Reliably cancel in-progress CryptoResult(Impl) upon shutdown.

Source/modules/crypto/CryptoResultImpl.h

Index: Source/modules/crypto/CryptoResultImpl.h
diff --git a/Source/modules/crypto/CryptoResultImpl.h b/Source/modules/crypto/CryptoResultImpl.h
index b6cb6e90126c8290fdfbbd3a2172afc230868247..a8b99af7b81cb9c10b33d574d0d35c65971f4d92 100644
--- a/Source/modules/crypto/CryptoResultImpl.h
+++ b/Source/modules/crypto/CryptoResultImpl.h
@@ -40,7 +40,6 @@
 
 namespace blink {
 
-class ScriptPromiseResolver;
 MODULES_EXPORT ExceptionCode webCryptoErrorToExceptionCode(WebCryptoErrorType);
 
 // Wrapper around a Promise to notify completion of the crypto operation.
@@ -50,27 +49,36 @@ MODULES_EXPORT ExceptionCode webCryptoErrorToExceptionCode(WebCryptoErrorType);
 //
 //  * At creation time there must be an active ExecutionContext.
 //  * The CryptoResult interface must only be called from the origin thread.
-//  * ref(), deref(), cancelled() and cancel() can be called from any thread.
+//  * cancel() can only be called from the origin thread.
+//  * ref(), deref() can be called from any thread.
 //  * One of the completeWith***() functions must be called, or the
 //    m_resolver will be leaked until the ExecutionContext is destroyed.
 class CryptoResultImpl final : public CryptoResult {
 public:
-    ~CryptoResultImpl();
-
     static PassRefPtrWillBeRawPtr<CryptoResultImpl> create(ScriptState*);
 
+    ~CryptoResultImpl();
+
     void completeWithError(WebCryptoErrorType, const WebString&) override;
     void completeWithBuffer(const void* bytes, unsigned bytesSize) override;
     void completeWithJson(const char* utf8Data, unsigned length) override;
     void completeWithBoolean(bool) override;
     void completeWithKey(const WebCryptoKey&) override;
     void completeWithKeyPair(const WebCryptoKey& publicKey, const WebCryptoKey& privateKey) override;
-    bool cancelled() const override;
 
     // If called after completion (including cancellation) will return an empty
     // ScriptPromise.
     ScriptPromise promise();
 
+    WebCryptoResult result()
+    {
+        return WebCryptoResult(this);
+    }
+
+    void assignedTo(WebCryptoResult*) override;
+
+    DECLARE_VIRTUAL_TRACE();
+
 private:
     class Resolver;
     explicit CryptoResultImpl(ScriptState*);
@@ -78,12 +86,21 @@ private:
     void clearResolver();
     void cancel();
 
-    // FIXME: ScriptPromiseResolver should not be exported.
-    // Instead, use ScriptPromise.
-    ScriptPromiseResolver* m_resolver;
-    volatile int m_cancelled;
+    RawPtrWillBeMember<Resolver> m_resolver;
+
+    // To reliably allow a WebCrypto-using execution context to shut down while
+    // crypto operations it has issued are still underway, keep track of the
+    // WebCrypto reference that keeps each CryptoResultImpl alive.
+    //
+    // Should the execution context be stop()ped, this keep-alive reference is
+    // eagerly cancelled and cleared out. The execution context can then
+    // proceed and shut down tidily.
+    //
+    // When the corresponding crypto operation eventually completes, it'll
+    // notice the cancellation and act accordingly.
+    WebCryptoResult* m_resultOwner;

[eroman, 2015/07/15 21:34:06]

This doesn't make sense.

WebCryptoResult is a copiable stack-allocated class, which holds a pointer to
CryptoResultImpl.

Consider what happens in this case:

WebCryptoResult x(impl);   // impl->m_resultOwner is now &x
{
  WebCryptoResult y = x;     // assignment changes impl->m_resultOwner to &y
}
// Now y is destroyed, and it sets m_impl->m_resultOwner to nullptr


With you change, upon leaving that second scope (and destroying y), the
underlying WebCryptoResultImpl is left with a null m_resultOwner, even though it
still references the WebCryptoResultImpl.

 };
 
 } // namespace blink
 
-#endif
+#endif // CryptoResultImpl_h