Oilpan: Fix worker thread termination finalization order issues.

Source/core/workers/WorkerThread.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 127 matching lines @@
     // The below assignment will destroy the context, which will in turn notify messaging proxy.
     // We cannot let any objects survive past thread exit, because no other thread will run GC or otherwise destroy them.
     // If Oilpan is enabled, we detach of the context/global scope, with the final heap cleanup below sweeping it out.
 #if ENABLE(OILPAN)
     m_workerGlobalScope->dispose();
 #else
     ASSERT(m_workerGlobalScope->hasOneRef());
 #endif
     m_workerGlobalScope = nullptr;
 
+    // Detach the ThreadState, cleaning out the thread's heap by
+    // performing a final GC. The cleanup operation will at the end
+    // assert that the heap is empty, as any surviving objects will
+    // otherwise leak and never be destructed. It is important to

[Vyacheslav Egorov (Google), 2014/03/18 14:17:46]

This comment is a bit confusing. 

It is correct that objects will not be destructed but they will be flushed down
the drain instead as underlying heap will be destroyed. So heap allocated
objects themselves will not leak, instead we are in danger of having dangling
pointers to them. That is the motivation for the assert.

It is also true that off-heap objects owned by heap objects will leak if heap
objects will not be finalized, and those potentially will leak. But dangling
pointers are a bigger danger here.

[Mads Ager (chromium), 2014/03/18 14:23:54]

Yes, thanks Slava. Updated the comment.

+    // detach while the thread is still valid. In particular,
+    // finalizers for objects in the heap for this thread will need to
+    // access thread local data.
     ThreadState::detach();
 
+    // Notify the proxy that the WorkerGlobalScope has been disposed of.
+    // This can free this thread object, hence it must not be touched afterwards.
+    workerReportingProxy().workerGlobalScopeDestroyed();
+
     // Clean up PlatformThreadData before WTF::WTFThreadData goes away!
     PlatformThreadData::current().destroy();
 
     // The thread object may be already destroyed from notification now, don't try to access "this".
     detachThread(threadID);
 }
 
 void WorkerThread::runEventLoop()
 {
     // Does not return until terminated.
@@ skipping 77 matching lines @@
 void WorkerThread::releaseFastMallocFreeMemoryInAllThreads()
 {
     MutexLocker lock(threadSetMutex());
     HashSet<WorkerThread*>& threads = workerThreads();
     HashSet<WorkerThread*>::iterator end = threads.end();
     for (HashSet<WorkerThread*>::iterator it = threads.begin(); it != end; ++it)
         (*it)->runLoop().postTask(adoptPtr(new ReleaseFastMallocFreeMemoryTask));
 }
 
 } // namespace WebCore