Merge 138994

Merge 138994
> Fixing memory read after free in CanvasRenderingContext2D::accessFont
> https://bugs.webkit.org/show_bug.cgi?id=106244
> 
> Reviewed by Abhishek Arya.
> 
> Source/WebCore:
> 
> Using a temporary String object to hold ref count on string that is
> passed by reference in CanvasRenderingContext2D::accessFont.
> 
> Test: fast/canvas/canvas-measureText.html
> 
> * html/canvas/CanvasRenderingContext2D.cpp:
> (WebCore::CanvasRenderingContext2D::accessFont):
> 
> LayoutTests:
> 
> New test case to verify stability of 2D canvas method measureText.
> Test case was causing a DumpRenderTree crash on builds with
> AddressSantitizer instrumentation.
> 
> * fast/canvas/canvas-measureText-expected.txt: Added.
> * fast/canvas/canvas-measureText.html: Added.
> 

TBR=junov@google.com
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=139058