We mustn't finalize sweeping when V8 started collecting garbage.

third_party/WebKit/Source/bindings/core/v8/V8GCController.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 256 matching lines @@
         TRACE_EVENT_SET_SAMPLING_STATE("v8", "V8MajorGC");
     } else {
         objectGroupingForMajorGC(isolate, constructRetainedObjectInfos);
     }
 }
 
 }
 
 void V8GCController::gcPrologue(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    if (ThreadState::current())
-        ThreadState::current()->willStartV8GC();
-

[haraken, 2015/11/20 15:11:35]

Would you move this to after ScriptForbiddenScope::enter() and comment out the
code with:

// TODO(haraken): It is not safe to run finalizers in a prologue callback
because V8AbstractEventListener's destructor can call into V8. We should post a
task to schedule willStartV8GC() and avoid running it inside the prologue
callback.

     if (isMainThread()) {
         ScriptForbiddenScope::enter();
     }
 
     // TODO(haraken): It would be nice if the GC callbacks passed the Isolate
     // directly.
     v8::Isolate* isolate = v8::Isolate::GetCurrent();
     v8::HandleScope scope(isolate);
     switch (type) {
     case v8::kGCTypeScavenge:
@@ skipping 149 matching lines @@
     Visitor* m_visitor;
 };
 
 void V8GCController::traceDOMWrappers(v8::Isolate* isolate, Visitor* visitor)
 {
     DOMWrapperTracer tracer(visitor);
     v8::V8::VisitHandlesWithClassIds(isolate, &tracer);
 }
 
 } // namespace blink