Bug 1060620 - RequestNotifyAfterRemotePaint can send messages to a dead actor on linux. r=smaug
authorBill McCloskey <wmccloskey@mozilla.com>
Thu, 04 Sep 2014 07:20:45 -0500
changeset 226839 e3407279f37275abfe144247eb58f1be32b2cc62
parent 226838 f2c25ddbd1cff0f3df0f5151ccab1267bcd3868c
child 226840 09cf44e2c00f80eff4679b812b8189d30752a6bd
push id4187
push userbhearsum@mozilla.com
push dateFri, 28 Nov 2014 15:29:12 +0000
treeherdermozilla-beta@f23cc6a30c11 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug
bugs1060620
milestone35.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1060620 - RequestNotifyAfterRemotePaint can send messages to a dead actor on linux. r=smaug
dom/ipc/TabChild.cpp
gfx/layers/ipc/CompositorChild.cpp
gfx/layers/ipc/CompositorChild.h
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -1550,16 +1550,19 @@ TabChild::ActorDestroy(ActorDestroyReaso
   if (mTabChildGlobal) {
     // The messageManager relays messages via the TabChild which
     // no longer exists.
     static_cast<nsFrameMessageManager*>
       (mTabChildGlobal->mMessageManager.get())->Disconnect();
     mTabChildGlobal->mMessageManager = nullptr;
   }
 
+  CompositorChild* compositorChild = static_cast<CompositorChild*>(CompositorChild::Get());
+  compositorChild->CancelNotifyAfterRemotePaint(this);
+
   if (Id() != 0) {
     NestedTabChildMap().erase(Id());
   }
 }
 
 TabChild::~TabChild()
 {
     DestroyWindow();
--- a/gfx/layers/ipc/CompositorChild.cpp
+++ b/gfx/layers/ipc/CompositorChild.cpp
@@ -286,12 +286,25 @@ CompositorChild::RecvRemotePaintIsReady(
 void
 CompositorChild::RequestNotifyAfterRemotePaint(TabChild* aTabChild)
 {
   MOZ_ASSERT(aTabChild, "NULL TabChild not allowed in CompositorChild::RequestNotifyAfterRemotePaint");
   mWeakTabChild = do_GetWeakReference( static_cast<dom::TabChildBase*>(aTabChild) );
   unused << SendRequestNotifyAfterRemotePaint();
 }
 
+void
+CompositorChild::CancelNotifyAfterRemotePaint(TabChild* aTabChild)
+{
+  nsRefPtr<nsISupports> iTabChildBase(do_QueryReferent(mWeakTabChild));
+  if (!iTabChildBase) {
+    return;
+  }
+  TabChildBase* tabChildBase = static_cast<TabChildBase*>(iTabChildBase.get());
+  TabChild* tabChild = static_cast<TabChild*>(tabChildBase);
+  if (tabChild == aTabChild) {
+    mWeakTabChild = nullptr;
+  }
+}
 
 } // namespace layers
 } // namespace mozilla
 
--- a/gfx/layers/ipc/CompositorChild.h
+++ b/gfx/layers/ipc/CompositorChild.h
@@ -73,16 +73,18 @@ public:
   /**
    * Request that the parent tell us when graphics are ready on GPU.
    * When we get that message, we bounce it to the TabParent via
    * the TabChild
    * @param tabChild The object to bounce the note to.  Non-NULL.
    */
   void RequestNotifyAfterRemotePaint(TabChild* aTabChild);
 
+  void CancelNotifyAfterRemotePaint(TabChild* aTabChild);
+
 private:
   // Private destructor, to discourage deletion outside of Release():
   virtual ~CompositorChild();
 
   virtual PLayerTransactionChild*
     AllocPLayerTransactionChild(const nsTArray<LayersBackend>& aBackendHints,
                                 const uint64_t& aId,
                                 TextureFactoryIdentifier* aTextureFactoryIdentifier,