Bug 46794 – Crashes randomly in cairo_scaled_font_destroy

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKitGTK

[Priit Laes (IRC: plaes)]

Webkit-gtk-1.3.4 on amd64 and epiphany 2.30.6

I'm getting random crashes like this:

#6  cairo_scaled_font_destroy (scaled_font=0xffffffffffffffff) at cairo-scaled-font.c:1221
#7  0x00007f380820f7f5 in operator= (this=0x7f3761ee2230, other=...) at ./JavaScriptCore/wtf/PlatformRefPtr.h:114
#8  WebCore::FontPlatformData::operator= (this=0x7f3761ee2230, other=...) at WebCore/platform/graphics/cairo/FontPlatformDataFreeType.cpp:169
#9  0x00007f3807f33161 in translate (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashMap.h:124
#10 add<WebCore::FontPlatformData, std::pair<WebCore::SimpleFontData*, unsigned int>, WTF::HashMapTranslator<std::pair<WebCore::FontPlatformData, std::pair<WebCore::SimpleFontData*, unsigned int> >, WTF::PairHashTraits<WebCore::FontDataCacheKeyTraits, WTF::HashTraits<std::pair<WebCore::SimpleFontData*, unsigned int> > >, WebCore::FontDataCacheKeyHash> > (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashTable.h:691
#11 inlineAdd (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashMap.h:241
#12 WTF::HashMap<WebCore::FontPlatformData, std::pair<WebCore::SimpleFontData*, unsigned int>, WebCore::FontDataCacheKeyHash, WebCore::FontDataCacheKeyTraits, WTF::HashTraits<std::pair<WebCore::SimpleFontData*, unsigned int> > >::set (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashMap.h:248
#13 0x00007f3807f2fcd5 in WebCore::FontCache::getCachedFontData (this=<value optimized out>, platformData=0x7f37612c6600) at WebCore/platform/graphics/FontCache.cpp:282
#14 0x00007f3807bc42b2 in WebCore::fontDataForGenericFamily (document=<value optimized out>, fontDescription=..., familyName=<value optimized out>) at WebCore/css/CSSFontSelector.cpp:393
#15 0x00007f3807bc5342 in WebCore::CSSFontSelector::getFontData (this=0x7f37e656fea0, fontDescription=<value optimized out>, familyName=<value optimized out>) at WebCore/css/CSSFontSelector.cpp:466
#16 0x00007f3807f31ea5 in WebCore::FontCache::getFontData (this=0x7f37ed2c4048, font=..., familyIndex=@0x7f37e6b89e60, fontSelector=0x7f37e656fea0) at WebCore/platform/graphics/FontCache.cpp:384
#17 0x00007f3807f35d8a in WebCore::FontFallbackList::fontDataAt (this=0x7f37e6b89e00, font=<value optimized out>, realizedFontIndex=<value optimized out>) at WebCore/platform/graphics/FontFallbackList.cpp:105
#18 0x00007f3807f35ed8 in primaryFontData (this=0xffffffffffffffff, font=0x7f37612c6600) at WebCore/platform/graphics/FontFallbackList.h:66
#19 WebCore::FontFallbackList::determinePitch (this=0xffffffffffffffff, font=0x7f37612c6600) at WebCore/platform/graphics/FontFallbackList.cpp:76
#20 0x00007f380806ccf5 in isFixedPitch (this=0x7f3763a10a58, leadWidth=<value optimized out>, fallbackFonts=<value optimized out>, glyphOverflow=<value optimized out>) at ./WebCore/platform/graphics/FontFallbackList.h:47
#21 isFixedPitch (this=0x7f3763a10a58, leadWidth=<value optimized out>, fallbackFonts=<value optimized out>, glyphOverflow=<value optimized out>) at ./WebCore/platform/graphics/Font.h:251
#22 widthFromCache (this=0x7f3763a10a58, leadWidth=<value optimized out>, fallbackFonts=<value optimized out>, glyphOverflow=<value optimized out>) at WebCore/rendering/RenderText.cpp:540
#23 WebCore::RenderText::calcPrefWidths (this=0x7f3763a10a58, leadWidth=<value optimized out>, fallbackFonts=<value optimized out>, glyphOverflow=<value optimized out>) at WebCore/rendering/RenderText.cpp:793
#24 0x00007f380806de9d in WebCore::RenderText::calcPrefWidths (this=0xffffffffffffffff, leadWidth=1630299648) at WebCore/rendering/RenderText.cpp:687
#25 0x00007f380806c1da in WebCore::RenderText::trimmedPrefWidths (this=0x7f3763a10a58, leadWidth=<value optimized out>, beginMinW=@0x7fff9e4b2edc, beginWS=<value optimized out>, endMinW=<value optimized out>, endWS=<value optimized out>, hasBreakableChar=@0x7fff9e4b2eee, hasBreak=@0x7fff9e4b2eed, beginMaxW=@0x7fff9e4b2ed4, endMaxW=@0x7fff9e4b2ed0, minW=@0x7fff9e4b2ee4, maxW=@0x7fff9e4b2ee0, stripFrontSpaces=@0x7fff9e4b2eef) at WebCore/rendering/RenderText.cpp:585
#26 0x00007f3807fc5b9a in WebCore::RenderBlock::calcInlinePrefWidths (this=0x7f3763a10820) at WebCore/rendering/RenderBlock.cpp:4924
#27 0x00007f3807fc6058 in WebCore::RenderBlock::calcPrefWidths (this=0x7f3763a10820) at WebCore/rendering/RenderBlock.cpp:4606
#28 0x00007f3808054bf7 in WebCore::RenderTableCell::calcPrefWidths (this=0x7f3763a10820) at WebCore/rendering/RenderTableCell.cpp:132
#29 0x00007f3807f9d754 in WebCore::AutoTableLayout::recalcColumn (this=<value optimized out>, effCol=<value optimized out>) at WebCore/rendering/AutoTableLayout.cpp:83
#30 0x00007f3807f9de4e in WebCore::AutoTableLayout::fullRecalc (this=0x7f375fe28c30) at WebCore/rendering/AutoTableLayout.cpp:206
#31 0x00007f3807f9e9b2 in WebCore::AutoTableLayout::calcPrefWidths (this=0xffffffffffffffff, minWidth=@0x7f37612c6600, maxWidth=@0xba706d9d) at WebCore/rendering/AutoTableLayout.cpp:244
#32 0x00007f38080595bf in WebCore::RenderTable::calcPrefWidths (this=0x7f3763a106f0) at WebCore/rendering/RenderTable.cpp:543
#33 0x00007f3807fd99c3 in WebCore::RenderBox::minPrefWidth (this=0x7f3763a106f0) at WebCore/rendering/RenderBox.cpp:539
#34 0x00007f38080572ef in WebCore::RenderTable::calcWidth (this=0x7f3763a106f0) at WebCore/rendering/RenderTable.cpp:209
#35 0x00007f3808059adf in WebCore::RenderTable::layout (this=0x7f3763a106f0) at WebCore/rendering/RenderTable.cpp:255
#36 0x00007f3807fc7116 in WebCore::RenderBlock::layoutBlockChild (this=0x7f3761d49538, child=0x7f3763a106f0, marginInfo=..., previousFloatBottom=@0x7fff9e4b334c, maxFloatBottom=<value optimized out>) at WebCore/rendering/RenderBlock.cpp:1853
#37 0x00007f3807fc8e1e in WebCore::RenderBlock::layoutBlockChildren (this=0x7f3761d49538, relayoutChildren=<value optimized out>, maxFloatBottom=@0x7fff9e4b3454) at WebCore/rendering/RenderBlock.cpp:1792
#38 0x00007f3807fc9674 in WebCore::RenderBlock::layoutBlock (this=0x7f3761d49538, relayoutChildren=true, pageHeight=0) at WebCore/rendering/RenderBlock.cpp:1206
#39 0x00007f3807fb502d in WebCore::RenderBlock::layout (this=0x7f3761d49538) at WebCore/rendering/RenderBlock.cpp:1103
#40 0x00007f3807fc7116 in WebCore::RenderBlock::layoutBlockChild (this=0x7f3761d49368, child=0x7f3761d49538, marginInfo=..., previousFloatBottom=@0x7fff9e4b357c, maxFloatBottom=<value optimized out>) at WebCore/rendering/RenderBlock.cpp:1853
#41 0x00007f3807fc8e1e in WebCore::RenderBlock::layoutBlockChildren (this=0x7f3761d49368, relayoutChildren=<value optimized out>, maxFloatBottom=@0x7fff9e4b3684) at WebCore/rendering/RenderBlock.cpp:1792
#42 0x00007f3807fc9674 in WebCore::RenderBlock::layoutBlock (this=0x7f3761d49368, relayoutChildren=true, pageHeight=0) at WebCore/rendering/RenderBlock.cpp:1206
#43 0x00007f3807fb502d in WebCore::RenderBlock::layout (this=0x7f3761d49368) at WebCore/rendering/RenderBlock.cpp:1103
#44 0x00007f3807fc7116 in WebCore::RenderBlock::layoutBlockChild (this=0x7f3761d49120, child=0x7f3761d49368, marginInfo=..., previousFloatBottom=@0x7fff9e4b37ac, maxFloatBottom=<value optimized out>) at WebCore/rendering/RenderBlock.cpp:1853
#45 0x00007f3807fc8e1e in WebCore::RenderBlock::layoutBlockChildren (this=0x7f3761d49120, relayoutChildren=<value optimized out>, maxFloatBottom=@0x7fff9e4b38b4) at WebCore/rendering/RenderBlock.cpp:1792
#46 0x00007f3807fc9674 in WebCore::RenderBlock::layoutBlock (this=0x7f3761d49120, relayoutChildren=true, pageHeight=0) at WebCore/rendering/RenderBlock.cpp:1206
#47 0x00007f3807fb502d in WebCore::RenderBlock::layout (this=0x7f3761d49120) at WebCore/rendering/RenderBlock.cpp:1103
#48 0x00007f3808077d4f in WebCore::RenderView::layout (this=0x7f3761d49120) at WebCore/rendering/RenderView.cpp:124
#49 0x00007f3807ef903a in WebCore::FrameView::layout (this=0x7f376131e8c0, allowSubtree=<value optimized out>) at WebCore/page/FrameView.cpp:766
#50 0x00007f3807f836f6 in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x7f37ed350570) at WebCore/platform/ThreadTimers.cpp:112
#51 0x00007f38081f47c2 in WebCore::timeout_cb () at WebCore/platform/gtk/SharedTimerGtk.cpp:49
#52 0x00007f3804decbab in IA__g_mapped_file_new (filename=<value optimized out>, writable=<value optimized out>, error=0x1) at gmappedfile.c:227
#53 0x00007f3800000000 in ?? ()
#54 0x00007f38050aa748 in ?? ()
#55 0x00007f38050aa780 in ?? ()
#56 0x0000000100000001 in ?? ()
#57 0x0000000000b3e1d8 in ?? ()
#58 0x00007fff9e4b4d58 in ?? ()
#59 0x0000007800000000 in ?? ()
#60 0x000000001bc8e1ac in ?? ()
#61 0x0000000000be81f0 in ?? ()
#62 0x0000000000b03e50 in ?? ()
#63 0x00007f38050aae20 in ?? ()
#64 0x0000000000000001 in ?? ()
#65 0x0000000000be81fc in ?? ()
#66 0x0000000000000000 in ?? ()

Thread 3 (Thread 0x7f37edbc2710 (LWP 11025)):
#0  pthread_cond_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
No locals.
#1  0x00007f3808809034 in WTF::TCMalloc_PageHeap::scavengerThread (this=0x7f3808e32960) at JavaScriptCore/wtf/FastMalloc.cpp:2400
No locals.
#2  0x00007f3808809059 in WTF::TCMalloc_PageHeap::runScavengerThread (context=0x7f3808e40a34) at JavaScriptCore/wtf/FastMalloc.cpp:1517
No locals.
#3  0x00007f3804657c1a in start_thread (arg=<value optimized out>) at pthread_create.c:301
        __res = <value optimized out>
        pd = 0x7f37edbc2710
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139878188459792, 3900333059547475318, 139878568699296, 139878188460496, 139878673485824, 3, -4012954415397196426, -4012482373570908810}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#4  0x00007f38043bca9d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
No locals.

Thread 2 (Thread 0x7f37ed2c1710 (LWP 11026)):
#0  pthread_cond_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
No locals.
#1  0x00007f3807e92c85 in WebCore::IconDatabase::syncThreadMainLoop (this=0x7f37ed2ca800) at WebCore/loader/icon/IconDatabase.cpp:1420
        didAnyWork = false
        shouldReenableSuddenTermination = true
#2  0x00007f3807e92d96 in WebCore::IconDatabase::iconDatabaseSyncThread (this=0x7f37ed2ca800) at WebCore/loader/icon/IconDatabase.cpp:1044
        journalFilename = {m_impl = {<WTF::FastAllocBase> = {<No data fields>}, m_ptr = 0x7f37ed2d8f20}}
#3  0x00007f3804657c1a in start_thread (arg=<value optimized out>) at pthread_create.c:301
        __res = <value optimized out>
        pd = 0x7f37ed2c1710
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139878179018512, 3900333059547475318, 139878568699296, 139878179019216, 139878673485824, 3, -4012955651810906762, -4012482373570908810}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#4  0x00007f38043bca9d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
No locals.

Thread 1 (Thread 0x7f380a9ff8c0 (LWP 11024)):
#0  0x00007f380465ffdd in __libc_waitpid (pid=20157, stat_loc=<value optimized out>, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:41
        _a3 = 0
        _a1 = 20157
        resultvar = <value optimized out>
        _a4 = 0
        _a2 = 140735849111520
        oldtype = 0
        result = <value optimized out>
#1  0x00007f3804e32751 in compile_branch (options=<value optimized out>, oldims=<value optimized out>, codeptr=<value optimized out>, ptrptr=<value optimized out>, errorcodeptr=<value optimized out>, lookbehind=<value optimized out>, reset_bracount=149090296, skipbytes=<value optimized out>, firstbyteptr=0x0, reqbyteptr=0x0, bcptr=0x0, cd=0x0, lengthptr=0x0) at /usr/include/bits/string3.h:52
        prop_type = <value optimized out>
        prop_value = 0
        recno = <value optimized out>
        subfirstbyte = 59848768
        mclength = <value optimized out>
        class_charcount = <value optimized out>
        possessive_quantifier = 0
        is_quantifier = 0
        is_recurse = <value optimized out>
        reset_bracount = <value optimized out>
        subreqbyte = 0
        mcbuffer = "@\000\000\000\000\000\000"
        negate_class = <value optimized out>
        should_flip_negation = 0
        class_lastchar = <value optimized out>
        refsign = <value optimized out>
        skipbytes = <value optimized out>
        terminator = <value optimized out>
        repeat_max = <value optimized out>
        greedy_non_default = 69219624
        save_hwm = <value optimized out>
        repeat_type = <value optimized out>
        code = 0x1 <Address 0x1 out of bounds>
        tempcode = 0x1c001d0040000a <Address 0x1c001d0040000a out of bounds>
        inescq = <value optimized out>
        ptr = 0x38004000000000 <Address 0x38004000000000 out of bounds>
        tempptr = <value optimized out>
        classbits = "\001", '\000' <repeats 15 times>, "\177ELF\002\001\001\000\000\000\000\000\000\000\000"
        after_manual_callout = <value optimized out>
        c = <value optimized out>
        op_type = <value optimized out>
        length_prevgroup = 0
        utf8_char = "\020\065 \004\000"
        bravalue = -1639243796
        groupsetfirstbyte = 2105977
        class_utf8 = 69219624
        req_caseopt = 32767
        utf8 = 0
        class_utf8data = <value optimized out>
        reqvary = 0
        tempreqvary = 69219624
#2  compile_regex (options=<value optimized out>, oldims=<value optimized out>, codeptr=<value optimized out>, ptrptr=<value optimized out>, errorcodeptr=<value optimized out>, lookbehind=<value optimized out>, reset_bracount=149090296, skipbytes=<value optimized out>, firstbyteptr=0x0, reqbyteptr=0x0, bcptr=0x0, cd=0x0, lengthptr=0x0) at pcre_compile.c:5401
        ptr = <value optimized out>
        code = 0x7fff9e4b1fe0 ""
        last_branch = <value optimized out>
        reverse_count = 0x0
        firstbyte = 0
        reqbyte = 0
        branchreqbyte = <value optimized out>
        length = 0
        max_bracount = 32767
        bc = {outer = 0x1003e0002, current = 0x434a20 "1\355I\211\321^H\211\342H\203\344\360PTI\307\300\200\225J"}
#3  0x00007f3808e2efe8 in guard variable for WebCore::FontPlatformDataCacheKeyTraits::emptyValue()::key () from /usr/lib64/libwebkitgtk-1.0.so.0
No symbol table info available.
#4  0x00007f3808e2eff8 in WebCore::FontPlatformDataCacheKeyTraits::emptyValue()::key () from /usr/lib64/libwebkitgtk-1.0.so.0
No symbol table info available.
#5  <signal handler called>
No symbol table info available.
#6  cairo_scaled_font_destroy (scaled_font=0xffffffffffffffff) at cairo-scaled-font.c:1221
        lru = <value optimized out>
        font_map = <value optimized out>
        __PRETTY_FUNCTION__ = "cairo_scaled_font_destroy"
#7  0x00007f380820f7f5 in operator= (this=0x7f3761ee2230, other=...) at ./JavaScriptCore/wtf/PlatformRefPtr.h:114
        optr = 0x3bba300
        ptr = 0xffffffffffffffff
#8  WebCore::FontPlatformData::operator= (this=0x7f3761ee2230, other=...) at WebCore/platform/graphics/cairo/FontPlatformDataFreeType.cpp:169
No locals.
#9  0x00007f3807f33161 in translate (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashMap.h:124
No locals.
#10 add<WebCore::FontPlatformData, std::pair<WebCore::SimpleFontData*, unsigned int>, WTF::HashMapTranslator<std::pair<WebCore::FontPlatformData, std::pair<WebCore::SimpleFontData*, unsigned int> >, WTF::PairHashTraits<WebCore::FontDataCacheKeyTraits, WTF::HashTraits<std::pair<WebCore::SimpleFontData*, unsigned int> > >, WebCore::FontDataCacheKeyHash> > (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashTable.h:691
        k = 0
        i = <value optimized out>
        sizeMask = 511
        h = <value optimized out>
#11 inlineAdd (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashMap.h:241
No locals.
#12 WTF::HashMap<WebCore::FontPlatformData, std::pair<WebCore::SimpleFontData*, unsigned int>, WebCore::FontDataCacheKeyHash, WebCore::FontDataCacheKeyTraits, WTF::HashTraits<std::pair<WebCore::SimpleFontData*, unsigned int> > >::set (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashMap.h:248
        result = {first = {m_impl = {m_iterator = {m_position = 0xb97d5b1be, m_endPosition = 0x6}}}, second = 160}
#13 0x00007f3807f2fcd5 in WebCore::FontCache::getCachedFontData (this=<value optimized out>, platformData=0x7f37612c6600) at WebCore/platform/graphics/FontCache.cpp:282
        newValue = {first = 0x7f375faa7000, second = 1}
#14 0x00007f3807bc42b2 in WebCore::fontDataForGenericFamily (document=<value optimized out>, fontDescription=..., familyName=<value optimized out>) at WebCore/css/CSSFontSelector.cpp:393
        settings = 0x7f375ff3b300
        genericFamily = {m_string = {m_impl = {<WTF::FastAllocBase> = {<No data fields>}, m_ptr = 0x7f37ed350510}}}
#15 0x00007f3807bc5342 in WebCore::CSSFontSelector::getFontData (this=0x7f37e656fea0, fontDescription=<value optimized out>, familyName=<value optimized out>) at WebCore/css/CSSFontSelector.cpp:466
        family = {m_impl = {<WTF::FastAllocBase> = {<No data fields>}, m_ptr = 0x0}}
        familyFontFaces = <value optimized out>
        segmentedFontFaceCache = <value optimized out>
        traitsMask = <value optimized out>
        face = {<WTF::FastAllocBase> = {<No data fields>}, m_ptr = 0x0}
#16 0x00007f3807f31ea5 in WebCore::FontCache::getFontData (this=0x7f37ed2c4048, font=..., familyIndex=@0x7f37e6b89e60, fontSelector=0x7f37e656fea0) at WebCore/platform/graphics/FontCache.cpp:384
        data = <value optimized out>
        result = <value optimized out>
        startIndex = 0
        startFamily = 0x7f37615106f0
        currFamily = 0x7f37615106f0
#17 0x00007f3807f35d8a in WebCore::FontFallbackList::fontDataAt (this=0x7f37e6b89e00, font=<value optimized out>, realizedFontIndex=<value optimized out>) at WebCore/platform/graphics/FontFallbackList.cpp:105
No locals.
#18 0x00007f3807f35ed8 in primaryFontData (this=0xffffffffffffffff, font=0x7f37612c6600) at WebCore/platform/graphics/FontFallbackList.h:66
No locals.
#19 WebCore::FontFallbackList::determinePitch (this=0xffffffffffffffff, font=0x7f37612c6600) at WebCore/platform/graphics/FontFallbackList.cpp:76
        fontData = <value optimized out>
#20 0x00007f380806ccf5 in isFixedPitch (this=0x7f3763a10a58, leadWidth=<value optimized out>, fallbackFonts=<value optimized out>, glyphOverflow=<value optimized out>) at ./WebCore/platform/graphics/FontFallbackList.h:47
No locals.
#21 isFixedPitch (this=0x7f3763a10a58, leadWidth=<value optimized out>, fallbackFonts=<value optimized out>, glyphOverflow=<value optimized out>) at ./WebCore/platform/graphics/Font.h:251
No locals.
#22 widthFromCache (this=0x7f3763a10a58, leadWidth=<value optimized out>, fallbackFonts=<value optimized out>, glyphOverflow=<value optimized out>) at WebCore/rendering/RenderText.cpp:540
No locals.
#23 WebCore::RenderText::calcPrefWidths (this=0x7f3763a10a58, leadWidth=<value optimized out>, fallbackFonts=<value optimized out>, glyphOverflow=<value optimized out>) at WebCore/rendering/RenderText.cpp:793
        w = <value optimized out>
        isSpace = <value optimized out>
        isCollapsibleWhiteSpace = <value optimized out>
        c = 32
        wordLen = 8
        isNewline = false
        hasBreak = false
        betweenWords = true
        j = 8
        i = 0
        currMaxWidth = 0
        wordSpacing = 0
        len = <value optimized out>
        needsWordSpacing = false
        ignoringSpaces = <value optimized out>
        f = @0x7f37615106f0
        firstWord = true
        nextBreakable = 8
        firstGlyphLeftOverflow = -1
        lastWordBoundary = <value optimized out>
        breakAll = false
        txt = 0x7f3763393920
        isSpace = false
        firstLine = true
        breakNBSP = <value optimized out>
#24 0x00007f380806de9d in WebCore::RenderText::calcPrefWidths (this=0xffffffffffffffff, leadWidth=1630299648) at WebCore/rendering/RenderText.cpp:687
        fallbackFonts = {<WTF::FastAllocBase> = {<No data fields>}, m_impl = {static m_minTableSize = <optimized out>, static m_maxLoad = <optimized out>, static m_minLoad = <optimized out>, m_table = 0x0, m_tableSize = 0, m_tableSizeMask = 0, m_keyCount = 0, m_deletedCount = 0}}
        glyphOverflow = {left = 0, right = 0, top = 0, bottom = 0}
#25 0x00007f380806c1da in WebCore::RenderText::trimmedPrefWidths (this=0x7f3763a10a58, leadWidth=<value optimized out>, beginMinW=@0x7fff9e4b2edc, beginWS=<value optimized out>, endMinW=<value optimized out>, endWS=<value optimized out>, hasBreakableChar=@0x7fff9e4b2eee, hasBreak=@0x7fff9e4b2eed, beginMaxW=@0x7fff9e4b2ed4, endMaxW=@0x7fff9e4b2ed0, minW=@0x7fff9e4b2ee4, maxW=@0x7fff9e4b2ee0, stripFrontSpaces=@0x7fff9e4b2eef) at WebCore/rendering/RenderText.cpp:585
        collapseWhiteSpace = <value optimized out>
        len = <value optimized out>
        text = <value optimized out>
#26 0x00007f3807fc5b9a in WebCore::RenderBlock::calcInlinePrefWidths (this=0x7f3763a10820) at WebCore/rendering/RenderBlock.cpp:4924
        hasBreakableChar = false
        beginWS = 55
        beginMax = 0
        endMax = 0
        hasBreak = 127
        beginMin = 0
        endMin = 1008
        endWS = 161
        ti = <value optimized out>
        cstyle = <value optimized out>
        childMin = 0
        childMax = 0
        child = 0x7f3763a10a58
        trailingSpaceChild = 0x0
        allowImagesToBreak = true
        autoWrap = true
        inlineMax = 0
        addedTextIndent = false
        prevFloat = 0x0
        inlineMin = 0
        cw = 1008
        stripFrontSpaces = true
        oldAutoWrap = true
        childIterator = {parent = 0x7f3763a10820, current = 0x7f3763a10a58, endOfInline = false}
#27 0x00007f3807fc6058 in WebCore::RenderBlock::calcPrefWidths (this=0x7f3763a10820) at WebCore/rendering/RenderBlock.cpp:4606
        toAdd = <value optimized out>
#28 0x00007f3808054bf7 in WebCore::RenderTableCell::calcPrefWidths (this=0x7f3763a10820) at WebCore/rendering/RenderTableCell.cpp:132
No locals.
#29 0x00007f3807f9d754 in WebCore::AutoTableLayout::recalcColumn (this=<value optimized out>, effCol=<value optimized out>) at WebCore/rendering/AutoTableLayout.cpp:83
        w = <value optimized out>
        current = {cells = {<WTF::FastAllocBase> = {<No data fields>}, m_size = 1, m_buffer = {<WTF::VectorBufferBase<WebCore::RenderTableCell*>> = {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = {<No data fields>}, <No data fields>}, m_buffer = 0x7fff9e4b2fd8, m_capacity = 1}, static m_inlineBufferSize = 8, m_inlineBuffer = {buffer = " \b\241c7\177\000"}}}, inColSpan = false}
        cell = 0x7f3763a10820
        cellHasContent = <value optimized out>
        i = 0
        numRows = 1
        l = @0x7f375fe28c58
        child = 0x7f3763a108f8
        fixedContributor = 0x0
        maxContributor = 0x0
#30 0x00007f3807f9de4e in WebCore::AutoTableLayout::fullRecalc (this=0x7f375fe28c30) at WebCore/rendering/AutoTableLayout.cpp:206
        i = 1
        nEffCols = 1
        child = <value optimized out>
        cCol = 0
#31 0x00007f3807f9e9b2 in WebCore::AutoTableLayout::calcPrefWidths (this=0xffffffffffffffff, minWidth=@0x7f37612c6600, maxWidth=@0xba706d9d) at WebCore/rendering/AutoTableLayout.cpp:244
        spanMaxWidth = <value optimized out>
        maxPercent = <value optimized out>
        maxNonPercent = <value optimized out>
        scaleColumns = true
        remainingPercent = <value optimized out>
        bs = <value optimized out>
#32 0x00007f38080595bf in WebCore::RenderTable::calcPrefWidths (this=0x7f3763a106f0) at WebCore/rendering/RenderTable.cpp:543
No locals.
#33 0x00007f3807fd99c3 in WebCore::RenderBox::minPrefWidth (this=0x7f3763a106f0) at WebCore/rendering/RenderBox.cpp:539
No locals.
#34 0x00007f38080572ef in WebCore::RenderTable::calcWidth (this=0x7f3763a106f0) at WebCore/rendering/RenderTable.cpp:209
        cb = <value optimized out>
        availableWidth = 1008
#35 0x00007f3808059adf in WebCore::RenderTable::layout (this=0x7f3763a106f0) at WebCore/rendering/RenderTable.cpp:255
        th = <value optimized out>
        section = <value optimized out>
        calculatedHeight = 1
        bpBottom = 86843095
        rightBorderOverflow = <value optimized out>
        leftBorderOverflow = <value optimized out>
        bottomBorderOverflow = <value optimized out>
        didFullRepaint = <value optimized out>
        collapsing = <value optimized out>
        sectionMoved = <value optimized out>
        movedSectionTop = <value optimized out>
        bpTop = <value optimized out>
        bl = <value optimized out>
        topBorderOverflow = <value optimized out>
        repainter = {m_object = @0x7f3763a106f0, m_repaintContainer = 0x0, m_oldBounds = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}, m_oldOutlineBox = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}, m_checkForRepaint = false}
        oldWidth = 0
        h = {<WTF::FastAllocBase> = {<No data fields>}, m_value = -1639238848}
#36 0x00007f3807fc7116 in WebCore::RenderBlock::layoutBlockChild (this=0x7f3761d49538, child=0x7f3763a106f0, marginInfo=..., previousFloatBottom=@0x7fff9e4b334c, maxFloatBottom=<value optimized out>) at WebCore/rendering/RenderBlock.cpp:1853
        oldRect = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}
        childRenderBlock = 0x7f3763a106f0
        paginated = false
        oldTopPosMargin = 8
        oldTopNegMargin = 0
        yPosEstimate = 96
        markDescendantsWithFloats = <value optimized out>
        yBeforeClear = 0
        yAfterClear = <value optimized out>
        childHadLayout = false
        childNeededLayout = true
        atTopOfBlock = <value optimized out>
#37 0x00007f3807fc8e1e in WebCore::RenderBlock::layoutBlockChildren (this=0x7f3761d49538, relayoutChildren=<value optimized out>, maxFloatBottom=@0x7fff9e4b3454) at WebCore/rendering/RenderBlock.cpp:1792
        top = 0
        marginInfo = {m_canCollapseWithChildren = true, m_canCollapseTopWithChildren = true, m_canCollapseBottomWithChildren = true, m_quirkContainer = true, m_atTopOfBlock = false, m_atBottomOfBlock = false, m_topQuirk = false, m_bottomQuirk = false, m_determinedTopQuirk = false, m_posMargin = 1, m_negMargin = 0}
        bottom = 0
        legend = 0x0
        previousFloatBottom = 0
        next = 0x7f3763a106f0
#38 0x00007f3807fc9674 in WebCore::RenderBlock::layoutBlock (this=0x7f3761d49538, relayoutChildren=true, pageHeight=0) at WebCore/rendering/RenderBlock.cpp:1206
        oldWidth = <value optimized out>
        previousHeight = 0
        hasSpecifiedPageHeight = <value optimized out>
        colInfo = 0x0
        repaintTop = 0
        statePusher = {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = {<No data fields>}, <No data fields>}, m_view = 0x7f3761d49120, m_disabled = false, m_didStart = true, m_didEnd = false, m_didCreateLayoutState = false}
        isCell = <value optimized out>
        repaintBottom = 0
        maxFloatBottom = 0
        oldHeight = <value optimized out>
        didFullRepaint = <value optimized out>
        repainter = {m_object = @0x7f3761d49538, m_repaintContainer = 0x0, m_oldBounds = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}, m_oldOutlineBox = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}, m_checkForRepaint = false}
        oldColumnWidth = <value optimized out>
        toAdd = <value optimized out>
#39 0x00007f3807fb502d in WebCore::RenderBlock::layout (this=0x7f3761d49538) at WebCore/rendering/RenderBlock.cpp:1103
No locals.
#40 0x00007f3807fc7116 in WebCore::RenderBlock::layoutBlockChild (this=0x7f3761d49368, child=0x7f3761d49538, marginInfo=..., previousFloatBottom=@0x7fff9e4b357c, maxFloatBottom=<value optimized out>) at WebCore/rendering/RenderBlock.cpp:1853
        oldRect = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}
        childRenderBlock = 0x7f3761d49538
        paginated = false
        oldTopPosMargin = 0
        oldTopNegMargin = 0
        yPosEstimate = 8
        markDescendantsWithFloats = <value optimized out>
        yBeforeClear = 32568
        yAfterClear = <value optimized out>
        childHadLayout = false
        childNeededLayout = false
        atTopOfBlock = <value optimized out>
#41 0x00007f3807fc8e1e in WebCore::RenderBlock::layoutBlockChildren (this=0x7f3761d49368, relayoutChildren=<value optimized out>, maxFloatBottom=@0x7fff9e4b3684) at WebCore/rendering/RenderBlock.cpp:1792
        top = 0
        marginInfo = {m_canCollapseWithChildren = false, m_canCollapseTopWithChildren = false, m_canCollapseBottomWithChildren = false, m_quirkContainer = false, m_atTopOfBlock = true, m_atBottomOfBlock = false, m_topQuirk = false, m_bottomQuirk = false, m_determinedTopQuirk = false, m_posMargin = 0, m_negMargin = 0}
        bottom = 0
        legend = 0x0
        previousFloatBottom = 0
        next = 0x7f3761d49538
#42 0x00007f3807fc9674 in WebCore::RenderBlock::layoutBlock (this=0x7f3761d49368, relayoutChildren=true, pageHeight=0) at WebCore/rendering/RenderBlock.cpp:1206
        oldWidth = <value optimized out>
        previousHeight = 0
        hasSpecifiedPageHeight = <value optimized out>
        colInfo = 0x0
        repaintTop = 0
        statePusher = {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = {<No data fields>}, <No data fields>}, m_view = 0x7f3761d49120, m_disabled = false, m_didStart = true, m_didEnd = false, m_didCreateLayoutState = false}
        isCell = <value optimized out>
        repaintBottom = 0
        maxFloatBottom = 0
        oldHeight = <value optimized out>
        didFullRepaint = <value optimized out>
        repainter = {m_object = @0x7f3761d49368, m_repaintContainer = 0x0, m_oldBounds = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}, m_oldOutlineBox = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}, m_checkForRepaint = false}
        oldColumnWidth = <value optimized out>
        toAdd = <value optimized out>
#43 0x00007f3807fb502d in WebCore::RenderBlock::layout (this=0x7f3761d49368) at WebCore/rendering/RenderBlock.cpp:1103
No locals.
#44 0x00007f3807fc7116 in WebCore::RenderBlock::layoutBlockChild (this=0x7f3761d49120, child=0x7f3761d49368, marginInfo=..., previousFloatBottom=@0x7fff9e4b37ac, maxFloatBottom=<value optimized out>) at WebCore/rendering/RenderBlock.cpp:1853
        oldRect = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}
        childRenderBlock = 0x7f3761d49368
        paginated = false
        oldTopPosMargin = 0
        oldTopNegMargin = 0
        yPosEstimate = 0
        markDescendantsWithFloats = <value optimized out>
        yBeforeClear = 0
        yAfterClear = <value optimized out>
        childHadLayout = false
        childNeededLayout = false
        atTopOfBlock = <value optimized out>
#45 0x00007f3807fc8e1e in WebCore::RenderBlock::layoutBlockChildren (this=0x7f3761d49120, relayoutChildren=<value optimized out>, maxFloatBottom=@0x7fff9e4b38b4) at WebCore/rendering/RenderBlock.cpp:1792
        top = 0
        marginInfo = {m_canCollapseWithChildren = false, m_canCollapseTopWithChildren = false, m_canCollapseBottomWithChildren = false, m_quirkContainer = false, m_atTopOfBlock = true, m_atBottomOfBlock = false, m_topQuirk = false, m_bottomQuirk = false, m_determinedTopQuirk = false, m_posMargin = 0, m_negMargin = 0}
        bottom = 0
        legend = 0x0
        previousFloatBottom = 0
        next = 0x7f3761d49368
#46 0x00007f3807fc9674 in WebCore::RenderBlock::layoutBlock (this=0x7f3761d49120, relayoutChildren=true, pageHeight=0) at WebCore/rendering/RenderBlock.cpp:1206
        oldWidth = <value optimized out>
        previousHeight = 0
        hasSpecifiedPageHeight = <value optimized out>
        colInfo = 0x0
        repaintTop = 0
        statePusher = {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = {<No data fields>}, <No data fields>}, m_view = 0x7f3761d49120, m_disabled = false, m_didStart = true, m_didEnd = false, m_didCreateLayoutState = false}
        isCell = <value optimized out>
        repaintBottom = 0
        maxFloatBottom = 0
        oldHeight = <value optimized out>
        didFullRepaint = <value optimized out>
        repainter = {m_object = @0x7f3761d49120, m_repaintContainer = 0x0, m_oldBounds = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}, m_oldOutlineBox = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}, m_checkForRepaint = false}
        oldColumnWidth = <value optimized out>
        toAdd = <value optimized out>
#47 0x00007f3807fb502d in WebCore::RenderBlock::layout (this=0x7f3761d49120) at WebCore/rendering/RenderBlock.cpp:1103
No locals.
#48 0x00007f3808077d4f in WebCore::RenderView::layout (this=0x7f3761d49120) at WebCore/rendering/RenderView.cpp:124
        state = {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = {<No data fields>}, <No data fields>}, m_clipped = false, m_clipRect = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0, m_height = 0}}, m_paintOffset = {m_width = 0, m_height = 0}, m_layoutOffset = {m_width = 0, m_height = 0}, m_layoutDelta = {m_width = 0, m_height = -104}, m_pageHeight = 0, m_pageOffset = {m_width = 0, m_height = 0}, m_columnInfo = 0x0, m_next = 0x0}
#49 0x00007f3807ef903a in WebCore::FrameView::layout (this=0x7f376131e8c0, allowSubtree=<value optimized out>) at WebCore/page/FrameView.cpp:766
        root = 0x7f3761d49120
        hMode = WebCore::ScrollbarAuto
        vMode = WebCore::ScrollbarAuto
        layer = 0x7f3761d49258
        document = 0x7f3763bda000
        subtree = false
        disableLayoutState = false
        cachedOffset = {m_x = -315292304, m_y = 32567}
#50 0x00007f3807f836f6 in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x7f37ed350570) at WebCore/platform/ThreadTimers.cpp:112
        interval = <value optimized out>
        fireTime = 1285756939.530076
        timeToQuit = 1285756939.580076
#51 0x00007f38081f47c2 in WebCore::timeout_cb () at WebCore/platform/gtk/SharedTimerGtk.cpp:49
No locals.
#52 0x00007f3804decbab in IA__g_mapped_file_new (filename=<value optimized out>, writable=<value optimized out>, error=0x1) at gmappedfile.c:227
        save_errno = 32568
        file = <value optimized out>
        fd = 11965264
        st = {st_dev = 11788752, st_ino = 67738592, st_nlink = 0, st_mode = 81707985, st_uid = 32568, st_gid = 120, __pad0 = 0, st_rdev = 11553856, st_size = 139878576606096, st_blksize = 67760832, st_blocks = 140735849118448, st_atim = {tv_sec = 11788760, tv_nsec = 140735849118472}, st_mtim = {tv_sec = 140735849118464, tv_nsec = 67738592}, st_ctim = {tv_sec = 0, tv_nsec = 139878631163824}, __unused = {0, 0, 11788752}}
        __PRETTY_FUNCTION__ = "\377\377\377L\215%\202\224\004\000\211D$\ff\220\017\266\302\200\372r"
#53 0x00007f3800000000 in ?? ()
No symbol table info available.
#54 0x00007f38050aa748 in ?? ()
No symbol table info available.
#55 0x00007f38050aa780 in ?? ()
No symbol table info available.
#56 0x0000000100000001 in ?? ()

[Martin Robinson]

Created attachment 70101 [details]
Potential crash fix

Looks like some of the HashTraits machinery is missing for PlatformRefPtr. Do you think you can try this patch and see if it improves things?

[Priit Laes (IRC: plaes)]

(In reply to comment #1)
> Looks like some of the HashTraits machinery is missing for PlatformRefPtr. Do you think you can try this patch and see if it improves things?

It seems that something is still missing, as it crashed with the patch:

#7  cairo_scaled_font_destroy (scaled_font=0xffffffffffffffff) at cairo-scaled-font.c:1221
#8  0x00007f689a7377f5 in operator= (this=0x7f67effa9bc0, other=...) at ./JavaScriptCore/wtf/PlatformRefPtr.h:115
#9  WebCore::FontPlatformData::operator= (this=0x7f67effa9bc0, other=...) at WebCore/platform/graphics/cairo/FontPlatformDataFreeType.cpp:169
#10 0x00007f689a45b161 in translate (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashMap.h:124
#11 add<WebCore::FontPlatformData, std::pair<WebCore::SimpleFontData*, unsigned int>, WTF::HashMapTranslator<std::pair<WebCore::FontPlatformData, std::pair<WebCore::SimpleFontData*, unsigned int> >, WTF::PairHashTraits<WebCore::FontDataCacheKeyTraits, WTF::HashTraits<std::pair<WebCore::SimpleFontData*, unsigned int> > >, WebCore::FontDataCacheKeyHash> > (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashTable.h:691
#12 inlineAdd (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashMap.h:241
#13 WTF::HashMap<WebCore::FontPlatformData, std::pair<WebCore::SimpleFontData*, unsigned int>, WebCore::FontDataCacheKeyHash, WebCore::FontDataCacheKeyTraits, WTF::HashTraits<std::pair<WebCore::SimpleFontData*, unsigned int> > >::set (this=<value optimized out>, key=<value optimized out>, mapped=<value optimized out>) at ./JavaScriptCore/wtf/HashMap.h:248
#14 0x00007f689a457cd5 in WebCore::FontCache::getCachedFontData (this=<value optimized out>, platformData=0x7f67f5443680) at WebCore/platform/graphics/FontCache.cpp:282
#15 0x00007f689a459eba in WebCore::FontCache::getFontData (this=0x7f689cdec048, font=..., familyIndex=@0x7f67ee92fd80, fontSelector=0x7f67e9c6b840) at WebCore/platform/graphics/FontCache.cpp:388
#16 0x00007f689a45dd8a in WebCore::FontFallbackList::fontDataAt (this=0x7f67ee92fd20, font=<value optimized out>, realizedFontIndex=<value optimized out>) at WebCore/platform/graphics/FontFallbackList.cpp:105
#17 0x00007f689a45ded8 in primaryFontData (this=0xffffffffffffffff, font=0x7f67f5443680) at WebCore/platform/graphics/FontFallbackList.h:66
#18 WebCore::FontFallbackList::determinePitch (this=0xffffffffffffffff, font=0x7f67f5443680) at WebCore/platform/graphics/FontFallbackList.cpp:76
#19 0x00007f689a4fba55 in isFixedPitch (this=<value optimized out>, resolver=<value optimized out>, firstLine=<value optimized out>, isLineEmpty=<value optimized out>, previousLineBrokeCleanly=<value optimized out>, hyphenated=@0x7fff6621b0c9, clear=0x7fff6621b0b4, lastFloatFromPreviousLine=0x0) at ./WebCore/platform/graphics/FontFallbackList.h:47
#20 isFixedPitch (this=<value optimized out>, resolver=<value optimized out>, firstLine=<value optimized out>, isLineEmpty=<value optimized out>, previousLineBrokeCleanly=<value optimized out>, hyphenated=@0x7fff6621b0c9, clear=0x7fff6621b0b4, lastFloatFromPreviousLine=0x0) at ./WebCore/platform/graphics/Font.h:251
#21 WebCore::RenderBlock::findNextLineBreak (this=<value optimized out>, resolver=<value optimized out>, firstLine=<value optimized out>, isLineEmpty=<value optimized out>, previousLineBrokeCleanly=<value optimized out>, hyphenated=@0x7fff6621b0c9, clear=0x7fff6621b0b4, lastFloatFromPreviousLine=0x0) at WebCore/rendering/RenderBlockLineLayout.cpp:1639
#22 0x00007f689a4fce5f in WebCore::RenderBlock::layoutInlineChildren (this=0x7f67f127f878, relayoutChildren=<value optimized out>, repaintTop=@0x7fff6621b1dc, repaintBottom=@0x7fff6621b1d8) at WebCore/rendering/RenderBlockLineLayout.cpp:684

I also have users experiencing the same (very random) issue in WebKit for MorphOS on PowerPC architecture.

[Martin Robinson]

Created attachment 71089 [details]
Potential crash fix 2

[Priit Laes (IRC: plaes)]

(In reply to comment #4)
> Created an attachment (id=71089) [details]
> Potential crash fix 2

It seems that this change fixes the crash.

[Martin Robinson]

Created attachment 71445 [details]
Patch for this issue

[Xan Lopez]

Comment on attachment 71445 [details]
Patch for this issue

Curious, why does nobody else seem to need to do this?

[Martin Robinson]

There's a similar check that happens in WebCore/platform/graphics/win/RefCountedGDIHandle.h.

[Xan Lopez]

Comment on attachment 71445 [details]
Patch for this issue

So, after talking on jabber we both find it strange that we have to take care of this manually, and it might just be a symptom for some other bug. Hopefully PlatformRefPtr is going away entirely soon anyway, so let's just go ahead and commit it.

[Martin Robinson]

Comment on attachment 71445 [details]
Patch for this issue

Clearing flags on attachment: 71445

Committed r70390: <http://trac.webkit.org/changeset/70390>

[Martin Robinson]

All reviewed patches have been landed.  Closing bug.

[Darin Adler]

I think this is the wrong fix. The right way to do this is with hash traits, I think. This is not how RefPtr handles hash table deleted values. It's not a good idea to handle this differently for this RefPtr variant.

[Martin Robinson]

(In reply to comment #12)
> I think this is the wrong fix. The right way to do this is with hash traits, I think. This is not how RefPtr handles hash table deleted values. It's not a good idea to handle this differently for this RefPtr variant.

I did attempt the HashTraits approach at first, but this did not fix the issue (my first patch on this bug). I think the trouble is that the RefPtr isn't the type contained in the HashMap, it is the containing type FontPlatformData. This is handled as a one-off by the Windows port. See win/RefCountedGDIHandle.h. Perhaps in this case, it just makes sense to manage memory manually and deal with the -1 inside FontPlatformDataFreetype. I'll post a patch.

[Darin Adler]

(In reply to comment #13)
> I did attempt the HashTraits approach at first, but this did not fix the issue (my first patch on this bug). I think the trouble is that the RefPtr isn't the type contained in the HashMap, it is the containing type FontPlatformData. This is handled as a one-off by the Windows port. See win/RefCountedGDIHandle.h. Perhaps in this case, it just makes sense to manage memory manually and deal with the -1 inside FontPlatformDataFreetype. I'll post a patch.

This might be solved by changing FontPlatformDataFreetype to have different hash traits.

[Martin Robinson]

Created attachment 71786 [details]
WIP patch taking Darin's advice into account

Darin, I've attached a patch for this issue which switches FontPlatformData.m_scaledFont to manual memory management and handles HashTableDeletedValue specifically. 

Some alternatives:
1. Create a RefCountedCairoPtr (similar to RefCountedGDIHandle on Windows), which essentially wraps the raw Cairo pointer in another layer of abstraction.
2. Handle -1 specifically in RefPtrCairo here: https://bugs.webkit.org/show_bug.cgi?id=48192

I hope my previous comment did not come off as too defensive. I appreciate your insight.

[Darin Adler]

Another option is to use a different value for the deleted value of FontPlatformData. There’s no reason it has to be the magic value -1. It could be some other kind of distinctive value. As with the empty value it simple needs to be a value that does not need to be used as a hash table key.