fix(threadpool): per-task nursery scope for sync tasks — snapshot UAF (no scope-pointer swap)

[EdmondDantes]

Problem

A synchronous ThreadPool task (new ThreadPool(N), i.e. coroutine_mode = false) ran its body inline in the worker's main coroutine and freed the per-task snapshot arena the instant the body returned. If the body had Async\spawn()ed a coroutine it never awaited, that coroutine was still pending in the scheduler — and its op_array lives in the just-freed arena. Running it later dereferenced freed memory: hard crash on the Windows debug heap, latent + ASAN-caught on Linux.

Approach (supersedes #159)

#159 fixed this by temporarily swapping the worker coroutine's scope pointer to redirect Async\spawn() into a per-task nursery, plus a hand-rolled cancel/await/pin dance. This PR removes that swap entirely.

The task body now runs as a real coroutine in its own per-task nursery Scope. Because CURRENT SCOPE follows the running coroutine, Async\spawn() inside the body lands in that scope on its own — no coro->scope hijacking. On task exit the worker cancels the scope and drains it — awaiting the physical disposal of every spawned coroutine — before freeing the snapshot.

Invariant: no coroutine spawned by the task outlives the snapshot. (Whether such a coroutine got to run at all is timing-dependent and intentionally not asserted — the only guarantee is no use-after-free.)

The drain reuses the canonical zombie-aware logic of Scope::awaitAfterCancellation instead of re-implementing it: its body is factored into a C function exposed on the engine API.

Changes

• php-src (ABI v0.20.0, already on true-async-stable): new zend_async_scope_await_after_cancellation_fn + ZEND_ASYNC_SCOPE_AWAIT_AFTER_CANCELLATION macro. Scope::awaitAfterCancellation is now a thin wrapper over the shared C core.
• ext/async: sync task path in thread_pool.c rewritten (NEW_SCOPE nursery → SPAWN_WITH → await body → cancel → drain → free snapshot); scope.c/.h factor + register the C core; async_API.c registration. pool_task_dispose/coroutine-mode path untouched.

Tests

tests/thread_pool/065-task_scope_nursery_no_uaf.phpt (spawned-not-awaited coroutine still pending at task return). Full tests/thread_pool/ 66/66 (+1 pre-existing XFAIL) and scope/task_group/task_set/coroutine/spawn/await/future/pool/channel (≈480) green under ASAN+ZTS.

Requires php-src true-async-stable at ABI v0.20.0 (pushed first so this PR's CI clones it).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!