Fix canvas-related crash caused by bad object teardown sequence

third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp

Index: third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
index fc9536545f53274c6cdfb7cb46af643c6a3aece5..623ebf4717011ecee19cb7f533840888c5c0a321 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
@@ -37,6 +37,18 @@ CanvasRenderingContext::CanvasRenderingContext(HTMLCanvasElement* canvas, Offscr
 {
 }
 
+void CanvasRenderingContext::dispose()
+{
+    // HTMLCanvasElement and CanvasRenderingContext have a circular reference.
+    // When the pair is no longer reachable, their destruction order is non-
+    // deterministic, so the first of the two to be destroyed needs to notify
+    // the other in order to break the circular reference.  This is to avoid
+    // an error when CanvasRenderingContext2D::didProcessTask() is invoked
+    // after the HTMLCanvasElement is destroyed.
+    if (canvas())
+        canvas()->detachContext();

[xlai (Olivia), 2016/06/10 19:28:17]

Same as above comment. Maybe add one more line here to clean up reference to
canvas?

[Justin Novosad, 2016/06/10 19:39:09]

Done.

+}
+
 CanvasRenderingContext::ContextType CanvasRenderingContext::contextTypeFromId(const String& id)
 {
     if (id == "2d")
@@ -72,7 +84,7 @@ bool CanvasRenderingContext::wouldTaintOrigin(CanvasImageSource* imageSource, Se
             return true;
     }
 
-    ASSERT(!canvas() == !!destinationSecurityOrigin); // Must have one or the other
+    DCHECK_EQ(!canvas(), !!destinationSecurityOrigin); // Must have one or the other
     bool taintOrigin = imageSource->wouldTaintOrigin(destinationSecurityOrigin ? destinationSecurityOrigin : canvas()->getSecurityOrigin());
 
     if (hasURL) {