Fixing crash during 2D canvas destruction

Source/platform/graphics/Canvas2DLayerBridge.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 102 matching lines @@
     m_canvas->setNotificationClient(this);
 #ifndef NDEBUG
     canvas2DLayerBridgeInstanceCounter.increment();
 #endif
 }
 
 Canvas2DLayerBridge::~Canvas2DLayerBridge()
 {
     ASSERT(m_destructionInProgress);
     ASSERT(!Canvas2DLayerManager::get().isInList(this));
+    if (m_canvas)
+        m_canvas->setNotificationClient(nullptr);
     m_layer.clear();
     ASSERT(m_mailboxes.size() == 0);
 #ifndef NDEBUG
     canvas2DLayerBridgeInstanceCounter.decrement();
 #endif
 }
 
 void Canvas2DLayerBridge::beginDestruction()
 {
     ASSERT(!m_destructionInProgress);
     setRateLimitingEnabled(false);
     m_canvas->silentFlush();
     m_imageBuffer = 0;
     freeTransientResources();
     setIsHidden(true);
     m_destructionInProgress = true;
     GraphicsLayer::unregisterContentsLayer(m_layer->layer());
     m_canvas->setNotificationClient(0);

[dshwang, 2015/02/04 13:32:06]

The patch demonstrates that the destructor is called without beginDestruction().
It looks like the root bug still exist. 

     m_surface.clear();
     m_canvas.clear();
     m_layer->clearTexture();
     // Orphaning the layer is required to trigger the recration of a new layer
     // in the case where destruction is caused by a canvas resize. Test:
     // virtual/gpu/fast/canvas/canvas-resize-after-paint-without-layout.html
     m_layer->layer()->removeFromParent();
     // To anyone who ever hits this assert: Please update crbug.com/344666
     // with repro steps.
     ASSERT(!m_bytesAllocated);
@@ skipping 380 matching lines @@
 Canvas2DLayerBridge::MailboxInfo::MailboxInfo(const MailboxInfo& other) {
     // This copy constructor should only be used for Deque::prepend
     // Assuming 'other' is to be destroyed, we transfer m_image and
     // m_parentLayerBridge ownership rather than do a refcount dance.
     memcpy(&m_mailbox, &other.m_mailbox, sizeof(m_mailbox));
     m_image = const_cast<MailboxInfo*>(&other)->m_image.release();
     m_parentLayerBridge = const_cast<MailboxInfo*>(&other)->m_parentLayerBridge.release();
 }
 
 } // namespace blink