ext/pcntl: do not drop queued signals when an exception is pending

pcntl_signal_dispatch() takes the whole queue out of PCNTL_G(head) before it
starts calling handlers, and recycles every entry it walks over. Two paths let
signals disappear that way.

The first one is the interrupt handler. ZEND_VM_FCALL_INTERRUPT_CHECK() runs
right after an internal function returns, before the pending exception is
handled, so pcntl_interrupt_function() reaches the dispatcher with EG(exception)
set. call_user_function() returns without calling anything in that state, the
"if (EG(exception)) break" added by 296fad1 fires on the first entry, and
the drain loop then recycles the entire queue without a single handler having
run. Setting the exception aside for the duration of the dispatch, the way
zend_lookup_class_ex() does around autoloading, lets the handlers run.

The second one is a handler that throws while other signals are queued behind
it: those were recycled too. They now go back to the queue, so the next
dispatch delivers them.

This is reachable from any long blocking internal call that throws on timeout.
pecl/amqp is one: AMQPQueue::consume() throws "Consumer timeout exceed" when
the read timeout expires, which made a Symfony messenger worker built on it
miss every SIGTERM, whatever the timeout was.

Author: nicolas-grekas

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.27
 
+- PCNTL:
+  . Fixed pcntl_signal_dispatch() dropping queued signals when it runs while an
+    exception is pending. (nicolas-grekas)
+
 
 24 Sep 2026, PHP 8.4.26
 

ext/pcntl/pcntl.c

@@ -1345,8 +1345,15 @@ void pcntl_signal_dispatch(void)
 	PCNTL_G(head) = NULL; /* simple stores are atomic */
 	PCNTL_G(tail) = NULL;
 
+	/* Dispatching can happen while an exception is propagating, typically from the interrupt
+	 * handler that runs right after an internal function returned with an exception pending.
+	 * Handlers cannot be called in that state, so set the exception aside for the time being. */
+	zend_exception_save();
+
 	/* Allocate */
 	while (queue) {
+		bool handler_threw = false;
+
 		if ((handle = zend_hash_index_find(&PCNTL_G(php_signal_table), queue->signo)) != NULL) {
 			if (Z_TYPE_P(handle) != IS_LONG) {
 				ZVAL_NULL(&retval);
@@ -1365,27 +1372,38 @@ void pcntl_signal_dispatch(void)
 #ifdef HAVE_STRUCT_SIGINFO_T
 				zval_ptr_dtor(&params[1]);
 #endif
-				if (EG(exception)) {
-					break;
-				}
+				handler_threw = NULL != EG(exception);
 			}
 		}
 
 		next = queue->next;
 		queue->next = PCNTL_G(spares);
 		PCNTL_G(spares) = queue;
 		queue = next;
-	}
 
-	/* drain the remaining in case of exception thrown */
-	while (queue) {
-		next = queue->next;
-		queue->next = PCNTL_G(spares);
-		PCNTL_G(spares) = queue;
-		queue = next;
+		/* No other handler can be called while the exception propagates */
+		if (handler_threw) {
+			break;
+		}
 	}
 
-	PCNTL_G(pending_signals) = 0;
+	zend_exception_restore();
+
+	if (UNEXPECTED(queue)) {
+		/* The signals a throwing handler left behind go back to the queue instead of being
+		 * dropped, so that the next dispatch delivers them. Signals are still blocked here, so
+		 * PCNTL_G(head) cannot have been repopulated in the meantime. */
+		next = queue;
+
+		while (next->next) {
+			next = next->next;
+		}
+
+		PCNTL_G(head) = queue;
+		PCNTL_G(tail) = next;
+	} else {
+		PCNTL_G(pending_signals) = 0;
+	}
 
 	/* Re-enable queue */
 	PCNTL_G(processing_signal_queue) = 0;

ext/pcntl/tests/pcntl_signal_dispatch_exception_2.phpt

@@ -0,0 +1,44 @@
+--TEST--
+pcntl_signal_dispatch() keeps the signals left in the queue by a throwing handler
+--EXTENSIONS--
+pcntl
+posix
+--FILE--
+<?php
+
+$called = [];
+
+pcntl_signal(SIGUSR1, function ($signo) use (&$called) {
+    $called[] = 'SIGUSR1';
+    throw new \Exception('Exception in signal handler');
+});
+
+pcntl_signal(SIGUSR2, function ($signo) use (&$called) {
+    $called[] = 'SIGUSR2';
+});
+
+pcntl_signal(SIGHUP, function ($signo) use (&$called) {
+    $called[] = 'SIGHUP';
+});
+
+posix_kill(posix_getpid(), SIGUSR1);
+posix_kill(posix_getpid(), SIGUSR2);
+posix_kill(posix_getpid(), SIGHUP);
+
+try {
+    pcntl_signal_dispatch();
+} catch (\Exception $e) {
+    echo $e->getMessage() . "\n";
+}
+
+echo "Handlers called: " . implode(', ', $called) . "\n";
+
+pcntl_signal_dispatch();
+
+echo "Handlers called: " . implode(', ', $called) . "\n";
+
+?>
+--EXPECT--
+Exception in signal handler
+Handlers called: SIGUSR1
+Handlers called: SIGUSR1, SIGUSR2, SIGHUP