Fix data race problem in createImageBitmap(Blob)

third_party/WebKit/LayoutTests/virtual/threaded/fast/canvas-toBlob/canvas-createImageBitmap-blob-in-workers.html

Index: third_party/WebKit/LayoutTests/virtual/threaded/fast/canvas-toBlob/canvas-createImageBitmap-blob-in-workers.html
diff --git a/third_party/WebKit/LayoutTests/virtual/threaded/fast/canvas-toBlob/canvas-createImageBitmap-blob-in-workers.html b/third_party/WebKit/LayoutTests/virtual/threaded/fast/canvas-toBlob/canvas-createImageBitmap-blob-in-workers.html
index 228e9e43be85bdf4a20b5ad8ef20951f0ef9e868..c4156ea221ae016ec9814fad7bb0c24406d9f5e2 100644
--- a/third_party/WebKit/LayoutTests/virtual/threaded/fast/canvas-toBlob/canvas-createImageBitmap-blob-in-workers.html
+++ b/third_party/WebKit/LayoutTests/virtual/threaded/fast/canvas-toBlob/canvas-createImageBitmap-blob-in-workers.html
@@ -64,13 +64,17 @@ newImg.onload = function() {
 
 canvas1.toBlob(function(blob) {
     worker.postMessage(blob);
+    var setImgSrc = false;
     for (var i = 0; i < numOfBitmaps; i++) {
         createImageBitmap(blob).then(imageBitmap => {
             bitmapArray.push(imageBitmap);
+            if (i >= numOfBitmaps - 1 && setImgSrc == false) {
+                var url = URL.createObjectURL(blob);
+                newImg.src = url;
+                setImgSrc = true;
+            }
         });
     }
-    url = URL.createObjectURL(blob);
-    newImg.src = url;
 });
 
 </script>