Merge 138994

Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp

Index: Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
===================================================================
--- Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp	(revision 139057)
+++ Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp	(working copy)
@@ -2360,8 +2360,13 @@
 {
     canvas()->document()->updateStyleIfNeeded();
 
-    if (!state().m_realizedFont)
-        setFont(state().m_unparsedFont);
+    if (!state().m_realizedFont) {
+        // Create temporary string object to hold ref count in case
+        // state().m_unparsedFont in unreffed by call to realizeSaves in
+        // setFont.
+        String unparsedFont(state().m_unparsedFont);
+        setFont(unparsedFont);
+    }
     return state().m_font;
 }