Bug 1392705 - part 3: Call nsBaseWidget::DestroyLayerManager() in nsWindow::Destroy to ensure IPC is not shutdown in the destructor for Android r=jchen

Due to the indeterminate nature of Gecko shutdown, the ref count of the
nsWindow on Android would sometimes go to zero before the XPCOM shutdown
observer was called in nsBaseWindow which is where the compositor thread
IPC is shutdown. If nsBaseWindow::Shutdown does not get called, then the
compositor thread IPC is shutdown in the nsBaseWindow destructor.
Unfortunately while the nsWindow is being deleted, it can be accessed in
the compositor thread and cause a crash in
LayerManagerComposite::RenderToPresentationSurface.
Calling nsBaseWidget::DestroyLayerManager() in nsWindow::Destroy()
ensures it gets called before the destructor gets invoked typically in
the Destroy() call.

MozReview-Commit-ID: KCv8SCmEjnb

--HG--
extra : rebase_source : f48fe01b15ff7e2e8763628dd22a2c926d051e9d

widget/android/nsWindow.cpp

@@ -1475,6 +1475,10 @@ nsWindow::~nsWindow()
 {
     gTopLevelWindows.RemoveElement(this);
     ALOG("nsWindow %p destructor", (void*)this);
+    // The mCompositorSession should have been cleaned up in nsWindow::Destroy()
+    // DestroyLayerManager() will call DestroyCompositor() which will crash if
+    // called from nsBaseWidget destructor. See Bug 1392705
+    MOZ_ASSERT(!mCompositorSession);
 }
 
 bool
@@ -1546,6 +1550,9 @@ nsWindow::Destroy()
         mChildren[0]->SetParent(nullptr);
     }
 
+    // Ensure the compositor has been shutdown before this nsWindow is potentially deleted
+    nsBaseWidget::DestroyCompositor();
+
     nsBaseWidget::Destroy();
 
     if (IsTopLevel())