Fix crash caused by Canvas2DLayerBridge::mailboxReleased

Source/platform/graphics/Canvas2DLayerBridge.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 498 matching lines @@
                 // in future.
                 if (mailboxInfo->m_image) {
                     mailboxInfo->m_image->getTexture()->resetFlag(
                         static_cast<GrTextureFlags>(GrTexture::kReturnToCache_FlagBit));
                     mailboxInfo->m_image->getTexture()->textureParamsModified();
                     mailboxInfo->m_image.clear();
                 }
                 size_t i = mailboxInfo - m_mailboxes.begin();
                 m_mailboxes.remove(i);
                 Canvas2DLayerManager::get().layerTransientResourceAllocationChanged(this);
+                // Here we need to return early since mailboxInfo removal would
+                // also clear m_parentLayerBridge reference.
+                return;
             } else {
                 mailboxInfo->m_status = MailboxReleased;
                 m_releasedMailboxInfoIndex = mailboxInfo - m_mailboxes.begin();
                 m_framesSinceMailboxRelease = 0;
                 if (isHidden()) {
                     freeReleasedMailbox();
                 } else {
                     ASSERT(!m_destructionInProgress);
                     Canvas2DLayerManager::get().layerTransientResourceAllocationChanged(this);
                 }
@@ skipping 38 matching lines @@
 Canvas2DLayerBridge::MailboxInfo::MailboxInfo(const MailboxInfo& other) {
     // This copy constructor should only be used for Vector reallocation
     // Assuming 'other' is to be destroyed, we transfer m_image ownership
     // rather than do a refcount dance.
     memcpy(&m_mailbox, &other.m_mailbox, sizeof(m_mailbox));
     m_image = const_cast<MailboxInfo*>(&other)->m_image.release();
     m_status = other.m_status;
 }
 
 }