Oilpan: Fix worker thread termination use-after-free found by the asan build.

Source/core/workers/WorkerThread.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 121 matching lines @@
     script->evaluate(ScriptSourceCode(sourceCode, scriptURL));
 
     runEventLoop();
 
     ThreadIdentifier threadID = m_threadID;
 
     // The below assignment will destroy the context, which will in turn notify messaging proxy.
     // We cannot let any objects survive past thread exit, because no other thread will run GC or otherwise destroy them.
     // If Oilpan is enabled, we detach of the context/global scope, with the final heap cleanup below sweeping it out.
 #if ENABLE(OILPAN)
-    m_workerGlobalScope->dispose();
+    // The thread object is owned by the main thread. After the call
+    // to dispose, the thread object can therefore be dead and the
+    // Persistent handle for m_workerGlobalScope has been deleted.
+    // Therefore, we clear the m_workerGlobalScope persistent handle
+    // before the call to dispose.
+    WorkerGlobalScope* scope = m_workerGlobalScope;
+    m_workerGlobalScope = nullptr;
+    scope->dispose();
 #else
     ASSERT(m_workerGlobalScope->hasOneRef());
+    m_workerGlobalScope = nullptr;
 #endif
-    m_workerGlobalScope = nullptr;
 
     ThreadState::detach();
 
     // Clean up PlatformThreadData before WTF::WTFThreadData goes away!
     PlatformThreadData::current().destroy();
 
     // The thread object may be already destroyed from notification now, don't try to access "this".
     detachThread(threadID);
 }
 
@@ skipping 80 matching lines @@
 void WorkerThread::releaseFastMallocFreeMemoryInAllThreads()
 {
     MutexLocker lock(threadSetMutex());
     HashSet<WorkerThread*>& threads = workerThreads();
     HashSet<WorkerThread*>::iterator end = threads.end();
     for (HashSet<WorkerThread*>::iterator it = threads.begin(); it != end; ++it)
         (*it)->runLoop().postTask(adoptPtr(new ReleaseFastMallocFreeMemoryTask));
 }
 
 } // namespace WebCore