Hold SVGFontFaceElement in SVGDocumentExtensions until StyleRecalc is finished

Source/core/svg/SVGFontFaceElement.cpp

 /*
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 313 matching lines @@
     return InsertionDone;
 }
 
 void SVGFontFaceElement::removedFrom(ContainerNode* rootParent)
 {
     SVGElement::removedFrom(rootParent);
 
     if (rootParent->inDocument()) {
         m_fontElement = 0;
         document().accessSVGExtensions().unregisterSVGFontFaceElement(this);
+
         // FIXME: HTMLTemplateElement's document or imported  document can be active?
         // If so, we also need to check whether fontSelector() is nullptr or not.
         // Otherwise, we will use just document().isActive() here.
-        if (document().isActive() && document().styleEngine()->fontSelector())
+        RecalcStyleTime recalcTime = RecalcStyleDeferred;
+        if (document().isActive() && document().styleEngine()->fontSelector()) {
             document().styleEngine()->fontSelector()->fontFaceCache()->remove(m_fontFaceRule.get());
+            // This SVGFontFaceElement might be referred from some render style.
+            // If this SVGFontFaceElement is used via the render style before recalc style,
+            // heap-use-after-free will occur. We need to quickly update render style.
+            recalcTime = RecalcStyleImmediately;

[esprehn, 2014/03/17 17:12:01]

This is bad, it means if you have a bunch of fonts and remove them we'll spam
the document with recalcs.

Why doesn't the font store a RefPtr to the SVGFontFaceElement?

[tasak, 2014/03/18 02:23:04]

I agree that this is a bad solution.

+        }
         m_fontFaceRule->mutableProperties().clear();
-
-        document().styleResolverChanged(RecalcStyleDeferred);
+        document().styleResolverChanged(recalcTime);
     } else
         ASSERT(!m_fontElement);
 }
 
 void SVGFontFaceElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     rebuildFontFace();
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG_FONTS)