Bug 1241841 - Clear the worker's debugger event queue before destroying its context;r=khuey

dom/workers/RuntimeService.cpp

@@ -2676,6 +2676,13 @@ WorkerThreadPrimaryRunnable::Run()
 #endif
     }
 
+    // There may still be runnables on the debugger event queue that hold a
+    // strong reference to the debugger global scope. These runnables are not
+    // visible to the cycle collector, so we need to make sure to clear the
+    // debugger event queue before we try to destroy the context. If we don't,
+    // the garbage collector will crash.
+    mWorkerPrivate->ClearDebuggerEventQueue();
+
     // Destroy the main context. This will unroot the main worker global and GC,
     // which should break all cycles that touch JS.
     JS_DestroyContext(cx);

dom/workers/WorkerPrivate.cpp

@@ -5020,6 +5020,17 @@ WorkerPrivate::ClearMainEventQueue(WorkerRanOrNot aRanOrNot)
   mCancelAllPendingRunnables = false;
 }
 
+void
+WorkerPrivate::ClearDebuggerEventQueue()
+{
+  while (!mDebuggerQueue.IsEmpty()) {
+    WorkerRunnable* runnable;
+    mDebuggerQueue.Pop(runnable);
+    // It should be ok to simply release the runnable, without running it.
+    runnable->Release();
+  }
+}
+
 uint32_t
 WorkerPrivate::RemainingRunTimeMS() const
 {

dom/workers/WorkerPrivate.h

@@ -1298,6 +1298,9 @@ public:
   void
   ClearMainEventQueue(WorkerRanOrNot aRanOrNot);
 
+  void
+  ClearDebuggerEventQueue();
+
   void
   OnProcessNextEvent();