Fix crash in Canvas2DLayerBridge when handling a GPU context loss

Source/platform/graphics/Canvas2DLayerBridge.cpp

Index: Source/platform/graphics/Canvas2DLayerBridge.cpp
diff --git a/Source/platform/graphics/Canvas2DLayerBridge.cpp b/Source/platform/graphics/Canvas2DLayerBridge.cpp
index e54518de3c4a8183ec47ce3359cb36f703f083da..713414b46b380c8e527cfb48e7d002226eefeaf0 100644
--- a/Source/platform/graphics/Canvas2DLayerBridge.cpp
+++ b/Source/platform/graphics/Canvas2DLayerBridge.cpp
@@ -323,12 +323,14 @@ bool Canvas2DLayerBridge::isValid()
     ASSERT(m_layer);
     if (m_destructionInProgress)
         return false;
-    if (m_contextProvider->context3d()->isContextLost() || !m_surfaceIsValid) {
+    if (!m_contextProvider || m_contextProvider->context3d()->isContextLost() || !m_surfaceIsValid) {
         // Attempt to recover.
         blink::WebGraphicsContext3D* sharedContext = 0;
-        m_layer->clearTexture();
+        // We must clear the mailboxes before calling m_layer->clearTexture() to prevent
+        // re-entry via mailboxReleased from operating on defunct GrContext objects.
         m_mailboxes.clear();
         m_releasedMailboxInfoIndex = InvalidMailboxIndex;
+        m_layer->clearTexture();
         m_contextProvider = adoptPtr(blink::Platform::current()->createSharedOffscreenGraphicsContext3DProvider());
         if (m_contextProvider)
             sharedContext = m_contextProvider->context3d();