Fixed the racy code around the message-only window in base::MessagePumpForUI on Windows.

base/message_pump_win.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_MESSAGE_PUMP_WIN_H_
 #define BASE_MESSAGE_PUMP_WIN_H_
 
 #include <windows.h>
 
 #include <list>
 
 #include "base/base_export.h"
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_pump.h"
 #include "base/message_pump_dispatcher.h"
 #include "base/message_pump_observer.h"
 #include "base/observer_list.h"
 #include "base/time.h"
+#include "base/win/message_window.h"
 #include "base/win/scoped_handle.h"
 
 namespace base {
 
 // MessagePumpWin serves as the base for specialized versions of the MessagePump
 // for Windows. It provides basic functionality like handling of observers and
 // controlling the lifetime of the message pump.
 class BASE_EXPORT MessagePumpWin : public MessagePump {
  public:
-  MessagePumpWin() : have_work_(0), state_(NULL) {}
+  MessagePumpWin();
   virtual ~MessagePumpWin() {}
 
   // Add an Observer, which will start receiving notifications immediately.
   void AddObserver(MessagePumpObserver* observer);
 
   // Remove an Observer.  It is safe to call this method while an Observer is
   // receiving a notification callback.
   void RemoveObserver(MessagePumpObserver* observer);
 
   // Give a chance to code processing additional messages to notify the
@@ skipping 21 matching lines @@
   };
 
   virtual void DoRunLoop() = 0;
   int GetCurrentDelay() const;
 
   ObserverList<MessagePumpObserver> observers_;
 
   // The time at which delayed work should run.
   TimeTicks delayed_work_time_;
 
-  // A boolean value used to indicate if there is a kMsgDoWork message pending
-  // in the Windows Message queue.  There is at most one such message, and it
-  // can drive execution of tasks when a native message pump is running.
-  LONG have_work_;
+  // Used to indicate if there is a kMsgDoWork message pending in the Windows
+  // Message queue. There is at most one such message, and it can drive
+  // execution of tasks when a native message pump is running.
+  LONG pump_state_;
 
   // State for the current invocation of Run.
   RunState* state_;
 };
 
 //-----------------------------------------------------------------------------
 // MessagePumpForUI extends MessagePumpWin with methods that are particular to a
 // MessageLoop instantiated with TYPE_UI.
 //
 // MessagePumpForUI implements a "traditional" Windows message pump. It contains
@@ skipping 33 matching lines @@
 // kMsgHaveWork messages.  As a result, care is taken to do some peeking in
 // between the posting of each kMsgHaveWork message (i.e., after kMsgHaveWork
 // is peeked, and before a replacement kMsgHaveWork is posted).
 //
 // NOTE: Although it may seem odd that messages are used to start and stop this
 // flow (as opposed to signaling objects, etc.), it should be understood that
 // the native message pump will *only* respond to messages.  As a result, it is
 // an excellent choice.  It is also helpful that the starter messages that are
 // placed in the queue when new task arrive also awakens DoRunLoop.
 //
-class BASE_EXPORT MessagePumpForUI : public MessagePumpWin {
+class BASE_EXPORT MessagePumpForUI
+    : public MessagePumpWin,
+      public win::MessageWindow::Delegate {
  public:
   // A MessageFilter implements the common Peek/Translate/Dispatch code to deal
   // with windows messages.
   // This abstraction is used to inject TSF message peeking. See
   // TextServicesMessageFilter.
   class BASE_EXPORT MessageFilter {
    public:
     virtual ~MessageFilter() {}
     // Implements the functionality exposed by the OS through PeekMessage.
     virtual BOOL DoPeekMessage(MSG* msg,
@@ skipping 20 matching lines @@
 
   MessagePumpForUI();
   virtual ~MessagePumpForUI();
 
   // Sets a new MessageFilter. MessagePumpForUI takes ownership of
   // |message_filter|. When SetMessageFilter is called, old MessageFilter is
   // deleted.
   void SetMessageFilter(scoped_ptr<MessageFilter> message_filter);
 
   // MessagePump methods:
-  virtual void ScheduleWork();
-  virtual void ScheduleDelayedWork(const TimeTicks& delayed_work_time);
+  virtual void ScheduleWork() OVERRIDE;
+  virtual void ScheduleDelayedWork(const TimeTicks& delayed_work_time) OVERRIDE;
+  virtual void WillDestroyCurrentMessageLoop() OVERRIDE;
 
   // Applications can call this to encourage us to process all pending WM_PAINT
   // messages.  This method will process all paint messages the Windows Message
   // queue can provide, up to some fixed number (to avoid any infinite loops).
   void PumpOutPendingPaintMessages();
 
  private:
-  static LRESULT CALLBACK WndProcThunk(HWND window_handle,
-                                       UINT message,
-                                       WPARAM wparam,
-                                       LPARAM lparam);
+  // win::MessageWindow::Delegate interface.
+  virtual bool HandleMessage(HWND hwnd,
+                             UINT message,
+                             WPARAM wparam,
+                             LPARAM lparam,
+                             LRESULT* result) OVERRIDE;
+
   virtual void DoRunLoop();
-  void InitMessageWnd();
   void WaitForWork();
   void HandleWorkMessage();
   void HandleTimerMessage();
   bool ProcessNextWindowsMessage();
   bool ProcessMessageHelper(const MSG& msg);
   bool ProcessPumpReplacementMessage();
 
-  // Instance of the module containing the window procedure.
-  HMODULE instance_;
+  scoped_ptr<MessageFilter> message_filter_;
+
+  // Used to post an APC to the thread running the message pump.
+  win::ScopedHandle thread_;
 
   // A hidden message-only window.
-  HWND message_hwnd_;
-
-  scoped_ptr<MessageFilter> message_filter_;
+  scoped_ptr<win::MessageWindow> window_;
 };
 
 //-----------------------------------------------------------------------------
 // MessagePumpForIO extends MessagePumpWin with methods that are particular to a
 // MessageLoop instantiated with TYPE_IO. This version of MessagePump does not
 // deal with Windows mesagges, and instead has a Run loop based on Completion
 // Ports so it is better suited for IO operations.
 //
 class BASE_EXPORT MessagePumpForIO : public MessagePumpWin {
  public:
@@ skipping 179 matching lines @@
   // This list will be empty almost always. It stores IO completions that have
   // not been delivered yet because somebody was doing cleanup.
   std::list<IOItem> completed_io_;
 
   ObserverList<IOObserver> io_observers_;
 };
 
 }  // namespace base
 
 #endif  // BASE_MESSAGE_PUMP_WIN_H_