1 files changed, 37 insertions, 5 deletions
diff --git a/Source/JavaScriptCore/heap/HeapTimer.cpp b/Source/JavaScriptCore/heap/HeapTimer.cpp
index b4d928a34..ae66f9e26 100644
--- a/Source/JavaScriptCore/heap/HeapTimer.cpp
+++ b/Source/JavaScriptCore/heap/HeapTimer.cpp
@@ -26,6 +26,10 @@
 #include "config.h"
 #include "HeapTimer.h"
 
+#include "APIShims.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "ScopeChain.h"
 #include <wtf/Threading.h>
 
 namespace JSC {
@@ -46,7 +50,8 @@ HeapTimer::HeapTimer(JSGlobalData* globalData, CFRunLoopRef runLoop)
 
 HeapTimer::~HeapTimer()
 {
-    invalidate();
+    CFRunLoopRemoveTimer(m_runLoop.get(), m_timer.get(), kCFRunLoopCommonModes);
+    CFRunLoopTimerInvalidate(m_timer.get());
 }
 
 void HeapTimer::synchronize()
@@ -60,14 +65,37 @@ void HeapTimer::synchronize()
 
 void HeapTimer::invalidate()
 {
-    CFRunLoopRemoveTimer(m_runLoop.get(), m_timer.get(), kCFRunLoopCommonModes);
-    CFRunLoopTimerInvalidate(m_timer.get());
+    m_globalData = 0;
+    CFRunLoopTimerSetNextFireDate(m_timer.get(), CFAbsoluteTimeGetCurrent() - s_decade);
+}
+
+void HeapTimer::didStartVMShutdown()
+{
+    if (CFRunLoopGetCurrent() == m_runLoop.get()) {
+        invalidate();
+        delete this;
+        return;
+    }
+    ASSERT(!m_globalData->apiLock().currentThreadIsHoldingLock());
+    MutexLocker locker(m_shutdownMutex);
+    invalidate();
 }
 
 void HeapTimer::timerDidFire(CFRunLoopTimerRef, void* info)
 {
     HeapTimer* agent = static_cast<HeapTimer*>(info);
-    agent->doWork();
+    agent->m_shutdownMutex.lock();
+    if (!agent->m_globalData) {
+        agent->m_shutdownMutex.unlock();
+        delete agent;
+        return;
+    }
+    {
+        // We don't ref here to prevent us from resurrecting the ref count of a "dead" JSGlobalData.
+        APIEntryShim shim(agent->m_globalData, APIEntryShimWithoutLock::DontRefGlobalData);
+        agent->doWork();
+    }
+    agent->m_shutdownMutex.unlock();
 }
 
 #else
@@ -81,6 +109,11 @@ HeapTimer::~HeapTimer()
 {
 }
 
+void HeapTimer::didStartVMShutdown()
+{
+    delete this;
+}
+
 void HeapTimer::synchronize()
 {
 }
@@ -89,7 +122,6 @@ void HeapTimer::invalidate()
 {
 }
 
-
 #endif