RequestNotifyAfterRemotePaint can send messages to a dead actor

RESOLVED FIXED in mozilla35

Status

()

defect
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: billm, Assigned: billm)

Tracking

unspecified
mozilla35
x86_64
Linux
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

When ActorDestroy is called on a TabChild, we're not supposed to use it to send any more messages. However, that can happen here, if the compositor outlives the TabChild (which it can):

http://mxr.mozilla.org/mozilla-central/source/gfx/layers/ipc/CompositorChild.cpp#271

I think we just need to null out mWeakTabChild in TabChild::ActorDestroy.

All the QueryReferent code looks kinda weird. I just copied it from RecvRemotePaintIsReady. Why does it look like this?
Attachment #8481608 - Flags: review?(bugs)
Comment on attachment 8481608 [details] [diff] [review]
compositor-fix

Hmm, yeah, QueryReferent to nsITabChild should work, since it is 
TabChild which inherits nsSupportsWeakReference.
Then cast that to TabChild.
I just missed that when reviewing RecvRemotePaintIsReady.
Attachment #8481608 - Flags: review?(bugs) → review+
https://hg.mozilla.org/mozilla-central/rev/e3407279f372
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.