Bug 1343212 - FilePicker child actor must not send Open() if it has been already distroyed, r=mccr8

widget/nsFilePickerProxy.cpp

@@ -18,6 +18,7 @@ NS_IMPL_ISUPPORTS(nsFilePickerProxy, nsIFilePicker)
 
 nsFilePickerProxy::nsFilePickerProxy()
   : mSelectedType(0)
+  , mIPCActive(false)
 {
 }
 
@@ -40,6 +41,8 @@ nsFilePickerProxy::Init(mozIDOMWindowProxy* aParent, const nsAString& aTitle,
 
   NS_ADDREF_THIS();
   tabChild->SendPFilePickerConstructor(this, nsString(aTitle), aMode);
+
+  mIPCActive = true;
   return NS_OK;
 }
 
@@ -136,6 +139,10 @@ nsFilePickerProxy::Open(nsIFilePickerShownCallback* aCallback)
     mDisplayDirectory->GetPath(displayDirectory);
   }
 
+  if (!mIPCActive) {
+    return NS_ERROR_FAILURE;
+  }
+
   SendOpen(mSelectedType, mAddToRecentDocs, mDefault, mDefaultExtension,
            mFilters, mFilterNames, displayDirectory, mOkButtonLabel);
 
@@ -271,3 +278,14 @@ nsFilePickerProxy::GetDomFileOrDirectoryEnumerator(nsISimpleEnumerator** aDomfil
   enumerator.forget(aDomfiles);
   return NS_OK;
 }
+
+void
+nsFilePickerProxy::ActorDestroy(ActorDestroyReason aWhy)
+{
+  mIPCActive = false;
+
+  if (mCallback) {
+    mCallback->Done(nsIFilePicker::returnCancel);
+    mCallback = nullptr;
+  }
+}

widget/nsFilePickerProxy.h

@@ -60,6 +60,9 @@ private:
     ~nsFilePickerProxy();
     void InitNative(nsIWidget*, const nsAString&) override;
 
+    void
+    ActorDestroy(ActorDestroyReason aWhy) override;
+
     nsTArray<mozilla::dom::OwningFileOrDirectory> mFilesOrDirectories;
     nsCOMPtr<nsIFilePickerShownCallback> mCallback;
 
@@ -68,6 +71,8 @@ private:
     nsString  mDefault;
     nsString  mDefaultExtension;
 
+    bool mIPCActive;
+
     InfallibleTArray<nsString> mFilters;
     InfallibleTArray<nsString> mFilterNames;
 };