Bug 923482 - Fix an edge case where we might try to re-use a destroyed APZC instance. r=botond

gfx/layers/composite/APZCTreeManager.cpp

@@ -117,7 +117,11 @@ APZCTreeManager::UpdatePanZoomControllerTree(CompositorParent* aCompositor,
 
         apzc = container->GetAsyncPanZoomController();
 
-        bool newApzc = (apzc == nullptr);
+        // The APZC we get off the layer may have been destroyed previously if the layer was inactive
+        // or omitted from the layer tree for whatever reason from a layers update. If it later comes
+        // back it will have a reference to a destroyed APZC and so we need to throw that out and make
+        // a new one.
+        bool newApzc = (apzc == nullptr || apzc->IsDestroyed());
         if (newApzc) {
           apzc = new AsyncPanZoomController(aLayersId, this, state->mController,
                                             AsyncPanZoomController::USE_GESTURE_DETECTOR);

gfx/layers/ipc/AsyncPanZoomController.cpp

@@ -326,6 +326,12 @@ AsyncPanZoomController::Destroy()
   mTreeManager = nullptr;
 }
 
+bool
+AsyncPanZoomController::IsDestroyed()
+{
+  return mTreeManager == nullptr;
+}
+
 /* static */float
 AsyncPanZoomController::GetTouchStartTolerance()
 {

gfx/layers/ipc/AsyncPanZoomController.h

@@ -203,6 +203,11 @@ public:
    */
   void Destroy();
 
+  /**
+   * Returns true if Destroy() has already been called on this APZC instance.
+   */
+  bool IsDestroyed();
+
   /**
    * Returns the incremental transformation corresponding to the async pan/zoom
    * in progress. That is, when this transform is multiplied with the layer's