LibWeb: Dont load a style sheet's fonts until it has an owning document

We need a style sheet to have an owning document to load it's fonts (to
generate a length resolution context).

Fixes #6445

Libraries/LibWeb/CSS/CSSImportRule.cpp

@@ -181,8 +181,6 @@ void CSSImportRule::set_style_sheet(GC::Ref<CSSStyleSheet> style_sheet)
     m_style_sheet = style_sheet;
     m_style_sheet->set_owner_css_rule(this);
 
-    m_document->style_computer().load_fonts_from_sheet(*m_style_sheet);
-
     if (m_parent_style_sheet) {
         for (auto owning_document_or_shadow_root : m_parent_style_sheet->owning_documents_or_shadow_roots())
             m_style_sheet->add_owning_document_or_shadow_root(*owning_document_or_shadow_root);

Libraries/LibWeb/CSS/CSSStyleSheet.cpp

@@ -322,6 +322,11 @@ void CSSStyleSheet::add_owning_document_or_shadow_root(DOM::Node& document_or_sh
     VERIFY(document_or_shadow_root.is_document() || document_or_shadow_root.is_shadow_root());
     m_owning_documents_or_shadow_roots.set(document_or_shadow_root);
 
+    // All owning documents or shadow roots must be part of the same document so we only need to load this style
+    // sheet's fonts against the document of the first
+    if (this->owning_documents_or_shadow_roots().size() == 1)
+        document_or_shadow_root.document().style_computer().load_fonts_from_sheet(*this);
+
     for (auto const& import_rule : m_import_rules) {
         if (import_rule->loaded_style_sheet())
             import_rule->loaded_style_sheet()->add_owning_document_or_shadow_root(document_or_shadow_root);
@@ -332,6 +337,11 @@ void CSSStyleSheet::remove_owning_document_or_shadow_root(DOM::Node& document_or
 {
     m_owning_documents_or_shadow_roots.remove(document_or_shadow_root);
 
+    // All owning documents or shadow roots must be part of the same document so we only need to unload this style
+    // sheet's fonts once we have none remaining.
+    if (this->owning_documents_or_shadow_roots().size() == 0)
+        document_or_shadow_root.document().style_computer().unload_fonts_from_sheet(*this);
+
     for (auto const& import_rule : m_import_rules) {
         if (import_rule->loaded_style_sheet())
             import_rule->loaded_style_sheet()->remove_owning_document_or_shadow_root(document_or_shadow_root);

Libraries/LibWeb/CSS/StyleSheetList.cpp

@@ -117,7 +117,6 @@ void StyleSheetList::add_sheet(CSSStyleSheet& sheet)
     }
 
     document().style_computer().invalidate_rule_cache();
-    document().style_computer().load_fonts_from_sheet(sheet);
     document_or_shadow_root().invalidate_style(DOM::StyleInvalidationReason::StyleSheetListAddSheet);
 }
 
@@ -132,7 +131,6 @@ void StyleSheetList::remove_sheet(CSSStyleSheet& sheet)
         return;
     }
 
-    m_document_or_shadow_root->document().style_computer().unload_fonts_from_sheet(sheet);
     m_document_or_shadow_root->document().style_computer().invalidate_rule_cache();
     document_or_shadow_root().invalidate_style(DOM::StyleInvalidationReason::StyleSheetListRemoveSheet);
 }

Libraries/LibWeb/DOM/AdoptedStyleSheets.cpp

@@ -31,7 +31,6 @@ GC::Ref<WebIDL::ObservableArray> create_adopted_style_sheets_list(Node& document
             return WebIDL::NotAllowedError::create(document_or_shadow_root.realm(), "Sharing a StyleSheet between documents is not allowed."_utf16);
 
         style_sheet.add_owning_document_or_shadow_root(document_or_shadow_root);
-        document_or_shadow_root.document().style_computer().load_fonts_from_sheet(style_sheet);
         document_or_shadow_root.document().style_computer().invalidate_rule_cache();
         document_or_shadow_root.invalidate_style(DOM::StyleInvalidationReason::AdoptedStyleSheetsList);
         return {};
@@ -43,7 +42,6 @@ GC::Ref<WebIDL::ObservableArray> create_adopted_style_sheets_list(Node& document
         auto& style_sheet = static_cast<CSS::CSSStyleSheet&>(object);
 
         style_sheet.remove_owning_document_or_shadow_root(document_or_shadow_root);
-        document_or_shadow_root.document().style_computer().unload_fonts_from_sheet(style_sheet);
         document_or_shadow_root.document().style_computer().invalidate_rule_cache();
         document_or_shadow_root.invalidate_style(DOM::StyleInvalidationReason::AdoptedStyleSheetsList);
         return {};

Tests/LibWeb/Crash/CSS/imported-style-sheet-loading-font-without-document.html

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<body>
+    <style id="style">
+        /*
+            The below data url is equivalent to:
+            @font-face {
+                font-family: Icons;
+                src: url(does/not/matter.ttf);
+                font-weight: 400;
+                font-style: normal;
+            }
+        */
+        @import url("data:text/css;charset=utf-8;base64,QGZvbnQtZmFjZSB7DQogICAgZm9udC1mYW1pbHk6IEljb25zOw0KICAgIHNyYzogdXJsKGRvZXMvbm90L21hdHRlci50dGYpOw0KICAgIGZvbnQtd2VpZ2h0OiA0MDA7DQogICAgZm9udC1zdHlsZTogbm9ybWFsOw0KfQ==");
+    </style>
+    <script>
+        style.remove();
+    </script>
+</body>