[SVG Fonts] Fix <font-face> element leak document

Source/core/svg/SVGFontData.cpp

 /*
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 28 matching lines @@
 #include "wtf/unicode/CharacterNames.h"
 #include "wtf/unicode/Unicode.h"
 
 using namespace WTF;
 using namespace Unicode;
 
 namespace WebCore {
 
 SVGFontData::SVGFontData(SVGFontFaceElement* fontFaceElement)
     : CustomFontData()
-    , m_svgFontFaceElement(fontFaceElement)
+    , m_svgFontFaceElement(fontFaceElement->createWeakRef())
     , m_horizontalOriginX(fontFaceElement->horizontalOriginX())
     , m_horizontalOriginY(fontFaceElement->horizontalOriginY())
     , m_horizontalAdvanceX(fontFaceElement->horizontalAdvanceX())
     , m_verticalOriginX(fontFaceElement->verticalOriginX())
     , m_verticalOriginY(fontFaceElement->verticalOriginY())
     , m_verticalAdvanceY(fontFaceElement->verticalAdvanceY())
 {
     ASSERT_ARG(fontFaceElement, fontFaceElement);
 }
 
+SVGFontData::~SVGFontData()
+{
+}
+
 void SVGFontData::initializeFontData(SimpleFontData* fontData, float fontSize)
 {
     ASSERT(fontData);
 
     SVGFontFaceElement* svgFontFaceElement = this->svgFontFaceElement();
-    ASSERT(svgFontFaceElement && svgFontFaceElement->inDocument());
 
     SVGFontElement* svgFontElement = svgFontFaceElement->associatedFontElement();
     ASSERT(svgFontElement);
     GlyphData missingGlyphData;
     missingGlyphData.fontData = fontData;
     missingGlyphData.glyph = svgFontElement->missingGlyph();
     fontData->setMissingGlyphData(missingGlyphData);
 
     fontData->setZeroWidthSpaceGlyph(0);
     fontData->determinePitch();
@@ skipping 38 matching lines @@
     Glyph numeralZeroGlyph = glyphPageZero->glyphForCharacter('0');
     fontData->setAvgCharWidth(numeralZeroGlyph ? fontData->widthForGlyph(numeralZeroGlyph) : fontData->spaceWidth());
 
     // Estimate maximum character width.
     Glyph letterWGlyph = glyphPageZero->glyphForCharacter('W');
     fontData->setMaxCharWidth(letterWGlyph ? fontData->widthForGlyph(letterWGlyph) : ascent);
 }
 
 float SVGFontData::widthForSVGGlyph(Glyph glyph, float fontSize) const
 {
+    // FIXME: (http://crbug.com/359380) Width calculation may be triggered after removeNode from the current editing impl.
+    // The retrieved width is not being used, so here we return a dummy value.
+    if (shouldSkipDrawing())
+        return 0.0;
+
     SVGFontFaceElement* svgFontFaceElement = this->svgFontFaceElement();
-    ASSERT(svgFontFaceElement);
+
     // RenderView::clearSelection is invoked while removing some element, e.g.
     // Document::nodeWillBeRemoved => FrameSelection::nodeWillBeRemoved => RenderView::clearSelection.
     // Since recalc style has not been executed yet, RenderStyle might have some reference to
     // SVGFontFaceElement which was also removed.
     // In this case, use default horizontalAdvanceX instead of associatedFontElement's one.
     if (!svgFontFaceElement->inDocument())
         return m_horizontalAdvanceX * scaleEmToUnits(fontSize, svgFontFaceElement->unitsPerEm());
 
     SVGFontElement* associatedFontElement = svgFontFaceElement->associatedFontElement();
     ASSERT(associatedFontElement);
@@ skipping 19 matching lines @@
         remainingTextInRun = String(run.data16(currentCharacter), run.charactersLength() - currentCharacter);
         remainingTextInRun = Character::normalizeSpaces(remainingTextInRun.characters16(), remainingTextInRun.length());
     }
 
     if (mirror)
         remainingTextInRun = createStringWithMirroredCharacters(remainingTextInRun);
     if (!currentCharacter && arabicForms.isEmpty())
         arabicForms = charactersWithArabicForm(remainingTextInRun, mirror);
 
     SVGFontFaceElement* svgFontFaceElement = this->svgFontFaceElement();
-    ASSERT(svgFontFaceElement && svgFontFaceElement->inDocument());
-
     SVGFontElement* associatedFontElement = svgFontFaceElement->associatedFontElement();
     ASSERT(associatedFontElement);
 
     RenderObject* renderObject = 0;
     if (TextRun::RenderingContext* renderingContext = run.renderingContext())
         renderObject = static_cast<SVGTextRunRenderingContext*>(renderingContext)->renderer();
 
     String language;
     bool isVerticalText = false;
     Vector<AtomicString> altGlyphNames;
@@ skipping 49 matching lines @@
 
     return false;
 }
 
 bool SVGFontData::fillSVGGlyphPage(GlyphPage* pageToFill, unsigned offset, unsigned length, UChar* buffer, unsigned bufferLength, const SimpleFontData* fontData) const
 {
     ASSERT(fontData->isCustomFont());
     ASSERT(fontData->isSVGFont());
 
     SVGFontFaceElement* fontFaceElement = this->svgFontFaceElement();
-    ASSERT(fontFaceElement && fontFaceElement->inDocument());
-
     SVGFontElement* fontElement = fontFaceElement->associatedFontElement();
     ASSERT(fontElement);
 
     if (bufferLength == length)
         return fillBMPGlyphs(fontElement, pageToFill, offset, length, buffer, fontData);
 
     ASSERT(bufferLength == 2 * length);
     return fillNonBMPGlyphs(fontElement, pageToFill, offset, length, buffer, fontData);
 }
 
@@ skipping 66 matching lines @@
         while (i < length) {
             UChar32 character;
             U16_NEXT(characters, i, length, character);
             mirroredCharacters.append(mirroredChar(character));
         }
     }
 
     return mirroredCharacters.toString();
 }
 
+SVGFontFaceElement* SVGFontData::svgFontFaceElement() const
+{
+    // FIXME: SVGFontData should be only used from the document with the SVGFontFaceElement.
+    RELEASE_ASSERT(m_svgFontFaceElement && m_svgFontFaceElement->inDocument());
+    return m_svgFontFaceElement.get();
+}
+
+bool SVGFontData::shouldSkipDrawing() const
+{
+    return !m_svgFontFaceElement || !m_svgFontFaceElement->inDocument();

[Kunihiko Sakamoto, 2014/04/03 03:17:08]

This is workaround for crbug.com/359380, right?
If so, please add a FIXME comment here as well.

[kouhei (in TOK), 2014/04/03 09:17:59]

Done.

+}
+
 } // namespace WebCore
 
 #endif