Fix crash caused by Canvas2DLayerBridge::mailboxReleased

Source/platform/graphics/Canvas2DLayerBridge.cpp

Index: Source/platform/graphics/Canvas2DLayerBridge.cpp
diff --git a/Source/platform/graphics/Canvas2DLayerBridge.cpp b/Source/platform/graphics/Canvas2DLayerBridge.cpp
index 68f174a32501db9df047b0fb9adf65509b8f3f25..2364924b5e035ec1731b2fd82e4dbf0ca8f89266 100644
--- a/Source/platform/graphics/Canvas2DLayerBridge.cpp
+++ b/Source/platform/graphics/Canvas2DLayerBridge.cpp
@@ -516,6 +516,9 @@ void Canvas2DLayerBridge::mailboxReleased(const blink::WebExternalTextureMailbox
                 size_t i = mailboxInfo - m_mailboxes.begin();
                 m_mailboxes.remove(i);
                 Canvas2DLayerManager::get().layerTransientResourceAllocationChanged(this);
+                // Here we need to return early since mailboxInfo removal would
+                // also clear m_parentLayerBridge reference.
+                return;
             } else {
                 mailboxInfo->m_status = MailboxReleased;
                 m_releasedMailboxInfoIndex = mailboxInfo - m_mailboxes.begin();