[SVG Fonts] Fix <font-face> element leak document

Source/core/svg/SVGFontData.h

Index: Source/core/svg/SVGFontData.h
diff --git a/Source/core/svg/SVGFontData.h b/Source/core/svg/SVGFontData.h
index 8d4483fbfd7db70acd5823efcc19922a73f79bf2..bb22dfa00b456848d784afa43df0735f92bad31a 100644
--- a/Source/core/svg/SVGFontData.h
+++ b/Source/core/svg/SVGFontData.h
@@ -22,6 +22,7 @@
 
 #if ENABLE(SVG_FONTS)
 #include "platform/fonts/CustomFontData.h"
+#include "wtf/WeakPtr.h"
 #include "wtf/text/WTFString.h"
 
 namespace WebCore {
@@ -37,7 +38,7 @@ public:
         return adoptRef(new SVGFontData(element));
     }
 
-    virtual ~SVGFontData() { }
+    virtual ~SVGFontData();
 
     virtual bool isSVGFont() const OVERRIDE { return true; };
     virtual void initializeFontData(SimpleFontData*, float fontSize) OVERRIDE;
@@ -46,7 +47,7 @@ public:
     virtual bool applySVGGlyphSelection(WidthIterator&, GlyphData&, bool mirror, int currentCharacter, unsigned& advanceLength) const OVERRIDE;
 
 
-    SVGFontFaceElement* svgFontFaceElement() const { return m_svgFontFaceElement; }
+    SVGFontFaceElement* svgFontFaceElement() const { return m_svgFontFaceElement.get(); }

[Kunihiko Sakamoto, 2014/04/01 04:44:14]

Maybe RELEASE_ASSERT in this method? A couple of classes other than SVGFontData
is calling this.

[kouhei (in TOK), 2014/04/03 01:57:18]

Done.

 
     float horizontalOriginX() const { return m_horizontalOriginX; }
     float horizontalOriginY() const { return m_horizontalOriginY; }
@@ -70,7 +71,7 @@ private:
     // 2) in the in-document font case: by virtue of being in the document tree and making sure that when it is removed
     //    from the document, it removes the @font-face rule it owns from the document's mapped element sheet and forces
     //    a style update.
-    SVGFontFaceElement* m_svgFontFaceElement;
+    WeakPtr<SVGFontFaceElement> m_svgFontFaceElement;
 
     float m_horizontalOriginX;
     float m_horizontalOriginY;