Oilpan: Fix worker thread termination finalization order issues.

Source/core/workers/WorkerThread.cpp

Index: Source/core/workers/WorkerThread.cpp
diff --git a/Source/core/workers/WorkerThread.cpp b/Source/core/workers/WorkerThread.cpp
index c60511544ab3c579e55ce404dcde5ef77705a1b8..0d686a4e4849831b1d801d8181e7da1def40de0e 100644
--- a/Source/core/workers/WorkerThread.cpp
+++ b/Source/core/workers/WorkerThread.cpp
@@ -145,8 +145,19 @@ void WorkerThread::workerThread()
 #endif
     m_workerGlobalScope = nullptr;
 
+    // Detach the ThreadState, cleaning out the thread's heap by
+    // performing a final GC. The cleanup operation will at the end
+    // assert that the heap is empty, as any surviving objects will
+    // otherwise leak and never be destructed. It is important to

[Vyacheslav Egorov (Google), 2014/03/18 14:17:46]

This comment is a bit confusing. 

It is correct that objects will not be destructed but they will be flushed down
the drain instead as underlying heap will be destroyed. So heap allocated
objects themselves will not leak, instead we are in danger of having dangling
pointers to them. That is the motivation for the assert.

It is also true that off-heap objects owned by heap objects will leak if heap
objects will not be finalized, and those potentially will leak. But dangling
pointers are a bigger danger here.

[Mads Ager (chromium), 2014/03/18 14:23:54]

Yes, thanks Slava. Updated the comment.

+    // detach while the thread is still valid. In particular,
+    // finalizers for objects in the heap for this thread will need to
+    // access thread local data.
     ThreadState::detach();
 
+    // Notify the proxy that the WorkerGlobalScope has been disposed of.
+    // This can free this thread object, hence it must not be touched afterwards.
+    workerReportingProxy().workerGlobalScopeDestroyed();
+
     // Clean up PlatformThreadData before WTF::WTFThreadData goes away!
     PlatformThreadData::current().destroy();