Code:  void AcceleratedStaticBitmapImage::CreateImageFromMailboxIfNeeded() {
   if (texture_holder_->IsSkiaTextureHolder())
     return;
   texture_holder_ =
      std::make_unique<SkiaTextureHolder>(std::move(texture_holder_));
}

Vulnerability Type: Overflow 
CWE ID: CWE-119
Summary: Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: Fix *StaticBitmapImage ThreadChecker and unaccelerated SkImage destroy

- AcceleratedStaticBitmapImage was misusing ThreadChecker by having its
own detach logic. Using proper DetachThread is simpler, cleaner and
correct.
- UnacceleratedStaticBitmapImage didn't destroy the SkImage in the
proper thread, leading to GrContext/SkSp problems.

Bug: 890576
Change-Id: Ic71e7f7322b0b851774628247aa5256664bc0723
Reviewed-on: https://chromium-review.googlesource.com/c/1307775
Reviewed-by: Gabriel Charette <gab@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: Fernando Serboncini <fserb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#604427}