Unwind PDFObject destructor calls into heap instead of stack. Notice: the order of the destructors …

src/pdf/SkPDFStream.h

Index: src/pdf/SkPDFStream.h
===================================================================
--- src/pdf/SkPDFStream.h	(revision 8010)
+++ src/pdf/SkPDFStream.h	(working copy)
@@ -51,6 +51,12 @@
 
     void setData(SkStream* stream);
 
+    virtual void transferPDFObjectsOwnership(SkTDArray<SkPDFObject*>* list) {
+        list->push(fSubstitute.detach());
+
+        INHERITED::transferPDFObjectsOwnership(list);
+    }
+
 private:
     enum State {
         kUnused_State,         //!< The stream hasn't been requested yet.