We mustn't finalize sweeping when V8 started collecting garbage.

third_party/WebKit/Source/bindings/core/v8/V8GCController.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 256 matching lines @@
         TRACE_EVENT_SET_SAMPLING_STATE("v8", "V8MajorGC");
     } else {
         objectGroupingForMajorGC(isolate, constructRetainedObjectInfos);
     }
 }
 
 }
 
 void V8GCController::gcPrologue(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    if (ThreadState::current())
-        ThreadState::current()->willStartV8GC();
-
     if (isMainThread()) {
         ScriptForbiddenScope::enter();
     }
 
+    // TODO(haraken): It is not safe to run finalizers in a prologue callback
+    // because V8AbstractEventListener's destructor cann call into V8. We
+    // should post a task to schedule willStartV8GC() and avoid running it
+    // inside the prologue callback.
+    // if (ThreadState::current())
+    //     ThreadState::current()->willStartV8GC();
+
     // TODO(haraken): It would be nice if the GC callbacks passed the Isolate
     // directly.
     v8::Isolate* isolate = v8::Isolate::GetCurrent();
     v8::HandleScope scope(isolate);
     switch (type) {
     case v8::kGCTypeScavenge:
         TRACE_EVENT_BEGIN1("devtools.timeline,v8", "MinorGC", "usedHeapSizeBefore", usedHeapSize(isolate));
         if (isMainThread()) {
             TRACE_EVENT_SCOPED_SAMPLING_STATE("blink", "DOMMinorGC");
         }
@@ skipping 145 matching lines @@
     Visitor* m_visitor;
 };
 
 void V8GCController::traceDOMWrappers(v8::Isolate* isolate, Visitor* visitor)
 {
     DOMWrapperTracer tracer(visitor);
     v8::V8::VisitHandlesWithClassIds(isolate, &tracer);
 }
 
 } // namespace blink