Bug 1289001 - Fix a race condition in the use of TabChild::mIPCOpen, r=jld

dom/ipc/TabChild.cpp

@@ -314,12 +314,7 @@ private:
     {
         MOZ_ASSERT(NS_IsMainThread());
         MOZ_ASSERT(mTabChild);
-
-        // Check in case ActorDestroy was called after RecvDestroy message.
-        if (mTabChild->IPCOpen()) {
-            Unused << PBrowserChild::Send__delete__(mTabChild);
-        }
-
+        mTabChild->SendDeleteIfOpen();
         mTabChild = nullptr;
         return NS_OK;
     }
@@ -1177,6 +1172,20 @@ TabChild::DestroyWindow()
     }
 }
 
+void
+TabChild::SendDeleteIfOpen()
+{
+  // Check in case ActorDestroy was called after RecvDestroy message.
+  if (mIPCOpen) {
+
+    // We must consider the IPC actor already dismissed in order to return the
+    // corrent value in IPCOpen().
+    mIPCOpen = false;
+
+    Unused << PBrowserChild::Send__delete__(this);
+  }
+}
+
 void
 TabChild::ActorDestroy(ActorDestroyReason why)
 {

dom/ipc/TabChild.h

@@ -749,6 +749,8 @@ private:
     mUnscaledInnerSize = aSize;
   }
 
+  void SendDeleteIfOpen();
+
   class DelayedDeleteRunnable;
 
   TextureFactoryIdentifier mTextureFactoryIdentifier;