Bug 1107639 - Remove GC roots before the final GC r=terrence

js/src/gc/GCRuntime.h

@@ -277,6 +277,7 @@ class GCRuntime
   public:
     explicit GCRuntime(JSRuntime *rt);
     bool init(uint32_t maxbytes, uint32_t maxNurseryBytes);
+    void finishRoots();
     void finish();
 
     inline int zeal();

js/src/jsgc.cpp

@@ -1312,11 +1312,6 @@ GCRuntime::finish()
     FreeChunkPool(rt, availableChunks_);
     FreeChunkPool(rt, emptyChunks_);
 
-    if (rootsHash.initialized())
-        rootsHash.clear();
-
-    FinishPersistentRootedChains(rt);
-
     if (lock) {
         PR_DestroyLock(lock);
         lock = nullptr;
@@ -1345,6 +1340,15 @@ js::gc::FinishPersistentRootedChains(JSRuntime *rt)
     FinishPersistentRootedChain(rt->valuePersistentRooteds);
 }
 
+void
+GCRuntime::finishRoots()
+{
+    if (rootsHash.initialized())
+        rootsHash.clear();
+
+    FinishPersistentRootedChains(rt);
+}
+
 void
 GCRuntime::setParameter(JSGCParamKey key, uint32_t value)
 {

js/src/vm/Runtime.cpp

@@ -371,6 +371,9 @@ JSRuntime::~JSRuntime()
         /* Clear atoms to remove GC roots and heap allocations. */
         finishAtoms();
 
+        /* Remove persistent GC roots. */
+        gc.finishRoots();
+
         /*
          * Flag us as being destroyed. This allows the GC to free things like
          * interned atoms and Ion trampolines.