1 files changed, 22 insertions, 14 deletions

diff --git a/Source/WebCore/svg/SVGFontFaceUriElement.cpp b/Source/WebCore/svg/SVGFontFaceUriElement.cpp
index c45173c41..56d5e63c3 100644
--- a/Source/WebCore/svg/SVGFontFaceUriElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceUriElement.cpp
@@ -23,7 +23,6 @@
 #if ENABLE(SVG_FONTS)
 #include "SVGFontFaceUriElement.h"
 
-#include "Attribute.h"
 #include "CSSFontFaceSrcValue.h"
 #include "CachedFont.h"
 #include "CachedResourceLoader.h"
@@ -43,21 +42,21 @@ inline SVGFontFaceUriElement::SVGFontFaceUriElement(const QualifiedName& tagName
     ASSERT(hasTagName(font_face_uriTag));
 }
 
-PassRefPtr<SVGFontFaceUriElement> SVGFontFaceUriElement::create(const QualifiedName& tagName, Document& document)
+Ref<SVGFontFaceUriElement> SVGFontFaceUriElement::create(const QualifiedName& tagName, Document& document)
 {
-    return adoptRef(new SVGFontFaceUriElement(tagName, document));
+    return adoptRef(*new SVGFontFaceUriElement(tagName, document));
 }
 
 SVGFontFaceUriElement::~SVGFontFaceUriElement()
 {
     if (m_cachedFont)
-        m_cachedFont->removeClient(this);
+        m_cachedFont->removeClient(*this);
 }
 
-PassRef<CSSFontFaceSrcValue> SVGFontFaceUriElement::srcValue() const
+Ref<CSSFontFaceSrcValue> SVGFontFaceUriElement::srcValue() const
 {
     auto src = CSSFontFaceSrcValue::create(getAttribute(XLinkNames::hrefAttr));
-    AtomicString value(fastGetAttribute(formatAttr));
+    AtomicString value(attributeWithoutSynchronization(formatAttr));
     src.get().setFormat(value.isEmpty() ? "svg" : value); // Default format
     return src;
 }
@@ -79,7 +78,7 @@ void SVGFontFaceUriElement::childrenChanged(const ChildChange& change)
     
     ContainerNode* grandparent = parentNode()->parentNode();
     if (grandparent && grandparent->hasTagName(font_faceTag))
-        toSVGFontFaceElement(grandparent)->rebuildFontFace();
+        downcast<SVGFontFaceElement>(*grandparent).rebuildFontFace();
 }
 
 Node::InsertionNotificationRequest SVGFontFaceUriElement::insertedInto(ContainerNode& rootParent)
@@ -88,23 +87,32 @@ Node::InsertionNotificationRequest SVGFontFaceUriElement::insertedInto(Container
     return SVGElement::insertedInto(rootParent);
 }
 
+static bool isSVGFontTarget(const SVGFontFaceUriElement& element)
+{
+    Ref<CSSFontFaceSrcValue> srcValue(element.srcValue());
+    return srcValue->isSVGFontTarget();
+}
+
 void SVGFontFaceUriElement::loadFont()
 {
     if (m_cachedFont)
-        m_cachedFont->removeClient(this);
+        m_cachedFont->removeClient(*this);
 
     const AtomicString& href = getAttribute(XLinkNames::hrefAttr);
     if (!href.isNull()) {
-        CachedResourceLoader* cachedResourceLoader = document().cachedResourceLoader();
-        CachedResourceRequest request(ResourceRequest(document().completeURL(href)));
-        request.setInitiator(this);
-        m_cachedFont = cachedResourceLoader->requestFont(request);
+        ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
+        options.contentSecurityPolicyImposition = isInUserAgentShadowTree() ? ContentSecurityPolicyImposition::SkipPolicyCheck : ContentSecurityPolicyImposition::DoPolicyCheck;
+
+        CachedResourceLoader& cachedResourceLoader = document().cachedResourceLoader();
+        CachedResourceRequest request(ResourceRequest(document().completeURL(href)), options);
+        request.setInitiator(*this);
+        m_cachedFont = cachedResourceLoader.requestFont(WTFMove(request), isSVGFontTarget(*this));
         if (m_cachedFont) {
-            m_cachedFont->addClient(this);
+            m_cachedFont->addClient(*this);
             m_cachedFont->beginLoadIfNeeded(cachedResourceLoader);
         }
     } else
-        m_cachedFont = 0;
+        m_cachedFont = nullptr;
 }
 
 }