Bug 1533673 - Prevent the GPU RemoteContentController from sending messages to a dead actor. r=rhunt

Currently it's possible for the RemoteContentController in the GPU process to
be sending a message to the UI process while the UI process is running
RemoteCompositorSession::Shutdown. This means that by the time that message
is processed, the UI process actor is destroyed and the message produces
a routing error.

This patch ensures that before RemoteCompositorSession::Shutdown completes,
it notifies the RemoteContentController in the GPU process that it's about
to destroy the APZChild actor. This eliminates the race because it ensures
the RemoteContentController is synchronously notified of the impending
actor destruction before it tries to send the message.

Differential Revision: https://phabricator.services.mozilla.com/D29941

--HG--
extra : moz-landing-system : lando

gfx/layers/ipc/CompositorBridgeChild.cpp

@@ -175,6 +175,12 @@ void CompositorBridgeChild::Destroy() {
     wrBridge->Destroy(/* aIsSync */ false);
   }
 
+  AutoTArray<PAPZChild*, 16> apzChildren;
+  ManagedPAPZChild(apzChildren);
+  for (PAPZChild* child : apzChildren) {
+    Unused << child->SendDestroy();
+  }
+
   const ManagedContainer<PTextureChild>& textures = ManagedPTextureChild();
   for (auto iter = textures.ConstIter(); !iter.Done(); iter.Next()) {
     RefPtr<TextureClient> texture =
@@ -185,6 +191,9 @@ void CompositorBridgeChild::Destroy() {
     }
   }
 
+  // The WillClose message is synchronous, so we know that after it returns
+  // any messages sent by the above code will have been processed on the
+  // other side.
   SendWillClose();
   mCanSend = false;
 

gfx/layers/ipc/PAPZ.ipdl

@@ -47,7 +47,6 @@ sync protocol PAPZ
   manager PCompositorBridge;
 
 parent:
-
   async __delete__();
 
 child:
@@ -71,6 +70,7 @@ child:
 
   async NotifyAsyncAutoscrollRejected(ViewID aScrollId);
 
+both:
   async Destroy();
 };
 

gfx/layers/ipc/RemoteContentController.cpp

@@ -370,6 +370,13 @@ void RemoteContentController::Destroy() {
   }
 }
 
+mozilla::ipc::IPCResult RemoteContentController::RecvDestroy() {
+  // The actor on the other side is about to get destroyed, so let's not send
+  // it any more messages.
+  mCanSend = false;
+  return IPC_OK();
+}
+
 bool RemoteContentController::IsRemote() { return true; }
 
 }  // namespace layers

gfx/layers/ipc/RemoteContentController.h

@@ -85,6 +85,7 @@ class RemoteContentController : public GeckoContentController,
   void ActorDestroy(ActorDestroyReason aWhy) override;
 
   void Destroy() override;
+  mozilla::ipc::IPCResult RecvDestroy();
 
   bool IsRemote() override;