Regression(270013@main): Crash when loading bgtime.tv

https://bugs.webkit.org/show_bug.cgi?id=264132
<rdar://117882210>

Reviewed by Brent Fulgham.

270013@main updated `GlyphPage::m_font` to be a CheckedPtr. However, the
assertion is the CanMakeCheckedPtrBase destructor is hitting when loading
bgtime.tv. As a result, I am downgrading to a simple WeakPtr to address
the crash.

* Source/WebCore/platform/graphics/GlyphPage.h:
(WebCore::GlyphPage::glyphDataForIndex const):
(WebCore::GlyphPage::font const):

Canonical link: https://commits.webkit.org/270190@main

Source/WebCore/platform/graphics/GlyphPage.h

@@ -97,7 +97,7 @@ class GlyphPage : public RefCounted<GlyphPage> {
     {
         Glyph glyph = glyphForIndex(index);
         auto colorGlyphType = colorGlyphTypeForIndex(index);
-        return GlyphData(glyph, glyph ? m_font.ptr() : nullptr, colorGlyphType);
+        return GlyphData(glyph, glyph ? m_font.get() : nullptr, colorGlyphType);
     }
 
     Glyph glyphForIndex(unsigned index) const
@@ -122,7 +122,7 @@ class GlyphPage : public RefCounted<GlyphPage> {
 
     const Font& font() const
     {
-        return m_font.get();
+        return *m_font;
     }
 
     // Implemented by the platform.
@@ -135,7 +135,7 @@ class GlyphPage : public RefCounted<GlyphPage> {
         ++s_count;
     }
 
-    CheckedRef<const Font> m_font;
+    WeakPtr<const Font> m_font;
     Glyph m_glyphs[size] { };
     WTF::BitSet<size> m_isColor;