Fix crash in SVGFontFaceElement::associatedFontElement crash when removing SVGFontFaceElement.

Source/core/svg/SVGFontFaceElement.cpp

 /*
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 10 matching lines @@
 
 #include "config.h"
 
 #if ENABLE(SVG_FONTS)
 #include "core/svg/SVGFontFaceElement.h"
 
 #include <math.h>
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "core/css/CSSFontFaceSrcValue.h"
+#include "core/css/CSSFontSelector.h"
 #include "core/css/CSSStyleSheet.h"
 #include "core/css/CSSValueList.h"
 #include "core/css/StylePropertySet.h"
 #include "core/css/StyleRule.h"
 #include "core/dom/Attribute.h"
 #include "core/dom/Document.h"
+#include "core/dom/StyleEngine.h"
 #include "core/svg/SVGDocumentExtensions.h"
 #include "core/svg/SVGFontElement.h"
 #include "core/svg/SVGFontFaceSrcElement.h"
 #include "core/svg/SVGGlyphElement.h"
 #include "platform/fonts/Font.h"
 
 namespace WebCore {
 
 using namespace SVGNames;
 
@@ skipping 279 matching lines @@
     return InsertionDone;
 }
 
 void SVGFontFaceElement::removedFrom(ContainerNode* rootParent)
 {
     SVGElement::removedFrom(rootParent);
 
     if (rootParent->inDocument()) {
         m_fontElement = 0;
         document().accessSVGExtensions().unregisterSVGFontFaceElement(this);
+        document().styleEngine()->fontSelector()->fontFaceCache()->remove(m_fontFaceRule.get());
         m_fontFaceRule->mutableProperties()->clear();
 
         document().styleResolverChanged(RecalcStyleDeferred);
     } else
         ASSERT(!m_fontElement);
 }
 
 void SVGFontFaceElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     rebuildFontFace();
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG_FONTS)