LibWeb: Add GC finalizer to Layout::ImageBox

It's not safe to unregister ImageBox from the browsing context in the
destructor (since the browsing context may have already been swept and
destroyed).

Userland/Libraries/LibWeb/Layout/ImageBox.cpp

@@ -18,8 +18,14 @@ ImageBox::ImageBox(DOM::Document& document, DOM::Element& element, NonnullRefPtr
     browsing_context().register_viewport_client(*this);
 }
 
-ImageBox::~ImageBox()
+ImageBox::~ImageBox() = default;
+
+void ImageBox::finalize()
 {
+    Base::finalize();
+
+    // NOTE: We unregister from the browsing context in finalize() to avoid trouble
+    //       in the scenario where our BrowsingContext has already been swept by GC.
     browsing_context().unregister_viewport_client(*this);
 }
 

Userland/Libraries/LibWeb/Layout/ImageBox.h

@@ -12,7 +12,7 @@
 
 namespace Web::Layout {
 
-class ImageBox
+class ImageBox final
     : public ReplacedBox
     , public HTML::BrowsingContext::ViewportClient {
     JS_CELL(ImageBox, ReplacedBox);
@@ -37,6 +37,9 @@ private:
     // ^BrowsingContext::ViewportClient
     virtual void browsing_context_did_set_viewport_rect(Gfx::IntRect const&) final;
 
+    // ^JS::Cell
+    virtual void finalize() override;
+
     int preferred_width() const;
     int preferred_height() const;