Cherry-pick 252432.595@safari-7614-branch (60a9996). rdar://101205947

    Crash in RenderImage::paintReplaced
    https://bugs.webkit.org/show_bug.cgi?id=246712
    rdar://101205947

    Reviewed by David Kilzer and Myles Maxfield.

    * Source/WebCore/rendering/RenderImage.cpp:
    (WebCore::RenderImage::paintReplaced):

    Canonical link: https://commits.webkit.org/252432.595@safari-7614-branch

Canonical link: https://commits.webkit.org/255960@main

Source/WebCore/rendering/RenderImage.cpp

@@ -542,7 +542,8 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
             if (!m_altText.isEmpty()) {
                 auto& font = style().fontCascade();
                 auto& fontMetrics = font.metricsOfPrimaryFont();
-                auto textRun = RenderBlock::constructTextRun(document().displayStringModifiedByEncoding(m_altText), style(), ExpansionBehavior::defaultBehavior(), RespectDirection | RespectDirectionOverride);
+                auto encodedDisplayString = document().displayStringModifiedByEncoding(m_altText);
+                auto textRun = RenderBlock::constructTextRun(encodedDisplayString, style(), ExpansionBehavior::defaultBehavior(), RespectDirection | RespectDirectionOverride);
                 auto textWidth = LayoutUnit { font.width(textRun) };
 
                 auto hasRoomForAltText = [&] {