Bug 1669160 - Have BrowserParent keep BrowsingContextGroup alive, r=kmag

Differential Revision: https://phabricator.services.mozilla.com/D94887

dom/ipc/ContentProcessManager.cpp

@@ -7,6 +7,7 @@
 #include "ContentProcessManager.h"
 #include "ContentParent.h"
 #include "mozilla/dom/BrowserParent.h"
+#include "mozilla/dom/BrowsingContextGroup.h"
 
 #include "mozilla/StaticPtr.h"
 #include "mozilla/ClearOnShutdown.h"
@@ -62,14 +63,24 @@ bool ContentProcessManager::RegisterRemoteFrame(BrowserParent* aChildBp) {
 
   auto entry = mBrowserParentMap.LookupForAdd(aChildBp->GetTabId());
   MOZ_ASSERT_IF(entry, entry.Data() == aChildBp);
-  entry.OrInsert([&] { return aChildBp; });
+  entry.OrInsert([&] {
+    // Ensure that this BrowserParent's BrowsingContextGroup is kept alive until
+    // the BrowserParent has been unregistered, ensuring the group isn't
+    // destroyed while this BrowserParent can still send messages.
+    aChildBp->GetBrowsingContext()->Group()->AddKeepAlive();
+    return aChildBp;
+  });
   return !entry;
 }
 
 void ContentProcessManager::UnregisterRemoteFrame(const TabId& aChildTabId) {
   MOZ_ASSERT(NS_IsMainThread());
 
-  MOZ_ALWAYS_TRUE(mBrowserParentMap.Remove(aChildTabId));
+  auto childBp = mBrowserParentMap.GetAndRemove(aChildTabId);
+  MOZ_DIAGNOSTIC_ASSERT(childBp);
+
+  // Clear the corresponding keepalive which was added in `RegisterRemoteFrame`.
+  (*childBp)->GetBrowsingContext()->Group()->RemoveKeepAlive();
 }
 
 ContentParentId ContentProcessManager::GetTabProcessId(