Bug 1446181 - Send __delete__ messages when destroying APZCTreeManagerChild instances. r=rhunt

MozReview-Commit-ID: HJSB4f5YKPo

--HG--
extra : rebase_source : 4d17f53a4f4fc97b94a0a5753ed3d3d3aaed6cb4

dom/ipc/TabChild.cpp

@@ -1081,6 +1081,10 @@ TabChild::DestroyWindow()
         mRemoteFrame = nullptr;
     }
 
+    if (mApzcTreeManager) {
+      mApzcTreeManager->Destroy();
+      mApzcTreeManager = nullptr;
+    }
 
     if (mLayersId.IsValid()) {
       StaticMutexAutoLock lock(sTabChildrenMutex);

gfx/layers/apz/public/IAPZCTreeManager.h

@@ -136,6 +136,8 @@ public:
    */
   virtual APZInputBridge* InputBridge() = 0;
 
+  virtual void Destroy() {}
+
 protected:
 
   // Discourage destruction outside of decref

gfx/layers/ipc/APZCTreeManagerChild.cpp

@@ -51,6 +51,7 @@ APZCTreeManagerChild::Destroy()
     mInputBridge->Destroy();
     mInputBridge = nullptr;
   }
+  Send__delete__(this);
 }
 
 void

gfx/layers/ipc/APZCTreeManagerChild.h

@@ -26,7 +26,8 @@ public:
 
   void SetCompositorSession(RemoteCompositorSession* aSession);
   void SetInputBridge(APZInputBridgeChild* aInputBridge);
-  void Destroy();
+
+  void Destroy() override;
 
   void
   SetKeyboardMap(const KeyboardMap& aKeyboardMap) override;

gfx/layers/ipc/PAPZCTreeManager.ipdl

@@ -35,6 +35,11 @@ namespace layers {
  * PAPZCTreeManagerParent lives in the compositor thread, while PAPZCTreeManagerChild
  * lives in the main thread of the main or the content process. APZCTreeManagerParent
  * and APZCTreeManagerChild implement this protocol.
+ *
+ * There is one instance of PAPZCTreeManager for each top-level window, plus one
+ * instance for each tab. The child instances are managed by the RemoteCompositorSession
+ * and TabChild classes, respectively. The parent instances are held in the
+ * compositor's sIndirectLayerTrees structure.
  */
 protocol PAPZCTreeManager
 {