Add state stack tests with lost contexts

With the new asynchronous restoring of contexts, things can break
(ContextLostRestoredEventsEnabled)

Bug: 1042738
Change-Id: Ib8cbe8c5575527e02f2e7245246615ba9c902d1b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2003337
Commit-Queue: Aaron Krajeski <aaronhk@chromium.org>
Reviewed-by: Aaron Krajeski <aaronhk@chromium.org>
Reviewed-by: Fernando Serboncini <fserb@chromium.org>
Reviewed-by: Juanmi Huertas <juanmihd@chromium.org>
Cr-Commit-Position: refs/heads/master@{#733465}

third_party/blink/web_tests/fast/canvas/canvas-state-stack-lost-context.html

+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<canvas id='canvas' height='800'></canvas>
+<script>
+/*
+  Both these tests are refactored versions of fuzzer code that managed to
+lose the context and then create an invalid state stack by saving and drawing
+in a particular order. See:
+    crbug.com/1035224
+    crbug.com/982321
+*/
+
+async_test(t => {
+  var canvas = document.getElementById('canvas');
+  var ctx = canvas.getContext('2d');
+  // The height is too big, so context will be lost
+  canvas.setAttribute('height', 16777217);
+  // Perform any operation with the lost context
+  ctx.fillRect(0, 0, 10, 10);
+  // Changing size resets the canvas
+  canvas.setAttribute('height', 800);
+  // Encode the canvas to an image, causing it to save
+  ctx.createPattern(canvas, 'no-repeat');
+  ctx.save();
+  // Any context operation here. State stacks will be out of sync unless the
+  // context loss was handled gracefully.
+  ctx.fillRect(0, 0, 10, 10);
+
+  setTimeout(function() {
+    t.done();
+  });
+}, "Verify that creating a pattern on a lost context does not cause an invalid state stack. See crbug.com/982321");
+
+async_test(t => {
+  var canvas = document.createElement('canvas');
+  document.body.appendChild(canvas);
+  var ctx = canvas.getContext('2d');
+  // The height is too big, so context will be lost
+  canvas.setAttribute('height', 16777215);
+  // Perform any operation with the lost context
+  ctx.fillRect(0,0,10,10);
+  // Changing size resets the canvas
+  canvas.setAttribute('height', 800);
+  // Draw to it again
+  ctx.fillRect(0,0,10,10);
+  ctx.save();
+  // Text baseline code involves setting a modifiable state
+  ctx.textBaseline = 'top';
+
+  setTimeout(function() {
+    // Reset the canvas again on the next frame. This can cause an invalid stack
+    // unless the context loss was handled gracefully
+    canvas.setAttribute('width', 800);
+    t.done();
+  });
+}, "Verify that resetting and drawing to a canvas with a lost context does not cause an invalid state stack. See crbug.com/1035224");
+
+
+</script>