Clean up CanvasResourceDispatcher on finalizer

We may have pending mojo messages after GC, so we want to drop the
dispatcher as soon as possible.

Bug: 929757,913964
Change-Id: I5789bcbb55aada4a74c67a28758f07686f8911c0
Reviewed-on: https://chromium-review.googlesource.com/c/1489175Reviewed-by: Ken Rockot <rockot@google.com>
Commit-Queue: Ken Rockot <rockot@google.com>
Commit-Queue: Fernando Serboncini <fserb@chromium.org>
Auto-Submit: Fernando Serboncini <fserb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#635833}

third_party/blink/renderer/core/html/canvas/html_canvas_element.cc

@@ -158,6 +158,9 @@ void HTMLCanvasElement::Dispose() {
   if (PlaceholderFrame())
     ReleasePlaceholderFrame();
 
+  // We need to drop frame dispatcher, to prevent mojo calls from completing.
+  frame_dispatcher_ = nullptr;
+
   if (context_) {
     context_->DetachHost();
     context_ = nullptr;

third_party/blink/renderer/core/offscreencanvas/offscreen_canvas.cc

@@ -67,6 +67,9 @@ void OffscreenCanvas::Commit(scoped_refptr<CanvasResource> canvas_resource,
 }
 
 void OffscreenCanvas::Dispose() {
+  // We need to drop frame dispatcher, to prevent mojo calls from completing.
+  frame_dispatcher_ = nullptr;
+
   if (context_) {
     context_->DetachHost();
     context_ = nullptr;