angler-fishThe Vulnerability History Project

Fix crash in SVGFontFaceElement::associatedFontElement crash when removing SVGFontFaceElement.

      (1) We need to remove its font-face rule from FontCache when removing SVGFontFaceElement,

(2) We should not use old styles in RenderSVGInlineText::styleDidChange.
Since styleRecalc is done in document-order, we cannot see any styles of next renderer
(obtained by nextInPreOrder).
The old styles might have old fonts which are created by SVGFontFaceElement.

BUG=346192
TEST=fast/dom/discard-svg-font-face-crash.svg

Review URL: https://codereview.chromium.org/176853009

git-svn-id: svn://svn.chromium.org/blink/trunk@167993 bbb929c8-8fbe-4397-9dbb-9b2b20218538
    
commit 9f88c15fbcd76321cfeedf3f4792534cb6041c4e
-9
-15
+1 -1
+3 -5
+1 -1
-3
expand_less