Destroy `mStagingBuffer` immediately in `BufferBase::Unmap()`

When calling `BufferBase::Unmap()` on the buffer created with
`mappedAtCreation == true` we can destroy the internal staging
buffer `mStagingBuffer` immediately after recording the copy
command instead of putting it into `DynamicUploader` and
destroying it in the next completed serial.

It is because the lifecycle of `mStagingBuffer` is the same
as the current pending commands and the pending command serial,
so it can be safely destroyed when the execution of the
pending commands are completed.

With this patch `mStagingBuffer` can be destroyed one serial
number earlier than current implementation.

Bug: chromium:42242066
Test: dawn_end2end_tests

Change-Id: I9ff15ab0c20a374b9065897a64a2b5e0a9e03214
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/212894
Reviewed-by: Loko Kung <lokokung@google.com>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Jiawei Shao <jiawei.shao@intel.com>
diff --git a/src/dawn/native/Buffer.cpp b/src/dawn/native/Buffer.cpp
index 361b25a..c618f84 100644
--- a/src/dawn/native/Buffer.cpp
+++ b/src/dawn/native/Buffer.cpp
@@ -886,8 +886,7 @@
     DAWN_TRY(
         GetDevice()->CopyFromStagingToBuffer(mStagingBuffer.Get(), 0, this, 0, GetAllocatedSize()));
 
-    DynamicUploader* uploader = GetDevice()->GetDynamicUploader();
-    uploader->ReleaseStagingBuffer(std::move(mStagingBuffer));
+    mStagingBuffer = nullptr;
 
     return {};
 }
diff --git a/src/dawn/native/null/DeviceNull.cpp b/src/dawn/native/null/DeviceNull.cpp
index 6953c4c..ab4889c 100644
--- a/src/dawn/native/null/DeviceNull.cpp
+++ b/src/dawn/native/null/DeviceNull.cpp
@@ -159,10 +159,10 @@
 
 struct CopyFromStagingToBufferOperation : PendingOperation {
     void Execute() override {
-        destination->CopyFromStaging(staging, sourceOffset, destinationOffset, size);
+        destination->CopyFromStaging(staging.Get(), sourceOffset, destinationOffset, size);
     }
 
-    raw_ptr<BufferBase> staging;
+    Ref<BufferBase> staging;
     Ref<Buffer> destination;
     uint64_t sourceOffset;
     uint64_t destinationOffset;