Hold SVGFontFaceElement in SVGDocumentExtensions until StyleRecalc is finished

Source/core/svg/SVGFontFaceElement.cpp

Index: Source/core/svg/SVGFontFaceElement.cpp
diff --git a/Source/core/svg/SVGFontFaceElement.cpp b/Source/core/svg/SVGFontFaceElement.cpp
index 5430c487dadf2cf79be4c93abfa771b2034189b5..dbdec36fe5ce6819e00a2a95e32418234f06dc07 100644
--- a/Source/core/svg/SVGFontFaceElement.cpp
+++ b/Source/core/svg/SVGFontFaceElement.cpp
@@ -331,13 +331,15 @@ void SVGFontFaceElement::removedFrom(ContainerNode* rootParent)
     if (rootParent->inDocument()) {
         m_fontElement = 0;
         document().accessSVGExtensions().unregisterSVGFontFaceElement(this);
+
         // FIXME: HTMLTemplateElement's document or imported  document can be active?
         // If so, we also need to check whether fontSelector() is nullptr or not.
         // Otherwise, we will use just document().isActive() here.
-        if (document().isActive() && document().styleEngine()->fontSelector())
+        if (document().isActive() && document().styleEngine()->fontSelector()) {
             document().styleEngine()->fontSelector()->fontFaceCache()->remove(m_fontFaceRule.get());
+            document().accessSVGExtensions().registerPendingSVGFontFaceElementsForRemoval(this);
+        }
         m_fontFaceRule->mutableProperties().clear();
-
         document().styleResolverChanged(RecalcStyleDeferred);
     } else
         ASSERT(!m_fontElement);