QFuture: fix handling of cancelled continuation chain

To support cancellation of continuations attached via the parent future,
for each future returned by a continuation we store a pointer to its
parent (i.e. future the continuation is attached to). Later, before
executing a continuation, we go through chain of parents and check if
any of them is cancelled. However, if one of the parents is destroyed
while the chain is executing, the next continuations' parent pointers
will become invalid. So storing the parent pointers isn't safe.

This commit changes the logic of handling the cancelled continuation
chain in the following way:

- Instead of storing a parent pointer in the continuation future's data,
  we do the opposite: we store a pointer to continuation's future in the
  parent.
- When a future is cancelled, we mark all continuation futures in the
  chain with a flag indicating that the chain is cancelled.
- To guarantee that the pointers to continuation future's data don't
  become invalid, we clean the continuation (that stores a copy of its
  future's data and keeps it alive) only when the associated promise
  is destructed, instead of cleaning it after the continuation is run.

Fixes: QTBUG-105182
Fixes: QTBUG-106083
Pick-to: 6.2 6.3 6.4
Change-Id: I48afa98152672c0fc737112be4ca3b1b42f6ed30
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>

1 files changed, 36 insertions, 19 deletions

diff --git a/src/corelib/thread/qfutureinterface.cpp b/src/corelib/thread/qfutureinterface.cpp
index a82b7af873..b62ceaf91d 100644
--- a/src/corelib/thread/qfutureinterface.cpp
+++ b/src/corelib/thread/qfutureinterface.cpp
@@ -105,6 +105,13 @@ void QFutureInterfaceBase::cancel(QFutureInterfaceBase::CancelMode mode)
         break;
     }
 
+    // Cancel the continuations chain
+    QFutureInterfaceBasePrivate *next = d->continuationData;
+    while (next) {
+        next->continuationState = QFutureInterfaceBasePrivate::Canceled;
+        next = next->continuationData;
+    }
+
     d->waitCondition.wakeAll();
     d->pausedWaitCondition.wakeAll();
 
@@ -816,45 +823,55 @@ void QFutureInterfaceBase::setContinuation(std::function<void(const QFutureInter
 {
     QMutexLocker lock(&d->continuationMutex);
 
-    if (continuationFutureData)
-        continuationFutureData->parentData = d;
-
     // If the state is ready, run continuation immediately,
     // otherwise save it for later.
     if (isFinished()) {
         lock.unlock();
         func(*this);
-    } else {
+        lock.relock();
+    }
+    // Unless the continuation has been cleaned earlier, we have to
+    // store the move-only continuation, to guarantee that the associated
+    // future's data stays alive.
+    if (d->continuationState != QFutureInterfaceBasePrivate::Cleaned) {
         d->continuation = std::move(func);
+        d->continuationData = continuationFutureData;
     }
 }
 
+void QFutureInterfaceBase::cleanContinuation()
+{
+    if (!d)
+        return;
+
+    QMutexLocker lock(&d->continuationMutex);
+    d->continuation = nullptr;
+    d->continuationState = QFutureInterfaceBasePrivate::Cleaned;
+}
+
 void QFutureInterfaceBase::runContinuation() const
 {
     QMutexLocker lock(&d->continuationMutex);
     if (d->continuation) {
-        auto fn = std::exchange(d->continuation, nullptr);
+        // Save the continuation in a local function, to avoid calling
+        // a null std::function below, in case cleanContinuation() is
+        // called from some other thread right after unlock() below.
+        auto fn = std::move(d->continuation);
         lock.unlock();
         fn(*this);
+
+        lock.relock();
+        // Unless the continuation has been cleaned earlier, we have to
+        // store the move-only continuation, to guarantee that the associated
+        // future's data stays alive.
+        if (d->continuationState != QFutureInterfaceBasePrivate::Cleaned)
+            d->continuation = std::move(fn);
     }
 }
 
 bool QFutureInterfaceBase::isChainCanceled() const
 {
-    if (isCanceled())
-        return true;
-
-    auto parent = d->parentData;
-    while (parent) {
-        // If the future is in Canceled state because it had an exception, we want to
-        // continue checking the chain of parents for cancellation, otherwise if the exception
-        // is handled inside the chain, it won't be interrupted even though cancellation has
-        // been requested.
-        if ((parent->state.loadRelaxed() & Canceled) && !parent->hasException)
-            return true;
-        parent = parent->parentData;
-    }
-    return false;
+    return isCanceled() || d->continuationState == QFutureInterfaceBasePrivate::Canceled;
 }
 
 void QFutureInterfaceBase::setLaunchAsync(bool value)