Bug 1004191 - Destroy LayerTransactionChild r=nical,bjacob

dom/base/nsDOMWindowUtils.cpp

@@ -2725,8 +2725,8 @@ nsDOMWindowUtils::AdvanceTimeAndRefresh(int64_t aMilliseconds)
   nsRefreshDriver* driver = GetPresContext()->RefreshDriver();
   driver->AdvanceTimeAndRefresh(aMilliseconds);
 
-  LayerTransactionChild* transaction = GetLayerTransaction();
-  if (transaction) {
+  RefPtr<LayerTransactionChild> transaction = GetLayerTransaction();
+  if (transaction && transaction->IPCOpen()) {
     transaction->SendSetTestSampleTime(driver->MostRecentRefresh());
   }
 
@@ -2743,8 +2743,8 @@ nsDOMWindowUtils::RestoreNormalRefresh()
   // Kick the compositor out of test mode before the refresh driver, so that
   // the refresh driver doesn't send an update that gets ignored by the
   // compositor.
-  LayerTransactionChild* transaction = GetLayerTransaction();
-  if (transaction) {
+  RefPtr<LayerTransactionChild> transaction = GetLayerTransaction();
+  if (transaction && transaction->IPCOpen()) {
     transaction->SendLeaveTestMode();
   }
 

gfx/layers/ipc/CompositorChild.cpp

@@ -48,7 +48,7 @@ CompositorChild::Destroy()
   mLayerManager->Destroy();
   mLayerManager = nullptr;
   while (size_t len = ManagedPLayerTransactionChild().Length()) {
-    LayerTransactionChild* layers =
+    RefPtr<LayerTransactionChild> layers =
       static_cast<LayerTransactionChild*>(ManagedPLayerTransactionChild()[len - 1]);
     layers->Destroy();
   }

gfx/layers/ipc/LayerTransactionChild.cpp

@@ -22,10 +22,19 @@ namespace layers {
 void
 LayerTransactionChild::Destroy()
 {
+  if (!IPCOpen() || mDestroyed) {
+    return;
+  }
+  // mDestroyed is used to prevent calling Send__delete__() twice.
+  // When this function is called from CompositorChild::Destroy(),
+  // under Send__delete__() call, this function is called from
+  // ShadowLayerForwarder's destructor.
+  // When it happens, IPCOpen() is still true.
+  // See bug 1004191.
+  mDestroyed = true;
   NS_ABORT_IF_FALSE(0 == ManagedPLayerChild().Length(),
                     "layers should have been cleaned up by now");
   PLayerTransactionChild::Send__delete__(this);
-  // WARNING: |this| has gone to the great heap in the sky
 }
 
 

gfx/layers/ipc/LayerTransactionChild.h

@@ -46,6 +46,8 @@ public:
 protected:
   LayerTransactionChild()
     : mIPCOpen(false)
+    , mDestroyed(false)
+    , mForwarder(nullptr)
   {}
   ~LayerTransactionChild() { }
 
@@ -78,6 +80,7 @@ protected:
   friend class layout::RenderFrameChild;
 
   bool mIPCOpen;
+  bool mDestroyed;
   ShadowLayerForwarder* mForwarder;
 };
 

gfx/layers/ipc/ShadowLayers.cpp

@@ -179,6 +179,7 @@ ShadowLayerForwarder::~ShadowLayerForwarder()
   delete mTxn;
   if (mShadowManager) {
     mShadowManager->SetForwarder(nullptr);
+    mShadowManager->Destroy();
   }
 }