Bug 1547760 - Ensuring UiCompositorControllerChild::mWidget alive when it is used

Differential Revision: https://phabricator.services.mozilla.com/D35166

gfx/layers/ipc/UiCompositorControllerChild.cpp

@@ -13,6 +13,7 @@
 #include "mozilla/gfx/GPUProcessManager.h"
 #include "mozilla/StaticPtr.h"
 #include "nsBaseWidget.h"
+#include "nsProxyRelease.h"
 #include "nsThreadUtils.h"
 
 #if defined(MOZ_WIDGET_ANDROID)
@@ -184,7 +185,12 @@ void UiCompositorControllerChild::Destroy() {
 
   if (mIsOpen) {
     // Close the underlying IPC channel.
-    mWidget = nullptr;
+
+    // Dispatch mWidget to main thread to prevent it from being destructed by
+    // the ui thread.
+    RefPtr<nsIWidget> widget = mWidget.forget();
+    NS_ReleaseOnMainThreadSystemGroup("UiCompositorControllerChild::mWidget",
+                                      widget.forget());
     PUiCompositorControllerChild::Close();
     mIsOpen = false;
   }

gfx/layers/ipc/UiCompositorControllerChild.h

@@ -78,7 +78,7 @@ class UiCompositorControllerChild final
   Maybe<int32_t> mMaxToolbarHeight;
   Maybe<uint32_t> mDefaultClearColor;
   Maybe<bool> mLayerUpdateEnabled;
-  nsBaseWidget* mWidget;
+  RefPtr<nsBaseWidget> mWidget;
   // Should only be set when compositor is in process.
   RefPtr<UiCompositorControllerParent> mParent;
 };