Oilpan: RenderImageResource::shutdown should be called earlier.

This CL fixes flaky crashes in tables/mozilla/bugs/.

RenderImageResource::shutdown unregisters the owner RenderImage from an
ImageResource. We should call it in RenderImage::destroy because
RenderObject::willRenderImage, which is a callback of ImageResourceClient,
should not be called after RenderImage::destroy.

BUG=398342

Review URL: https://codereview.chromium.org/458383003

git-svn-id: svn://svn.chromium.org/blink/trunk@180029 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/rendering/RenderImage.cpp

@@ -74,9 +74,14 @@ RenderImage* RenderImage::createAnonymous(Document* document)
 }
 
 RenderImage::~RenderImage()
+{
+}
+
+void RenderImage::destroy()
 {
     ASSERT(m_imageResource);
     m_imageResource->shutdown();
+    RenderReplaced::destroy();
 }
 
 void RenderImage::setImageResource(PassOwnPtr<RenderImageResource> imageResource)

third_party/WebKit/Source/core/rendering/RenderImage.h

@@ -37,6 +37,7 @@ class RenderImage : public RenderReplaced {
 public:
     RenderImage(Element*);
     virtual ~RenderImage();
+    virtual void destroy() OVERRIDE;
 
     static RenderImage* createAnonymous(Document*);