From 4e353cb618745cdb5d98e58e7dcd400ded01299a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Barbosa?= <joao.paulo.barbosa@gmail.com>
Date: Thu, 21 May 2020 18:12:49 +0100
Subject: [PATCH] http: Release work queue after event base finish

This fixes a race between http_request_cb and StopHTTPServer where
the work queue is used after release.
---
 src/httpserver.cpp | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/httpserver.cpp b/src/httpserver.cpp
index 1e5ea2de83..0bc46a4d03 100644
--- a/src/httpserver.cpp
+++ b/src/httpserver.cpp
@@ -91,7 +91,7 @@ public:
     bool Enqueue(WorkItem* item)
     {
         LOCK(cs);
-        if (queue.size() >= maxDepth) {
+        if (!running || queue.size() >= maxDepth) {
             return false;
         }
         queue.emplace_back(std::unique_ptr<WorkItem>(item));
@@ -107,7 +107,7 @@ public:
                 WAIT_LOCK(cs, lock);
                 while (running && queue.empty())
                     cond.wait(lock);
-                if (!running)
+                if (!running && queue.empty())
                     break;
                 i = std::move(queue.front());
                 queue.pop_front();
@@ -456,8 +456,6 @@ void StopHTTPServer()
             thread.join();
         }
         g_thread_http_workers.clear();
-        delete workQueue;
-        workQueue = nullptr;
     }
     // Unlisten sockets, these are what make the event loop running, which means
     // that after this and all connections are closed the event loop will quit.
@@ -477,6 +475,10 @@ void StopHTTPServer()
         event_base_free(eventBase);
         eventBase = nullptr;
     }
+    if (workQueue) {
+        delete workQueue;
+        workQueue = nullptr;
+    }
     LogPrint(BCLog::HTTP, "Stopped HTTP server\n");
 }