ba-g timeouts are unrelated

Copilot · 2026-04-23T07:33:52Z

Description

ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation fails intermittently in CI because _canceled is set after SignalCore(PosixSignal.SIGKILL) returns. The reaping thread triggered by the kill signal can enter ChildReaped and read _canceled == false before the cancellation/timeout path writes true, producing exitStatus.Canceled == false.

Changes

Set _canceled = truebefore calling SignalCore(PosixSignal.SIGKILL) at all call sites (WaitForExitOrKillOnCancellationAsync, WaitForExitOrKillOnTimeoutCore on both Unix and Windows), so the reaping thread always observes the canceled state
Remove volatile from _canceled since the _gate lock acquire in ChildReaped provides the necessary memory barrier on the read side

tmds · 2026-04-23T07:40:54Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock

Suggestion: remove the volatile, don't take a lock, and do this:

waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

dotnet-policy-service · 2026-04-23T07:54:46Z

Tagging subscribers to this area: @dotnet/area-system-diagnostics-process
See info in area-owners.md if you want to be subscribed.

The test ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation was failing intermittently because _canceled was being set outside the _gate lock, while ChildReaped reads it under the lock to build ProcessExitStatus. This caused a race where ChildReaped could read _canceled as false before the cancellation callback set it to true. Changes: - Add Cancel() method to SafeProcessHandle (platform-specific implementations) - On Unix, Cancel() delegates to ProcessWaitState.Cancel() which acquires _gate before setting _canceled, ensuring atomicity with ChildReaped - On Windows, Cancel() wraps the existing SignalCore + Canceled property set - Remove volatile from _canceled field since it's now protected by the lock - Update all call sites to use Cancel() instead of directly setting Canceled Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/d23310ac-167d-4a45-a389-45918504a964 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot

Pull request overview

Fixes an intermittent CI failure by ensuring the “canceled” state is set atomically with process reaping on Unix, eliminating a race between the cancellation/timeout path and ChildReaped exit-status construction.

Changes:

Add a Unix ProcessWaitState.Cancel(SafeProcessHandle) that takes _gate before signaling and setting _canceled.
Introduce platform-specific SafeProcessHandle.Cancel() helpers and route cancellation/timeout call sites through them (or through the wait state on Unix).
Remove volatile from _canceled now that access is lock-protected.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs	Adds lock-protected cancel path and removes `volatile` on `_canceled` to make cancellation state consistent with `ChildReaped`.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.cs	Switches cancellation callback to call the new `Cancel()` helper.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs	Adds `Cancel()` helper and uses it for timeout kill path.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs	Adds `Cancel()` helper that routes through `ProcessWaitState.Cancel`, and updates timeout kill path.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/22fb6e3e-d0e3-4cf8-91b3-5b227dbbc8a4 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

adamsitnik · 2026-04-23T10:44:22Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
Suggestion: remove the volatile, don't take a lock, and do this:
waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

@copilot revert all the changes and implement this suggestion.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e3d7eda5-6eea-46ce-8caf-8dbe57c1b899 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-23T11:21:31Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc7251: set _canceled = true before SignalCore(PosixSignal.SIGKILL) at all call sites (Unix timeout, Unix cancellation, Windows timeout, shared cancellation callback), removed volatile from _canceled. No lock needed. All 561 tests pass.

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc72519. At all 3 call sites, _canceled is now set to true before SignalCore(PosixSignal.SIGKILL), and volatile is removed. All 561 tests pass.

adamsitnik · 2026-04-23T19:55:22Z

/ba-g timeouts are unrelated

Copilot · 2026-04-23T07:33:52Z

Description

ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation fails intermittently in CI because _canceled is set after SignalCore(PosixSignal.SIGKILL) returns. The reaping thread triggered by the kill signal can enter ChildReaped and read _canceled == false before the cancellation/timeout path writes true, producing exitStatus.Canceled == false.

Changes

Set _canceled = truebefore calling SignalCore(PosixSignal.SIGKILL) at all call sites (WaitForExitOrKillOnCancellationAsync, WaitForExitOrKillOnTimeoutCore on both Unix and Windows), so the reaping thread always observes the canceled state
Remove volatile from _canceled since the _gate lock acquire in ChildReaped provides the necessary memory barrier on the read side

tmds · 2026-04-23T07:40:54Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock

Suggestion: remove the volatile, don't take a lock, and do this:

waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

dotnet-policy-service · 2026-04-23T07:54:46Z

Tagging subscribers to this area: @dotnet/area-system-diagnostics-process
See info in area-owners.md if you want to be subscribed.

The test ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation was failing intermittently because _canceled was being set outside the _gate lock, while ChildReaped reads it under the lock to build ProcessExitStatus. This caused a race where ChildReaped could read _canceled as false before the cancellation callback set it to true. Changes: - Add Cancel() method to SafeProcessHandle (platform-specific implementations) - On Unix, Cancel() delegates to ProcessWaitState.Cancel() which acquires _gate before setting _canceled, ensuring atomicity with ChildReaped - On Windows, Cancel() wraps the existing SignalCore + Canceled property set - Remove volatile from _canceled field since it's now protected by the lock - Update all call sites to use Cancel() instead of directly setting Canceled Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/d23310ac-167d-4a45-a389-45918504a964 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot

Pull request overview

Fixes an intermittent CI failure by ensuring the “canceled” state is set atomically with process reaping on Unix, eliminating a race between the cancellation/timeout path and ChildReaped exit-status construction.

Changes:

Add a Unix ProcessWaitState.Cancel(SafeProcessHandle) that takes _gate before signaling and setting _canceled.
Introduce platform-specific SafeProcessHandle.Cancel() helpers and route cancellation/timeout call sites through them (or through the wait state on Unix).
Remove volatile from _canceled now that access is lock-protected.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs	Adds lock-protected cancel path and removes `volatile` on `_canceled` to make cancellation state consistent with `ChildReaped`.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.cs	Switches cancellation callback to call the new `Cancel()` helper.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs	Adds `Cancel()` helper and uses it for timeout kill path.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs	Adds `Cancel()` helper that routes through `ProcessWaitState.Cancel`, and updates timeout kill path.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/22fb6e3e-d0e3-4cf8-91b3-5b227dbbc8a4 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

adamsitnik · 2026-04-23T10:44:22Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
Suggestion: remove the volatile, don't take a lock, and do this:
waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

@copilot revert all the changes and implement this suggestion.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e3d7eda5-6eea-46ce-8caf-8dbe57c1b899 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-23T11:21:31Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc7251: set _canceled = true before SignalCore(PosixSignal.SIGKILL) at all call sites (Unix timeout, Unix cancellation, Windows timeout, shared cancellation callback), removed volatile from _canceled. No lock needed. All 561 tests pass.

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc72519. At all 3 call sites, _canceled is now set to true before SignalCore(PosixSignal.SIGKILL), and volatile is removed. All 561 tests pass.

adamsitnik · 2026-04-23T19:55:22Z

/ba-g timeouts are unrelated

Copilot · 2026-04-23T07:33:52Z

Description

ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation fails intermittently in CI because _canceled is set after SignalCore(PosixSignal.SIGKILL) returns. The reaping thread triggered by the kill signal can enter ChildReaped and read _canceled == false before the cancellation/timeout path writes true, producing exitStatus.Canceled == false.

Changes

Set _canceled = truebefore calling SignalCore(PosixSignal.SIGKILL) at all call sites (WaitForExitOrKillOnCancellationAsync, WaitForExitOrKillOnTimeoutCore on both Unix and Windows), so the reaping thread always observes the canceled state
Remove volatile from _canceled since the _gate lock acquire in ChildReaped provides the necessary memory barrier on the read side

tmds · 2026-04-23T07:40:54Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock

Suggestion: remove the volatile, don't take a lock, and do this:

waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

dotnet-policy-service · 2026-04-23T07:54:46Z

Tagging subscribers to this area: @dotnet/area-system-diagnostics-process
See info in area-owners.md if you want to be subscribed.

The test ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation was failing intermittently because _canceled was being set outside the _gate lock, while ChildReaped reads it under the lock to build ProcessExitStatus. This caused a race where ChildReaped could read _canceled as false before the cancellation callback set it to true. Changes: - Add Cancel() method to SafeProcessHandle (platform-specific implementations) - On Unix, Cancel() delegates to ProcessWaitState.Cancel() which acquires _gate before setting _canceled, ensuring atomicity with ChildReaped - On Windows, Cancel() wraps the existing SignalCore + Canceled property set - Remove volatile from _canceled field since it's now protected by the lock - Update all call sites to use Cancel() instead of directly setting Canceled Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/d23310ac-167d-4a45-a389-45918504a964 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot

Pull request overview

Fixes an intermittent CI failure by ensuring the “canceled” state is set atomically with process reaping on Unix, eliminating a race between the cancellation/timeout path and ChildReaped exit-status construction.

Changes:

Add a Unix ProcessWaitState.Cancel(SafeProcessHandle) that takes _gate before signaling and setting _canceled.
Introduce platform-specific SafeProcessHandle.Cancel() helpers and route cancellation/timeout call sites through them (or through the wait state on Unix).
Remove volatile from _canceled now that access is lock-protected.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs	Adds lock-protected cancel path and removes `volatile` on `_canceled` to make cancellation state consistent with `ChildReaped`.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.cs	Switches cancellation callback to call the new `Cancel()` helper.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs	Adds `Cancel()` helper and uses it for timeout kill path.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs	Adds `Cancel()` helper that routes through `ProcessWaitState.Cancel`, and updates timeout kill path.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/22fb6e3e-d0e3-4cf8-91b3-5b227dbbc8a4 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

adamsitnik · 2026-04-23T10:44:22Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
Suggestion: remove the volatile, don't take a lock, and do this:
waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

@copilot revert all the changes and implement this suggestion.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e3d7eda5-6eea-46ce-8caf-8dbe57c1b899 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-23T11:21:31Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc7251: set _canceled = true before SignalCore(PosixSignal.SIGKILL) at all call sites (Unix timeout, Unix cancellation, Windows timeout, shared cancellation callback), removed volatile from _canceled. No lock needed. All 561 tests pass.

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc72519. At all 3 call sites, _canceled is now set to true before SignalCore(PosixSignal.SIGKILL), and volatile is removed. All 561 tests pass.

adamsitnik · 2026-04-23T19:55:22Z

/ba-g timeouts are unrelated

Copilot · 2026-04-23T07:33:52Z

Description

ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation fails intermittently in CI because _canceled is set after SignalCore(PosixSignal.SIGKILL) returns. The reaping thread triggered by the kill signal can enter ChildReaped and read _canceled == false before the cancellation/timeout path writes true, producing exitStatus.Canceled == false.

Changes

Set _canceled = truebefore calling SignalCore(PosixSignal.SIGKILL) at all call sites (WaitForExitOrKillOnCancellationAsync, WaitForExitOrKillOnTimeoutCore on both Unix and Windows), so the reaping thread always observes the canceled state
Remove volatile from _canceled since the _gate lock acquire in ChildReaped provides the necessary memory barrier on the read side

tmds · 2026-04-23T07:40:54Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock

Suggestion: remove the volatile, don't take a lock, and do this:

waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

dotnet-policy-service · 2026-04-23T07:54:46Z

Tagging subscribers to this area: @dotnet/area-system-diagnostics-process
See info in area-owners.md if you want to be subscribed.

The test ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation was failing intermittently because _canceled was being set outside the _gate lock, while ChildReaped reads it under the lock to build ProcessExitStatus. This caused a race where ChildReaped could read _canceled as false before the cancellation callback set it to true. Changes: - Add Cancel() method to SafeProcessHandle (platform-specific implementations) - On Unix, Cancel() delegates to ProcessWaitState.Cancel() which acquires _gate before setting _canceled, ensuring atomicity with ChildReaped - On Windows, Cancel() wraps the existing SignalCore + Canceled property set - Remove volatile from _canceled field since it's now protected by the lock - Update all call sites to use Cancel() instead of directly setting Canceled Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/d23310ac-167d-4a45-a389-45918504a964 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot

Pull request overview

Fixes an intermittent CI failure by ensuring the “canceled” state is set atomically with process reaping on Unix, eliminating a race between the cancellation/timeout path and ChildReaped exit-status construction.

Changes:

Add a Unix ProcessWaitState.Cancel(SafeProcessHandle) that takes _gate before signaling and setting _canceled.
Introduce platform-specific SafeProcessHandle.Cancel() helpers and route cancellation/timeout call sites through them (or through the wait state on Unix).
Remove volatile from _canceled now that access is lock-protected.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs	Adds lock-protected cancel path and removes `volatile` on `_canceled` to make cancellation state consistent with `ChildReaped`.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.cs	Switches cancellation callback to call the new `Cancel()` helper.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs	Adds `Cancel()` helper and uses it for timeout kill path.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs	Adds `Cancel()` helper that routes through `ProcessWaitState.Cancel`, and updates timeout kill path.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/22fb6e3e-d0e3-4cf8-91b3-5b227dbbc8a4 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

adamsitnik · 2026-04-23T10:44:22Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
Suggestion: remove the volatile, don't take a lock, and do this:
waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

@copilot revert all the changes and implement this suggestion.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e3d7eda5-6eea-46ce-8caf-8dbe57c1b899 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-23T11:21:31Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc7251: set _canceled = true before SignalCore(PosixSignal.SIGKILL) at all call sites (Unix timeout, Unix cancellation, Windows timeout, shared cancellation callback), removed volatile from _canceled. No lock needed. All 561 tests pass.

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc72519. At all 3 call sites, _canceled is now set to true before SignalCore(PosixSignal.SIGKILL), and volatile is removed. All 561 tests pass.

adamsitnik · 2026-04-23T19:55:22Z

/ba-g timeouts are unrelated

Copilot · 2026-04-23T07:33:52Z

Description

ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation fails intermittently in CI because _canceled is set after SignalCore(PosixSignal.SIGKILL) returns. The reaping thread triggered by the kill signal can enter ChildReaped and read _canceled == false before the cancellation/timeout path writes true, producing exitStatus.Canceled == false.

Changes

Set _canceled = truebefore calling SignalCore(PosixSignal.SIGKILL) at all call sites (WaitForExitOrKillOnCancellationAsync, WaitForExitOrKillOnTimeoutCore on both Unix and Windows), so the reaping thread always observes the canceled state
Remove volatile from _canceled since the _gate lock acquire in ChildReaped provides the necessary memory barrier on the read side

tmds · 2026-04-23T07:40:54Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock

Suggestion: remove the volatile, don't take a lock, and do this:

waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

dotnet-policy-service · 2026-04-23T07:54:46Z

Tagging subscribers to this area: @dotnet/area-system-diagnostics-process
See info in area-owners.md if you want to be subscribed.

The test ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation was failing intermittently because _canceled was being set outside the _gate lock, while ChildReaped reads it under the lock to build ProcessExitStatus. This caused a race where ChildReaped could read _canceled as false before the cancellation callback set it to true. Changes: - Add Cancel() method to SafeProcessHandle (platform-specific implementations) - On Unix, Cancel() delegates to ProcessWaitState.Cancel() which acquires _gate before setting _canceled, ensuring atomicity with ChildReaped - On Windows, Cancel() wraps the existing SignalCore + Canceled property set - Remove volatile from _canceled field since it's now protected by the lock - Update all call sites to use Cancel() instead of directly setting Canceled Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/d23310ac-167d-4a45-a389-45918504a964 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot

Pull request overview

Fixes an intermittent CI failure by ensuring the “canceled” state is set atomically with process reaping on Unix, eliminating a race between the cancellation/timeout path and ChildReaped exit-status construction.

Changes:

Add a Unix ProcessWaitState.Cancel(SafeProcessHandle) that takes _gate before signaling and setting _canceled.
Introduce platform-specific SafeProcessHandle.Cancel() helpers and route cancellation/timeout call sites through them (or through the wait state on Unix).
Remove volatile from _canceled now that access is lock-protected.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs	Adds lock-protected cancel path and removes `volatile` on `_canceled` to make cancellation state consistent with `ChildReaped`.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.cs	Switches cancellation callback to call the new `Cancel()` helper.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs	Adds `Cancel()` helper and uses it for timeout kill path.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs	Adds `Cancel()` helper that routes through `ProcessWaitState.Cancel`, and updates timeout kill path.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/22fb6e3e-d0e3-4cf8-91b3-5b227dbbc8a4 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

adamsitnik · 2026-04-23T10:44:22Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
Suggestion: remove the volatile, don't take a lock, and do this:
waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

@copilot revert all the changes and implement this suggestion.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e3d7eda5-6eea-46ce-8caf-8dbe57c1b899 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-23T11:21:31Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc7251: set _canceled = true before SignalCore(PosixSignal.SIGKILL) at all call sites (Unix timeout, Unix cancellation, Windows timeout, shared cancellation callback), removed volatile from _canceled. No lock needed. All 561 tests pass.

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc72519. At all 3 call sites, _canceled is now set to true before SignalCore(PosixSignal.SIGKILL), and volatile is removed. All 561 tests pass.

adamsitnik · 2026-04-23T19:55:22Z

/ba-g timeouts are unrelated

Copilot · 2026-04-23T07:33:52Z

Description

ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation fails intermittently in CI because _canceled is set after SignalCore(PosixSignal.SIGKILL) returns. The reaping thread triggered by the kill signal can enter ChildReaped and read _canceled == false before the cancellation/timeout path writes true, producing exitStatus.Canceled == false.

Changes

Set _canceled = truebefore calling SignalCore(PosixSignal.SIGKILL) at all call sites (WaitForExitOrKillOnCancellationAsync, WaitForExitOrKillOnTimeoutCore on both Unix and Windows), so the reaping thread always observes the canceled state
Remove volatile from _canceled since the _gate lock acquire in ChildReaped provides the necessary memory barrier on the read side

tmds · 2026-04-23T07:40:54Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock

Suggestion: remove the volatile, don't take a lock, and do this:

waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

dotnet-policy-service · 2026-04-23T07:54:46Z

Tagging subscribers to this area: @dotnet/area-system-diagnostics-process
See info in area-owners.md if you want to be subscribed.

The test ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation was failing intermittently because _canceled was being set outside the _gate lock, while ChildReaped reads it under the lock to build ProcessExitStatus. This caused a race where ChildReaped could read _canceled as false before the cancellation callback set it to true. Changes: - Add Cancel() method to SafeProcessHandle (platform-specific implementations) - On Unix, Cancel() delegates to ProcessWaitState.Cancel() which acquires _gate before setting _canceled, ensuring atomicity with ChildReaped - On Windows, Cancel() wraps the existing SignalCore + Canceled property set - Remove volatile from _canceled field since it's now protected by the lock - Update all call sites to use Cancel() instead of directly setting Canceled Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/d23310ac-167d-4a45-a389-45918504a964 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot

Pull request overview

Fixes an intermittent CI failure by ensuring the “canceled” state is set atomically with process reaping on Unix, eliminating a race between the cancellation/timeout path and ChildReaped exit-status construction.

Changes:

Add a Unix ProcessWaitState.Cancel(SafeProcessHandle) that takes _gate before signaling and setting _canceled.
Introduce platform-specific SafeProcessHandle.Cancel() helpers and route cancellation/timeout call sites through them (or through the wait state on Unix).
Remove volatile from _canceled now that access is lock-protected.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs	Adds lock-protected cancel path and removes `volatile` on `_canceled` to make cancellation state consistent with `ChildReaped`.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.cs	Switches cancellation callback to call the new `Cancel()` helper.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs	Adds `Cancel()` helper and uses it for timeout kill path.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs	Adds `Cancel()` helper that routes through `ProcessWaitState.Cancel`, and updates timeout kill path.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/22fb6e3e-d0e3-4cf8-91b3-5b227dbbc8a4 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

adamsitnik · 2026-04-23T10:44:22Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
Suggestion: remove the volatile, don't take a lock, and do this:
waitState._canceled = true;
SignalCore(PosixSignal.SIGKILL);

@copilot revert all the changes and implement this suggestion.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e3d7eda5-6eea-46ce-8caf-8dbe57c1b899 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-23T11:21:31Z

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc7251: set _canceled = true before SignalCore(PosixSignal.SIGKILL) at all call sites (Unix timeout, Unix cancellation, Windows timeout, shared cancellation callback), removed volatile from _canceled. No lock needed. All 561 tests pass.

Add Cancel(SafeProcessHandle) method to ProcessWaitState.Unix.cs that sets _canceled under _gate lock
...

Reverted all previous changes and implemented the simpler approach in 6bc72519. At all 3 call sites, _canceled is now set to true before SignalCore(PosixSignal.SIGKILL), and volatile is removed. All 561 tests pass.

adamsitnik · 2026-04-23T19:55:22Z

/ba-g timeouts are unrelated

Initial plan
80c6a19

CopilotAI assigned Copilot and adamsitnik Apr 23, 2026

CopilotAI requested review from Copilot and removed request for Copilot April 23, 2026 07:33

Copilotstarted work on behalf of adamsitnik April 23, 2026 07:33 View session

CopilotAI linked an issue Apr 23, 2026 that may be closed by this pull request
ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync_KillsOnCancellation failuring in CI #127287
Closed

github-actionsBot added the area-System.Diagnostics.Process label Apr 23, 2026

CopilotAI requested review from Copilot and removed request for Copilot April 23, 2026 08:23

CopilotAI changed the title ~~[WIP] Fix ProcessSafeHandle_WaitForExitOrKillOnCancellationAsync test failure in CI~~Fix race condition: set _canceled under _gate lock in ProcessWaitStateApr 23, 2026

Copilotfinished work on behalf of adamsitnik April 23, 2026 08:25

CopilotAI requested a review from adamsitnik April 23, 2026 08:25

adamsitnik marked this pull request as ready for review April 23, 2026 08:45

CopilotAI review requested due to automatic review settings April 23, 2026 08:45

Copilotstarted reviewing on behalf of adamsitnik April 23, 2026 08:46 View session

CopilotAI reviewed Apr 23, 2026
View reviewed changes

Comment threadsrc/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs
Comment thread...braries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs Outdated

tmds reviewed Apr 23, 2026
View reviewed changes

Comment thread...braries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs Outdated

Copilotstarted work on behalf of adamsitnik April 23, 2026 09:48 View session

Make _canceled field private in ProcessWaitState
8c30a44
Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/22fb6e3e-d0e3-4cf8-91b3-5b227dbbc8a4 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilotfinished work on behalf of adamsitnik April 23, 2026 10:14

Copilotstarted work on behalf of adamsitnik April 23, 2026 10:44 View session

tmds reviewed Apr 23, 2026
View reviewed changes

Comment threadsrc/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessWaitState.Unix.cs Outdated

Revert lock-based approach; set _canceled before SignalCore instead
6bc7251
Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e3d7eda5-6eea-46ce-8caf-8dbe57c1b899 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

CopilotAI requested review from Copilot and removed request for Copilot April 23, 2026 11:21

CopilotAI changed the title ~~Fix race condition: set _canceled under _gate lock in ProcessWaitState~~Fix race condition: set _canceled before SignalCore in ProcessWaitStateApr 23, 2026

Copilotfinished work on behalf of adamsitnik April 23, 2026 11:24

jkotas approved these changes Apr 23, 2026
View reviewed changes

adamsitnik enabled auto-merge (squash) April 23, 2026 16:36

adamsitnik merged commit caa9958 into mainApr 23, 2026
84 of 92 checks passed

adamsitnik deleted the copilot/fix-process-safe-handle-test-failure branch April 23, 2026 19:55

dotnet-maestroBot mentioned this pull request Apr 24, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#6241
Merged

github-actionsBot locked and limited conversation to collaborators May 24, 2026