src: don't kill own process group on failed spawn

[lazerg]

libuv only assigns a pid to the process handle once uv_spawn() succeeds, so a child that never started keeps pid 0. Calling kill() on that child still reached uv_process_kill(), which ended up in kill(0, signal) and signalled every process in the caller's own process group, Node included. The handle is now reported as ESRCH when there is no pid, so child.kill() just returns false. The pid is also zeroed in the constructor so the check never reads an unassigned value.

Reproducing it on its own needs no prototype tampering:

const { spawn } = require('child_process');
const child = spawn('foo123');
child.on('error', () => {});
child.kill();  // terminates the whole process group

In the report the spawn failed for a different reason: overriding Array.prototype[Symbol.iterator] makes normalizeSpawnArguments() build an empty env, so the command was no longer found through PATH. The dead handle is what took the parent down.

Behavior change

kill() on a child that failed to spawn used to return true on POSIX. It now returns false.

Windows was never affected by the process-group problem, since uv_process_kill() bails out with EINVAL when the handle has no process handle. It reached the throw new ErrnoException(err, 'kill') branch instead, so there kill() goes from throwing EINVAL to returning false. Both platforms now agree.

subprocess.killed is also left alone in this case, which matches what the docs already say about it being set only when a signal is sent successfully.

Fixes: #65052

[avivkeller]

What's the point this? Won't the PID be assigned to 0 anyway by libuv?

[lazerg]

Checked uv__handle_init: it only sets loop / type/ flags / handle_queue, never touches pid. So before this, pid was whatever was on the stack, not 0. Kept the explicit zero.

[avivkeller]

Maybe I'm thinking into this too much, but it seems redundant to initialize properties when other properties serve the same purpose. Surely elsewhere on the object some other indication of failure is present. If not, then I guess this is correct.

[lazerg]

no, nothing else on the object marks it. state_ only reflects the handle's own open/close lifecycle, not whether uv_spawn set a pid. Without the explicit zero it's leftover stack memory.

btw thank you for putting html injection 💀 . But I think most of the frontier models can notice it instantly :)