Fixed the racy code around the message-only window in base::MessagePumpForUI on Windows.

base/message_pump_win.h

Index: base/message_pump_win.h
diff --git a/base/message_pump_win.h b/base/message_pump_win.h
index 5ea195fb15ac87d9944b9a8b1121556e671364e7..a376e0931b58b7026ae29977b8b2c9a9e00d877c 100644
--- a/base/message_pump_win.h
+++ b/base/message_pump_win.h
@@ -17,6 +17,7 @@
 #include "base/message_pump_observer.h"
 #include "base/observer_list.h"
 #include "base/time.h"
+#include "base/win/message_window.h"
 #include "base/win/scoped_handle.h"
 
 namespace base {
@@ -26,7 +27,7 @@ namespace base {
 // controlling the lifetime of the message pump.
 class BASE_EXPORT MessagePumpWin : public MessagePump {
  public:
-  MessagePumpWin() : have_work_(0), state_(NULL) {}
+  MessagePumpWin();
   virtual ~MessagePumpWin() {}
 
   // Add an Observer, which will start receiving notifications immediately.
@@ -68,10 +69,10 @@ class BASE_EXPORT MessagePumpWin : public MessagePump {
   // The time at which delayed work should run.
   TimeTicks delayed_work_time_;
 
-  // A boolean value used to indicate if there is a kMsgDoWork message pending
-  // in the Windows Message queue.  There is at most one such message, and it
-  // can drive execution of tasks when a native message pump is running.
-  LONG have_work_;
+  // Used to indicate if there is a kMsgDoWork message pending in the Windows
+  // Message queue. There is at most one such message, and it can drive
+  // execution of tasks when a native message pump is running.
+  LONG pump_state_;
 
   // State for the current invocation of Run.
   RunState* state_;
@@ -125,7 +126,9 @@ class BASE_EXPORT MessagePumpWin : public MessagePump {
 // an excellent choice.  It is also helpful that the starter messages that are
 // placed in the queue when new task arrive also awakens DoRunLoop.
 //
-class BASE_EXPORT MessagePumpForUI : public MessagePumpWin {
+class BASE_EXPORT MessagePumpForUI
+    : public MessagePumpWin,
+      public win::MessageWindow::Delegate {
  public:
   // A MessageFilter implements the common Peek/Translate/Dispatch code to deal
   // with windows messages.
@@ -166,8 +169,9 @@ class BASE_EXPORT MessagePumpForUI : public MessagePumpWin {
   void SetMessageFilter(scoped_ptr<MessageFilter> message_filter);
 
   // MessagePump methods:
-  virtual void ScheduleWork();
-  virtual void ScheduleDelayedWork(const TimeTicks& delayed_work_time);
+  virtual void ScheduleWork() OVERRIDE;
+  virtual void ScheduleDelayedWork(const TimeTicks& delayed_work_time) OVERRIDE;
+  virtual void WillDestroyCurrentMessageLoop() OVERRIDE;
 
   // Applications can call this to encourage us to process all pending WM_PAINT
   // messages.  This method will process all paint messages the Windows Message
@@ -175,12 +179,14 @@ class BASE_EXPORT MessagePumpForUI : public MessagePumpWin {
   void PumpOutPendingPaintMessages();
 
  private:
-  static LRESULT CALLBACK WndProcThunk(HWND window_handle,
-                                       UINT message,
-                                       WPARAM wparam,
-                                       LPARAM lparam);
+  // win::MessageWindow::Delegate interface.
+  virtual bool HandleMessage(HWND hwnd,
+                             UINT message,
+                             WPARAM wparam,
+                             LPARAM lparam,
+                             LRESULT* result) OVERRIDE;
+
   virtual void DoRunLoop();
-  void InitMessageWnd();
   void WaitForWork();
   void HandleWorkMessage();
   void HandleTimerMessage();
@@ -188,13 +194,13 @@ class BASE_EXPORT MessagePumpForUI : public MessagePumpWin {
   bool ProcessMessageHelper(const MSG& msg);
   bool ProcessPumpReplacementMessage();
 
-  // Instance of the module containing the window procedure.
-  HMODULE instance_;
+  scoped_ptr<MessageFilter> message_filter_;
 
-  // A hidden message-only window.
-  HWND message_hwnd_;
+  // Used to post an APC to the thread running the message pump.
+  win::ScopedHandle thread_;
 
-  scoped_ptr<MessageFilter> message_filter_;
+  // A hidden message-only window.
+  scoped_ptr<win::MessageWindow> window_;
 };
 
 //-----------------------------------------------------------------------------