Bug 1777301 - Fix crash in FontFaceSetDocumentImpl::Destroy due to clearing document reference too early. r=jfkthame

Differential Revision: https://phabricator.services.mozilla.com/D150684

layout/style/FontFaceSetDocumentImpl.cpp

@@ -95,9 +95,11 @@ void FontFaceSetDocumentImpl::Destroy() {
 
   mRuleFaces.Clear();
 
-  mDocument = nullptr;
-
+  // Since the base class may depend on the document remaining set, we need to
+  // clear mDocument after.
   FontFaceSetImpl::Destroy();
+
+  mDocument = nullptr;
 }
 
 uint64_t FontFaceSetDocumentImpl::GetInnerWindowID() {