Fix canvas-related crash caused by bad object teardown sequence

third_party/WebKit/Source/core/html/HTMLCanvasElement.h

 /*
  * Copyright (C) 2004, 2006, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 52 matching lines @@
 class ImageBufferSurface;
 class ImageData;
 class IntSize;
 
 class CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContext;
 typedef CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContext RenderingContext;
 
 class CORE_EXPORT HTMLCanvasElement final : public HTMLElement, public ContextLifecycleObserver, public PageLifecycleObserver, public CanvasImageSource, public ImageBufferClient, public ImageBitmapSource {
     DEFINE_WRAPPERTYPEINFO();
     USING_GARBAGE_COLLECTED_MIXIN(HTMLCanvasElement);
+    USING_PRE_FINALIZER(HTMLCanvasElement, dispose);
 public:
     using Node::getExecutionContext;
 
     DECLARE_NODE_FACTORY(HTMLCanvasElement);
     ~HTMLCanvasElement() override;
 
     // Attributes and functions exposed to script
     int width() const { return size().width(); }
     int height() const { return size().height(); }
 
@@ skipping 112 matching lines @@
 
     // For Canvas HitRegions
     bool isSupportedInteractiveCanvasFallback(const Element&);
     std::pair<Element*, String> getControlAndIdIfHitRegionExists(const LayoutPoint&);
     String getIdFromControl(const Element*);
 
     // For OffscreenCanvas that controls this html canvas element
     CanvasSurfaceLayerBridge* surfaceLayerBridge() const { return m_surfaceLayerBridge.get(); }
     void createSurfaceLayerBridge();
 
+    void detachContext() { m_context = nullptr; }
+
 protected:
     void didMoveToNewDocument(Document& oldDocument) override;
 
 private:
     explicit HTMLCanvasElement(Document&);
+    void dispose();
 
     using ContextFactoryVector = Vector<OwnPtr<CanvasRenderingContextFactory>>;
     static ContextFactoryVector& renderingContextFactories();
     static CanvasRenderingContextFactory* getRenderingContextFactory(int);
 
     void parseAttribute(const QualifiedName&, const AtomicString&, const AtomicString&) override;
     LayoutObject* createLayoutObject(const ComputedStyle&) override;
     bool areAuthorShadowsAllowed() const override { return false; }
 
     void reset();
@@ skipping 32 matching lines @@
 
     mutable RefPtr<Image> m_copiedImage; // FIXME: This is temporary for platforms that have to copy the image buffer to render (and for CSSCanvasValue).
 
     // Used for OffscreenCanvas that controls this HTML canvas element
     OwnPtr<CanvasSurfaceLayerBridge> m_surfaceLayerBridge;
 };
 
 } // namespace blink
 
 #endif // HTMLCanvasElement_h