hb_face is a ref-counted object and every hb_face_reference() must be paired with hb_face_destroy() (via face_destroy_func); in contrary, HB-old's HB_Face isn't ref-counted object, so calling face_destroy_func() destroys the object.
QFontEngineFT calls harfbuzzFace() to prepare HB's face object prior to reparenting it, so we're leaking hb_face object there.

We should either not release the object returned by harfbuzzFace(), or introduce ref-counting for HB-old's HB_Face.