[SVG Fonts] Fix <font-face> element leak document

Source/core/svg/SVGFontData.cpp

Index: Source/core/svg/SVGFontData.cpp
diff --git a/Source/core/svg/SVGFontData.cpp b/Source/core/svg/SVGFontData.cpp
index a62697455da50d047415d5422b9f577545ca2094..2e53d4cb98e64c203e5cef0198483057960a4f61 100644
--- a/Source/core/svg/SVGFontData.cpp
+++ b/Source/core/svg/SVGFontData.cpp
@@ -46,7 +46,7 @@ namespace WebCore {
 
 SVGFontData::SVGFontData(SVGFontFaceElement* fontFaceElement)
     : CustomFontData()
-    , m_svgFontFaceElement(fontFaceElement)
+    , m_svgFontFaceElement(fontFaceElement->createWeakRef())
     , m_horizontalOriginX(fontFaceElement->horizontalOriginX())
     , m_horizontalOriginY(fontFaceElement->horizontalOriginY())
     , m_horizontalAdvanceX(fontFaceElement->horizontalAdvanceX())
@@ -57,12 +57,15 @@ SVGFontData::SVGFontData(SVGFontFaceElement* fontFaceElement)
     ASSERT_ARG(fontFaceElement, fontFaceElement);
 }
 
+SVGFontData::~SVGFontData()
+{
+}
+
 void SVGFontData::initializeFontData(SimpleFontData* fontData, float fontSize)
 {
     ASSERT(fontData);
 
     SVGFontFaceElement* svgFontFaceElement = this->svgFontFaceElement();
-    ASSERT(svgFontFaceElement && svgFontFaceElement->inDocument());
 
     SVGFontElement* svgFontElement = svgFontFaceElement->associatedFontElement();
     ASSERT(svgFontElement);
@@ -121,8 +124,13 @@ void SVGFontData::initializeFontData(SimpleFontData* fontData, float fontSize)
 
 float SVGFontData::widthForSVGGlyph(Glyph glyph, float fontSize) const
 {
+    // FIXME: (http://crbug.com/359380) Width calculation may be triggered after removeNode from the current editing impl.
+    // The retrieved width is not being used, so here we return a dummy value.
+    if (shouldSkipDrawing())
+        return 0.0;
+
     SVGFontFaceElement* svgFontFaceElement = this->svgFontFaceElement();
-    ASSERT(svgFontFaceElement);
+
     // RenderView::clearSelection is invoked while removing some element, e.g.
     // Document::nodeWillBeRemoved => FrameSelection::nodeWillBeRemoved => RenderView::clearSelection.
     // Since recalc style has not been executed yet, RenderStyle might have some reference to
@@ -162,8 +170,6 @@ bool SVGFontData::applySVGGlyphSelection(WidthIterator& iterator, GlyphData& gly
         arabicForms = charactersWithArabicForm(remainingTextInRun, mirror);
 
     SVGFontFaceElement* svgFontFaceElement = this->svgFontFaceElement();
-    ASSERT(svgFontFaceElement && svgFontFaceElement->inDocument());
-
     SVGFontElement* associatedFontElement = svgFontFaceElement->associatedFontElement();
     ASSERT(associatedFontElement);
 
@@ -233,8 +239,6 @@ bool SVGFontData::fillSVGGlyphPage(GlyphPage* pageToFill, unsigned offset, unsig
     ASSERT(fontData->isSVGFont());
 
     SVGFontFaceElement* fontFaceElement = this->svgFontFaceElement();
-    ASSERT(fontFaceElement && fontFaceElement->inDocument());
-
     SVGFontElement* fontElement = fontFaceElement->associatedFontElement();
     ASSERT(fontElement);
 
@@ -321,6 +325,19 @@ String SVGFontData::createStringWithMirroredCharacters(const String& string) con
     return mirroredCharacters.toString();
 }
 
+SVGFontFaceElement* SVGFontData::svgFontFaceElement() const
+{
+    // FIXME: SVGFontData should be only used from the document with the SVGFontFaceElement.
+    RELEASE_ASSERT(m_svgFontFaceElement && m_svgFontFaceElement->inDocument());
+    return m_svgFontFaceElement.get();
+}
+
+bool SVGFontData::shouldSkipDrawing() const
+{
+    // FIXME: (http://crbug.com/359380) Glyph may be referenced after removeNode from the current editing impl.
+    return !m_svgFontFaceElement || !m_svgFontFaceElement->inDocument();
+}
+
 } // namespace WebCore
 
 #endif