Code:  void OffscreenCanvas::Dispose() {
   if (context_) {
     context_->DetachHost();
     context_ = nullptr;
  }

  if (HasPlaceholderCanvas() && GetTopExecutionContext() &&
      GetTopExecutionContext()->IsWorkerGlobalScope()) {
    WorkerAnimationFrameProvider* animation_frame_provider =
        To<WorkerGlobalScope>(GetTopExecutionContext())
            ->GetAnimationFrameProvider();
    if (animation_frame_provider)
      animation_frame_provider->DeregisterOffscreenCanvas(this);
  }
}

Vulnerability Type: 
CWE ID: CWE-416
Summary: Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: Clean up CanvasResourceDispatcher on finalizer

We may have pending mojo messages after GC, so we want to drop the
dispatcher as soon as possible.

Bug: 929757,913964
Change-Id: I5789bcbb55aada4a74c67a28758f07686f8911c0
Reviewed-on: https://chromium-review.googlesource.com/c/1489175
Reviewed-by: Ken Rockot <rockot@google.com>
Commit-Queue: Ken Rockot <rockot@google.com>
Commit-Queue: Fernando Serboncini <fserb@chromium.org>
Auto-Submit: Fernando Serboncini <fserb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#635833}