Bug 1125030 - Handle VsyncChild shutdown in ActorDestroy(). r=bent

ipc/glue/BackgroundChildImpl.cpp

@@ -190,7 +190,10 @@ BackgroundChildImpl::DeallocPFileDescriptorSetChild(
 BackgroundChildImpl::PVsyncChild*
 BackgroundChildImpl::AllocPVsyncChild()
 {
-  return new mozilla::layout::VsyncChild();
+  nsRefPtr<mozilla::layout::VsyncChild> actor = new mozilla::layout::VsyncChild();
+  // There still has one ref-count after return, and it will be released in
+  // DeallocPVsyncChild().
+  return actor.forget().take();
 }
 
 bool
@@ -198,7 +201,9 @@ BackgroundChildImpl::DeallocPVsyncChild(PVsyncChild* aActor)
 {
   MOZ_ASSERT(aActor);
 
-  delete static_cast<mozilla::layout::VsyncChild*>(aActor);
+  // This actor already has one ref-count. Please check AllocPVsyncChild().
+  nsRefPtr<mozilla::layout::VsyncChild> actor =
+      dont_AddRef(static_cast<mozilla::layout::VsyncChild*>(aActor));
   return true;
 }
 

layout/base/nsRefreshDriver.cpp

@@ -440,9 +440,13 @@ private:
     Tick(vsyncJsNow, aTimeStamp);
   }
 
-  nsRefPtr<RefreshTimerVsyncDispatcher> mVsyncDispatcher;
   nsRefPtr<RefreshDriverVsyncObserver> mVsyncObserver;
-  VsyncChild* mVsyncChild;
+  // Used for parent process.
+  nsRefPtr<RefreshTimerVsyncDispatcher> mVsyncDispatcher;
+  // Used for child process.
+  // The mVsyncChild will be always available before VsncChild::ActorDestroy().
+  // After ActorDestroy(), StartTimer() and StopTimer() calls will be non-op.
+  nsRefPtr<VsyncChild> mVsyncChild;
 }; // VsyncRefreshDriverTimer
 
 /*

layout/ipc/VsyncChild.cpp

@@ -13,6 +13,7 @@ namespace layout {
 
 VsyncChild::VsyncChild()
   : mObservingVsync(false)
+  , mIsShutdown(false)
 {
   MOZ_ASSERT(NS_IsMainThread());
 }
@@ -26,9 +27,9 @@ bool
 VsyncChild::SendObserve()
 {
   MOZ_ASSERT(NS_IsMainThread());
-  if (!mObservingVsync) {
-    PVsyncChild::SendObserve();
+  if (!mObservingVsync && !mIsShutdown) {
     mObservingVsync = true;
+    PVsyncChild::SendObserve();
   }
   return true;
 }
@@ -37,9 +38,9 @@ bool
 VsyncChild::SendUnobserve()
 {
   MOZ_ASSERT(NS_IsMainThread());
-  if (mObservingVsync) {
-    PVsyncChild::SendUnobserve();
+  if (mObservingVsync && !mIsShutdown) {
     mObservingVsync = false;
+    PVsyncChild::SendUnobserve();
   }
   return true;
 }
@@ -48,6 +49,8 @@ void
 VsyncChild::ActorDestroy(ActorDestroyReason aActorDestroyReason)
 {
   MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!mIsShutdown);
+  mIsShutdown = true;
   mObserver = nullptr;
 }
 
@@ -55,6 +58,7 @@ bool
 VsyncChild::RecvNotify(const TimeStamp& aVsyncTimestamp)
 {
   MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!mIsShutdown);
   if (mObservingVsync && mObserver) {
     mObserver->NotifyVsync(aVsyncTimestamp);
   }

layout/ipc/VsyncChild.h

@@ -7,6 +7,7 @@
 #define mozilla_layout_ipc_VsyncChild_h
 
 #include "mozilla/layout/PVsyncChild.h"
+#include "nsISupportsImpl.h"
 #include "nsRefPtr.h"
 
 namespace mozilla {
@@ -25,6 +26,8 @@ namespace layout {
 // PVsyncParent actor dies.
 class VsyncChild MOZ_FINAL : public PVsyncChild
 {
+  NS_INLINE_DECL_REFCOUNTING(VsyncChild)
+
   friend class mozilla::ipc::BackgroundChildImpl;
 
 public:
@@ -44,6 +47,7 @@ private:
   virtual void ActorDestroy(ActorDestroyReason aActorDestroyReason) MOZ_OVERRIDE;
 
   bool mObservingVsync;
+  bool mIsShutdown;
 
   // The content side vsync observer.
   nsRefPtr<VsyncObserver> mObserver;