Fix multi-thread protection in custom url handler

The classes were not properly protected against race conditions. To
solve this there is now a class shared between the two thread that is
not deleted until the classes on both threads have been deleted.

Change-Id: I499bd98805ae7a195aca42f30610eb6c2b0fd0f7
Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com>
Reviewed-by: Joerg Bornemann <joerg.bornemann@theqtcompany.com>

1 files changed, 30 insertions, 10 deletions

diff --git a/src/core/url_request_custom_job.h b/src/core/url_request_custom_job.h
index a994c467a..eedb41814 100644
--- a/src/core/url_request_custom_job.h
+++ b/src/core/url_request_custom_job.h
@@ -50,6 +50,7 @@ QT_FORWARD_DECLARE_CLASS(QWebEngineUrlSchemeHandler)
 namespace QtWebEngineCore {
 
 class URLRequestCustomJobDelegate;
+class URLRequestCustomJobShared;
 
 // A request job that handles reading custom URL schemes
 class URLRequestCustomJob : public net::URLRequestJob {
@@ -62,6 +63,25 @@ public:
     virtual bool GetCharset(std::string *charset) Q_DECL_OVERRIDE;
     virtual bool IsRedirectResponse(GURL* location, int* http_status_code) Q_DECL_OVERRIDE;
 
+protected:
+    virtual ~URLRequestCustomJob();
+
+private:
+    QWebEngineUrlSchemeHandler *m_schemeHandler;
+    URLRequestCustomJobShared *m_shared;
+
+    friend class URLRequestCustomJobShared;
+
+    DISALLOW_COPY_AND_ASSIGN(URLRequestCustomJob);
+};
+
+// A shared state between URLRequestCustomJob living on the IO thread
+// and URLRequestCustomJobDelegate living on the UI thread.
+class URLRequestCustomJobShared {
+public:
+    URLRequestCustomJobShared(URLRequestCustomJob *job);
+    ~URLRequestCustomJobShared();
+
     void setReplyMimeType(const std::string &);
     void setReplyCharset(const std::string &);
     void setReplyDevice(QIODevice *);
@@ -70,28 +90,28 @@ public:
     void fail(int);
     void abort();
 
-protected:
-    virtual ~URLRequestCustomJob();
+    void killJob();
+    void unsetJobDelegate();
+
     void startAsync();
     void notifyStarted();
     void notifyFailure();
     void notifyCanceled();
 
-private:
+    GURL requestUrl();
+    std::string requestMethod();
+
     QMutex m_mutex;
     QPointer<QIODevice> m_device;
-    QPointer<URLRequestCustomJobDelegate> m_delegate;
-    QWebEngineUrlSchemeHandler *m_schemeHandler;
+    URLRequestCustomJob *m_job;
+    URLRequestCustomJobDelegate *m_delegate;
     std::string m_mimeType;
     std::string m_charset;
     int m_error;
     GURL m_redirect;
     bool m_started;
-    base::WeakPtrFactory<URLRequestCustomJob> m_weakFactory;
-
-    friend class URLRequestCustomJobDelegate;
-
-    DISALLOW_COPY_AND_ASSIGN(URLRequestCustomJob);
+    bool m_asyncInitialized;
+    base::WeakPtrFactory<URLRequestCustomJobShared> m_weakFactory;
 };
 
 } // namespace QtWebEngineCore