Document owns a DocumentFontLoader as a plain unique_ptr member (m_fontLoader) with no independent reference counting. DocumentFontLoader::loadPendingFonts() iterates and starts pending font loads, and font loading can synchronously run author script — for example an <iframe onload> handler that removes itself, which can tear down its Document and, transitively, free the DocumentFontLoader while loadPendingFonts() is still executing on it. Operating on the freed loader (or the freed Document it points at) after the callback is a use-after-free.

The fix gives DocumentFontLoader lifetime tied to its Document: it adds ref()/deref() that forward to m_document, is created with makeUniqueWithoutRefCountedCheck, and loadPendingFonts() takes Ref protectedThis { *this } at entry so the loader (and its Document) are kept alive for the duration of the potentially-reentrant load, even if script destroys the document mid-iteration.

The restored invariant is that the font loader cannot be freed while it is running font loads that may re-enter through script. The layout test loads a cached font and removes the loading iframes on their onload, reproducing the destroy-during-load re-entrancy under ASan.

A use-after-free of a Document’s font loader when script destroys the document during font loading, reachable from ordinary @font-face usage plus self-removing subframes, in the WebContent process. Attacker control over the re-entrancy timing makes it a groomable UAF; the observable is an ASan crash. Confined to WebContent; rated medium.