[Webkit-unassigned] [Bug 241540] [WinCairo] TextPainter::setGlyphDisplayListIfNeeded → GlyphDisplayListCache::get → WTF::equal → SEGV

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=241540

--- Comment #2 from Fujii Hironori <Hironori.Fujii at sony.com> ---
https://github.com/WebKit/WebKit/blob/79ad9ed64760e9fb1d02e26be2ff69b849907061/Source/WebCore/rendering/GlyphDisplayListCache.h#L127-L128

>    HashMap<const void*, Ref<GlyphDisplayListCacheEntry>> m_entriesForLayoutRun;
>    HashSet<GlyphDisplayListCacheEntry*> m_entries;

m_entries is a HashSet of GlyphDisplayListCacheEntry raw pointer.
m_entriesForLayoutRun retains GlyphDisplayListCacheEntry ref-counters.

https://github.com/WebKit/WebKit/blob/79ad9ed64760e9fb1d02e26be2ff69b849907061/Source/WebCore/rendering/GlyphDisplayListCache.cpp#L202

GlyphDisplayListCache::remove removes the item of m_entriesForLayoutRun.
Who retains GlyphDisplayListCacheEntry ref-counters for m_entries?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220612/08f15da9/attachment-0001.htm>