1749004 - call CancelManagedPostRefreshObservers after frame tree is destroyed

Status: RESOLVED FIXED

(Core :: Layout, defect)

Comment 1

[Timothy Nikkel (:tnikkel)]

Attachment: Bug 1749004. Call CancelManagedPostRefreshObservers after frame tree is destroyed. r?emilio

nsPresContest::RegisterManagedPostRefreshObserver still lets us add a managed post refresh observer until the mPresShell pointer on the prescontent is nulled out. That means that between the call to CancelManagedPostRefreshObservers and mPresContext->DetachPresShell() (which nulls out the mPresShell pointer on the prescontext) in PresShell::Destroy we can add a managed post refresh observer that will never get removed. Notably, destroying the frame tree happens between these two calls.

So move the CancelManagedPostRefreshObservers call to happen right after we null out the mPresShell pointer on the prescontext.

In bug 1737503 I want to add a managed post refresh observer when we destroy a subdocument frame (it's only interested in the recreate frames case not the destruction case, but not an easy way to tell them apart afaik), so it triggers this bug. The patch and test I have for that bug exercise this scenario.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d5415ebea193
Call CancelManagedPostRefreshObservers after frame tree is destroyed. r=emilio

Comment 3

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/d5415ebea193