Unwind PDFObject destructor calls into heap instead of stack. Notice: the order of the destructors …

src/pdf/SkPDFGraphicState.h

Index: src/pdf/SkPDFGraphicState.h
===================================================================
--- src/pdf/SkPDFGraphicState.h	(revision 8010)
+++ src/pdf/SkPDFGraphicState.h	(working copy)
@@ -63,7 +63,17 @@
      *  other references.
      */
     static SkPDFGraphicState* GetNoSMaskGraphicState();
+    
+protected:
+    virtual void transferPDFObjectsOwnership(SkTDArray<SkPDFObject*>* list) {
+        for (int i = 0 ; i < fResources.count(); ++i) {
+          list->push(fResources[i]);
+        }
+        fResources.remove(0, fResources.count());
 
+        SkPDFDict::transferPDFObjectsOwnership(list);
+    }
+
 private:
     const SkPaint fPaint;
     SkTDArray<SkPDFObject*> fResources;