Fixed the racy code around the message-only window in base::MessagePumpForUI on Windows.

base/message_pump_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/message_pump_win.h"
 
 #include <math.h>
 
 #include "base/debug/trace_event.h"
 #include "base/message_loop.h"
 #include "base/metrics/histogram.h"
-#include "base/process_util.h"
-#include "base/win/wrapped_window_proc.h"
 
 namespace {
 
 enum MessageLoopProblems {
   MESSAGE_POST_ERROR,
   COMPLETION_POST_ERROR,
   SET_TIMER_ERROR,
   MESSAGE_LOOP_PROBLEM_MAX,
 };
 
 }  // namespace
 
 namespace base {
 
-static const wchar_t kWndClass[] = L"Chrome_MessagePumpWindow";
-
 // Message sent to get an additional time slice for pumping (processing) another
 // task (a series of such messages creates a continuous task pump).
 static const int kMsgHaveWork = WM_USER + 1;
 
+// Used by MessagePumpUI to wake up the thread and check any pending timers.
+static const int kTimerId = 1;
+
 //-----------------------------------------------------------------------------
 // MessagePumpWin public:
 
 void MessagePumpWin::AddObserver(MessagePumpObserver* observer) {
   observers_.AddObserver(observer);
 }
 
 void MessagePumpWin::RemoveObserver(MessagePumpObserver* observer) {
   observers_.RemoveObserver(observer);
 }
@@ skipping 45 matching lines @@
   if (delay < 0)
     delay = 0;
 
   return delay;
 }
 
 //-----------------------------------------------------------------------------
 // MessagePumpForUI public:
 
 MessagePumpForUI::MessagePumpForUI()
-    : instance_(NULL),
-      message_filter_(new MessageFilter) {
-  InitMessageWnd();
+    : message_filter_(new MessageFilter),
+      window_(new win::MessageWindow()) {
+  CHECK(window_->Create(this));
 }
 
 MessagePumpForUI::~MessagePumpForUI() {
-  DestroyWindow(message_hwnd_);
-  UnregisterClass(kWndClass, instance_);
 }
 
 void MessagePumpForUI::ScheduleWork() {
   if (InterlockedExchange(&have_work_, 1))
     return;  // Someone else continued the pumping.
 
-  // Make sure the MessagePump does some work for us.
-  BOOL ret = PostMessage(message_hwnd_, kMsgHaveWork,
-                         reinterpret_cast<WPARAM>(this), 0);
-  if (ret)
-    return;  // There was room in the Window Message queue.
+  BOOL result = FALSE;
+
+  {
+    // Take the lock to make sure the window will not be destroyed until
+    // PostMessage() returns below.
+    AutoLock lock(window_lock_);

[darin (slow to review), 2013/05/25 21:23:17]

Is it perhaps worth avoiding this lock when ScheduleWork is called on the same
thread as the MessagePumpForUI constructor?

Have you done any kind of performance testing?

[alexeypa (please no reviews), 2013/05/29 18:11:52]

Just an FYI.

I wrote a test that posts tasks to the loop keeping at most one task in the
queue (to make sure that we hit ScheduleWork() every time). The test repeats 20
warmup-and-measure loops. "Warmup" posts 100,000 tasks. "Measure" posts another
1,000,000 tasks.

The thread was affinitized to one logical core. It was running at real-time
priority.

The version with the lock was running about 2% slower. The version that was
checking thread ID (to avoid taking a lock on the same thread) was about 1%
slower.

Without the lock:

[0528/113104:INFO:rabbit.cc(100)] mean: 1.92923
[0528/113104:INFO:rabbit.cc(109)] deviation: 0.0138212

With the lock:

[0528/112843:INFO:rabbit.cc(100)] mean: 1.97287
[0528/112843:INFO:rabbit.cc(109)] deviation: 0.0171741

With thread ID check:

[0528/123213:INFO:rabbit.cc(100)] mean: 1.94465
[0528/123213:INFO:rabbit.cc(109)] deviation: 0.0481169

+    if (window_) {
+      // Make sure the MessagePump does some work for us.
+      if (PostMessage(window_->hwnd(), kMsgHaveWork, 0, 0))

[darin (slow to review), 2013/05/24 21:42:58]

Perhaps MessageWindow should be reference counted instead?  If we just need to
retain the HWND across a PostMessage call, then InterlockedIncrement +
InterlockedDecrement seems cheaper than an AutoLock.

[alexeypa (please no reviews), 2013/05/24 22:22:48]

No, the problem is that DestroyWindow() should be called on the right thread.
WillDestroyCurrentMessageLoop() is the very last call on that thread, so it
should wait until a concurrent PostMessage() call returns on a different thread.
Because otherwise by the time PostMessage() returns the thread owning the window
might be destroyed already. 

+        return;
+    }
+  }
 
   // We have failed to insert a have-work message, so there is a chance that we
   // will starve tasks/timers while sitting in a nested message loop.  Nested
   // loops only look at Windows Message queues, and don't look at *our* task
   // queues, etc., so we might not get a time slice in such. :-(
   // We could abort here, but the fear is that this failure mode is plausibly
   // common (queue is full, of about 2000 messages), so we'll do a near-graceful
   // recovery.  Nested loops are pretty transient (we think), so this will
   // probably be recoverable.
   InterlockedExchange(&have_work_, 0);  // Clarify that we didn't really insert.
   UMA_HISTOGRAM_ENUMERATION("Chrome.MessageLoopProblem", MESSAGE_POST_ERROR,
                             MESSAGE_LOOP_PROBLEM_MAX);
 }
 
 void MessagePumpForUI::ScheduleDelayedWork(const TimeTicks& delayed_work_time) {
+  DCHECK(window_->CalledOnValidThread());
+
   //
   // We would *like* to provide high resolution timers.  Windows timers using
   // SetTimer() have a 10ms granularity.  We have to use WM_TIMER as a wakeup
   // mechanism because the application can enter modal windows loops where it
   // is not running our MessageLoop; the only way to have our timers fire in
   // these cases is to post messages there.
   //
   // To provide sub-10ms timers, we process timers directly from our run loop.
   // For the common case, timers will be processed there as the run loop does
   // its normal work.  However, we *also* set the system timer so that WM_TIMER
   // events fire.  This mops up the case of timers not being able to work in
   // modal message loops.  It is possible for the SetTimer to pop and have no
   // pending timers, because they could have already been processed by the
   // run loop itself.
   //
   // We use a single SetTimer corresponding to the timer that will expire
   // soonest.  As new timers are created and destroyed, we update SetTimer.
   // Getting a spurrious SetTimer event firing is benign, as we'll just be
   // processing an empty timer queue.
   //
   delayed_work_time_ = delayed_work_time;
 
   int delay_msec = GetCurrentDelay();
   DCHECK_GE(delay_msec, 0);
   if (delay_msec < USER_TIMER_MINIMUM)
     delay_msec = USER_TIMER_MINIMUM;
 
   // Create a WM_TIMER event that will wake us up to check for any pending
   // timers (in case we are running within a nested, external sub-pump).
-  BOOL ret = SetTimer(message_hwnd_, reinterpret_cast<UINT_PTR>(this),
-                      delay_msec, NULL);
+  BOOL ret = SetTimer(window_->hwnd(), kTimerId, delay_msec, NULL);
   if (ret)
     return;
   // If we can't set timers, we are in big trouble... but cross our fingers for
   // now.
   // TODO(jar): If we don't see this error, use a CHECK() here instead.
   UMA_HISTOGRAM_ENUMERATION("Chrome.MessageLoopProblem", SET_TIMER_ERROR,
                             MESSAGE_LOOP_PROBLEM_MAX);
 }
 
+void MessagePumpForUI::WillDestroyCurrentMessageLoop() {
+  DCHECK(window_->CalledOnValidThread());
+
+  // Synchronize with MessagePumpForUI::ScheduleWork() that can access |window_|
+  // on arbitrary thread.
+  AutoLock lock(window_lock_);
+  window_.reset();
+}
+
 void MessagePumpForUI::PumpOutPendingPaintMessages() {
   // If we are being called outside of the context of Run, then don't try to do
   // any work.
   if (!state_)
     return;
 
   // Create a mini-message-pump to force immediate processing of only Windows
   // WM_PAINT messages.  Don't provide an infinite loop, but do enough peeking
   // to get the job done.  Actual common max is 4 peeks, but we'll be a little
   // safe here.
   const int kMaxPeekCount = 20;
   int peek_count;
   for (peek_count = 0; peek_count < kMaxPeekCount; ++peek_count) {
     MSG msg;
     if (!PeekMessage(&msg, NULL, 0, 0, PM_REMOVE | PM_QS_PAINT))
       break;
     ProcessMessageHelper(msg);
     if (state_->should_quit)  // Handle WM_QUIT.
       break;
   }
   // Histogram what was really being used, to help to adjust kMaxPeekCount.
   DHISTOGRAM_COUNTS("Loop.PumpOutPendingPaintMessages Peeks", peek_count);
 }
 
 //-----------------------------------------------------------------------------
 // MessagePumpForUI private:
 
-// static
-LRESULT CALLBACK MessagePumpForUI::WndProcThunk(
-    HWND hwnd, UINT message, WPARAM wparam, LPARAM lparam) {
+bool MessagePumpForUI::HandleMessage(HWND hwnd,
+                                     UINT message,
+                                     WPARAM wparam,
+                                     LPARAM lparam,
+                                     LRESULT* result) {
   switch (message) {
     case kMsgHaveWork:
-      reinterpret_cast<MessagePumpForUI*>(wparam)->HandleWorkMessage();
+      HandleWorkMessage();
       break;
+
     case WM_TIMER:
-      reinterpret_cast<MessagePumpForUI*>(wparam)->HandleTimerMessage();
+      HandleTimerMessage();
       break;
   }
-  return DefWindowProc(hwnd, message, wparam, lparam);
+
+  // Do default processing for all messages.
+  return false;
 }
 
 void MessagePumpForUI::DoRunLoop() {
+  DCHECK(window_->CalledOnValidThread());
+
   // IF this was just a simple PeekMessage() loop (servicing all possible work
   // queues), then Windows would try to achieve the following order according
   // to MSDN documentation about PeekMessage with no filter):
   //    * Sent messages
   //    * Posted messages
   //    * Sent messages (again)
   //    * WM_PAINT messages
   //    * WM_TIMER messages
   //
   // Summary: none of the above classes is starved, and sent messages has twice
@@ skipping 17 matching lines @@
     if (state_->should_quit)
       break;
 
     more_work_is_plausible |=
         state_->delegate->DoDelayedWork(&delayed_work_time_);
     // If we did not process any delayed work, then we can assume that our
     // existing WM_TIMER if any will fire when delayed work should run.  We
     // don't want to disturb that timer if it is already in flight.  However,
     // if we did do all remaining delayed work, then lets kill the WM_TIMER.
     if (more_work_is_plausible && delayed_work_time_.is_null())
-      KillTimer(message_hwnd_, reinterpret_cast<UINT_PTR>(this));
+      KillTimer(window_->hwnd(), kTimerId);
     if (state_->should_quit)
       break;
 
     if (more_work_is_plausible)
       continue;
 
     more_work_is_plausible = state_->delegate->DoIdleWork();
     if (state_->should_quit)
       break;
 
     if (more_work_is_plausible)
       continue;
 
     WaitForWork();  // Wait (sleep) until we have work to do again.
   }
 }
 
-void MessagePumpForUI::InitMessageWnd() {
-  WNDCLASSEX wc = {0};
-  wc.cbSize = sizeof(wc);
-  wc.lpfnWndProc = base::win::WrappedWindowProc<WndProcThunk>;
-  wc.hInstance = base::GetModuleFromAddress(wc.lpfnWndProc);
-  wc.lpszClassName = kWndClass;
-  instance_ = wc.hInstance;
-  RegisterClassEx(&wc);
-
-  message_hwnd_ =
-      CreateWindow(kWndClass, 0, 0, 0, 0, 0, 0, HWND_MESSAGE, 0, instance_, 0);
-  DCHECK(message_hwnd_);
-}
-
 void MessagePumpForUI::WaitForWork() {
   // Wait until a message is available, up to the time needed by the timer
   // manager to fire the next set of timers.
   int delay = GetCurrentDelay();
   if (delay < 0)  // Negative value means no timers waiting.
     delay = INFINITE;
 
   DWORD result;
   result = MsgWaitForMultipleObjectsEx(0, NULL, delay, QS_ALLINPUT,
                                        MWMO_INPUTAVAILABLE);
@@ skipping 37 matching lines @@
   // messages that may be in the Windows message queue.
   ProcessPumpReplacementMessage();
 
   // Now give the delegate a chance to do some work.  He'll let us know if he
   // needs to do more work.
   if (state_->delegate->DoWork())
     ScheduleWork();
 }
 
 void MessagePumpForUI::HandleTimerMessage() {
-  KillTimer(message_hwnd_, reinterpret_cast<UINT_PTR>(this));
+  KillTimer(window_->hwnd(), kTimerId);
 
   // If we are being called outside of the context of Run, then don't do
   // anything.  This could correspond to a MessageBox call or something of
   // that sort.
   if (!state_)
     return;
 
   state_->delegate->DoDelayedWork(&delayed_work_time_);
   if (!delayed_work_time_.is_null()) {
     // A bit gratuitous to set delayed_work_time_ again, but oh well.
@@ skipping 23 matching lines @@
                "message", msg.message);
   if (WM_QUIT == msg.message) {
     // Repost the QUIT message so that it will be retrieved by the primary
     // GetMessage() loop.
     state_->should_quit = true;
     PostQuitMessage(static_cast<int>(msg.wParam));
     return false;
   }
 
   // While running our main message pump, we discard kMsgHaveWork messages.
-  if (msg.message == kMsgHaveWork && msg.hwnd == message_hwnd_)
+  if (msg.message == kMsgHaveWork && msg.hwnd == window_->hwnd())
     return ProcessPumpReplacementMessage();
 
   if (CallMsgFilter(const_cast<MSG*>(&msg), kMessageFilterCode))
     return true;
 
   WillProcessMessage(msg);
 
   if (!message_filter_->ProcessMessage(msg)) {
     if (state_->dispatcher) {
       if (!state_->dispatcher->Dispatch(msg))
@@ skipping 26 matching lines @@
   if (MessageLoop::current()->os_modal_loop()) {
     // We only peek out WM_PAINT and WM_TIMER here for reasons mentioned above.
     have_message = PeekMessage(&msg, NULL, WM_PAINT, WM_PAINT, PM_REMOVE) ||
                    PeekMessage(&msg, NULL, WM_TIMER, WM_TIMER, PM_REMOVE);
   } else {
     have_message = !!message_filter_->DoPeekMessage(&msg, NULL, 0, 0,
                                                     PM_REMOVE);
   }
 
   DCHECK(!have_message || kMsgHaveWork != msg.message ||
-         msg.hwnd != message_hwnd_);
+         msg.hwnd != window_->hwnd());
 
   // Since we discarded a kMsgHaveWork message, we must update the flag.
   int old_have_work = InterlockedExchange(&have_work_, 0);
   DCHECK(old_have_work);
 
   // We don't need a special time slice if we didn't have_message to process.
   if (!have_message)
     return false;
 
   // Guarantee we'll get another time slice in the case where we go into native
@@ skipping 228 matching lines @@
 
 // static
 MessagePumpForIO::IOHandler* MessagePumpForIO::KeyToHandler(
     ULONG_PTR key,
     bool* has_valid_io_context) {
   *has_valid_io_context = ((key & 1) == 0);
   return reinterpret_cast<IOHandler*>(key & ~static_cast<ULONG_PTR>(1));
 }
 
 }  // namespace base