5
95%
develop: 95%

Ran 16 Jun 2026 11:47AM UTC

Files 53

Run time 8s

Badge

Embed ▾

Committed 16 Jun 2026 11:41AM UTC coverage: 90.156% (+0.009%) from 90.147%

Job # 27614957808.5

Build Type

push

github

Committed by

web-flow

Commit Message

Fix use-after-free race on future->monitor in error paths (#381)

When a task threw (normal exception) or crashed (IllegalInstruction), the
worker signalled the future twice: first PHP_PARALLEL_ERROR (or READY|ERROR),
then an unconditional trailing PHP_PARALLEL_READY at the end of
php_parallel_scheduler_run().

Future::value() waits on READY|FAILURE|ERROR, so the first signal already
releases the consumer. The consumer can then tear the future down (freeing
future->monitor) before the worker runs the trailing
php_parallel_monitor_set(future->monitor, PHP_PARALLEL_READY), which then
dereferences a dangling monitor inside pthread_cond_signal -> access
violation / use-after-free.

This was observed as a hard crash on Windows (0xC0000005) in
tests/functional/007.phpt, masked until now by the catch-all VEH; on Linux
the freed memory happened to stay readable.

Fix: the error paths now signal READY|ERROR exactly once and skip the
trailing READY (via a 'ready' flag). The success and kill paths are
unchanged - they have no early wake and still rely on the trailing READY.
Setting READY in the error path also ensures the future destructor (which
waits for READY) never blocks when value() is not called.

Coverage Stats

2766 of 3068 relevant lines covered (90.16%)

339.68 hits per line

krakjoe / parallel / 27614957808 / 5
95%
develop: 95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job opcache-8.1 - 27614957808.5

krakjoe / parallel / 27614957808 / 5 95% develop: 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job opcache-8.1 - 27614957808.5

krakjoe / parallel / 27614957808 / 5
95%
develop: 95%

README BADGES
x