Fix for race condition in 2D canvas teardown

We currently sometimes have Canvas2DLayerBridge objects referenced by
the Canvas2DLayerManager even though they are slated for destruction.
There is a race condition with the rate limiting mechanism that can
cause limitPendingFrames() to be called on a defunct layer bridge,
which may or may not cause a crash.

This change fixes the bug by ensuring that all transient resources are
properly freed when a canvas layer has its destruction in progress.
The added ASSERTs serve as regression tests for this issue when running
layout tests with accelerated 2D canvases.

BUG=344666
TEST=virtual/gpu/fast/canvas Layout tests

Review URL: https://codereview.chromium.org/216473007

git-svn-id: svn://svn.chromium.org/blink/trunk@170346 bbb929c8-8fbe-4397-9dbb-9b2b20218538