[SVG Fonts] Fix <font-face> element leak document

Source/core/css/FontFace.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 567 matching lines @@
                     } else
 #endif
                     {
                         source = adoptPtr(new RemoteFontFaceSource(fetched));
                     }
                 }
             }
         } else {
 #if ENABLE(SVG_FONTS)
             if (item->svgFontFaceElement()) {
-                source = adoptPtr(new SVGFontFaceSource(item->svgFontFaceElement()));
+                RefPtr<SVGFontFaceElement> fontfaceElement = item->svgFontFaceElement();
+                // SVGFontFaceSource assumes that it is the case where <font-face> element resides in the same document.
+                // We put a RELEASE_ASSERT here as it will cause UAF if the assumption is false.
+                RELEASE_ASSERT(fontfaceElement->inDocument());
+                RELEASE_ASSERT(fontfaceElement->document() == document);
+                source = adoptPtr(new SVGFontFaceSource(fontfaceElement.get()));
             } else
 #endif
             {
                 source = adoptPtr(new LocalFontFaceSource(item->resource()));
             }
         }
 
         if (source)
             m_cssFontFace->addSource(source.release());
     }
@@ skipping 25 matching lines @@
     visitor->trace(m_featureSettings);
     visitor->trace(m_error);
 }
 
 bool FontFace::hadBlankText() const
 {
     return m_cssFontFace->hadBlankText();
 }
 
 } // namespace WebCore