Cherrypick WebKit r94508.

http://trac.webkit.org/changeset/94508

This, in conjunction with WebKit r95959, addresses our issue involving
referencing deleted fonts.

Bug: 6105670
Change-Id: Ica4c89046ed47e2c75d13640a27ac92f2aad6709

6 files changed, 32 insertions, 4 deletions

diff --git a/Source/WebCore/css/CSSFontFace.cpp b/Source/WebCore/css/CSSFontFace.cpp
index 2c50a04..3b6dea4 100644
--- a/Source/WebCore/css/CSSFontFace.cpp
+++ b/Source/WebCore/css/CSSFontFace.cpp
@@ -118,6 +118,19 @@ SimpleFontData* CSSFontFace::getFontData(const FontDescription& fontDescription,
     return 0;
 }
 
+void CSSFontFace::retireCustomFont(SimpleFontData* fontData)
+{
+    if (m_segmentedFontFaces.isEmpty()) {
+        GlyphPageTreeNode::pruneTreeCustomFontData(fontData);
+        delete fontData;
+        return;
+    }
+
+    // Use one of the CSSSegmentedFontFaces' font selector. They all have
+    // the same font selector.
+    (*m_segmentedFontFaces.begin())->fontSelector()->retireCustomFont(fontData);
+}
+
 #if ENABLE(SVG_FONTS)
 bool CSSFontFace::hasSVGFontFaceSource() const
 {
diff --git a/Source/WebCore/css/CSSFontFace.h b/Source/WebCore/css/CSSFontFace.h
index 55e048c..45f8f13 100644
--- a/Source/WebCore/css/CSSFontFace.h
+++ b/Source/WebCore/css/CSSFontFace.h
@@ -63,6 +63,7 @@ public:
     void addSource(CSSFontFaceSource*);
 
     void fontLoaded(CSSFontFaceSource*);
+    void retireCustomFont(SimpleFontData*);
 
     SimpleFontData* getFontData(const FontDescription&, bool syntheticBold, bool syntheticItalic);
 
diff --git a/Source/WebCore/css/CSSFontFaceSource.cpp b/Source/WebCore/css/CSSFontFaceSource.cpp
index eeb90a4..49175e6 100644
--- a/Source/WebCore/css/CSSFontFaceSource.cpp
+++ b/Source/WebCore/css/CSSFontFaceSource.cpp
@@ -69,10 +69,11 @@ void CSSFontFaceSource::pruneTable()
 {
     if (m_fontDataTable.isEmpty())
         return;
+
     HashMap<unsigned, SimpleFontData*>::iterator end = m_fontDataTable.end();
     for (HashMap<unsigned, SimpleFontData*>::iterator it = m_fontDataTable.begin(); it != end; ++it)
-        GlyphPageTreeNode::pruneTreeCustomFontData(it->second);
-    deleteAllValues(m_fontDataTable);
+        m_face->retireCustomFont(it->second);
+
     m_fontDataTable.clear();
 }
 
diff --git a/Source/WebCore/css/CSSFontSelector.cpp b/Source/WebCore/css/CSSFontSelector.cpp
index 8024afa..0f70664 100644
--- a/Source/WebCore/css/CSSFontSelector.cpp
+++ b/Source/WebCore/css/CSSFontSelector.cpp
@@ -378,6 +378,16 @@ void CSSFontSelector::fontCacheInvalidated()
     dispatchInvalidationCallbacks();
 }
 
+void CSSFontSelector::retireCustomFont(FontData* fontData)
+{
+    if (m_document)
+        m_document->retireCustomFont(fontData);
+    else {
+        GlyphPageTreeNode::pruneTreeCustomFontData(fontData);
+        delete fontData;
+    }
+}
+
 static FontData* fontDataForGenericFamily(Document* document, const FontDescription& fontDescription, const AtomicString& familyName)
 {
     if (!document || !document->frame())
diff --git a/Source/WebCore/css/CSSFontSelector.h b/Source/WebCore/css/CSSFontSelector.h
index f50ea42..2b0df28 100644
--- a/Source/WebCore/css/CSSFontSelector.h
+++ b/Source/WebCore/css/CSSFontSelector.h
@@ -59,6 +59,8 @@ public:
     void fontLoaded();
     virtual void fontCacheInvalidated();
 
+    void retireCustomFont(FontData*);
+
     bool isEmpty() const;
 
     CachedResourceLoader* cachedResourceLoader() const;
diff --git a/Source/WebCore/css/CSSSegmentedFontFace.cpp b/Source/WebCore/css/CSSSegmentedFontFace.cpp
index 1f6e20d..6303ff8 100644
--- a/Source/WebCore/css/CSSSegmentedFontFace.cpp
+++ b/Source/WebCore/css/CSSSegmentedFontFace.cpp
@@ -52,10 +52,11 @@ void CSSSegmentedFontFace::pruneTable()
     // Make sure the glyph page tree prunes out all uses of this custom font.
     if (m_fontDataTable.isEmpty())
         return;
+
     HashMap<unsigned, SegmentedFontData*>::iterator end = m_fontDataTable.end();
     for (HashMap<unsigned, SegmentedFontData*>::iterator it = m_fontDataTable.begin(); it != end; ++it)
-        GlyphPageTreeNode::pruneTreeCustomFontData(it->second);
-    deleteAllValues(m_fontDataTable);
+        m_fontSelector->retireCustomFont(it->second);
+
     m_fontDataTable.clear();
 }