From ea96436c1b43b80f227f5541a3c7b1c5689ef143 Mon Sep 17 00:00:00 2001
From: Cervantes Yu <cyu@mozilla.com>
Date: Thu, 17 Oct 2013 06:25:50 +0800
Subject: [PATCH] Bug 878366: don't send send out messages of
 PContendPermissionRequest if the managing TabParent is being destroyed.
 r=bent

---
 dom/base/nsContentPermissionHelper.cpp | 23 +++++++++++++++++++++++
 dom/base/nsContentPermissionHelper.h   |  2 ++
 dom/ipc/TabParent.h                    |  6 ++++++
 3 files changed, 31 insertions(+)

diff --git a/dom/base/nsContentPermissionHelper.cpp b/dom/base/nsContentPermissionHelper.cpp
index 42ed0ead3fb1..b4b3c87dca5a 100644
--- a/dom/base/nsContentPermissionHelper.cpp
+++ b/dom/base/nsContentPermissionHelper.cpp
@@ -8,6 +8,7 @@
 #include "nsIDOMElement.h"
 #include "nsIPrincipal.h"
 #include "mozilla/dom/Element.h"
+#include "mozilla/dom/TabParent.h"
 #include "mozilla/unused.h"
 #include "nsComponentManagerUtils.h"
 
@@ -105,6 +106,12 @@ nsContentPermissionRequestProxy::Cancel()
     return NS_ERROR_FAILURE;
   }
 
+  // Don't send out the delete message when the managing protocol (PBrowser) is
+  // being destroyed and PContentPermissionRequest will soon be.
+  if (mParent->IsBeingDestroyed()) {
+    return NS_ERROR_FAILURE;
+  }
+
   unused << ContentPermissionRequestParent::Send__delete__(mParent, false);
   mParent = nullptr;
   return NS_OK;
@@ -116,6 +123,13 @@ nsContentPermissionRequestProxy::Allow()
   if (mParent == nullptr) {
     return NS_ERROR_FAILURE;
   }
+
+  // Don't send out the delete message when the managing protocol (PBrowser) is
+  // being destroyed and PContentPermissionRequest will soon be.
+  if (mParent->IsBeingDestroyed()) {
+    return NS_ERROR_FAILURE;
+  }
+
   unused << ContentPermissionRequestParent::Send__delete__(mParent, true);
   mParent = nullptr;
   return NS_OK;
@@ -161,5 +175,14 @@ ContentPermissionRequestParent::ActorDestroy(ActorDestroyReason why)
   }
 }
 
+bool
+ContentPermissionRequestParent::IsBeingDestroyed()
+{
+  // When TabParent::Destroy() is called, we are being destroyed. It's unsafe
+  // to send out any message now.
+  TabParent* tabParent = static_cast<TabParent*>(Manager());
+  return tabParent->IsDestroyed();
+}
+
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/base/nsContentPermissionHelper.h b/dom/base/nsContentPermissionHelper.h
index 96440d0c3d15..9a750c6efb57 100644
--- a/dom/base/nsContentPermissionHelper.h
+++ b/dom/base/nsContentPermissionHelper.h
@@ -27,6 +27,8 @@ class ContentPermissionRequestParent : public PContentPermissionRequestParent
                                  const IPC::Principal& principal);
   virtual ~ContentPermissionRequestParent();
 
+  bool IsBeingDestroyed();
+
   nsCOMPtr<nsIPrincipal> mPrincipal;
   nsCOMPtr<Element> mElement;
   nsCOMPtr<nsContentPermissionRequestProxy> mProxy;
diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h
index a6a7e7ec6159..24731d27a393 100644
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -238,6 +238,12 @@ public:
 
     ContentParent* Manager() { return mManager; }
 
+    /**
+     * Let managees query if Destroy() is already called so they don't send out
+     * messages when the PBrowser actor is being destroyed.
+     */
+    bool IsDestroyed() const { return mIsDestroyed; }
+
 protected:
     bool ReceiveMessage(const nsString& aMessage,
                         bool aSync,