Heap-use-after-free in WebCore::RenderText::computePreferredLogicalWidths