Bug 1826027 - Check whether window is destroyed during starting touch event. r=geckoview-reviewers,calu

`HandleMotionEvent` have a race condition of destroying `nsWindow` (in Gecko
main thread) and dispatching touch event (Android UI thread). When destroying
the window, it can accept motion event.

So we should check whether window is destroyed.

Differential Revision: https://phabricator.services.mozilla.com/D174390

widget/android/nsWindow.cpp

@@ -806,7 +806,14 @@ class NPZCSupport final
       if (!win) {
         return;
       }
-      nsWindow* gkWindow = win->GetNsWindow();
+      RefPtr<nsWindow> gkWindow = win->GetNsWindow();
+      if (!gkWindow) {
+        return;
+      }
+      MutexAutoLock lock(gkWindow->GetDestroyMutex());
+      if (gkWindow->Destroyed()) {
+        return;
+      }
       jni::NativeWeakPtr<NPZCSupport> weakPtrToThis =
           gkWindow->GetNPZCSupportWeakPtr();
       mObserver = Observer::Create(std::move(weakPtrToThis));
@@ -1966,7 +1973,8 @@ nsWindow::nsWindow()
       mDynamicToolbarMaxHeight(0),
       mSizeMode(nsSizeMode_Normal),
       mIsFullScreen(false),
-      mCompositorWidgetDelegate(nullptr) {}
+      mCompositorWidgetDelegate(nullptr),
+      mDestroyMutex("nsWindow::mDestroyMutex") {}
 
 nsWindow::~nsWindow() {
   gTopLevelWindows.RemoveElement(this);
@@ -2035,6 +2043,8 @@ nsresult nsWindow::Create(nsIWidget* aParent, nsNativeWidget aNativeParent,
 }
 
 void nsWindow::Destroy() {
+  MutexAutoLock lock(mDestroyMutex);
+
   nsBaseWidget::mOnDestroyCalled = true;
 
   // Disassociate our native object from GeckoView.

widget/android/nsWindow.h

@@ -129,6 +129,8 @@ class nsWindow final : public nsBaseWidget {
 
   void DetachNatives();
 
+  mozilla::Mutex& GetDestroyMutex() { return mDestroyMutex; }
+
   //
   // nsIWidget
   //
@@ -282,6 +284,8 @@ class nsWindow final : public nsBaseWidget {
 
   mozilla::widget::PlatformCompositorWidgetDelegate* mCompositorWidgetDelegate;
 
+  mozilla::Mutex mDestroyMutex;
+
   friend class mozilla::widget::GeckoViewSupport;
   friend class mozilla::widget::LayerViewSupport;
   friend class mozilla::widget::NPZCSupport;