Fix Refcount in FontDataCache for objects from FontFallbackIterator

third_party/WebKit/Source/platform/fonts/shaping/HarfBuzzShaper.cpp

Index: third_party/WebKit/Source/platform/fonts/shaping/HarfBuzzShaper.cpp
diff --git a/third_party/WebKit/Source/platform/fonts/shaping/HarfBuzzShaper.cpp b/third_party/WebKit/Source/platform/fonts/shaping/HarfBuzzShaper.cpp
index 0999e941170d1c6e4868e60ed45be1ccad47389a..ef8418e9ec19dd9287fe44749906f500488e9e1f 100644
--- a/third_party/WebKit/Source/platform/fonts/shaping/HarfBuzzShaper.cpp
+++ b/third_party/WebKit/Source/platform/fonts/shaping/HarfBuzzShaper.cpp
@@ -582,8 +582,7 @@ PassRefPtr<ShapeResult> HarfBuzzShaper::shapeResult()
         appendToHolesQueue(HolesQueueNextFont, 0, 0);
         appendToHolesQueue(HolesQueueRange, segmentRange.start, segmentRange.end - segmentRange.start);
 
-        const SimpleFontData* currentFont = nullptr;
-        RefPtr<UnicodeRangeSet> currentFontRangeSet;
+        RefPtr<FontDataForRangeSet> currentFontDataForRangeSet;
 
         bool fontCycleQueued = false;
         while (m_holesQueue.size()) {
@@ -603,11 +602,9 @@ PassRefPtr<ShapeResult> HarfBuzzShaper::shapeResult()
                     break;
                 }
 
-                FontDataForRangeSet nextFontDataForRangeSet = fallbackIterator->next(fallbackCharsHint);
-                currentFont = nextFontDataForRangeSet.fontData();
-                currentFontRangeSet = nextFontDataForRangeSet.ranges();
+                currentFontDataForRangeSet = fallbackIterator->next(fallbackCharsHint);
 
-                if (!currentFont) {
+                if (!currentFontDataForRangeSet->fontData()) {
                     ASSERT(!m_holesQueue.size());
                     break;
                 }
@@ -617,7 +614,8 @@ PassRefPtr<ShapeResult> HarfBuzzShaper::shapeResult()
 
             SmallCapsIterator::SmallCapsBehavior smallCapsBehavior = SmallCapsIterator::SmallCapsSameCase;
             if (needsCapsHandling) {
-                capsSupport = OpenTypeCapsSupport(currentFont->platformData().harfBuzzFace(),
+                capsSupport = OpenTypeCapsSupport(
+                    currentFontDataForRangeSet->fontData()->platformData().harfBuzzFace(),
                     fontDescription.variantCaps(),
                     ICUScriptToHBScript(segmentRange.script));
                 if (capsSupport.needsRunCaseSplitting())
@@ -628,8 +626,8 @@ PassRefPtr<ShapeResult> HarfBuzzShaper::shapeResult()
 
             const SimpleFontData* smallcapsAdjustedFont = needsCapsHandling
                 && capsSupport.needsSyntheticFont(smallCapsBehavior)
-                ? currentFont->smallCapsFontData(fontDescription).get()
-                : currentFont;
+                ? currentFontDataForRangeSet->fontData()->smallCapsFontData(fontDescription).get()
+                : currentFontDataForRangeSet->fontData();
 
             // Compatibility with SimpleFontData approach of keeping a flag for overriding drawing direction.
             // TODO: crbug.com/506224 This should go away in favor of storing that information elsewhere, for example in
@@ -657,7 +655,7 @@ PassRefPtr<ShapeResult> HarfBuzzShaper::shapeResult()
                 currentQueueItem.m_startIndex,
                 currentQueueItem.m_numCharacters,
                 directionAndSmallCapsAdjustedFont,
-                currentFontRangeSet,
+                currentFontDataForRangeSet->ranges(),
                 segmentRange.script,
                 language))
                 DLOG(ERROR) << "Shaping range failed.";