Bug 1547760 - Ensuring UiCompositorControllerChild::mWidget alive when it is used. r=kats, a=jcristau
authorsotaro <sotaro.ikeda.g@gmail.com>
Tue, 18 Jun 2019 09:44:52 +0900
changeset 537031 01f0e8d1402c59cd01a65ae644f380081d8a0b36
parent 537030 87f1246a1c3dbac25673d8b84ca55ec70932b5b8
child 537032 c5a64922e1a1ed68fb97489e86bda6f48b695288
push id2082
push userffxbld-merge
push dateMon, 01 Jul 2019 08:34:18 +0000
treeherdermozilla-release@2fb19d0466d2 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerskats, jcristau
bugs1547760
milestone68.0
Bug 1547760 - Ensuring UiCompositorControllerChild::mWidget alive when it is used. r=kats, a=jcristau Differential Revision: https://phabricator.services.mozilla.com/D35166
gfx/layers/ipc/UiCompositorControllerChild.cpp
gfx/layers/ipc/UiCompositorControllerChild.h
--- a/gfx/layers/ipc/UiCompositorControllerChild.cpp
+++ b/gfx/layers/ipc/UiCompositorControllerChild.cpp
@@ -8,16 +8,17 @@
 
 #include "mozilla/dom/ContentChild.h"
 #include "mozilla/layers/CompositorThread.h"
 #include "mozilla/layers/UiCompositorControllerMessageTypes.h"
 #include "mozilla/layers/UiCompositorControllerParent.h"
 #include "mozilla/gfx/GPUProcessManager.h"
 #include "mozilla/StaticPtr.h"
 #include "nsBaseWidget.h"
+#include "nsProxyRelease.h"
 #include "nsThreadUtils.h"
 
 #if defined(MOZ_WIDGET_ANDROID)
 #  include "mozilla/widget/AndroidUiThread.h"
 
 static RefPtr<nsThread> GetUiThread() { return mozilla::GetAndroidUiThread(); }
 #else
 static RefPtr<nsThread> GetUiThread() {
@@ -179,17 +180,22 @@ void UiCompositorControllerChild::Destro
         NewRunnableMethod("layers::UiCompositorControllerChild::Destroy", this,
                           &UiCompositorControllerChild::Destroy),
         nsIThread::DISPATCH_SYNC);
     return;
   }
 
   if (mIsOpen) {
     // Close the underlying IPC channel.
-    mWidget = nullptr;
+
+    // Dispatch mWidget to main thread to prevent it from being destructed by
+    // the ui thread.
+    RefPtr<nsIWidget> widget = mWidget.forget();
+    NS_ReleaseOnMainThreadSystemGroup("UiCompositorControllerChild::mWidget",
+                                      widget.forget());
     PUiCompositorControllerChild::Close();
     mIsOpen = false;
   }
 }
 
 void UiCompositorControllerChild::SetBaseWidget(nsBaseWidget* aWidget) {
   mWidget = aWidget;
 }
--- a/gfx/layers/ipc/UiCompositorControllerChild.h
+++ b/gfx/layers/ipc/UiCompositorControllerChild.h
@@ -73,17 +73,17 @@ class UiCompositorControllerChild final
   void SendCachedValues();
 
   bool mIsOpen;
   uint64_t mProcessToken;
   Maybe<gfx::IntRect> mResize;
   Maybe<int32_t> mMaxToolbarHeight;
   Maybe<uint32_t> mDefaultClearColor;
   Maybe<bool> mLayerUpdateEnabled;
-  nsBaseWidget* mWidget;
+  RefPtr<nsBaseWidget> mWidget;
   // Should only be set when compositor is in process.
   RefPtr<UiCompositorControllerParent> mParent;
 };
 
 }  // namespace layers
 }  // namespace mozilla
 
 #endif  // include_gfx_ipc_UiCompositorControllerChild_h