1060620 - RequestNotifyAfterRemotePaint can send messages to a dead actor

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: compositor-fix

When ActorDestroy is called on a TabChild, we're not supposed to use it to send any more messages. However, that can happen here, if the compositor outlives the TabChild (which it can):

http://mxr.mozilla.org/mozilla-central/source/gfx/layers/ipc/CompositorChild.cpp#271

I think we just need to null out mWeakTabChild in TabChild::ActorDestroy.

All the QueryReferent code looks kinda weird. I just copied it from RecvRemotePaintIsReady. Why does it look like this?

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8481608 [details] [diff] [review]
compositor-fix

Hmm, yeah, QueryReferent to nsITabChild should work, since it is 
TabChild which inherits nsSupportsWeakReference.
Then cast that to TabChild.
I just missed that when reviewing RecvRemotePaintIsReady.

Comment 2

[Jim Mathies [:jimm]]

https://tbpl.mozilla.org/?tree=Try&rev=ddec0f227684

Comment 3

[Jim Mathies [:jimm]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e3407279f372

Comment 4

[Jim Mathies [:jimm]]

also pushed to holly:

https://hg.mozilla.org/projects/holly/rev/a9cc7f174c26

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/e3407279f372