Use after free error due to CanvasRenderinContext2D::State not unregistering callback

In CanvasRenderinContext2D::setFont, code was falsely assuming that the
new font would always use the same fontSelector as the previous font,
if any.  This is apparently not the case, so we need to unregister
from the old font selector to avoid being registered with two at the same
time.  When registered with two fontSelectors, the State will only
unregister from the last one upon destruction, thus leavaing a dangling
reference to a deleted FontSelectorClient.

BUG=293521

Review URL: https://chromiumcodereview.appspot.com/23904022

git-svn-id: svn://svn.chromium.org/blink/trunk@157917 bbb929c8-8fbe-4397-9dbb-9b2b20218538