Bug 966284 - Fix the shutdown sequence of PLayerTransaction and PTexture. r=sotaro

gfx/layers/ipc/CompositorChild.cpp

@@ -50,9 +50,11 @@ CompositorChild::Destroy()
 {
   mLayerManager->Destroy();
   mLayerManager = nullptr;
-  while (size_t len = ManagedPLayerTransactionChild().Length()) {
+  // start from the end of the array because Destroy() can cause the
+  // LayerTransactionChild to be removed from the array.
+  for (int i = ManagedPLayerTransactionChild().Length() - 1; i >= 0; --i) {
     RefPtr<LayerTransactionChild> layers =
-      static_cast<LayerTransactionChild*>(ManagedPLayerTransactionChild()[len - 1]);
+      static_cast<LayerTransactionChild*>(ManagedPLayerTransactionChild()[i]);
     layers->Destroy();
   }
   SendStop();

gfx/layers/ipc/LayerTransactionChild.cpp

@@ -22,7 +22,7 @@ namespace layers {
 void
 LayerTransactionChild::Destroy()
 {
-  if (!IPCOpen() || mDestroyed) {
+  if (!IPCOpen()) {
     return;
   }
   // mDestroyed is used to prevent calling Send__delete__() twice.
@@ -34,7 +34,15 @@ LayerTransactionChild::Destroy()
   mDestroyed = true;
   NS_ABORT_IF_FALSE(0 == ManagedPLayerChild().Length(),
                     "layers should have been cleaned up by now");
-  PLayerTransactionChild::Send__delete__(this);
+
+  for (size_t i = 0; i < ManagedPTextureChild().Length(); ++i) {
+    TextureClient* texture = TextureClient::AsTextureClient(ManagedPTextureChild()[i]);
+    if (texture) {
+      texture->ForceRemove();
+    }
+  }
+
+  SendShutdown();
 }
 
 
@@ -56,6 +64,7 @@ LayerTransactionChild::DeallocPLayerChild(PLayerChild* actor)
 PCompositableChild*
 LayerTransactionChild::AllocPCompositableChild(const TextureInfo& aInfo)
 {
+  MOZ_ASSERT(!mDestroyed);
   return CompositableClient::CreateIPDLActor();
 }
 
@@ -136,6 +145,7 @@ PTextureChild*
 LayerTransactionChild::AllocPTextureChild(const SurfaceDescriptor&,
                                           const TextureFlags&)
 {
+  MOZ_ASSERT(!mDestroyed);
   return TextureClient::CreateIPDLActor();
 }
 

gfx/layers/ipc/LayerTransactionChild.h

@@ -31,7 +31,8 @@ class LayerTransactionChild : public PLayerTransactionChild
 public:
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(LayerTransactionChild)
   /**
-   * Clean this up, finishing with Send__delete__().
+   * Clean this up, finishing with SendShutDown() which will cause __delete__
+   * to be sent from the parent side.
    *
    * It is expected (checked with an assert) that all shadow layers
    * created by this have already been destroyed and
@@ -39,7 +40,7 @@ public:
    */
   void Destroy();
 
-  bool IPCOpen() const { return mIPCOpen; }
+  bool IPCOpen() const { return mIPCOpen && !mDestroyed; }
 
   void SetForwarder(ShadowLayerForwarder* aForwarder)
   {

gfx/layers/ipc/LayerTransactionParent.cpp

@@ -161,6 +161,13 @@ LayerTransactionParent::~LayerTransactionParent()
   MOZ_COUNT_DTOR(LayerTransactionParent);
 }
 
+bool
+LayerTransactionParent::RecvShutdown()
+{
+  Destroy();
+  return Send__delete__(this);
+}
+
 void
 LayerTransactionParent::Destroy()
 {

gfx/layers/ipc/LayerTransactionParent.h

@@ -101,6 +101,8 @@ public:
   }
 
 protected:
+  virtual bool RecvShutdown() MOZ_OVERRIDE;
+
   virtual bool RecvUpdate(const EditArray& cset,
                           const uint64_t& aTransactionId,
                           const TargetConfig& targetConfig,

gfx/layers/ipc/PLayerTransaction.ipdl

@@ -102,6 +102,8 @@ parent:
 
   async ChildAsyncMessages(AsyncChildMessageData[] aMessages);
 
+  async Shutdown();
+child:
   async __delete__();
 };