QFuture: fix handling of cancelled continuation chain

To support cancellation of continuations attached via the parent future,
for each future returned by a continuation we store a pointer to its
parent (i.e. future the continuation is attached to). Later, before
executing a continuation, we go through chain of parents and check if
any of them is cancelled. However, if one of the parents is destroyed
while the chain is executing, the next continuations' parent pointers
will become invalid. So storing the parent pointers isn't safe.

This commit changes the logic of handling the cancelled continuation
chain in the following way:

- Instead of storing a parent pointer in the continuation future's data,
  we do the opposite: we store a pointer to continuation's future in the
  parent.
- When a future is cancelled, we mark all continuation futures in the
  chain with a flag indicating that the chain is cancelled.
- To guarantee that the pointers to continuation future's data don't
  become invalid, we clean the continuation (that stores a copy of its
  future's data and keeps it alive) only when the associated promise
  is destructed, instead of cleaning it after the continuation is run.

Fixes: QTBUG-105182
Fixes: QTBUG-106083
Pick-to: 6.2 6.3 6.4
Change-Id: I48afa98152672c0fc737112be4ca3b1b42f6ed30
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>

1 files changed, 4 insertions, 1 deletions

diff --git a/src/corelib/thread/qfutureinterface_p.h b/src/corelib/thread/qfutureinterface_p.h
index ec3517bab3..6258e61de7 100644
--- a/src/corelib/thread/qfutureinterface_p.h
+++ b/src/corelib/thread/qfutureinterface_p.h
@@ -141,7 +141,10 @@ public:
     QThreadPool *m_pool = nullptr;
     // Wrapper for continuation
     std::function<void(const QFutureInterfaceBase &)> continuation;
-    QFutureInterfaceBasePrivate *parentData = nullptr;
+    QFutureInterfaceBasePrivate *continuationData = nullptr;
+
+    enum ContinuationState : quint8 { Default, Canceled, Cleaned };
+    std::atomic<ContinuationState> continuationState { Default };
 
     RefCount refCount = 1;
     QAtomicInt state; // reads and writes can happen unprotected, both must be atomic