Hold SVGFontFaceElement in SVGDocumentExtensions until StyleRecalc is finished

Source/core/svg/SVGFontData.cpp

 /*
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 44 matching lines @@
     , m_verticalAdvanceY(fontFaceElement->verticalAdvanceY())
 {
     ASSERT_ARG(fontFaceElement, fontFaceElement);
 }
 
 void SVGFontData::initializeFontData(SimpleFontData* fontData, float fontSize)
 {
     ASSERT(fontData);
 
     SVGFontFaceElement* svgFontFaceElement = this->svgFontFaceElement();
-    ASSERT(svgFontFaceElement);
+    ASSERT(svgFontFaceElement && svgFontFaceElement->inDocument());
 
     SVGFontElement* svgFontElement = svgFontFaceElement->associatedFontElement();
     ASSERT(svgFontElement);
     GlyphData missingGlyphData;
     missingGlyphData.fontData = fontData;
     missingGlyphData.glyph = svgFontElement->missingGlyph();
     fontData->setMissingGlyphData(missingGlyphData);
 
     fontData->setZeroWidthSpaceGlyph(0);
     fontData->determinePitch();
@@ skipping 40 matching lines @@
 
     // Estimate maximum character width.
     Glyph letterWGlyph = glyphPageZero->glyphForCharacter('W');
     fontData->setMaxCharWidth(letterWGlyph ? fontData->widthForGlyph(letterWGlyph) : ascent);
 }
 
 float SVGFontData::widthForSVGGlyph(Glyph glyph, float fontSize) const
 {
     SVGFontFaceElement* svgFontFaceElement = this->svgFontFaceElement();
     ASSERT(svgFontFaceElement);
+    // RenderView::clearSelection is invoked while removing some element, e.g.
+    // Document::nodeWillBeRemoved => FrameSelection::nodeWillBeRemoved => RenderView::clearSelection.
+    // Since recalc style has not been executed yet, RenderStyle might have some reference to
+    // SVGFontFaceElement which was also removed.
+    // In this case, use default horizontalAdvanceX instead of associatedFontElement's one.
+    if (!svgFontFaceElement->inDocument())
+        return m_horizontalAdvanceX * scaleEmToUnits(fontSize, svgFontFaceElement->unitsPerEm());
 
     SVGFontElement* associatedFontElement = svgFontFaceElement->associatedFontElement();
     ASSERT(associatedFontElement);
 
     SVGGlyph svgGlyph = associatedFontElement->svgGlyphForGlyph(glyph);
     SVGGlyphElement::inheritUnspecifiedAttributes(svgGlyph, this);
     return svgGlyph.horizontalAdvanceX * scaleEmToUnits(fontSize, svgFontFaceElement->unitsPerEm());
 }
 
 bool SVGFontData::applySVGGlyphSelection(WidthIterator& iterator, GlyphData& glyphData, bool mirror, int currentCharacter, unsigned& advanceLength) const
@@ skipping 12 matching lines @@
         remainingTextInRun = String(run.data16(currentCharacter), run.charactersLength() - currentCharacter);
         remainingTextInRun = Character::normalizeSpaces(remainingTextInRun.characters16(), remainingTextInRun.length());
     }
 
     if (mirror)
         remainingTextInRun = createStringWithMirroredCharacters(remainingTextInRun);
     if (!currentCharacter && arabicForms.isEmpty())
         arabicForms = charactersWithArabicForm(remainingTextInRun, mirror);
 
     SVGFontFaceElement* svgFontFaceElement = this->svgFontFaceElement();
-    ASSERT(svgFontFaceElement);
+    ASSERT(svgFontFaceElement && svgFontFaceElement->inDocument());
 
     SVGFontElement* associatedFontElement = svgFontFaceElement->associatedFontElement();
     ASSERT(associatedFontElement);
 
     RenderObject* renderObject = 0;
     if (TextRun::RenderingContext* renderingContext = run.renderingContext())
         renderObject = static_cast<SVGTextRunRenderingContext*>(renderingContext)->renderer();
 
     String language;
     bool isVerticalText = false;
@@ skipping 50 matching lines @@
 
     return false;
 }
 
 bool SVGFontData::fillSVGGlyphPage(GlyphPage* pageToFill, unsigned offset, unsigned length, UChar* buffer, unsigned bufferLength, const SimpleFontData* fontData) const
 {
     ASSERT(fontData->isCustomFont());
     ASSERT(fontData->isSVGFont());
 
     SVGFontFaceElement* fontFaceElement = this->svgFontFaceElement();
-    ASSERT(fontFaceElement);
+    ASSERT(fontFaceElement && fontFaceElement->inDocument());
 
     SVGFontElement* fontElement = fontFaceElement->associatedFontElement();
     ASSERT(fontElement);
 
     if (bufferLength == length)
         return fillBMPGlyphs(fontElement, pageToFill, offset, length, buffer, fontData);
 
     ASSERT(bufferLength == 2 * length);
     return fillNonBMPGlyphs(fontElement, pageToFill, offset, length, buffer, fontData);
 }
@@ skipping 70 matching lines @@
             mirroredCharacters.append(mirroredChar(character));
         }
     }
 
     return mirroredCharacters.toString();
 }
 
 } // namespace WebCore
 
 #endif