Retain ref on passed in image data to avoid GC.

We were using the data in the buffer without retaining a ref, so
it could be destroyed while we were using it.

R=sandersd

Bug: 1073995
Change-Id: I7e625103c3e881a47baa6e85499a1bc904efd7f0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2168822
Auto-Submit: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Dan Sanders <sandersd@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#763436}

third_party/blink/renderer/modules/webcodecs/image_decoder_external.cc

@@ -69,6 +69,9 @@ ImageDecoderExternal::ImageDecoderExternal(ScriptState* script_state,
     return;
   }
 
+  // Since we don't make a copy of buffer passed in, we must retain a reference.
+  init_data_ = init;
+
   DOMArrayPiece buffer;
   if (init->data().IsArrayBuffer()) {
     buffer = DOMArrayPiece(init->data().GetAsArrayBuffer());
@@ -171,6 +174,7 @@ void ImageDecoderExternal::Trace(Visitor* visitor) {
   visitor->Trace(script_state_);
   visitor->Trace(consumer_);
   visitor->Trace(pending_decodes_);
+  visitor->Trace(init_data_);
   visitor->Trace(options_);
   ScriptWrappable::Trace(visitor);
 }

third_party/blink/renderer/modules/webcodecs/image_decoder_external.h

@@ -61,7 +61,8 @@ class MODULES_EXPORT ImageDecoderExternal final : public ScriptWrappable,
   Member<ReadableStreamBytesConsumer> consumer_;
   scoped_refptr<SharedBuffer> stream_buffer_;
 
-  // Construction parameters from ImageDecoderInit.
+  // Construction parameters.
+  Member<const ImageDecoderInit> init_data_;
   Member<ImageBitmapOptions> options_;
 
   bool data_complete_ = false;