Fix for segfault on destruction of BitmapTextBlob

src/gpu/GrBatchAtlas.h

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #ifndef GrBatchAtlas_DEFINED
 #define GrBatchAtlas_DEFINED
 
@@ skipping 72 matching lines @@
 
     private:
         bool find(int index) const {
             SkASSERT(index < kMaxPlots);
             return (fPlotAlreadyUpdated >> index) & 1;
         }
 
         void set(int index) {
             SkASSERT(!this->find(index));
             fPlotAlreadyUpdated = fPlotAlreadyUpdated | (1 << index);
-            if (fCount < fAllocated) {
-                fPlotsToUpdate[fCount++] = index;
-            } else {
-                // This case will almost never happen
-                fAllocated = fCount << 1;
-                fPlotsToUpdate.realloc(fAllocated);
-                fPlotsToUpdate[fCount++] = index;
-            }
+            fPlotsToUpdate.push_back(index);
         }
 
         static const int kMinItems = 4;
         static const int kMaxPlots = 32;
-        SkAutoSTMalloc<kMinItems, int> fPlotsToUpdate;
+        SkSTArray<kMinItems, int, true> fPlotsToUpdate;
         uint32_t fPlotAlreadyUpdated;
         int fCount;
         int fAllocated;
 
         friend class GrBatchAtlas;
     };
 
     void setLastUseTokenBulk(const BulkUseTokenUpdater& reffer, BatchToken);
 
     static const int kGlyphMaxDim = 256;
@@ skipping 30 matching lines @@
     };
 
     SkTDArray<EvictionData> fEvictionCallbacks;
     // allocated array of GrBatchPlots
     SkAutoTUnref<BatchPlot>* fPlotArray;
     // LRU list of GrPlots (MRU at head - LRU at tail)
     GrBatchPlotList fPlotList;
 };
 
 #endif