Backed out changeset 13ed73c1c335 (bug 1551615) for causing wpt leaks in Gecko Media Process.

dom/media/gmp/GMPChild.cpp

@@ -655,9 +655,12 @@ mozilla::ipc::IPCResult GMPChild::RecvInitGMPContentChild(
 
 void GMPChild::GMPContentChildActorDestroy(GMPContentChild* aGMPContentChild) {
   for (uint32_t i = mGMPContentChildren.Length(); i > 0; i--) {
-    RefPtr<GMPContentChild>& destroyedActor = mGMPContentChildren[i - 1];
-    if (destroyedActor.get() == aGMPContentChild) {
+    UniquePtr<GMPContentChild>& toDestroy = mGMPContentChildren[i - 1];
+    if (toDestroy.get() == aGMPContentChild) {
       SendPGMPContentChildDestroyed();
+      RefPtr<DeleteTask<GMPContentChild>> task =
+          new DeleteTask<GMPContentChild>(toDestroy.release());
+      MessageLoop::current()->PostTask(task.forget());
       mGMPContentChildren.RemoveElementAt(i - 1);
       break;
     }

dom/media/gmp/GMPChild.h

@@ -69,7 +69,7 @@ class GMPChild : public PGMPChild {
 
   nsTArray<std::pair<nsCString, nsCString>> MakeCDMHostVerificationPaths();
 
-  nsTArray<RefPtr<GMPContentChild>> mGMPContentChildren;
+  nsTArray<UniquePtr<GMPContentChild>> mGMPContentChildren;
 
   RefPtr<GMPTimerChild> mTimerChild;
   RefPtr<GMPStorageChild> mStorage;

dom/media/gmp/GMPContentChild.cpp

@@ -14,6 +14,12 @@
 namespace mozilla {
 namespace gmp {
 
+GMPContentChild::GMPContentChild(GMPChild* aChild) : mGMPChild(aChild) {
+  MOZ_COUNT_CTOR(GMPContentChild);
+}
+
+GMPContentChild::~GMPContentChild() { MOZ_COUNT_DTOR(GMPContentChild); }
+
 MessageLoop* GMPContentChild::GMPMessageLoop() {
   return mGMPChild->GMPMessageLoop();
 }

dom/media/gmp/GMPContentChild.h

@@ -16,11 +16,8 @@ class GMPChild;
 
 class GMPContentChild : public PGMPContentChild, public GMPSharedMem {
  public:
-  // Mark AddRef and Release as `final`, as they overload pure virtual
-  // implementations in PGMPContentChild.
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(GMPContentChild, final)
-
-  explicit GMPContentChild(GMPChild* aChild) : mGMPChild(aChild) {}
+  explicit GMPContentChild(GMPChild* aChild);
+  virtual ~GMPContentChild();
 
   MessageLoop* GMPMessageLoop();
 
@@ -48,9 +45,6 @@ class GMPContentChild : public PGMPContentChild, public GMPSharedMem {
   bool IsUsed();
 
   GMPChild* mGMPChild;
-
- private:
-  ~GMPContentChild() = default;
 };
 
 }  // namespace gmp

dom/media/gmp/GMPContentParent.cpp

@@ -42,11 +42,23 @@ GMPContentParent::~GMPContentParent() {
       GetBoolString(mChromiumCDMs.IsEmpty()), mCloseBlockerCount);
 }
 
+class ReleaseGMPContentParent : public Runnable {
+ public:
+  explicit ReleaseGMPContentParent(GMPContentParent* aToRelease)
+      : Runnable("gmp::ReleaseGMPContentParent"), mToRelease(aToRelease) {}
+
+  NS_IMETHOD Run() override { return NS_OK; }
+
+ private:
+  RefPtr<GMPContentParent> mToRelease;
+};
+
 void GMPContentParent::ActorDestroy(ActorDestroyReason aWhy) {
   GMP_LOG_DEBUG("GMPContentParent::ActorDestroy(this=%p, aWhy=%d)", this,
                 static_cast<int>(aWhy));
   MOZ_ASSERT(mVideoDecoders.IsEmpty() && mVideoEncoders.IsEmpty() &&
              mChromiumCDMs.IsEmpty());
+  NS_DispatchToCurrentThread(new ReleaseGMPContentParent(this));
 }
 
 void GMPContentParent::CheckThread() {

dom/media/gmp/GMPContentParent.h

@@ -22,9 +22,7 @@ class GMPContentParent final : public PGMPContentParent, public GMPSharedMem {
   friend class PGMPContentParent;
 
  public:
-  // Mark AddRef and Release as `final`, as they overload pure virtual
-  // implementations in PGMPContentParent.
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(GMPContentParent, final)
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(GMPContentParent)
 
   explicit GMPContentParent(GMPParent* aParent = nullptr);
 

dom/media/gmp/PGMPContent.ipdl

@@ -10,7 +10,7 @@ include protocol PChromiumCDM;
 namespace mozilla {
 namespace gmp {
 
-intr refcounted protocol PGMPContent
+intr protocol PGMPContent
 {
   manages PGMPVideoDecoder;
   manages PGMPVideoEncoder;