[skia-sync] Merge upstream chrome/m153 bug fixes (#350)

[skia-sync] Merge upstream chrome/m153 bug fixes (#350)

Requires: mono/SkiaSharp#4927
Changes: ca4e52c...d87457d

Merge the Chrome M153 use-after-free fix into the SkiaSharp fork.

SkCachedData::internalUnref could delete its owning object before the
AutoMutexWritable guard released the object's mutex. Store the unref result,
destroy the guard, and only then delete the object, preventing the mutex from
being unlocked through freed memory.

The reviewed range changes only src/core/SkCachedData.cpp and requires no fork
conflict resolution. Preserve its two-parent ancestry by selecting
**Create a merge commit**; do not squash or rebase this PR.

Co-authored-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Co-authored-by: Matthew Leibowitz <mattleibow@live.com>

Author: mattleibow

src/core/SkCachedData.cpp

@@ -65,7 +65,12 @@ void SkCachedData::internalRef(bool fromCache) const {
 }
 
 void SkCachedData::internalUnref(bool fromCache) const {
-    if (AutoMutexWritable(this)->inMutexUnref(fromCache)) {
+    bool shouldDelete = false;
+    {
+        AutoMutexWritable amw(this);
+        shouldDelete = amw->inMutexUnref(fromCache);
+    }
+    if (shouldDelete) {
         // can't delete inside doInternalUnref, since it is locking a mutex (which we own)
         delete this;
     }