Fix unsafe shape_plan->face dependency
diff --git a/src/hb-ot-shape-private.hh b/src/hb-ot-shape-private.hh
index 8171471..cbfab5b 100644
--- a/src/hb-ot-shape-private.hh
+++ b/src/hb-ot-shape-private.hh
@@ -66,7 +66,7 @@
   hb_ot_map_builder_t map;
 
   hb_ot_shape_planner_t (const hb_shape_plan_t *master_plan) :
-			 face (master_plan->face),
+			 face (master_plan->face_unsafe),
 			 props (master_plan->props),
 			 shaper (NULL),
 			 map (face, &props) {}
diff --git a/src/hb-shape-plan-private.hh b/src/hb-shape-plan-private.hh
index ee48767..e12b05f 100644
--- a/src/hb-shape-plan-private.hh
+++ b/src/hb-shape-plan-private.hh
@@ -39,7 +39,7 @@
   ASSERT_POD ();
 
   hb_bool_t default_shaper_list;
-  hb_face_t *face;
+  hb_face_t *face_unsafe; /* We don't carry a reference to face. */
   hb_segment_properties_t props;
 
   hb_shape_func_t *shaper_func;
diff --git a/src/hb-shape-plan.cc b/src/hb-shape-plan.cc
index d2aa03b..e354f29 100644
--- a/src/hb-shape-plan.cc
+++ b/src/hb-shape-plan.cc
@@ -46,7 +46,7 @@
 
 #define HB_SHAPER_PLAN(shaper) \
 	HB_STMT_START { \
-	  if (hb_##shaper##_shaper_face_data_ensure (shape_plan->face)) { \
+	  if (hb_##shaper##_shaper_face_data_ensure (shape_plan->face_unsafe)) { \
 	    HB_SHAPER_DATA (shaper, shape_plan) = \
 	      HB_SHAPER_DATA_CREATE_FUNC (shaper, shape_plan) (shape_plan, user_features, num_user_features); \
 	    shape_plan->shaper_func = _hb_##shaper##_shape; \
@@ -122,7 +122,7 @@
 
   hb_face_make_immutable (face);
   shape_plan->default_shaper_list = shaper_list == NULL;
-  shape_plan->face = hb_face_reference (face);
+  shape_plan->face_unsafe = face;
   shape_plan->props = *props;
   shape_plan->num_user_features = num_user_features;
   shape_plan->user_features = features;
@@ -202,7 +202,6 @@
 #include "hb-shaper-list.hh"
 #undef HB_SHAPER_IMPLEMENT
 
-  hb_face_destroy (shape_plan->face);
   free (shape_plan->user_features);
 
   free (shape_plan);
@@ -277,7 +276,7 @@
 		hb_object_is_inert (buffer)))
     return false;
 
-  assert (shape_plan->face == font->face);
+  assert (shape_plan->face_unsafe == font->face);
   assert (hb_segment_properties_equal (&shape_plan->props, &buffer->props));
 
 #define HB_SHAPER_EXECUTE(shaper) \
@@ -444,11 +443,6 @@
     goto retry;
   }
 
-  /* Release our reference on face. */
-  /* XXX This is unsafe, since the face can be freed before us,
-   * and we will call hb_face_destroy() in our destroy()! */
-  hb_face_destroy (face);
-
   return hb_shape_plan_reference (shape_plan);
 }