Bug 570620, part f: Add a "destroy" phase to PBrowser shutdown to make clean-up easier. r=smaug sr=bsmedberg

content/base/src/nsFrameLoader.cpp

@@ -1171,7 +1171,10 @@ nsFrameLoader::DestroyChild()
 #ifdef MOZ_IPC
   if (mRemoteBrowser) {
     mRemoteBrowser->SetOwnerElement(nsnull);
-    unused << PBrowserParent::Send__delete__(mRemoteBrowser);
+    // If this fails, it's most likely due to a content-process crash,
+    // and auto-cleanup will kick in.  Otherwise, the child side will
+    // destroy itself and send back __delete__().
+    unused << mRemoteBrowser->SendDestroy();
     mRemoteBrowser = nsnull;
   }
 #endif

dom/ipc/PBrowser.ipdl

@@ -70,9 +70,6 @@ rpc protocol PBrowser
 both:
     AsyncMessage(nsString aMessage, nsString aJSON);
 
-child:
-    __delete__();
-
 parent:
     /**
      * When child sends this message, parent should move focus to
@@ -110,6 +107,8 @@ parent:
     PContentDialog(PRUint32 aType, nsCString aName, nsCString aFeatures,
                    PRInt32[] aIntParams, nsString[] aStringParams);
 
+    __delete__();
+
 child:
     CreateWidget(MagicWindowHandle parentWidget);
 
@@ -161,6 +160,28 @@ child:
     // @param matrix the transformation matrix the context we're going to draw into should have.
     PDocumentRendererNativeID(PRInt32 x, PRInt32 y, PRInt32 w, PRInt32 h, nsString bgcolor, PRUint32 flags, bool flush,
                               gfxMatrix matrix, PRUint32 nativeID);
+
+    /**
+     * Sent by the chrome process when it no longer wants this remote
+     * <browser>.  The child side cleans up in response, then
+     * finalizing its death by sending back __delete__() to the
+     * parent.
+     */
+    Destroy();
+
+/*
+ * FIXME: write protocol!
+
+state LIVE:
+    send LoadURL goto LIVE;
+//etc.
+    send Destroy goto DYING;
+
+state DYING:
+    discard send blah;
+// etc.
+    recv __delete__;
+ */
 };
 
 }

dom/ipc/TabChild.cpp

@@ -495,8 +495,6 @@ TabChild::~TabChild()
       do_GetWeakReference(static_cast<nsSupportsWeakReference*>(this));
     webBrowser->RemoveWebBrowserListener(weak, NS_GET_IID(nsIWebProgressListener));
 
-    DestroyWidget();
-
     if (webBrowser) {
       webBrowser->SetContainerWindow(nsnull);
     }
@@ -596,8 +594,6 @@ TabChild::OnRefreshAttempted(nsIWebProgress *aWebProgress,
   *aRefreshAllowed = refreshAllowed;
   return NS_OK;
 }
-                             
-                             
 
 bool
 TabChild::RecvLoadURL(const nsCString& uri)
@@ -957,6 +953,15 @@ TabChild::RecvAsyncMessage(const nsString& aMessage,
   return true;
 }
 
+bool
+TabChild::RecvDestroy()
+{
+    DestroyWidget();
+
+    // XXX what other code in ~TabChild() should we be running here?
+
+    return Send__delete__(this);
+}
 
 bool
 TabChild::InitTabChildGlobal()

dom/ipc/TabChild.h

@@ -281,6 +281,10 @@ public:
 
     nsIPrincipal* GetPrincipal() { return mPrincipal; }
 
+protected:
+    NS_OVERRIDE
+    virtual bool RecvDestroy();
+
 private:
     void ActorDestroy(ActorDestroyReason why);