Route DebuggerController operations through a per-controller worker queue

[xusheng6]

Summary

Replaces the previous "spawn one std::thread per operation and detach it" pattern (17 sites across Launch, Attach, Connect, Go, GoReverse, Step{Into,Over,Return}{,Reverse}, RunTo{,Reverse}, Restart, Detach, Quit, Pause) with a single persistent worker thread per DebuggerController plus a FIFO work queue. Every public Xxx() / XxxAndWait() method now routes through Submit().

The worker thread is owned by the controller, started in the constructor and joined in the destructor (after draining the queue). Async work can no longer outlive the controller it touches — the lifetime guarantee is structural rather than reliant on per-call DbgRef captures, which this PR removes (those were added in #1086 as a stopgap; the queue model makes them unnecessary).

Builds on #1086.

Design notes

Submit (templated, header)

• Detects re-entrant calls from the worker itself (std::this_thread::get_id() == m_workerThreadId) and runs them inline. This is what lets RestartAndWaitOnWorker call QuitAndWaitOnWorker + LaunchAndWaitOnWorker without deadlocking on its own queue.
• Returns a std::future so sync callers can wait.

SubmitAndWait (templated, header)

• Submits a task and blocks the caller until the future resolves.
• Takes an optional std::chrono::milliseconds timeout. milliseconds::max() ("wait forever") is the default and bypasses wait_for entirely (avoids overflow inside the stdlib).
• On non-infinite timeout: signals m_adapter->BreakInto() and still waits for the in-flight op to settle before returning.

Public/Internal/OnWorker split

• The existing public/internal split (XxxAndWaitInternal does the actual work; the old XxxAndWait was the lock-Internal-notify wrapper) is preserved.
• The old public XxxAndWait is renamed XxxAndWaitOnWorker (private) — same body, now invoked from the worker thread.
• New public XxxAndWait(timeout) is a one-line SubmitAndWait wrapper.

Public API compatibility

• Every public XxxAndWait keeps its current signature with an appended optional timeout parameter defaulted to infinite. Existing callers in core/ffi.cpp and ui/uinotification.cpp keep their current behavior.

Pause / BreakInto (special-cased)

• Both Pause() and PauseAndWait() bypass the queue and call m_adapter->BreakInto() directly on the caller's thread. The worker is presumed blocked inside ExecuteAdapterAndWait for whatever resume op is in flight; BreakInto unsticks it.
• PauseAndWait then waits for the worker to drain past the in-flight task by submitting a no-op probe.

IL stepping fits without changes

• Step operations on HLIL/MLIL etc. are still implemented as loops inside StepIntoIL/StepOverIL which call XxxAndWaitInternal multiple times. The loop runs as a single queued task on the worker — no change to event-filtering semantics or stop-reason logic.

Out of scope (follow-ups)

• Adapter-internal threads: DbgEngAdapter::Attach's spawned thread (BINARYNINJA-1A), DbgEngAdapter::EngineLoop, LLDB EventListener, RSP send/receive loops. These need adapter destructors to act as join barriers; that's a separate concern from the controller's queue.
• m_targetControlMutex cleanup. With single-worker serialization it's largely redundant, but I left it in place to minimize behavioral risk in this PR.
• BinaryDataNotification and settings-callback unregistration in Destroy (BINARYNINJA-75 / -2H — the RebaseToAddress family of crashes).
• m_userRequestedBreak should arguably be std::atomic<bool> now that Pause writes it from outside the worker. Left as-is for this PR.

Test plan

• Builds cleanly (ninja — both libdebuggercore.dylib and libdebuggerui.dylib)
• Manual: launch, step, hit breakpoint, pause while running, detach mid-step, close tab mid-operation
• Python regression tests in test/debugger_test.py

🤖 Generated with Claude Code