Bug 834470: Release AsyncPanZoomController and friends. r=roc

gfx/layers/ipc/AsyncPanZoomController.cpp

@@ -192,6 +192,14 @@ AsyncPanZoomController::~AsyncPanZoomController() {
 
 }
 
+void
+AsyncPanZoomController::Destroy()
+{
+  // These memebrs can only be used on the controller/UI thread.
+  mGeckoContentController = nullptr;
+  mGestureEventListener = nullptr;
+}
+
 /* static */float
 AsyncPanZoomController::GetTouchStartTolerance()
 {

gfx/layers/ipc/AsyncPanZoomController.h

@@ -78,6 +78,12 @@ public:
   // These methods must only be called on the controller/UI thread.
   //
 
+  /**
+   * Shut down the controller/UI thread state and prepare to be
+   * deleted (which may happen from any thread).
+   */
+  void Destroy();
+
   /**
    * General handler for incoming input events. Manipulates the frame metrics
    * basde on what type of input it is. For example, a PinchGestureEvent will

gfx/layers/ipc/Axis.h

@@ -183,7 +183,7 @@ protected:
   // they are flinging multiple times in a row very quickly, probably trying to
   // reach one of the extremes of the page.
   int32_t mAcceleration;
-  nsRefPtr<AsyncPanZoomController> mAsyncPanZoomController;
+  AsyncPanZoomController* mAsyncPanZoomController;
 };
 
 class AxisX : public Axis {

layout/ipc/RenderFrameParent.cpp

@@ -802,6 +802,7 @@ RenderFrameParent::ActorDestroy(ActorDestroyReason why)
       // Stop our content controller from requesting repaints of our
       // content.
       mContentController->ClearRenderFrame();
+      mPanZoomController->Destroy();
     }
   }