Sweep property tree after finalizing objects, which may have watchpoints pointing to tree nodes (361451, r=mrbkap).

js/src/jsgc.c

@@ -2973,7 +2973,6 @@ restart:
      * rather than nest badly and leave the unmarked newborn to be swept.
      */
     js_SweepAtomState(&rt->atomState);
-    js_SweepScopeProperties(rt);
 
     /*
      * Finalize smaller objects before larger, to guarantee finalization of
@@ -3020,6 +3019,12 @@ restart:
         }
     }
 
+    /*
+     * Sweep the runtime's property tree after finalizing objects, in case any
+     * had watchpoints referencing tree nodes.
+     */
+    js_SweepScopeProperties(rt);
+
     /*
      * Sweep script filenames after sweeping functions in the generic loop
      * above. In this way when scripted function's finalizer destroys script