See e.g. <http://build.webkit.org/results/trunk-mac-intel-debug/5945/DumpRenderTree2-leaks.txt>. I have a fix, patch forthcoming.
Created attachment 27260 [details] proposed fix The issue turned out to be much simpler than I thought.
Interesting. Looks good to me (but I'm not a reviewer so it doesn't matter). The key thing to note is that workerContextDestroyedInternal may get called due to a posted task before the worker object is destroyed. Then when the worker object is destroyed later, it should call workerContextDestroyedInternal(); to do the final clean up. One issue the comment in WorkerMessagingProxy::workerObjectDestroyed() workerContextDestroyedInternal(); // It never existed, just do our cleanup. isn't really accurate anymore. Really, the worker thread no longer exists at this point.
Comment on attachment 27260 [details] proposed fix r=me
Committed revision 40523. I've removed the obsolete comment - thanks Dave!