Oilpan: Fix worker thread termination finalization order issues.

Source/core/workers/WorkerThread.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 127 matching lines @@
     // The below assignment will destroy the context, which will in turn notify messaging proxy.
     // We cannot let any objects survive past thread exit, because no other thread will run GC or otherwise destroy them.
     // If Oilpan is enabled, we detach of the context/global scope, with the final heap cleanup below sweeping it out.
 #if ENABLE(OILPAN)
     m_workerGlobalScope->dispose();
 #else
     ASSERT(m_workerGlobalScope->hasOneRef());
 #endif
     m_workerGlobalScope = nullptr;
 
+    // Detach the ThreadState, cleaning out the thread's heap by
+    // performing a final GC. The cleanup operation will at the end
+    // assert that the heap is empty. If the heap does not become
+    // empty, there are still pointers into the heap and those
+    // pointers will be dangling after thread termination because we
+    // are destroying the heap. It is important to detach while the
+    // thread is still valid. In particular, finalizers for objects in
+    // the heap for this thread will need to access thread local data.
     ThreadState::detach();
 
+    // Notify the proxy that the WorkerGlobalScope has been disposed of.
+    // This can free this thread object, hence it must not be touched afterwards.
+    workerReportingProxy().workerGlobalScopeDestroyed();
+
     // Clean up PlatformThreadData before WTF::WTFThreadData goes away!
     PlatformThreadData::current().destroy();
 
     // The thread object may be already destroyed from notification now, don't try to access "this".
     detachThread(threadID);
 }
 
 void WorkerThread::runEventLoop()
 {
     // Does not return until terminated.
@@ skipping 77 matching lines @@
 void WorkerThread::releaseFastMallocFreeMemoryInAllThreads()
 {
     MutexLocker lock(threadSetMutex());
     HashSet<WorkerThread*>& threads = workerThreads();
     HashSet<WorkerThread*>::iterator end = threads.end();
     for (HashSet<WorkerThread*>::iterator it = threads.begin(); it != end; ++it)
         (*it)->runLoop().postTask(adoptPtr(new ReleaseFastMallocFreeMemoryTask));
 }
 
 } // namespace WebCore