Change Canvas2DLayerBridge to stay alive until last mailbox is returned.

Source/core/platform/graphics/ImageBuffer.h

 /*
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 128 matching lines @@
     friend class GraphicsContext;
     friend class GeneratedImage;
     friend class CrossfadeGeneratedImage;
     friend class GeneratorGeneratedImage;
 
     IntSize m_size;
     IntSize m_logicalSize;
     float m_resolutionScale;
     OwnPtr<SkCanvas> m_canvas;
     OwnPtr<GraphicsContext> m_context;
-    OwnPtr<Canvas2DLayerBridge> m_layerBridge;
+    RefPtr<Canvas2DLayerBridge> m_layerBridge;
 
     // This constructor will place its success into the given out-variable
     // so that create() knows when it should return failure.
     ImageBuffer(const IntSize&, float resolutionScale, RenderingMode, OpacityMode, bool& success);
     ImageBuffer(const IntSize&, float resolutionScale, const GraphicsContext*, bool hasAlpha, bool& success);
 };
 
 String ImageDataToDataURL(const ImageData&, const String& mimeType, const double* quality);
 
 } // namespace WebCore
 
 #endif // ImageBuffer_h