Bug 1153628 - Break FontFaceSet <-> UserFontSet cycle when a document's pres shell is going away. r=mccr8

layout/style/FontFaceSet.cpp

@@ -412,6 +412,9 @@ FontFaceSet::DestroyUserFontSet()
   mNonRuleFaces.Clear();
   mUnavailableFaces.Clear();
   mReady = nullptr;
+  if (mUserFontSet) {
+    mUserFontSet->mFontFaceSet = nullptr;
+  }
   mUserFontSet = nullptr;
 }