When ActorDestroy is called on a TabChild, we're not supposed to use it to send any more messages. However, that can happen here, if the compositor outlives the TabChild (which it can): http://mxr.mozilla.org/mozilla-central/source/gfx/layers/ipc/CompositorChild.cpp#271 I think we just need to null out mWeakTabChild in TabChild::ActorDestroy. All the QueryReferent code looks kinda weird. I just copied it from RecvRemotePaintIsReady. Why does it look like this?
Attachment #8481608 - Flags: review?(bugs)
5 years ago
Comment on attachment 8481608 [details] [diff] [review] compositor-fix Hmm, yeah, QueryReferent to nsITabChild should work, since it is TabChild which inherits nsSupportsWeakReference. Then cast that to TabChild. I just missed that when reviewing RecvRemotePaintIsReady.
Attachment #8481608 - Flags: review?(bugs) → review+
also pushed to holly: https://hg.mozilla.org/projects/holly/rev/a9cc7f174c26
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.