trivial fix for TextBlobCache

src/gpu/GrTextBlobCache.h

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #ifndef GrTextBlobCache_DEFINED
 #define GrTextBlobCache_DEFINED
 
@@ skipping 47 matching lines @@
         fBlobList.addToHead(blob);
 
         // If we are overbudget, then unref until we are below budget again
         if (fPool.size() > kBudget) {
             BitmapBlobList::Iter iter;
             iter.init(fBlobList, BitmapBlobList::Iter::kTail_IterStart);
             BitmapTextBlob* lruBlob = iter.get();
             SkASSERT(lruBlob);
             while (fPool.size() > kBudget && (lruBlob = iter.get()) && lruBlob != blob) {
                 fCache.remove(lruBlob->fUniqueID);
+
+                // Backup the iterator before removing and unrefing the blob
+                iter.prev();
                 fBlobList.remove(lruBlob);
-                iter.prev();
                 lruBlob->unref();
             }
 
             // If we break out of the loop with lruBlob == blob, then we haven't purged enough
             // use the call back and try to free some more.  If we are still overbudget after this,
             // then this single textblob is over our budget
             if (lruBlob == blob) {
                 (*fCallback)(fData);
             }
 
@@ skipping 31 matching lines @@
     static const int kMinGrowthSize = 1 << 17;
     static const int kBudget = 1 << 22;
     BitmapBlobList fBlobList;
     SkTDynamicHash<BitmapTextBlob, uint32_t> fCache;
     GrMemoryPool fPool;
     PFOverBudgetCB fCallback;
     void* fData;
 };
 
 #endif