webgl context objects leak fix

Changing order of operations in ~WebGLRenderingContextBase
Otherwise, WebGLContextGroup will not be able to release some of the
'group shared' resources that still have attachements when being removed
via WebGLSharedObject destructor - it happens eg. for
WebGLVertexArrayObjectBase objects that have buffers set on
destruction time.

The current behaviour in ~WebGLRenderingContextBase:

- first, the reference to some WebGLSharedObject (like m_boundArrayBuffer)
   is nullified
- since this decreases refcnt to 0, destructor for this WebGLSharedObject is
  executed - this goes via WebGLObject::runDestructor() -> WebGLObject::deleteObject.
- WebGLObject::deleteObject checks for attachement count (m_attachmentCount)
  and if it's not 0 it will not execute deleteObjectImpl (where the actual
  removal from the context takes place).
- So the reference to the object is destructed, and ~WebGLSharedObject removes
  the object from m_contextGroup as well. At this point the resource is leaked.

With the fix, m_contextGroup->removeContext(*this) is executed at the beginning
of ~WebGLRenderingContextBase - this calls detach() on all the objects
(WebGLContextGroup::detachAndRemoveAllObjects) so is possible to release them.

Author: tomasz-karczewski-red

Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp

@@ -1238,6 +1238,13 @@ void WebGLRenderingContextBase::removeActivityStateChangeObserver()
 
 WebGLRenderingContextBase::~WebGLRenderingContextBase()
 {
+    if (!m_isPendingPolicyResolution) {
+        // need to remove from the group first, before we destroy the graphics context
+        // othwerwise, in case this is the last context in the group, when the context group tries
+        // to cleanup the remaining objects, it will not call deleteImpl (see WebGLObject::deleteObject)
+        // since the context is no longer available
+        m_contextGroup->removeContext(*this);
+    }
     // Remove all references to WebGLObjects so if they are the last reference
     // they will be freed before the last context is removed from the context group.
     m_boundArrayBuffer = nullptr;
@@ -1262,7 +1269,6 @@ WebGLRenderingContextBase::~WebGLRenderingContextBase()
         detachAndRemoveAllObjects();
         loseExtensions(LostContextMode::RealLostContext);
         destroyGraphicsContextGL();
-        m_contextGroup->removeContext(*this);
     }
 
     {