In the chromium port of FontCustomPlatformData, an instance of RemoteFontStream is allocated on the stack, so its memory is freed immediately when FontCustomPlatformData::createFontCustomPlatformData returns. SkTypeface::CreateFromStream increments the reference count, but it keeps the pointer to the memory allocated on the stack which is not valid anymore. RemoteFontStream is a descendant of SkRefCount and SkRefCount::unref invokes SkDELETE(this) internally once the reference count reaches zero. This means that SkRefCount-ed instances must be allocated on the heap. It causes a crash in the acid3 test which loads web fonts.
Created attachment 45363 [details] Allocate RemoteFontStream on the heap RemoteFontStream must be allocated on the heap.
style-queue ran check-webkit-style on attachment 45363 [details] without any errors.
This would need review from one of the Chrome linux guys. Once they OK it, I'm happy to r+.
LGTM
Comment on attachment 45363 [details] Allocate RemoteFontStream on the heap Clearing flags on attachment: 45363 Committed r52492: <http://trac.webkit.org/changeset/52492>
All reviewed patches have been landed. Closing bug.