Implement ProcessStartInfo.KillOnParentExit for Windows by Copilot · Pull Request #126699 · dotnet/runtime

Copilot · 2026-04-09T11:20:47Z

Description

Implements the ProcessStartInfo.KillOnParentExit property for Windows, which terminates child processes when the parent process exits. This is the Windows part of the KillOnParentExit feature.

API approved at #125838 (comment)

Changes Made

New API surface:

Added KillOnParentExit property to ProcessStartInfo with [SupportedOSPlatform("windows")] attribute (linux support will be added in upcoming PRs)
Added to reference assembly (ref/System.Diagnostics.Process.cs) with matching [SupportedOSPlatformAttribute("windows")]
Added XML documentation with a link to the Windows SDK description of JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE

Windows implementation (SafeProcessHandle.Windows.cs):

Added a lazily-initialized static SafeJobHandle with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE flag, shared across all child processes with KillOnParentExit=true
For CreateProcess path (no user credentials): uses PROC_THREAD_ATTRIBUTE_JOB_LIST in the extended startup info for atomic job assignment at process creation
For CreateProcessWithLogonW path (with user credentials): starts the process suspended, assigns it to the job object via AssignProcessToJobObject, then resumes the thread only on the happy path — on failure, the suspended process is terminated
ResumeThread return value is checked; failure throws Win32Exception and the suspended process is terminated
AssignJobAndResumeThread takes (IntPtr hThread, SafeProcessHandle procSH) and uses procSH consistently for all process handle operations (no mixing of processInfo.hProcess and procSH)
ConfigureExtendedStartupInfo returns bool and the caller sets creationFlags, startupInfoEx.StartupInfo.cb, and startupInfoEx.lpAttributeList to reduce the number of method arguments
Uses string.IsNullOrEmpty(startInfo.UserName) for defensive checks when determining the code path

P/Invoke definitions:

Interop.JobObjects.cs: CreateJobObjectW, SetInformationJobObject, AssignProcessToJobObject (accepts SafeProcessHandle), JOBOBJECT_EXTENDED_LIMIT_INFORMATION, IO_COUNTERS, JOBOBJECTINFOCLASS structs/enums, SafeJobHandle, PROC_THREAD_ATTRIBUTE_JOB_LIST constant
Interop.ResumeThread.cs: ResumeThread P/Invoke returning uint (matching native DWORD) in its own dedicated file (following the pattern of Interop.TerminateProcess.cs, Interop.GetExitCodeProcess.cs, etc.)
IO_COUNTERS and JOBOBJECT_EXTENDED_LIMIT_INFORMATION use nuint for fields representing numerical values (sizes, limits, affinity masks) per interop convention
Replaced the local ResumeThread P/Invoke in ProcessHandlesTests.Windows.cs with the shared Interop.Kernel32.ResumeThread, eliminating the duplicate declaration and aligning the test code with the production uint/0xFFFFFFFF pattern

Validation:

Extended ProcessStartInfo.ThrowIfInvalid to throw InvalidOperationException when KillOnParentExit is combined with UseShellExecute
Added KillOnParentExitCannotBeUsedWithUseShellExecute string resource

Tests (KillOnParentExitTests.cs):

KillOnParentExit_DefaultsToFalse / KillOnParentExit_CanBeSetToTrue — property basics
KillOnParentExit_WithUseShellExecute_Throws — validation test
KillOnParentExit_ProcessStartsAndExitsNormally — smoke test
KillOnParentExit_KillsTheChild_WhenParentExits — verifies child is killed (enabled=true) or survives (enabled=false) on normal parent exit, reports grandchild pid via stdout
KillOnParentExit_KillsTheChild_WhenParentIsKilled — same when parent is forcefully killed
KillOnParentExit_KillsTheChild_WhenParentCrashes — same when parent crashes (access violation)
User credentials code path is exercised via the updated ProcessStartInfoTests.TestUserCredentialsPropertiesOnWindows (admin/OuterLoop)

Add KillOnParentExit property to ProcessStartInfo that terminates child processes when the parent process exits. Windows implementation uses Job Objects with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE flag. For CreateProcess: uses PROC_THREAD_ATTRIBUTE_JOB_LIST for atomic assignment. For CreateProcessWithLogonW: starts suspended, assigns to job, then resumes. Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/61612ca1-930c-4836-8554-d143d05c8321 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

adamsitnik

@copilot address my feedback

...ries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs

src/libraries/System.Diagnostics.Process/tests/KillOnParentExitTests.cs

…py path, add user credentials test, fix pid reporting via stdout, remove nop UseShellExecute test Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/c4dd95b4-cd8e-4740-83f9-7358444c04ce Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-09T12:51:22Z

@copilot address my feedback

All feedback addressed in 31f6e6b. All 403 tests pass.

- simplify the tests - avoid duplication!!

Copilot

Pull request overview

Implements Windows support for ProcessStartInfo.KillOnParentExit by using Windows Job Objects to ensure spawned processes are terminated when the parent exits.

Changes:

Added ProcessStartInfo.KillOnParentExit API surface (implementation + ref assembly) and validation against UseShellExecute.
Implemented Windows job-object based process start paths (CreateProcess job-list attribute, and CreateProcessWithLogonW suspended + assign + resume).
Added Windows-focused tests validating the behavior.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/libraries/System.Diagnostics.Process/tests/System.Diagnostics.Process.Tests.csproj	Includes the new KillOnParentExit test file in the test project.
src/libraries/System.Diagnostics.Process/tests/ProcessStartInfoTests.cs	Extends existing Windows credential tests to cover KillOnParentExit on that path.
src/libraries/System.Diagnostics.Process/tests/KillOnParentExitTests.cs	Adds new Windows tests validating KillOnParentExit behavior under various parent-exit scenarios.
src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessStartInfo.cs	Adds the KillOnParentExit property, docs, and validation with UseShellExecute.
src/libraries/System.Diagnostics.Process/src/System.Diagnostics.Process.csproj	Links in the new Windows job-object interop file.
src/libraries/System.Diagnostics.Process/src/Resources/Strings.resx	Adds a resource string for the KillOnParentExit + UseShellExecute validation.
src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs	Windows implementation: shared job handle, job-list attribute support, and logon path job assignment.
src/libraries/System.Diagnostics.Process/ref/System.Diagnostics.Process.cs	Adds the KillOnParentExit property to the reference assembly surface.
src/libraries/Common/src/Interop/Windows/Kernel32/Interop.JobObjects.cs	Adds required job-object P/Invokes/structs/constants.
src/libraries/Common/src/Interop/Windows/Advapi32/Interop.ProcessOptions.cs	Adds CREATE_SUSPENDED for the CreateProcessWithLogonW suspended-start path.

src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessStartInfo.cs

src/libraries/System.Diagnostics.Process/ref/System.Diagnostics.Process.cs

...ries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs

src/libraries/System.Diagnostics.Process/tests/KillOnParentExitTests.cs

adamsitnik

@copilot address my feedback

src/libraries/System.Diagnostics.Process/ref/System.Diagnostics.Process.cs

...ries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs

src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessStartInfo.cs

src/libraries/System.Diagnostics.Process/tests/KillOnParentExitTests.cs

…sumeThread return, remove unused using, improve VerifyProcessIsRunning polling Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/06c58cfa-bdef-4f35-9345-9ab03e7dc542 Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-09T16:17:49Z

@copilot address my feedback

All feedback addressed in cc04598. Source builds and all 401 tests pass.

src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessStartInfo.cs

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs:524

If InitializeProcThreadAttributeList(attributeListBuffer, ...) fails, attributeListBuffer is still non-null and the finally block will call DeleteProcThreadAttributeList on a buffer that was never successfully initialized. That’s undefined per Win32 contract and could lead to AVs in low-memory/error paths. Consider only assigning to attributeListBuffer after successful initialization (or track an initialized flag) so cleanup calls DeleteProcThreadAttributeList only when initialization succeeded; otherwise just free the allocated memory.

            nuint size = 0;
            Interop.Kernel32.InitializeProcThreadAttributeList(null, attributeCount, 0, ref size);
            attributeListBuffer = NativeMemory.Alloc(size);

            if (!Interop.Kernel32.InitializeProcThreadAttributeList(attributeListBuffer, attributeCount, 0, ref size))
            {
                throw new Win32Exception(Marshal.GetLastWin32Error());
            }

github-actions · 2026-04-11T09:10:25Z

🤖 Copilot Code Review — PR #126699

Note

This review was AI/Copilot-generated.

Holistic Assessment

Motivation: Justified — these are code review follow-up fixes addressing maintainer feedback (jkotas) on the recently-merged KillOnParentExit feature. Each change improves correctness, safety, or code organization.

Approach: Sound — all changes are incremental improvements that align with dotnet/runtime conventions: SafeHandle-based P/Invoke parameters, correct unsigned return types for Windows DWORD APIs, modern nuint syntax, and per-function interop file separation.

Summary: ✅ LGTM. All changes are correct and well-motivated. No new public API surface. No correctness, safety, or performance concerns found. Reviewed by Claude Opus 4.6 and Claude Sonnet 4.5 (GPT-5.4 also consulted but did not complete in time).

Detailed Findings

✅ SafeProcessHandle for AssignProcessToJobObject — Correctness improvement

Changing AssignProcessToJobObject from IntPtr hProcess to SafeProcessHandle hProcess is a genuine safety improvement. The old code passed processInfo.hProcess as a raw IntPtr after Marshal.InitHandle(procSH, processInfo.hProcess) had already transferred ownership to procSH. Using SafeProcessHandle ensures the marshaller calls DangerousAddRef/DangerousRelease, preventing the handle from being collected during the P/Invoke. The only consumer of this shared interop declaration is System.Diagnostics.Process (verified via csproj search), so no other callers are broken.

✅ ResumeThread return type and error check — Bug fix

The Windows ResumeThread API returns DWORD (unsigned 32-bit), with failure indicated by (DWORD)-1 = 0xFFFFFFFF. The old code used int return type with == -1 check, which happened to work due to bit pattern equivalence, but was technically incorrect for a DWORD-returning API. The new uint return with == 0xFFFFFFFF is correct per the Windows API specification.

✅ ResumeThread in separate file — No duplicate concern

Interop.ResumeThread.cs (uint ResumeThread(IntPtr)) is compiled only into System.Diagnostics.Process. The existing Interop.Threading.cs (uint ResumeThread(SafeWaitHandle)) is compiled only into System.Private.CoreLib. They never coexist in the same compilation unit, so there is no duplicate or conflict.

✅ UIntPtr → nuint — Clean modernization

nuint is a keyword alias for UIntPtr in modern C#. Same type, same layout, same marshalling. Consistent with the codebase's gradual modernization.

✅ AssignJobAndResumeThread signature — Cleaner interface

Passing only IntPtr hThread instead of the full PROCESS_INFORMATION struct is appropriate since the method only needs the thread handle (the process handle now comes from procSH).

✅ Test changes — All appropriate

[SkipOnPlatform(iOS | tvOS)] removal: Correctly identified as redundant — the test class is already [PlatformSpecific(TestPlatforms.Windows)].
[OuterLoop("May create a memory dump")]: Appropriate for a crash test that intentionally triggers an access violation.
RedirectStandardError = true removal: Correct — the test never reads from StandardError.
HELIX_WORKITEM_UPLOAD_ROOT = null: Setting to null removes the env var from the child process, disabling Helix dump upload for this intentional-crash test.
using System.Threading removal: Correct — no longer used after prior refactoring.

💡 Out-of-scope: Test `ResumeThread` inconsistency

ProcessHandlesTests.Windows.cs (line 187) has a local private static partial int ResumeThread(nint hThread) with == -1 check. This is technically correct (same bit pattern) but inconsistent with the production code's uint/0xFFFFFFFF pattern. Not a bug, and out of scope for this PR, but could be cleaned up in a future pass.

Generated by Code Review for issue #126699 · ◷

jkotas · 2026-04-11T14:10:07Z

ProcessHandlesTests.Windows.cs (line 187) has a local private static partial int ResumeThread(nint hThread) with == -1 check. This is technically correct (same bit pattern) but inconsistent with the production code's uint/0xFFFFFFFF pattern.

@copilot Address this feedback by replacing the local ResumeThread with the shared copy

…d Interop.Kernel32.ResumeThread Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e8bb36bc-5c71-4723-a32c-17e87d762370 Co-authored-by: jkotas <6668460+jkotas@users.noreply.github.com>

Copilot · 2026-04-11T14:20:09Z

ProcessHandlesTests.Windows.cs (line 187) has a local private static partial int ResumeThread(nint hThread) with == -1 check. This is technically correct (same bit pattern) but inconsistent with the...

Replaced the local ResumeThread P/Invoke in ProcessHandlesTests.Windows.cs with the shared Interop.Kernel32.ResumeThread (returns uint, check == 0xFFFFFFFF) in c5b7d59. Also added the Interop.ResumeThread.cs reference to the test csproj.

…al ResumeThread P/Invoke Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e8bb36bc-5c71-4723-a32c-17e87d762370 Co-authored-by: jkotas <6668460+jkotas@users.noreply.github.com>

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/f3703368-dbc7-4226-8258-1bb793d93faf Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

src/libraries/Common/src/Interop/Windows/Kernel32/Interop.JobObjects.cs

...ries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Windows.cs

adamsitnik · 2026-04-11T19:25:17Z

@copilot please address @jkotas feedback

…, unnecessary assert, reduce ConfigureExtendedStartupInfo args Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/2dd25b7c-da4a-4ed0-a9b3-cc6561f14aeb Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot · 2026-04-11T19:35:05Z

@copilot please address @jkotas feedback

All four items addressed in f497166.

Copilot AI assigned Copilot and adamsitnik Apr 9, 2026

Copilot AI requested review from Copilot and removed request for Copilot April 9, 2026 11:20

Copilot created this pull request from a session on behalf of adamsitnik April 9, 2026 11:20 View session

github-actions bot added the area-System.Diagnostics.Process label Apr 9, 2026

adamsitnik reviewed Apr 9, 2026

View reviewed changes

Copilot started work on behalf of adamsitnik April 9, 2026 12:09 View session

adamsitnik added this to the 11.0.0 milestone Apr 9, 2026

adamsitnik added the NO-REVIEW Experimental/testing PR, do NOT review it label Apr 9, 2026

Copilot AI requested review from Copilot and removed request for Copilot April 9, 2026 12:50

Copilot AI changed the title ~~Implementing KillOnParentExit property in ProcessStartInfo class~~ Implement ProcessStartInfo.KillOnParentExit for Windows Apr 9, 2026

Copilot finished work on behalf of adamsitnik April 9, 2026 12:53

Copilot AI requested a review from adamsitnik April 9, 2026 12:53

address my own feedback:

b910623

- simplify the tests - avoid duplication!!

Copilot AI review requested due to automatic review settings April 9, 2026 14:13

adamsitnik marked this pull request as ready for review April 9, 2026 14:20

Copilot AI reviewed Apr 9, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

adamsitnik reviewed Apr 9, 2026

View reviewed changes

Copilot started work on behalf of adamsitnik April 9, 2026 15:39 View session

Copilot AI requested a review from adamsitnik April 9, 2026 17:06

Copilot finished work on behalf of adamsitnik April 9, 2026 17:06

adamsitnik reviewed Apr 9, 2026

View reviewed changes

src/libraries/System.Diagnostics.Process/src/System/Diagnostics/ProcessStartInfo.cs Show resolved Hide resolved

Copilot AI reviewed Apr 11, 2026

View reviewed changes

This was referenced Apr 11, 2026

ResolveFileProvider_WithMissingParentDirectory_WatchTokenFiresWhenFileCreated test timing out in CI #126787

Open

System.Runtime.InteropServices.Tests.DestroyStructureTests.DestroyStructure_Blittable_Success failing in CI #126788

Closed

Copilot started work on behalf of jkotas April 11, 2026 14:10 View session

Replace local ResumeThread P/Invoke in ProcessHandlesTests with share…

c5b7d59

…d Interop.Kernel32.ResumeThread Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e8bb36bc-5c71-4723-a32c-17e87d762370 Co-authored-by: jkotas <6668460+jkotas@users.noreply.github.com>

Remove unused System.Runtime.InteropServices using after removing loc…

84ca617

…al ResumeThread P/Invoke Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/e8bb36bc-5c71-4723-a32c-17e87d762370 Co-authored-by: jkotas <6668460+jkotas@users.noreply.github.com>

Copilot AI requested review from Copilot and removed request for Copilot April 11, 2026 14:21

Copilot finished work on behalf of jkotas April 11, 2026 14:22

Copilot AI mentioned this pull request Apr 11, 2026

Fix WasmTestOnChrome: exclude browser/wasi from gen-debug-dump-docs.py helix post-command #126789

Open

1 task

Copilot started work on behalf of adamsitnik April 11, 2026 17:12 View session

Remove defensive HELIX_WORKITEM_UPLOAD_ROOT env var from crash test

96e2804

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/f3703368-dbc7-4226-8258-1bb793d93faf Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com>

Copilot AI requested review from Copilot and removed request for Copilot April 11, 2026 17:16

Copilot finished work on behalf of adamsitnik April 11, 2026 17:18

jkotas approved these changes Apr 11, 2026

View reviewed changes

Copilot started work on behalf of adamsitnik April 11, 2026 19:25 View session

Copilot AI requested review from Copilot and removed request for Copilot April 11, 2026 19:34

Copilot finished work on behalf of adamsitnik April 11, 2026 19:36

adamsitnik enabled auto-merge (squash) April 11, 2026 19:41

Copilot AI mentioned this pull request Apr 11, 2026

Fix NullReferenceException in DestroyStructure for blittable types #126795

Merged

This was referenced Apr 11, 2026

Unable to pull image from mcr.microsoft.com #117164

Open

AF: *(_UNCHECKED_OBJECTREF *)handle == NULL (HndCreateHandle called by getJitHandleForObject) #117138

Open

Conversation

Copilot AI commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes Made

Uh oh!

adamsitnik left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

adamsitnik left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 9, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

github-actions bot commented Apr 11, 2026

🤖 Copilot Code Review — PR #126699

Holistic Assessment

Detailed Findings

✅ SafeProcessHandle for AssignProcessToJobObject — Correctness improvement

✅ ResumeThread return type and error check — Bug fix

✅ ResumeThread in separate file — No duplicate concern

✅ UIntPtr → nuint — Clean modernization

✅ AssignJobAndResumeThread signature — Cleaner interface

✅ Test changes — All appropriate

💡 Out-of-scope: Test ResumeThread inconsistency

Uh oh!

jkotas commented Apr 11, 2026

Uh oh!

Copilot AI commented Apr 11, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

adamsitnik commented Apr 11, 2026

Uh oh!

Copilot AI commented Apr 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Apr 9, 2026 •

edited

Loading

💡 Out-of-scope: Test `ResumeThread` inconsistency