Bug 1710879 - Don't clear BrowserBridgeHost::mBridge until BrowserBridgeChild has been completely destroyed. r=nika

Differential Revision: https://phabricator.services.mozilla.com/D122214

dom/ipc/BrowserBridgeChild.cpp

@@ -214,6 +214,10 @@ mozilla::ipc::IPCResult BrowserBridgeChild::RecvSubFrameCrashed() {
 }
 
 void BrowserBridgeChild::ActorDestroy(ActorDestroyReason aWhy) {
+  if (mFrameLoader) {
+    mFrameLoader->DestroyComplete();
+  }
+
   if (!mBrowsingContext) {
     // This BBC was never valid, skip teardown.
     return;

dom/ipc/BrowserBridgeHost.cpp

@@ -47,14 +47,15 @@ void BrowserBridgeHost::ResumeLoad(uint64_t aPendingSwitchId) {
   Unused << mBridge->SendResumeLoad(aPendingSwitchId);
 }
 
-void BrowserBridgeHost::DestroyStart() { DestroyComplete(); }
+void BrowserBridgeHost::DestroyStart() {
+  // We don't clear the bridge until BrowserBridgeChild::ActorDestroy is called,
+  // which will end up calling DestroyComplete().
+  if (mBridge) {
+    Unused << mBridge->SendBeginDestroy();
+  }
+}
 
 void BrowserBridgeHost::DestroyComplete() {
-  if (!mBridge) {
-    return;
-  }
-
-  Unused << mBridge->Send__delete__(mBridge);
   mBridge = nullptr;
 }
 

dom/ipc/BrowserBridgeParent.cpp

@@ -143,6 +143,9 @@ void BrowserBridgeParent::Destroy() {
     mBrowserParent->SetBrowserBridgeParent(nullptr);
     mBrowserParent = nullptr;
   }
+  if (CanSend()) {
+    Unused << Send__delete__(this);
+  }
 }
 
 IPCResult BrowserBridgeParent::RecvShow(const OwnerShowInfo& aOwnerInfo) {
@@ -197,6 +200,11 @@ IPCResult BrowserBridgeParent::RecvNavigateByKey(
   return IPC_OK();
 }
 
+IPCResult BrowserBridgeParent::RecvBeginDestroy() {
+  Destroy();
+  return IPC_OK();
+}
+
 IPCResult BrowserBridgeParent::RecvDispatchSynthesizedMouseEvent(
     const WidgetMouseEvent& aEvent) {
   if (aEvent.mMessage != eMouseMove ||

dom/ipc/BrowserBridgeParent.h

@@ -86,6 +86,7 @@ class BrowserBridgeParent : public PBrowserBridgeParent {
 
   mozilla::ipc::IPCResult RecvNavigateByKey(const bool& aForward,
                                             const bool& aForDocumentNavigation);
+  mozilla::ipc::IPCResult RecvBeginDestroy();
 
   mozilla::ipc::IPCResult RecvDispatchSynthesizedMouseEvent(
       const WidgetMouseEvent& aEvent);

dom/ipc/PBrowserBridge.ipdl

@@ -78,10 +78,17 @@ child:
   async IntrinsicSizeOrRatioChanged(IntrinsicSize? aIntrinsicSize,
                                     AspectRatio? aIntrinsicRatio);
 
-parent:
+both:
+
   // Destroy the remote web browser due to the nsFrameLoader going away.
+  // Before initialization we sync-delete it from the child. After
+  // initialization we sync-delete it from the parent after BeginDestroy().
   async __delete__();
 
+parent:
+
+  async BeginDestroy();
+
   // DocShell messaging.
   async LoadURL(nsDocShellLoadState aLoadState);
   async ResumeLoad(uint64_t aPendingSwitchID);

dom/ipc/WindowGlobalChild.cpp

@@ -404,6 +404,8 @@ mozilla::ipc::IPCResult WindowGlobalChild::RecvMakeFrameRemote(
     return IPC_OK();
   }
 
+  // Synchronously delete de actor here rather than using SendBeginDestroy(), as
+  // we haven't initialized it yet.
   auto deleteBridge =
       MakeScopeExit([&] { BrowserBridgeChild::Send__delete__(bridge); });