3 files changed, 39 insertions, 30 deletions

diff --git a/layout/style/FontFaceImpl.cpp b/layout/style/FontFaceImpl.cpp
index 30f16e4be8..bd7e6a595f 100644
--- a/layout/style/FontFaceImpl.cpp
+++ b/layout/style/FontFaceImpl.cpp
@@ -676,25 +676,40 @@ bool FontFaceImpl::IsInFontFaceSet(FontFaceSetImpl* aFontFaceSet) const {
 void FontFaceImpl::AddFontFaceSet(FontFaceSetImpl* aFontFaceSet) {
   MOZ_ASSERT(!IsInFontFaceSet(aFontFaceSet));
 
-  if (mFontFaceSet == aFontFaceSet) {
-    mInFontFaceSet = true;
+  auto doAddFontFaceSet = [&]() {
+    if (mFontFaceSet == aFontFaceSet) {
+      mInFontFaceSet = true;
+    } else {
+      mOtherFontFaceSets.AppendElement(aFontFaceSet);
+    }
+  };
+
+  if (mUserFontEntry) {
+    AutoWriteLock lock(mUserFontEntry->Lock());
+    doAddFontFaceSet();
   } else {
-    mOtherFontFaceSets.AppendElement(aFontFaceSet);
+    doAddFontFaceSet();
   }
 }
 
 void FontFaceImpl::RemoveFontFaceSet(FontFaceSetImpl* aFontFaceSet) {
   MOZ_ASSERT(IsInFontFaceSet(aFontFaceSet));
 
-  if (mFontFaceSet == aFontFaceSet) {
-    mInFontFaceSet = false;
-  } else {
-    mOtherFontFaceSets.RemoveElement(aFontFaceSet);
-  }
+  auto doRemoveFontFaceSet = [&]() {
+    if (mFontFaceSet == aFontFaceSet) {
+      mInFontFaceSet = false;
+    } else {
+      mOtherFontFaceSets.RemoveElement(aFontFaceSet);
+    }
+  };
 
-  // The caller should be holding a strong reference to the FontFaceSetImpl.
   if (mUserFontEntry) {
-    mUserFontEntry->CheckUserFontSet();
+    AutoWriteLock lock(mUserFontEntry->Lock());
+    doRemoveFontFaceSet();
+    // The caller should be holding a strong reference to the FontFaceSetImpl.
+    mUserFontEntry->CheckUserFontSetLocked();
+  } else {
+    doRemoveFontFaceSet();
   }
 }
 
@@ -737,7 +752,7 @@ void FontFaceImpl::Entry::SetLoadState(UserFontLoadState aLoadState) {
 
   nsTArray<RefPtr<FontFaceImpl>> fontFaces;
   {
-    MutexAutoLock lock(mMutex);
+    AutoReadLock lock(mLock);
     fontFaces.SetCapacity(mFontFaces.Length());
     for (FontFaceImpl* f : mFontFaces) {
       fontFaces.AppendElement(f);
@@ -759,7 +774,7 @@ void FontFaceImpl::Entry::SetLoadState(UserFontLoadState aLoadState) {
 /* virtual */
 void FontFaceImpl::Entry::GetUserFontSets(
     nsTArray<RefPtr<gfxUserFontSet>>& aResult) {
-  MutexAutoLock lock(mMutex);
+  AutoReadLock lock(mLock);
 
   aResult.Clear();
 
@@ -784,7 +799,7 @@ void FontFaceImpl::Entry::GetUserFontSets(
 
 /* virtual */ already_AddRefed<gfxUserFontSet>
 FontFaceImpl::Entry::GetUserFontSet() const {
-  MutexAutoLock lock(mMutex);
+  AutoReadLock lock(mLock);
   if (mFontSet) {
     return do_AddRef(mFontSet);
   }
@@ -817,7 +832,7 @@ void FontFaceImpl::Entry::CheckUserFontSetLocked() {
 }
 
 void FontFaceImpl::Entry::FindFontFaceOwners(nsTHashSet<FontFace*>& aOwners) {
-  MutexAutoLock lock(mMutex);
+  AutoReadLock lock(mLock);
   for (FontFaceImpl* f : mFontFaces) {
     if (FontFace* owner = f->GetOwner()) {
       aOwners.Insert(owner);
@@ -826,13 +841,13 @@ void FontFaceImpl::Entry::FindFontFaceOwners(nsTHashSet<FontFace*>& aOwners) {
 }
 
 void FontFaceImpl::Entry::AddFontFace(FontFaceImpl* aFontFace) {
-  MutexAutoLock lock(mMutex);
+  AutoWriteLock lock(mLock);
   mFontFaces.AppendElement(aFontFace);
   CheckUserFontSetLocked();
 }
 
 void FontFaceImpl::Entry::RemoveFontFace(FontFaceImpl* aFontFace) {
-  MutexAutoLock lock(mMutex);
+  AutoWriteLock lock(mLock);
   mFontFaces.RemoveElement(aFontFace);
   CheckUserFontSetLocked();
 }
diff --git a/layout/style/FontFaceImpl.h b/layout/style/FontFaceImpl.h
index 70c06609e9..7f1279a248 100644
--- a/layout/style/FontFaceImpl.h
+++ b/layout/style/FontFaceImpl.h
@@ -10,7 +10,7 @@
 #include "mozilla/dom/FontFaceBinding.h"
 #include "mozilla/FontPropertyTypes.h"
 #include "mozilla/Maybe.h"
-#include "mozilla/Mutex.h"
+#include "mozilla/RWLock.h"
 #include "mozilla/ServoStyleConsts.h"
 #include "gfxUserFontSet.h"
 #include "nsCSSPropertyID.h"
@@ -50,21 +50,15 @@ class FontFaceImpl final {
     Entry(gfxUserFontSet* aFontSet, nsTArray<gfxFontFaceSrc>&& aFontFaceSrcList,
           gfxUserFontAttributes&& aAttr)
         : gfxUserFontEntry(std::move(aFontFaceSrcList), std::move(aAttr)),
-          mMutex("FontFaceImpl::Entry::mMutex"),
           mFontSet(aFontSet) {}
 
     void SetLoadState(UserFontLoadState aLoadState) override;
     void GetUserFontSets(nsTArray<RefPtr<gfxUserFontSet>>& aResult) override;
     already_AddRefed<gfxUserFontSet> GetUserFontSet() const override;
 
-    void CheckUserFontSet() {
-      MutexAutoLock lock(mMutex);
-      CheckUserFontSetLocked();
-    }
-
 #ifdef DEBUG
     bool HasUserFontSet(gfxUserFontSet* aFontSet) const {
-      MutexAutoLock lock(mMutex);
+      AutoReadLock lock(mLock);
       return mFontSet == aFontSet;
     }
 #endif
@@ -73,19 +67,19 @@ class FontFaceImpl final {
     void RemoveFontFace(FontFaceImpl* aOwner);
     void FindFontFaceOwners(nsTHashSet<FontFace*>& aOwners);
 
-   protected:
-    void CheckUserFontSetLocked() MOZ_REQUIRES(mMutex);
+    RWLock& Lock() const MOZ_RETURN_CAPABILITY(mLock) { return mLock; }
 
-    mutable Mutex mMutex;
+   protected:
+    void CheckUserFontSetLocked() MOZ_REQUIRES(mLock);
 
     // Font set which owns this entry;
-    gfxUserFontSet* MOZ_NON_OWNING_REF mFontSet MOZ_GUARDED_BY(mMutex);
+    gfxUserFontSet* MOZ_NON_OWNING_REF mFontSet MOZ_GUARDED_BY(mLock);
 
     // The FontFace objects that use this user font entry.  We need to store
     // an array of these, not just a single pointer, since the user font
     // cache can return the same entry for different FontFaces that have
     // the same descriptor values and come from the same origin.
-    AutoTArray<FontFaceImpl*, 1> mFontFaces MOZ_GUARDED_BY(mMutex);
+    AutoTArray<FontFaceImpl*, 1> mFontFaces MOZ_GUARDED_BY(mLock);
   };
 
 #ifdef DEBUG
diff --git a/layout/xul/tree/nsTreeBodyFrame.cpp b/layout/xul/tree/nsTreeBodyFrame.cpp
index c7e8272aa0..582860179b 100644
--- a/layout/xul/tree/nsTreeBodyFrame.cpp
+++ b/layout/xul/tree/nsTreeBodyFrame.cpp
@@ -3960,7 +3960,7 @@ void nsTreeBodyFrame::RemoveImageCacheEntry(int32_t aRowIndex,
                                             nsTreeColumn* aCol) {
   nsAutoString imageSrc;
   nsCOMPtr<nsITreeView> view = GetExistingView();
-  if (NS_FAILED(view->GetImageSrc(aRowIndex, aCol, imageSrc))) {
+  if (!view || NS_FAILED(view->GetImageSrc(aRowIndex, aCol, imageSrc))) {
     return;
   }
   nsTreeImageCacheEntry entry;