1163446 - drop reference to FontFace once a FontFaceBufferSource is loaded

Status: RESOLVED FIXED

(Core :: DOM: CSS Object Model, defect)

Description

[Cameron McCormack (:heycam)]

Attachment: patch

A FontFaceBufferSource encapsulates an ArrayBuffer(Source) for gfxUserFontSet.  It holds a strong reference to the FontFace which initially owns the buffer.  Once the gfxUserFontSet takes ownership of the buffer to parse it as a font, the FontFaceBufferSource no longer needs a reference to the FontFace.

Dropping the reference to the FontFace is needed for bug 1161413, where we can no longer rely on a call to FontFaceSet::DestroyUserFontSet at pres context destruction time to drop enough references so that we don't leak.  Otherwise a simple document like this will leak:

  <script>new FontFace("x", new ArrayBuffer(0))</script>

as the gfxUserFontSet holds on to the FontFace (through the FontFaceBufferSource in its mSrcList).

We could alternatively traverse/unlink the FontFace reference in FontFaceBufferSource from FontFaceSet's CC macros, but it's easier to just drop the reference here.

Comment 1

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6325283ba40b

Comment 2

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/651e2c2015f6

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/6325283ba40b
https://hg.mozilla.org/mozilla-central/rev/651e2c2015f6