Don't dispatch the extensions bindings unload event during GC.

chrome/renderer/extensions/event_bindings.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/event_bindings.h"
 
 #include "base/basictypes.h"
 #include "base/singleton.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/url_constants.h"
@@ skipping 104 matching lines @@
 void EventBindings::SetRenderThread(RenderThreadBase* thread) {
   render_thread = thread;
   in_unit_tests = true;
 }
 
 // static
 RenderThreadBase* EventBindings::GetRenderThread() {
   return render_thread ? render_thread : RenderThread::current();
 }
 
+static void DeferredUnload(v8::Persistent<v8::Context> context) {
+  v8::HandleScope handle_scope;
+  CallFunctionInContext(context, "dispatchOnUnload", 0, NULL);
+  context.Dispose();
+  context.Clear();
+}
+
 static void HandleContextDestroyed(ContextList::iterator context_iter,
-                                   bool callUnload) {
+                                   bool in_gc) {
   // Notify the bindings that they're going away.
-  if (callUnload) {
-    CallFunctionInContext((*context_iter)->context, "dispatchOnUnload", 0,
-                          NULL);
+  if (in_gc) {
+    // We shouldn't call back into javascript during a garbage collect.  Do it
+    // later.  We'll hang onto the context until this DeferredUnload is called.
+    MessageLoop::current()->PostTask(FROM_HERE, NewRunnableFunction(
+        DeferredUnload, (*context_iter)->context));
+  } else {
+    CallFunctionInContext((*context_iter)->context, "dispatchOnUnload",
+                          0, NULL);
   }
 
   // Remove all pending requests for this context.
   PendingRequestMap& pending_requests = GetPendingRequestMap();
   for (PendingRequestMap::iterator it = pending_requests.begin();
        it != pending_requests.end(); ) {
     PendingRequestMap::iterator current = it++;
     if (current->second->context == (*context_iter)->context) {
       current->second->context.Dispose();
       current->second->context.Clear();
       pending_requests.erase(current);
     }
   }
 
   // Unload any content script contexts for this frame.
   for (ContextList::iterator it = GetContexts().begin();
        it != GetContexts().end(); ) {
     ContextList::iterator current = it++;
     if ((*current)->parent_context == (*context_iter)->context)
-      HandleContextDestroyed(current, callUnload);
+      HandleContextDestroyed(current, in_gc);
   }
 
-  // Remove it from our registered contexts.
-  (*context_iter)->context.ClearWeak();
-  (*context_iter)->context.Dispose();
-  (*context_iter)->context.Clear();
-
   if (!(*context_iter)->parent_context.IsEmpty()) {
     (*context_iter)->parent_context.Dispose();
     (*context_iter)->parent_context.Clear();
   }
 
+  // Remove it from our registered contexts.
+  (*context_iter)->context.ClearWeak();
+  if (!in_gc) {
+    (*context_iter)->context.Dispose();
+    (*context_iter)->context.Clear();
+  }
+
   GetContexts().erase(context_iter);
 }
 
 static void ContextWeakReferenceCallback(v8::Persistent<v8::Value> context,
                                          void*) {
   for (ContextList::iterator it = GetContexts().begin();
        it != GetContexts().end(); ++it) {
     if ((*it)->context == context) {
-      HandleContextDestroyed(it, false);
+      HandleContextDestroyed(it, true);
       return;
     }
   }
 
   NOTREACHED();
 }
 
 void EventBindings::HandleContextCreated(WebFrame* frame, bool content_script) {
   if (!bindings_registered)
     return;
@@ skipping 55 matching lines @@
 void EventBindings::HandleContextDestroyed(WebFrame* frame) {
   if (!bindings_registered)
     return;
 
   v8::HandleScope handle_scope;
   v8::Local<v8::Context> context = frame->GetScriptContext();
   DCHECK(!context.IsEmpty());
 
   ContextList::iterator context_iter = bindings_utils::FindContext(context);
   if (context_iter != GetContexts().end())
-    ::HandleContextDestroyed(context_iter, true);
+    ::HandleContextDestroyed(context_iter, false);
 }
 
 // static
 void EventBindings::CallFunction(const std::string& function_name,
                                  int argc, v8::Handle<v8::Value>* argv,
                                  RenderView* render_view) {
   for (ContextList::iterator it = GetContexts().begin();
        it != GetContexts().end(); ++it) {
     if (render_view && render_view != (*it)->render_view)
       continue;
     CallFunctionInContext((*it)->context, function_name, argc, argv);
   }
 }