Fix crash in FontFaceSet::ready

third_party/WebKit/Source/core/css/FontFaceSet.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 225 matching lines @@
   fontFace->addCallback(this);
 }
 
 void FontFaceSet::removeFromLoadingFonts(FontFace* fontFace) {
   m_loadingFonts.erase(fontFace);
   if (m_loadingFonts.isEmpty())
     handlePendingEventsAndPromisesSoon();
 }
 
 ScriptPromise FontFaceSet::ready(ScriptState* scriptState) {
-  if (m_ready->getState() != ReadyProperty::Pending) {
+  if (m_ready->getState() != ReadyProperty::Pending &&
+      inActiveDocumentContext()) {
     // |m_ready| is already resolved, but there may be pending stylesheet
     // changes and/or layout operations that may cause another font loads.
     // So synchronously update style and layout here.
     // This may trigger font loads, and replace |m_ready| with a new Promise.
     document()->updateStyleAndLayout();
   }
   return m_ready->promise(scriptState->world());
 }
 
 FontFaceSet* FontFaceSet::addForBinding(ScriptState*,
@@ skipping 311 matching lines @@
   visitor->trace(m_failedFonts);
   visitor->trace(m_nonCSSConnectedFaces);
   visitor->trace(m_asyncRunner);
   EventTargetWithInlineData::trace(visitor);
   Supplement<Document>::trace(visitor);
   SuspendableObject::trace(visitor);
   FontFace::LoadFontCallback::trace(visitor);
 }
 
 }  // namespace blink