Fix crash in SVGFontFaceElement::associatedFontElement crash when removing SVGFontFaceElement.

Fix crash in SVGFontFaceElement::associatedFontElement crash when removing SVGFontFaceElement.

(1) We need to remove its font-face rule from FontCache when removing SVGFontFaceElement,

(2) We should not use old styles in RenderSVGInlineText::styleDidChange.
Since styleRecalc is done in document-order, we cannot see any styles of next renderer
(obtained by nextInPreOrder).
The old styles might have old fonts which are created by SVGFontFaceElement.

BUG=346192
TEST=fast/dom/discard-svg-font-face-crash.svg

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=167993

[kouhei (in TOK), 2014-02-25 09:11:06]

Would you post results on run-perf-tests svg?

[tasak, 2014-02-25 10:25:26]

On 2014/02/25 09:11:06, kouhei wrote:
> Would you post results on run-perf-tests svg?

Sure. I ran SVG perf-tests 5 times. The first 2 times are for master and left
are for patched.

SVG/AzLizardBenjiPark:Time	ms
	24.50	± 5.51% master
	25.13	± 5.75% master
	26.17	± 6.66% patched
	24.21	± 4.37% patched
	24.60	± 6.40%	patched

/SVG/Bamboo:Time	ms
	369.88	± 0.82%			master
	375.80	± 0.78%	1.60% Worse	master
 	371.10	± 0.86%			patched
	370.98	± 0.80%			patched
	367.40	± 1.21%			patched

/SVG/Cactus:Time	ms
	94.55	± 1.47%	master
	94.79	± 1.13%	master
	93.76	± 1.80%	patched
	93.20	± 1.43% patched
	93.10	± 2.05%	patched

/SVG/Cowboy:Time	ms
	76.60	± 1.81%	master
	75.28	± 2.42%	master
	77.87	± 2.69% patched
	77.18	± 2.59% patched
	76.78	± 1.19%	 patched

/SVG/CrawFishGanson:Time	ms
	34.25	± 6.82%	master
	34.66	± 6.37%	master
	35.56	± 5.96% patched
	34.66	± 4.70% patched
	34.34	± 5.16%	 patched

/SVG/Debian:Time	ms
	70.18	± 2.73%	master
	71.00	± 1.77%	master
	70.87	± 2.27% patched
	71.28	± 1.72% patched
	71.75	± 1.56%	 patched

/SVG/DropsOnABlade:Time	ms
	21.00	± 5.38%	master
	21.88	± 6.87%	master
	20.16	± 4.89% patched
	21.32	± 6.98% patched
	20.71	± 6.53%	 patched

/SVG/FlowerFromMyGarden:Time	ms
	26.37	± 5.69%	master
	24.74	± 3.41%	6.16% Better	master
	26.01	± 6.11% patched
	23.76	± 2.56%	9.87% Better patched
	26.30	± 4.77%	 patched

/SVG/FoodLeifLodahl:Time	ms
	52.93	± 3.98%	master
	49.53	± 4.61%	6.42% Better	master
	50.43	± 4.44%	4.73% Better patched
	52.03	± 4.49% patched
	52.82	± 4.80%	 patched

/SVG/HarveyRayner:Time	ms
	41.61	± 3.07%	master
	41.45	± 3.00%	master
	41.92	± 2.36% patched
	41.58	± 3.28% patched
	44.29	± 4.03%	6.43% Worse  patched

/SVG/SvgCubics:Time	ms
	10.42	± 5.84%	master
	11.54	± 8.32%	10.78% Worse	master
 	10.96	± 6.03% patched
	10.82	± 6.83% patched
	11.22	± 8.89%	 patched

/SVG/SvgHitTesting:Time	ms
	101.92	± 1.34%	master
	101.40	± 1.49%	master
	100.64	± 1.12%
	100.67	± 1.45%
	100.31	± 1.20%	1.58% Better

/SVG/UnderTheSee:Time	ms
	47.41	± 3.36%	master
	46.28	± 2.47%	master
	44.98	± 2.65%	5.14% Better
	46.65	± 2.90%
	48.19	± 3.19%	

/SVG/WorldIso:Time	ms
	158.86	± 2.26%	master
	163.60	± 2.84%	2.98% Worse	master
 	158.62	± 2.52%
	158.41	± 2.30%
	161.34	± 2.09%	

/SVG/Worldcup:Time	ms
	368.63	± 0.84%	master
	373.04	± 0.88%	1.20% Worse	master
 	360.95	± 1.08%	2.08% Better patched
	361.53	± 0.73%	1.93% Better patched
	366.24	± 0.84%	 patched

[kouhei (in TOK), 2014-02-26 03:00:47]

Looks like no regression. Actually this is a win.
non owner lgtm, but I'm not rendering/ expert so would you get approval from
other reviewers also?

[tasak, 2014-02-26 05:15:21]

jchaffraix, would you review this CL?

I need rendering owner's lgtm.

[Stephen Chennney, 2014-02-26 19:57:33]

LGTM.

[Stephen Chennney, 2014-02-26 19:57:39]

The CQ bit was checked by schenney@chromium.org

[Stephen Chennney, 2014-02-26 19:57:43]

The CQ bit was unchecked by schenney@chromium.org

[tasak, 2014-02-27 05:00:44]

The CQ bit was checked by tasak@google.com

[commit-bot: I haz the power, 2014-02-27 05:00:58]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/tasak@google.com/176853009/40001

[commit-bot: I haz the power, 2014-02-27 05:01:00]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-02-27 05:01:01]

Failed to apply patch for Source/core/svg/SVGFontFaceElement.cpp:
While running patch -p1 --forward --force --no-backup-if-mismatch;
  patching file Source/core/svg/SVGFontFaceElement.cpp
  Hunk #2 FAILED at 335.
  1 out of 2 hunks FAILED -- saving rejects to file
Source/core/svg/SVGFontFaceElement.cpp.rej

Patch:       Source/core/svg/SVGFontFaceElement.cpp
Index: Source/core/svg/SVGFontFaceElement.cpp
diff --git a/Source/core/svg/SVGFontFaceElement.cpp
b/Source/core/svg/SVGFontFaceElement.cpp
index
235b9225903a936a07128579b1c7efacaf003f1b..55139ab806a33c5fbbc88535dcaf7870cde02993
100644
--- a/Source/core/svg/SVGFontFaceElement.cpp
+++ b/Source/core/svg/SVGFontFaceElement.cpp
@@ -28,12 +28,14 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "core/css/CSSFontFaceSrcValue.h"
+#include "core/css/CSSFontSelector.h"
 #include "core/css/CSSStyleSheet.h"
 #include "core/css/CSSValueList.h"
 #include "core/css/StylePropertySet.h"
 #include "core/css/StyleRule.h"
 #include "core/dom/Attribute.h"
 #include "core/dom/Document.h"
+#include "core/dom/StyleEngine.h"
 #include "core/svg/SVGDocumentExtensions.h"
 #include "core/svg/SVGFontElement.h"
 #include "core/svg/SVGFontFaceSrcElement.h"
@@ -333,6 +335,7 @@ void SVGFontFaceElement::removedFrom(ContainerNode*
rootParent)
     if (rootParent->inDocument()) {
         m_fontElement = 0;
         document().accessSVGExtensions()->unregisterSVGFontFaceElement(this);
+       
document().styleEngine()->fontSelector()->fontFaceCache()->remove(m_fontFaceRule.get());
         m_fontFaceRule->mutableProperties()->clear();
 
         document().styleResolverChanged(RecalcStyleDeferred);

[tasak, 2014-02-27 07:11:14]

The CQ bit was checked by tasak@google.com

[commit-bot: I haz the power, 2014-02-27 07:11:28]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/tasak@google.com/176853009/60001

[commit-bot: I haz the power, 2014-02-27 08:37:56]

Change committed as 167993