Fix canvas-related crash caused by bad object teardown sequence

third_party/WebKit/Source/core/html/HTMLCanvasElement.h

Index: third_party/WebKit/Source/core/html/HTMLCanvasElement.h
diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.h b/third_party/WebKit/Source/core/html/HTMLCanvasElement.h
index 1c72248b08640e274dd43730b87f6a8ede270bc6..cb6c241b8d0d1538f285fc9abca3f19a0fd69528 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.h
@@ -70,6 +70,7 @@ typedef CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextO
 class CORE_EXPORT HTMLCanvasElement final : public HTMLElement, public ContextLifecycleObserver, public PageLifecycleObserver, public CanvasImageSource, public ImageBufferClient, public ImageBitmapSource {
     DEFINE_WRAPPERTYPEINFO();
     USING_GARBAGE_COLLECTED_MIXIN(HTMLCanvasElement);
+    USING_PRE_FINALIZER(HTMLCanvasElement, dispose);
 public:
     using Node::getExecutionContext;
 
@@ -202,11 +203,14 @@ public:
     CanvasSurfaceLayerBridge* surfaceLayerBridge() const { return m_surfaceLayerBridge.get(); }
     void createSurfaceLayerBridge();
 
+    void detachContext() { m_context = nullptr; }
+
 protected:
     void didMoveToNewDocument(Document& oldDocument) override;
 
 private:
     explicit HTMLCanvasElement(Document&);
+    void dispose();
 
     using ContextFactoryVector = Vector<OwnPtr<CanvasRenderingContextFactory>>;
     static ContextFactoryVector& renderingContextFactories();