From 04da9aa4edb363c5a2941ad3e33e3d54aaec3247 Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Wed, 13 Jan 2016 11:37:57 +1300
Subject: [PATCH] Bug 1200514 - Run remaining stable state runnables after
 final cycle collection. r=froydnj,mccr8

---
 xpcom/base/CycleCollectedJSRuntime.h | 2 ++
 xpcom/base/nsCycleCollector.cpp      | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/xpcom/base/CycleCollectedJSRuntime.h b/xpcom/base/CycleCollectedJSRuntime.h
index 7937d935cff..4d306f4a282 100644
--- a/xpcom/base/CycleCollectedJSRuntime.h
+++ b/xpcom/base/CycleCollectedJSRuntime.h
@@ -215,7 +215,9 @@ private:
   void TraceNativeGrayRoots(JSTracer* aTracer);
 
   void AfterProcessMicrotask(uint32_t aRecursionDepth);
+public:
   void ProcessStableStateQueue();
+private:
   void ProcessMetastableStateQueue(uint32_t aRecursionDepth);
 
 public:
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index 82e0b412b31..374e5daaab9 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -4166,6 +4166,11 @@ nsCycleCollector_shutdown()
 
     data->mCollector->Shutdown();
     data->mCollector = nullptr;
+    if (data->mRuntime) {
+      // Run any remaining tasks that may have been enqueued via
+      // RunInStableState during the final cycle collection.
+      data->mRuntime->ProcessStableStateQueue();
+    }
     if (!data->mRuntime) {
       delete data;
       sCollectorData.set(nullptr);