After the document is destroyed, it doesn't make any sense for a font to extend the lifetime of the font selector. Once this is done, CSSFontSelector can probably be a std::unique_ptr or even a raw member variable of Document.
This should be done for all references to a FontSelector, except for the Document's.