[System.Drawing.Common] Work around libgdiplus use after free

[lambdageek]

On Windows, both of the following are legal

Metafile mf = ... ; // get a metafile instance
Graphics g = Graphics.FromImage(mf);
g.Dispose(); mf.Dispose();

and

Metafile mf = ... ; // get a metafile instance
Graphics g = Graphics.FromImage(mf);
mf.Dispose(); g.Dispose();

On Unix, libgdiplus has a use after free bug for the second form - the metafile
native image is disposed, but the graphics instance still has a pointer to the
memory that it will use during cleanup. If the memory is reused, the graphics
instance will see garbage values and crash.

The workaround is to add a MetadataHolder class and to transfer responsibility
for disposing of the native image instance to it if the Metafile is disposed
before the Graphics.

Note that the following is not allowed (throws OutOfMemoryException on GDI+ on
Windows), so there's only ever one instance of Graphics associated with a
Metafile at a time.

Graphics g = Graphics.FromImage(mf);
Graphics g2 = Graphics.FromImage(mf); // throws

Addresses #37838

[ghost]

Tagging subscribers to this area: @roji, @ajcvickers
See info in area-owners.md if you want to be subscribed.

[ghost]

Tagging subscribers to this area: @safern, @tannergooding, @jeffhandley
See info in area-owners.md if you want to be subscribed.

[lambdageek]

One thing I'm not sure about - is it worthwhile to make Metafile.MetafileHolder a subclass of SafeHandle. On construction I'd bump the refcount to 2 but leave the handle as invalid, then MetafileDispose would call SetHandle and SafeHandle.Dispose, and GraphicsDispose would also call SafeHandle.Dispose.

One reason not to do it might be because the rest of the SafeHandle methods aren't really meaningful to MetafileHolder - it has quite a constrained API surface. I wish SafeHandle was a concrete class with a delegate for the release method, then I could just use it as a field in MetafileHolder.

[safern]

cc: @stephentoub

[RussKie]

Just for my own curiosity, any reason not to make it a struct?

[ericstj]

Looks like it has a finalizer. Structs can't have finalizers.