Bug 1503082 - Clear CanvasShutdownObserver::mCanvas when the canvas goes away. r=nical

It is possible for the CanvasRenderingContext2D to be destroyed while
we're in the middle of the call to nsObserverService::NotifyObservers()
for shutdown. This leaves the shutdown observer with a dangling pointer
to the canvas, so this patch explicitly clears the pointer when the
context goes away.

Differential Revision: https://phabricator.services.mozilla.com/D10777

dom/canvas/CanvasRenderingContext2D.cpp

@@ -780,6 +780,15 @@ public:
   : mCanvas(aCanvas)
   {}
 
+  void OnShutdown() {
+    if (!mCanvas) {
+      return;
+    }
+
+    mCanvas = nullptr;
+    nsContentUtils::UnregisterShutdownObserver(this);
+  }
+
   NS_DECL_ISUPPORTS
   NS_DECL_NSIOBSERVER
 private:
@@ -797,7 +806,7 @@ CanvasShutdownObserver::Observe(nsISupports* aSubject,
 {
   if (mCanvas && strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID) == 0) {
     mCanvas->OnShutdown();
-    nsContentUtils::UnregisterShutdownObserver(this);
+    OnShutdown();
   }
 
   return NS_OK;
@@ -1190,7 +1199,7 @@ void
 CanvasRenderingContext2D::RemoveShutdownObserver()
 {
   if (mShutdownObserver) {
-    nsContentUtils::UnregisterShutdownObserver(mShutdownObserver);
+    mShutdownObserver->OnShutdown();
     mShutdownObserver = nullptr;
   }
 }