Fix for race condition in 2D canvas teardown
Fix for race condition in 2D canvas teardown

We currently sometimes have Canvas2DLayerBridge objects referenced by
the Canvas2DLayerManager even though they are slated for destruction.
There is a race condition with the rate limiting mechanism that can
cause limitPendingFrames() to be called on a defunct layer bridge,
which may or may not cause a crash.

This change fixes the bug by ensuring that all transient resources are
properly freed when a canvas layer has its destruction in progress.
The added ASSERTs serve as regression tests for this issue when running
layout tests with accelerated 2D canvases.

BUG=344666
TEST=virtual/gpu/fast/canvas Layout tests

Review URL: https://codereview.chromium.org/216473007

git-svn-id: bf5cd6ccde378db821296732a091cfbcf5285fbd@170346 bbb929c8-8fbe-4397-9dbb-9b2b20218538

primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs