Bug 1656459 - Hold ref in DrawingBufferSize to prevent dangling reference use on context-loss. r=lsalzman

Differential Revision: https://phabricator.services.mozilla.com/D93398

dom/canvas/ClientWebGLContext.cpp

@@ -748,6 +748,8 @@ bool ClientWebGLContext::CreateHostContext(const uvec2& requestedSize) {
 
 uvec2 ClientWebGLContext::DrawingBufferSize() {
   if (IsContextLost()) return {};
+  const auto notLost =
+      mNotLost;  // Hold a strong-ref to prevent LoseContext=>UAF.
   auto& state = State();
   auto& size = state.mDrawingBufferSize;