Fix Refcount in FontDataCache for objects from FontFallbackIterator

third_party/WebKit/Source/core/css/CSSSegmentedFontFace.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 107 matching lines @@
     FontDescription requestedFontDescription(fontDescription);
     requestedFontDescription.setTraits(m_traits);
     requestedFontDescription.setSyntheticBold(m_traits.weight() < FontWeight600 && desiredTraits.weight() >= FontWeight600);
     requestedFontDescription.setSyntheticItalic(m_traits.style() == FontStyleNormal && desiredTraits.style() == FontStyleItalic);
 
     for (FontFaceList::reverse_iterator it = m_fontFaces.rbegin(); it != m_fontFaces.rend(); ++it) {
         if (!(*it)->cssFontFace()->isValid())
             continue;
         if (RefPtr<SimpleFontData> faceFontData = (*it)->cssFontFace()->getFontData(requestedFontDescription)) {
             ASSERT(!faceFontData->isSegmented());
-            fontData->appendFace(FontDataForRangeSet(faceFontData.release(), (*it)->cssFontFace()->ranges()));
+            if (faceFontData->isCustomFont())
+                fontData->appendFace(adoptRef(new FontDataForRangeSet(faceFontData.release(), (*it)->cssFontFace()->ranges())));
+            else
+                fontData->appendFace(adoptRef(new FontDataForRangeSetFromCache(faceFontData.release(), (*it)->cssFontFace()->ranges())));
         }
     }
     if (fontData->numFaces())
         return fontData; // No release, we have a reference to an object in the cache which should retain the ref count it has.
 
     return nullptr;
 }
 
 void CSSSegmentedFontFace::willUseFontData(const FontDescription& fontDescription, const String& text)
 {
@@ skipping 35 matching lines @@
     }
 }
 
 DEFINE_TRACE(CSSSegmentedFontFace)
 {
     visitor->trace(m_fontSelector);
     visitor->trace(m_fontFaces);
 }
 
 } // namespace blink