import change from rmottola/Arctic-Fox:

- Bug 1139453 - Send network UP/DOWN events on desktop Linux. (7466c1298) - Bug 1141488 - On non-APZ platforms, combine any async transform with the OMTA transform rather than clobbering it the OMTA transform. (fe48d6774) - Bug 1080752 - Hold wakelock when attempting to connect to push server. (b1e74295f) - Bug 1126089 - Allow messages to be sent after frame script unload event. (167ebbd9a) - Bug 1126089 - Add test for pageload event on browser element when tab closed (f2011e6e4) - Bug 1090921 - Logging to see which tasks remain alive too long (ebfc3c9bd) - Bug 1142544 - delete now-unnecessary |extern "C++"| block from nsISupportsUtils.h; r=mccr8 (07e6572f8) - Bug 1142503 - don't use QueryInterface when the compiler can do the cast for us; r=ehsan (b13219054) - Bug 1140161 - Sensibly handle patterns with absolute paths in TEST_HARNESS_FILES. (173e369a7) - Bug 1082510 - When we detect a chrome popup at the current event coordinates and remote content has the mouse captured, release capture. r=Enn (da9fe26a7) - Bug 1137722 - Ensure that system message cache is refreshed before openapp. r=fabrice (97dc41f50) - Bug 1139904 - Add initial test runtime files for mochitest browser-chrome and devtools (9837c79b1) - Bug 1061604 part.1 nsTextStore::GetTextExt() should rReturn previous character rect instead of TS_E_NOLAYOUT when Google Japanese Input retrieves first character of selected clause at composing r=emk (54779d30e) - Bug 1061604 part.2 nsTextStore::GetTextExt() should rReturn previous character rect of modified range instead of TS_E_NOLAYOUT when Google Japanese Input retrieves caret rect during composition r=emk (ba7f93879) - Bug 1136051 - component_insert_pair statrs checks only while we are still checking or haven't started pairing; (ae1ae1d4f) - Bug 1137007 - Detect namespace and SECCOMP_FILTER_FLAG_TSYNC support in SandboxInfo. r=kang, r=Unfocused (6d9e32a8f) - Bug 1142263 - Specify all syscall parameters when doing CLONE_NEWUSER detection; f=bwc r=kang (8bcba1831) - Bug 1142567 - Remove FAIL_ON_WARNINGS_DEBUG; It is not used. (bf22f1ccf) - No bug - Add an explanatory message to the multiple-inheritance assertion in DOM bindings; # (ffd94ef07) - Bug 1141252. Don't mark the TablePainter display item as having background-attachment:fixed content if the background-attachment:fixed image will be painted by a dedicated nsDisplayTableCellBackground. r=mats (98287b37c) - Bug 1140084 - delete list of script counts in tail-recursive fashion. (90a2b7c45) - Bug 1048741 - [WebGL2] texParameter: Fix silly bug in TEXTURE_COMPARE_FUNC handling. (ccc90dae3) - Bug 1142478. Fix integer attribute parsing to not lose track of leading zeroes. (d596a1ce1) - Bug 1139388 - Remove superfluous locking in the OS X profiler implementation to fix deadlock. (r=mstange) (a13088958) - Bug 1128603: Remove findReferences and the tests that use it. (bccc64734) - Bug 1140683: Fix async plugin init using null plugin funcs on MacOSX (47b591d54) - Bug 1142494 - Fix OSX packaging mistake. (15555f4ee) - Bug 1136784 - Add screenshot to LogShake produced data. (7ff264243) - Bug 1142550 - Fix screenshot. (d684b6469) - Bug 1142006 - Set MACOSX_DEPLOYMENT_TARGET earlier. r=mshal (c333b954e) - Bug 1100966 - Remember all ranges for all selections when joining nodes in the editor transactions; r=roc (bf34bd0c8) - Bug 1136507 - L8, LA8, and A8 should not be renderable. (96e807795) - Bug 1128019 - Init SCISSOR_BOX with initial width and height. (7258cc44c) - Bug 1142211 - Add layerization testing mechanisms to reftest. r=roc (4c6aa11f8) - Bug 1106905 - Modify mobile desktop mode implementation to use a desktop viewport. (644ede0e7) - Bug 1139675 - Simplify the APIs for getting and setting the pres shell resolution. r=mstange,mattwoodrow (c520a8c98) - Bug 1141563 - Don't update Shapes in parallel after compacting GC (098af79c9)
2026-05-26 13:23:07 +00:00 · 2019-07-13 08:35:45 +08:00
parent 0a2ee1ef29
commit 2a3dd7f84c
177 changed files with 2586 additions and 1668 deletions
@@ -107,25 +107,6 @@ using namespace mozilla::layers;
 using namespace mozilla::layout;
 typedef FrameMetrics::ViewID ViewID;

-class nsAsyncDocShellDestroyer : public nsRunnable
-{
-public:
-  explicit nsAsyncDocShellDestroyer(nsIDocShell* aDocShell)
-    : mDocShell(aDocShell)
-  {
-  }
-
-  NS_IMETHOD Run()
-  {
-    nsCOMPtr<nsIBaseWindow> base_win(do_QueryInterface(mDocShell));
-    if (base_win) {
-      base_win->Destroy();
-    }
-    return NS_OK;
-  }
-  nsRefPtr<nsIDocShell> mDocShell;
-};
-
 // Bug 136580: Limit to the number of nested content frames that can have the
 //             same URL. This is to stop content that is recursively loading
 //             itself.  Note that "#foo" on the end of URL doesn't affect
@@ -181,7 +162,6 @@ nsFrameLoader::nsFrameLoader(Element* aOwner, bool aNetworkCreated)

 nsFrameLoader::~nsFrameLoader()
 {
-  mNeedsAsyncDestroy = true;
  if (mMessageManager) {
    mMessageManager->Disconnect();
  }
@@ -523,16 +503,6 @@ nsFrameLoader::GetDocShell(nsIDocShell **aDocShell)
  return rv;
 }

-void
-nsFrameLoader::Finalize()
-{
-  nsCOMPtr<nsIBaseWindow> base_win(do_QueryInterface(mDocShell));
-  if (base_win) {
-    base_win->Destroy();
-  }
-  mDocShell = nullptr;
-}
-
 static void
 FirePageHideEvent(nsIDocShellTreeItem* aItem,
                  EventTarget* aChromeEventHandler)
@@ -1358,29 +1328,59 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
  return NS_OK;
 }

-void
-nsFrameLoader::DestroyChild()
-{
-  if (mRemoteBrowser) {
-    mRemoteBrowser->SetOwnerElement(nullptr);
-    mRemoteBrowser->Destroy();
-    mRemoteBrowser = nullptr;
-  }
-}
-
 NS_IMETHODIMP
 nsFrameLoader::Destroy()
 {
+  StartDestroy();
+  return NS_OK;
+}
+
+class nsFrameLoaderDestroyRunnable : public nsRunnable
+{
+  enum DestroyPhase
+  {
+    // See the implementation of Run for an explanation of these phases.
+    eDestroyDocShell,
+    eWaitForUnloadMessage,
+    eDestroyComplete
+  };
+
+  nsRefPtr<nsFrameLoader> mFrameLoader;
+  DestroyPhase mPhase;
+
+public:
+  explicit nsFrameLoaderDestroyRunnable(nsFrameLoader* aFrameLoader)
+   : mFrameLoader(aFrameLoader), mPhase(eDestroyDocShell) {}
+
+  NS_IMETHODIMP Run() override;
+};
+
+void
+nsFrameLoader::StartDestroy()
+{
+  // nsFrameLoader::StartDestroy is called just before the frameloader is
+  // detached from the <browser> element. Destruction continues in phases via
+  // the nsFrameLoaderDestroyRunnable.
+
  if (mDestroyCalled) {
-    return NS_OK;
+    return;
  }
  mDestroyCalled = true;

+  // After this point, we return an error when trying to send a message using
+  // the message manager on the frame.
  if (mMessageManager) {
-    mMessageManager->Disconnect();
+    mMessageManager->Close();
  }
-  if (mChildMessageManager) {
-    static_cast<nsInProcessTabChildGlobal*>(mChildMessageManager.get())->Disconnect();
+
+  // Retain references to the <browser> element and the frameloader in case we
+  // receive any messages from the message manager on the frame. These
+  // references are dropped in DestroyComplete.
+  if (mChildMessageManager || mRemoteBrowser) {
+    mOwnerContentStrong = mOwnerContent;
+    if (mRemoteBrowser) {
+      mRemoteBrowser->CacheFrameLoader(this);
+    }
  }

  nsCOMPtr<nsIDocument> doc;
@@ -1392,7 +1392,6 @@ nsFrameLoader::Destroy()

    SetOwnerContent(nullptr);
  }
-  DestroyChild();

  // Seems like this is a dynamic frame removal.
  if (dynamicSubframeRemoval) {
@@ -1412,7 +1411,7 @@ nsFrameLoader::Destroy()
      }
    }
  }
-  
+
  // Let our window know that we are gone
  if (mDocShell) {
    nsCOMPtr<nsPIDOMWindow> win_private(mDocShell->GetWindow());
@@ -1421,23 +1420,122 @@ nsFrameLoader::Destroy()
    }
  }

-  if ((mNeedsAsyncDestroy || !doc ||
-       NS_FAILED(doc->FinalizeFrameLoader(this))) && mDocShell) {
-    nsCOMPtr<nsIRunnable> event = new nsAsyncDocShellDestroyer(mDocShell);
-    NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
-    NS_DispatchToCurrentThread(event);
+  nsCOMPtr<nsIRunnable> destroyRunnable = new nsFrameLoaderDestroyRunnable(this);
+  if (mNeedsAsyncDestroy || !doc ||
+      NS_FAILED(doc->FinalizeFrameLoader(this, destroyRunnable))) {
+    NS_DispatchToCurrentThread(destroyRunnable);
+  }
+}

-    // Let go of our docshell now that the async destroyer holds on to
-    // the docshell.
+nsresult
+nsFrameLoaderDestroyRunnable::Run()
+{
+  switch (mPhase) {
+  case eDestroyDocShell:
+    mFrameLoader->DestroyDocShell();

-    mDocShell = nullptr;
+    // In the out-of-process case, TabParent will eventually call
+    // DestroyComplete once it receives a __delete__ message from the child. In
+    // the in-process case, we dispatch a series of runnables to ensure that
+    // DestroyComplete gets called at the right time. The frame loader is kept
+    // alive by mFrameLoader during this time.
+    if (mFrameLoader->mChildMessageManager) {
+      // When the docshell is destroyed, NotifyWindowIDDestroyed is called to
+      // asynchronously notify {outer,inner}-window-destroyed via a runnable. We
+      // don't want DestroyComplete to run until after those runnables have
+      // run. Since we're enqueueing ourselves after the window-destroyed
+      // runnables are enqueued, we're guaranteed to run after.
+      mPhase = eWaitForUnloadMessage;
+      NS_DispatchToCurrentThread(this);
+    }
+    break;
+
+   case eWaitForUnloadMessage:
+     // The *-window-destroyed observers have finished running at this
+     // point. However, it's possible that a *-window-destroyed observer might
+     // have sent a message using the message manager. These messages might not
+     // have been processed yet. So we enqueue ourselves again to ensure that
+     // DestroyComplete runs after all messages sent by *-window-destroyed
+     // observers have been processed.
+     mPhase = eDestroyComplete;
+     NS_DispatchToCurrentThread(this);
+     break;
+
+   case eDestroyComplete:
+     // Now that all messages sent by unload listeners and window destroyed
+     // observers have been processed, we disconnect the message manager and
+     // finish destruction.
+     mFrameLoader->DestroyComplete();
+     break;
  }

-  // NOTE: 'this' may very well be gone by now.
-
  return NS_OK;
 }

+void
+nsFrameLoader::DestroyDocShell()
+{
+  // This code runs after the frameloader has been detached from the <browser>
+  // element. We postpone this work because we may not be allowed to run
+  // script at that time.
+
+  // Ask the TabChild to fire the frame script "unload" event, destroy its
+  // docshell, and finally destroy the PBrowser actor. This eventually leads to
+  // nsFrameLoader::DestroyComplete being called.
+  if (mRemoteBrowser) {
+    mRemoteBrowser->Destroy();
+  }
+
+  // Fire the "unload" event if we're in-process.
+  if (mChildMessageManager) {
+    static_cast<nsInProcessTabChildGlobal*>(mChildMessageManager.get())->FireUnloadEvent();
+  }
+
+  // Destroy the docshell.
+  nsCOMPtr<nsIBaseWindow> base_win(do_QueryInterface(mDocShell));
+  if (base_win) {
+    base_win->Destroy();
+  }
+  mDocShell = nullptr;
+
+  if (mChildMessageManager) {
+    // Stop handling events in the in-process frame script.
+    static_cast<nsInProcessTabChildGlobal*>(mChildMessageManager.get())->DisconnectEventListeners();
+  }
+}
+
+void
+nsFrameLoader::DestroyComplete()
+{
+  // We get here, as part of StartDestroy, after the docshell has been destroyed
+  // and all message manager messages sent during docshell destruction have been
+  // dispatched.  We also get here if the child process crashes. In the latter
+  // case, StartDestroy might not have been called.
+
+  // Drop the strong references created in StartDestroy.
+  if (mChildMessageManager || mRemoteBrowser) {
+    mOwnerContentStrong = nullptr;
+    if (mRemoteBrowser) {
+      mRemoteBrowser->CacheFrameLoader(nullptr);
+    }
+  }
+
+  // Call TabParent::Destroy if we haven't already (in case of a crash).
+  if (mRemoteBrowser) {
+    mRemoteBrowser->SetOwnerElement(nullptr);
+    mRemoteBrowser->Destroy();
+    mRemoteBrowser = nullptr;
+  }
+
+  if (mMessageManager) {
+    mMessageManager->Disconnect();
+  }
+
+  if (mChildMessageManager) {
+    static_cast<nsInProcessTabChildGlobal*>(mChildMessageManager.get())->Disconnect();
+  }
+}
+
 NS_IMETHODIMP
 nsFrameLoader::GetDepthTooGreat(bool* aDepthTooGreat)
 {