Bug 1445659 - Remove dangling BrowsingContexts left from closing process. r=Nika

To not leave dangling BrowsingContexts due to crashing child processes
we need to detach all BrowsingContexts owned by a specific process
when that process goes away.

--HG--
extra : histedit_source : a737dd272224ae2595e8851813f3f9a66a2e01f2

docshell/base/BrowsingContext.cpp

@@ -16,6 +16,7 @@
 #include "nsRefPtrHashtable.h"
 #include "nsIDocShell.h"
 #include "nsContentUtils.h"
+#include "nsThreadUtils.h"
 
 namespace mozilla {
 namespace dom {
@@ -59,6 +60,28 @@ BrowsingContext::GetLog()
   return gBrowsingContextLog;
 }
 
+// TODO(farre): BrowsingContext::CleanupContexts starts from the list
+// of root BrowsingContexts. This isn't enough when separate
+// BrowsingContext nodes of a BrowsingContext tree not in a crashing
+// child process are from that process and thus needs to be
+// cleaned. [Bug 1472108]
+/* static */ void
+BrowsingContext::CleanupContexts(uint64_t aProcessId)
+{
+  if (sRootBrowsingContexts) {
+    RefPtr<BrowsingContext> context = sRootBrowsingContexts->getFirst();
+
+    while (context) {
+      RefPtr<BrowsingContext> next = context->getNext();
+      if (context->IsOwnedByProcess() &&
+          aProcessId == context->OwnerProcessId()) {
+        context->Detach();
+      }
+      context = next;
+    }
+  }
+}
+
 /* static */ already_AddRefed<BrowsingContext>
 BrowsingContext::Get(uint64_t aId)
 {

docshell/base/BrowsingContext.h

@@ -42,6 +42,7 @@ class BrowsingContext
 public:
   static void Init();
   static LogModule* GetLog();
+  static void CleanupContexts(uint64_t aProcessId);
 
   static already_AddRefed<BrowsingContext> Get(uint64_t aId);
 
@@ -78,6 +79,7 @@ public:
 
   uint64_t Id() const { return mBrowsingContextId; }
   uint64_t OwnerProcessId() const;
+  bool IsOwnedByProcess() const { return mProcessId.isSome(); }
 
   BrowsingContext* Parent() const { return mParent; }
 

dom/ipc/ContentParent.cpp

@@ -1896,6 +1896,8 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
 #if defined(XP_WIN32) && defined(ACCESSIBILITY)
   a11y::AccessibleWrap::ReleaseContentProcessIdFor(ChildID());
 #endif
+
+  BrowsingContext::CleanupContexts(ChildID());
 }
 
 bool