1 files changed, 51 insertions, 48 deletions

diff --git a/dom/ipc/BrowserParent.cpp b/dom/ipc/BrowserParent.cpp
index 23c677c09c..75bfbd150b 100644
--- a/dom/ipc/BrowserParent.cpp
+++ b/dom/ipc/BrowserParent.cpp
@@ -265,7 +265,26 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(BrowserParent)
   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMEventListener)
 NS_INTERFACE_MAP_END
-NS_IMPL_CYCLE_COLLECTION_WEAK(BrowserParent, mFrameLoader, mBrowsingContext)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(BrowserParent)
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(BrowserParent)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mFrameLoader)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mBrowsingContext)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mFrameElement)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mBrowserDOMWindow)
+  tmp->UnlinkManager();
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_WEAK_REFERENCE
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(BrowserParent)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFrameLoader)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mBrowsingContext)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFrameElement)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mBrowserDOMWindow)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_RAWPTR(Manager())
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
 NS_IMPL_CYCLE_COLLECTING_ADDREF(BrowserParent)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(BrowserParent)
 
@@ -275,7 +294,6 @@ BrowserParent::BrowserParent(ContentParent* aManager, const TabId& aTabId,
                              uint32_t aChromeFlags)
     : TabContext(aContext),
       mTabId(aTabId),
-      mManager(aManager),
       mBrowsingContext(aBrowsingContext),
       mFrameElement(nullptr),
       mBrowserDOMWindow(nullptr),
@@ -292,7 +310,6 @@ BrowserParent::BrowserParent(ContentParent* aManager, const TabId& aTabId,
       mUpdatedDimensions(false),
       mSizeMode(nsSizeMode_Normal),
       mCreatingWindow(false),
-      mVsyncParent(nullptr),
       mMarkedDestroying(false),
       mIsDestroyed(false),
       mRemoteTargetSetsCursor(false),
@@ -307,6 +324,10 @@ BrowserParent::BrowserParent(ContentParent* aManager, const TabId& aTabId,
       mShowingTooltip(false) {
   MOZ_ASSERT(aManager);
 
+  // We access `Manager()` when updating priorities later in this constructor,
+  // so need to initialize it before IPC does.
+  SetManager(aManager);
+
   RequestingAccessKeyEventData::OnBrowserParentCreated();
 
   // When the input event queue is disabled, we don't need to handle the case
@@ -383,6 +404,10 @@ TabId BrowserParent::GetTabIdFrom(nsIDocShell* docShell) {
   return TabId(0);
 }
 
+ContentParent* BrowserParent::Manager() const {
+  return static_cast<ContentParent*>(PBrowserParent::Manager());
+}
+
 void BrowserParent::AddBrowserParentToTable(layers::LayersId aLayersId,
                                             BrowserParent* aBrowserParent) {
   if (!sLayerToBrowserParentTable) {
@@ -1388,7 +1413,7 @@ IPCResult BrowserParent::RecvNewWindowGlobal(
     }
   }
 
-  if (!mManager->ValidatePrincipal(aInit.principal(), validationOptions)) {
+  if (!Manager()->ValidatePrincipal(aInit.principal(), validationOptions)) {
     ContentParent::LogAndAssertFailedPrincipalValidationInfo(aInit.principal(),
                                                              __func__);
   }
@@ -1401,21 +1426,19 @@ IPCResult BrowserParent::RecvNewWindowGlobal(
   return IPC_OK();
 }
 
-PVsyncParent* BrowserParent::AllocPVsyncParent() {
-  MOZ_ASSERT(!mVsyncParent);
-  mVsyncParent = new VsyncParent();
-  UpdateVsyncParentVsyncDispatcher();
-  return mVsyncParent.get();
+already_AddRefed<PVsyncParent> BrowserParent::AllocPVsyncParent() {
+  return MakeAndAddRef<VsyncParent>();
 }
 
-bool BrowserParent::DeallocPVsyncParent(PVsyncParent* aActor) {
-  MOZ_ASSERT(aActor);
-  mVsyncParent = nullptr;
-  return true;
+IPCResult BrowserParent::RecvPVsyncConstructor(PVsyncParent* aActor) {
+  UpdateVsyncParentVsyncDispatcher();
+  return IPC_OK();
 }
 
 void BrowserParent::UpdateVsyncParentVsyncDispatcher() {
-  if (!mVsyncParent) {
+  VsyncParent* actor = static_cast<VsyncParent*>(
+      LoneManagedOrNullAsserts(ManagedPVsyncParent()));
+  if (!actor) {
     return;
   }
 
@@ -1424,7 +1447,7 @@ void BrowserParent::UpdateVsyncParentVsyncDispatcher() {
     if (!vsyncDispatcher) {
       vsyncDispatcher = gfxPlatform::GetPlatform()->GetGlobalVsyncDispatcher();
     }
-    mVsyncParent->UpdateVsyncDispatcher(vsyncDispatcher);
+    actor->UpdateVsyncDispatcher(vsyncDispatcher);
   }
 }
 
@@ -2297,12 +2320,9 @@ mozilla::ipc::IPCResult BrowserParent::RecvAsyncMessage(
 }
 
 mozilla::ipc::IPCResult BrowserParent::RecvSetCursor(
-    const nsCursor& aCursor, const bool& aHasCustomCursor,
-    Maybe<BigBuffer>&& aCursorData, const uint32_t& aWidth,
-    const uint32_t& aHeight, const float& aResolutionX,
-    const float& aResolutionY, const uint32_t& aStride,
-    const gfx::SurfaceFormat& aFormat, const uint32_t& aHotspotX,
-    const uint32_t& aHotspotY, const bool& aForce) {
+    const nsCursor& aCursor, Maybe<IPCImage>&& aCustomCursor,
+    const float& aResolutionX, const float& aResolutionY,
+    const uint32_t& aHotspotX, const uint32_t& aHotspotY, const bool& aForce) {
   nsCOMPtr<nsIWidget> widget = GetWidget();
   if (!widget) {
     return IPC_OK();
@@ -2312,38 +2332,21 @@ mozilla::ipc::IPCResult BrowserParent::RecvSetCursor(
     widget->ClearCachedCursor();
   }
 
-  nsCOMPtr<imgIContainer> cursorImage;
-  if (aHasCustomCursor) {
-    const bool cursorDataValid = [&] {
-      if (!aCursorData) {
-        return false;
-      }
-      auto expectedSize = CheckedInt<uint32_t>(aHeight) * aStride;
-      if (!expectedSize.isValid() ||
-          expectedSize.value() != aCursorData->Size()) {
-        return false;
-      }
-      auto minStride =
-          CheckedInt<uint32_t>(aWidth) * gfx::BytesPerPixel(aFormat);
-      if (!minStride.isValid() || aStride < minStride.value()) {
-        return false;
-      }
-      return true;
-    }();
-    if (!cursorDataValid) {
+  nsCOMPtr<imgIContainer> customCursorImage;
+  if (aCustomCursor) {
+    RefPtr<gfx::DataSourceSurface> customCursorSurface =
+        nsContentUtils::IPCImageToSurface(*aCustomCursor);
+    if (!customCursorSurface) {
       return IPC_FAIL(this, "Invalid custom cursor data");
     }
-    const gfx::IntSize size(aWidth, aHeight);
-    RefPtr<gfx::DataSourceSurface> customCursor =
-        gfx::CreateDataSourceSurfaceFromData(size, aFormat, aCursorData->Data(),
-                                             aStride);
 
-    RefPtr<gfxDrawable> drawable = new gfxSurfaceDrawable(customCursor, size);
-    cursorImage = image::ImageOps::CreateFromDrawable(drawable);
+    RefPtr<gfxDrawable> drawable = new gfxSurfaceDrawable(
+        customCursorSurface, customCursorSurface->GetSize());
+    customCursorImage = image::ImageOps::CreateFromDrawable(drawable);
   }
 
   mCursor = nsIWidget::Cursor{aCursor,
-                              std::move(cursorImage),
+                              std::move(customCursorImage),
                               aHotspotX,
                               aHotspotY,
                               {aResolutionX, aResolutionY}};
@@ -3962,7 +3965,7 @@ mozilla::ipc::IPCResult BrowserParent::RecvQueryVisitedState(
   }
 
   auto* gvHistory = static_cast<GeckoViewHistory*>(history.get());
-  gvHistory->QueryVisitedState(widget, mManager, std::move(aURIs));
+  gvHistory->QueryVisitedState(widget, Manager(), std::move(aURIs));
   return IPC_OK();
 #else
   return IPC_FAIL(this, "QueryVisitedState is Android-only");