Build font off of cached copy of data in CFX_FontMapper.

Otherwise, it is a duplicate copy that we will not preserve past
the end of the function. A follow-up task is to avoid the duplicate
copy in the first place.

Bug: chromium:976231
Change-Id: I589c68b9ab277aeb3b4ca5aefd64f170c347cc4d
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/56470
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

core/fxge/cfx_fontmgr.cpp

diff --git a/core/fxge/cfx_fontmgr.cpp b/core/fxge/cfx_fontmgr.cpp
index e473c4f..828f0dc 100644
--- a/core/fxge/cfx_fontmgr.cpp
+++ b/core/fxge/cfx_fontmgr.cpp
@@ -154,12 +154,6 @@
     std::unique_ptr<uint8_t, FxFreeDeleter> pData,
     uint32_t size,
     uint32_t font_offset) {
-  int face_index = GetTTCIndex(pData.get(), ttc_size, font_offset);
-  RetainPtr<CFX_Face> face =
-      GetFixedFace({pData.get(), static_cast<size_t>(ttc_size)}, face_index);
-  if (!face)
-    return nullptr;
-
   CTTFontDesc* pFontDesc = nullptr;
   ByteString keyname = KeyNameFromSize(ttc_size, checksum);
   auto it = m_FaceMap.find(keyname);
@@ -171,6 +165,13 @@
     pFontDesc = pNewDesc.get();
     m_FaceMap[keyname] = std::move(pNewDesc);
   }
+
+  int face_index = GetTTCIndex(pFontDesc->FontData(), ttc_size, font_offset);
+  RetainPtr<CFX_Face> face = GetFixedFace(
+      {pFontDesc->FontData(), static_cast<size_t>(ttc_size)}, face_index);
+  if (!face)
+    return nullptr;
+
   pFontDesc->SetFace(face_index, face.Get());
   return face;
 }