Bug 1103036 - Ensure __delete__ message from TabChild doesn't get sent after ActorDestroy (r=bent)

dom/ipc/TabChild.cpp

@@ -777,7 +777,10 @@ private:
         MOZ_ASSERT(NS_IsMainThread());
         MOZ_ASSERT(mTabChild);
 
-        unused << PBrowserChild::Send__delete__(mTabChild);
+        // Check in case ActorDestroy was called after RecvDestroy message.
+        if (mTabChild->IPCOpen()) {
+            unused << PBrowserChild::Send__delete__(mTabChild);
+        }
 
         mTabChild = nullptr;
         return NS_OK;
@@ -905,6 +908,7 @@ TabChild::TabChild(nsIContentChild* aManager,
   , mUniqueId(aTabId)
   , mDPI(0)
   , mDefaultScale(0)
+  , mIPCOpen(true)
 {
   if (!sActiveDurationMsSet) {
     Preferences::AddIntVarCache(&sActiveDurationMs,
@@ -1654,6 +1658,8 @@ TabChild::DestroyWindow()
 void
 TabChild::ActorDestroy(ActorDestroyReason why)
 {
+  mIPCOpen = false;
+
   DestroyWindow();
 
   if (mTabChildGlobal) {

dom/ipc/TabChild.h

@@ -499,6 +499,8 @@ public:
 
     nsIntPoint GetChromeDisplacement() { return mChromeDisp; };
 
+    bool IPCOpen() { return mIPCOpen; }
+
 protected:
     virtual ~TabChild();
 
@@ -662,6 +664,7 @@ private:
     TabId mUniqueId;
     float mDPI;
     double mDefaultScale;
+    bool mIPCOpen;
 
     DISALLOW_EVIL_CONSTRUCTORS(TabChild);
 };