Fix canvas-related crash caused by bad object teardown sequence

third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp

Index: third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp
diff --git a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp
index e048949b7c0ed9e3165c1e5591e83629492bbbd8..9937fcc77390da8324eaf84188ad89358aa6c0ac 100644
--- a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp
@@ -84,6 +84,7 @@ protected:
 
     void createContext(OpacityMode);
     void TearDown();
+    void unrefCanvas();
 
 private:
     OwnPtr<DummyPageHolder> m_dummyPageHolder;
@@ -719,4 +720,26 @@ TEST_F(CanvasRenderingContext2DTest, GPUMemoryUpdateForAcceleratedCanvas)
     EXPECT_EQ(0, getGlobalGPUMemoryUsage());
 }
 
+TEST_F(CanvasRenderingContext2DTest, CanvasDisposedBeforeContext)
+{
+    createContext(NonOpaque);
+    context2d()->fillRect(0, 0, 1, 1); // results in task observer registration
+
+    context2d()->detachCanvas();
+
+    // This is the only method that is callable after detachCanvas
+    // Test passes by not crashing.
+    context2d()->didProcessTask();
+
+    // Test passes by not crashing during teardown
+}
+
+TEST_F(CanvasRenderingContext2DTest, ContextDisposedBeforeCanvas)
+{
+    createContext(NonOpaque);
+
+    canvasElement().detachContext();
+    // Passes by not crashing later during teardown
+}
+
 } // namespace blink