Make CPDF_ImageCacheEntry retain CPDF_Image

CPDF_PageRenderCache::m_ImageCache is a map from streams to
an image cache entry containing a clump of data associated
with the stream. Oddly, the clump includes the stream key (which
we already have in order to get to the clump), but worse doesn't
ensure the existence of the CPDF_Image object which (maybe) owns
the stream key in question.

So replace the stream with a retained ptr to the image.

Also renamed an unrelated member to avoid confusion with the
CPDF_Object in play.

Bug: 724460
Change-Id: Id13d2c246918d4ff78c12b5bdb927f99c3f5e4e1
Reviewed-on: https://pdfium-review.googlesource.com/5771
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

7 files changed, 42 insertions, 34 deletions

diff --git a/core/fpdfapi/page/cpdf_image.cpp b/core/fpdfapi/page/cpdf_image.cpp
index 2c117fdc71..7d16dd9618 100644
--- a/core/fpdfapi/page/cpdf_image.cpp
+++ b/core/fpdfapi/page/cpdf_image.cpp
@@ -323,7 +323,8 @@ void CPDF_Image::SetImage(const CFX_RetainPtr<CFX_DIBitmap>& pBitmap) {
 
 void CPDF_Image::ResetCache(CPDF_Page* pPage,
                             const CFX_RetainPtr<CFX_DIBitmap>& pBitmap) {
-  pPage->GetRenderCache()->ResetBitmap(m_pStream.Get(), pBitmap);
+  CFX_RetainPtr<CPDF_Image> pHolder(this);
+  pPage->GetRenderCache()->ResetBitmap(pHolder, pBitmap);
 }
 
 CFX_RetainPtr<CFX_DIBSource> CPDF_Image::LoadDIBSource() const {
diff --git a/core/fpdfapi/render/cpdf_imagecacheentry.cpp b/core/fpdfapi/render/cpdf_imagecacheentry.cpp
index 6ea1caf68f..fad94f71ae 100644
--- a/core/fpdfapi/render/cpdf_imagecacheentry.cpp
+++ b/core/fpdfapi/render/cpdf_imagecacheentry.cpp
@@ -18,12 +18,13 @@
 #include "core/fpdfapi/render/cpdf_rendercontext.h"
 #include "core/fpdfapi/render/cpdf_renderstatus.h"
 
-CPDF_ImageCacheEntry::CPDF_ImageCacheEntry(CPDF_Document* pDoc,
-                                           CPDF_Stream* pStream)
+CPDF_ImageCacheEntry::CPDF_ImageCacheEntry(
+    CPDF_Document* pDoc,
+    const CFX_RetainPtr<CPDF_Image>& pImage)
     : m_dwTimeCount(0),
       m_MatteColor(0),
       m_pDocument(pDoc),
-      m_pStream(pStream),
+      m_pImage(pImage),
       m_dwCacheSize(0) {}
 
 CPDF_ImageCacheEntry::~CPDF_ImageCacheEntry() {}
@@ -68,8 +69,8 @@ int CPDF_ImageCacheEntry::StartGetCachedBitmap(
 
   m_pCurBitmap = pdfium::MakeRetain<CPDF_DIBSource>();
   int ret = m_pCurBitmap.As<CPDF_DIBSource>()->StartLoadDIBSource(
-      m_pDocument.Get(), m_pStream.Get(), true, pFormResources, pPageResources,
-      bStdCS, GroupFamily, bLoadMask);
+      m_pDocument.Get(), m_pImage->GetStream(), true, pFormResources,
+      pPageResources, bStdCS, GroupFamily, bLoadMask);
   if (ret == 2)
     return ret;
 
diff --git a/core/fpdfapi/render/cpdf_imagecacheentry.h b/core/fpdfapi/render/cpdf_imagecacheentry.h
index 0909f80da9..fac2c1ff56 100644
--- a/core/fpdfapi/render/cpdf_imagecacheentry.h
+++ b/core/fpdfapi/render/cpdf_imagecacheentry.h
@@ -13,24 +13,24 @@
 #include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_system.h"
 
-class CFX_DIBitmap;
 class CFX_DIBSource;
+class CFX_DIBitmap;
 class CPDF_Dictionary;
 class CPDF_Document;
+class CPDF_Image;
 class CPDF_RenderStatus;
-class CPDF_Stream;
 class IFX_Pause;
 
 class CPDF_ImageCacheEntry {
  public:
-  CPDF_ImageCacheEntry(CPDF_Document* pDoc, CPDF_Stream* pStream);
+  CPDF_ImageCacheEntry(CPDF_Document* pDoc,
+                       const CFX_RetainPtr<CPDF_Image>& pImage);
   ~CPDF_ImageCacheEntry();
 
   void Reset(const CFX_RetainPtr<CFX_DIBitmap>& pBitmap);
   uint32_t EstimateSize() const { return m_dwCacheSize; }
   uint32_t GetTimeCount() const { return m_dwTimeCount; }
-  CPDF_Stream* GetStream() const { return m_pStream.Get(); }
-
+  CPDF_Image* GetImage() const { return m_pImage.Get(); }
   int StartGetCachedBitmap(CPDF_Dictionary* pFormResources,
                            CPDF_Dictionary* pPageResources,
                            bool bStdCS,
@@ -49,7 +49,7 @@ class CPDF_ImageCacheEntry {
   void CalcSize();
 
   CFX_UnownedPtr<CPDF_Document> const m_pDocument;
-  CFX_UnownedPtr<CPDF_Stream> const m_pStream;
+  CFX_RetainPtr<CPDF_Image> const m_pImage;
   CFX_RetainPtr<CFX_DIBSource> m_pCurBitmap;
   CFX_RetainPtr<CFX_DIBSource> m_pCurMask;
   CFX_RetainPtr<CFX_DIBSource> m_pCachedBitmap;
diff --git a/core/fpdfapi/render/cpdf_imageloader.cpp b/core/fpdfapi/render/cpdf_imageloader.cpp
index bf540c610d..53b6009c15 100644
--- a/core/fpdfapi/render/cpdf_imageloader.cpp
+++ b/core/fpdfapi/render/cpdf_imageloader.cpp
@@ -18,7 +18,7 @@ CPDF_ImageLoader::CPDF_ImageLoader()
     : m_MatteColor(0),
       m_bCached(false),
       m_pCache(nullptr),
-      m_pImage(nullptr) {}
+      m_pImageObject(nullptr) {}
 
 CPDF_ImageLoader::~CPDF_ImageLoader() {}
 
@@ -29,14 +29,13 @@ bool CPDF_ImageLoader::Start(const CPDF_ImageObject* pImage,
                              bool bLoadMask,
                              CPDF_RenderStatus* pRenderStatus) {
   m_pCache = pCache;
-  m_pImage = const_cast<CPDF_ImageObject*>(pImage);
+  m_pImageObject = const_cast<CPDF_ImageObject*>(pImage);
   bool ret;
   if (pCache) {
-    ret =
-        pCache->StartGetCachedBitmap(m_pImage->GetImage()->GetStream(), bStdCS,
-                                     GroupFamily, bLoadMask, pRenderStatus);
+    ret = pCache->StartGetCachedBitmap(m_pImageObject->GetImage(), bStdCS,
+                                       GroupFamily, bLoadMask, pRenderStatus);
   } else {
-    ret = m_pImage->GetImage()->StartLoadDIBSource(
+    ret = m_pImageObject->GetImage()->StartLoadDIBSource(
         pRenderStatus->m_pFormResource, pRenderStatus->m_pPageResource, bStdCS,
         GroupFamily, bLoadMask);
   }
@@ -48,7 +47,7 @@ bool CPDF_ImageLoader::Start(const CPDF_ImageObject* pImage,
 bool CPDF_ImageLoader::Continue(IFX_Pause* pPause,
                                 CPDF_RenderStatus* pRenderStatus) {
   bool ret = m_pCache ? m_pCache->Continue(pPause, pRenderStatus)
-                      : m_pImage->GetImage()->Continue(pPause);
+                      : m_pImageObject->GetImage()->Continue(pPause);
   if (!ret)
     HandleFailure();
   return ret;
@@ -63,7 +62,7 @@ void CPDF_ImageLoader::HandleFailure() {
     m_MatteColor = entry->m_MatteColor;
     return;
   }
-  CFX_RetainPtr<CPDF_Image> pImage = m_pImage->GetImage();
+  CFX_RetainPtr<CPDF_Image> pImage = m_pImageObject->GetImage();
   m_bCached = false;
   m_pBitmap = pImage->DetachBitmap();
   m_pMask = pImage->DetachMask();
diff --git a/core/fpdfapi/render/cpdf_imageloader.h b/core/fpdfapi/render/cpdf_imageloader.h
index d7c6f60fcc..f17f29cce5 100644
--- a/core/fpdfapi/render/cpdf_imageloader.h
+++ b/core/fpdfapi/render/cpdf_imageloader.h
@@ -38,7 +38,7 @@ class CPDF_ImageLoader {
   void HandleFailure();
 
   CPDF_PageRenderCache* m_pCache;
-  CPDF_ImageObject* m_pImage;
+  CPDF_ImageObject* m_pImageObject;
 };
 
 #endif  // CORE_FPDFAPI_RENDER_CPDF_IMAGELOADER_H_
diff --git a/core/fpdfapi/render/cpdf_pagerendercache.cpp b/core/fpdfapi/render/cpdf_pagerendercache.cpp
index cc1f267f14..a997e34906 100644
--- a/core/fpdfapi/render/cpdf_pagerendercache.cpp
+++ b/core/fpdfapi/render/cpdf_pagerendercache.cpp
@@ -9,6 +9,7 @@
 #include <algorithm>
 #include <vector>
 
+#include "core/fpdfapi/page/cpdf_image.h"
 #include "core/fpdfapi/page/cpdf_page.h"
 #include "core/fpdfapi/render/cpdf_imagecacheentry.h"
 #include "core/fpdfapi/render/cpdf_renderstatus.h"
@@ -45,8 +46,10 @@ void CPDF_PageRenderCache::CacheOptimization(int32_t dwLimitCacheSize) {
   size_t nCount = m_ImageCache.size();
   std::vector<CacheInfo> cache_info;
   cache_info.reserve(nCount);
-  for (const auto& it : m_ImageCache)
-    cache_info.emplace_back(it.second->GetTimeCount(), it.second->GetStream());
+  for (const auto& it : m_ImageCache) {
+    cache_info.emplace_back(it.second->GetTimeCount(),
+                            it.second->GetImage()->GetStream());
+  }
   std::sort(cache_info.begin(), cache_info.end());
 
   // Check if time value is about to roll over and reset all entries.
@@ -77,18 +80,19 @@ void CPDF_PageRenderCache::ClearImageCacheEntry(CPDF_Stream* pStream) {
 }
 
 bool CPDF_PageRenderCache::StartGetCachedBitmap(
-    CPDF_Stream* pStream,
+    const CFX_RetainPtr<CPDF_Image>& pImage,
     bool bStdCS,
     uint32_t GroupFamily,
     bool bLoadMask,
     CPDF_RenderStatus* pRenderStatus) {
+  CPDF_Stream* pStream = pImage->GetStream();
   const auto it = m_ImageCache.find(pStream);
   m_bCurFindCache = it != m_ImageCache.end();
   if (m_bCurFindCache) {
     m_pCurImageCacheEntry = it->second;
   } else {
     m_pCurImageCacheEntry =
-        new CPDF_ImageCacheEntry(m_pPage->m_pDocument.Get(), pStream);
+        new CPDF_ImageCacheEntry(m_pPage->m_pDocument.Get(), pImage);
   }
   int ret = m_pCurImageCacheEntry->StartGetCachedBitmap(
       pRenderStatus->m_pFormResource, m_pPage->m_pPageResources.Get(), bStdCS,
@@ -113,23 +117,26 @@ bool CPDF_PageRenderCache::Continue(IFX_Pause* pPause,
     return true;
 
   m_nTimeCount++;
-  if (!m_bCurFindCache)
-    m_ImageCache[m_pCurImageCacheEntry->GetStream()] = m_pCurImageCacheEntry;
+  if (!m_bCurFindCache) {
+    m_ImageCache[m_pCurImageCacheEntry->GetImage()->GetStream()] =
+        m_pCurImageCacheEntry;
+  }
   if (!ret)
     m_nCacheSize += m_pCurImageCacheEntry->EstimateSize();
   return false;
 }
 
 void CPDF_PageRenderCache::ResetBitmap(
-    CPDF_Stream* pStream,
+    const CFX_RetainPtr<CPDF_Image>& pImage,
     const CFX_RetainPtr<CFX_DIBitmap>& pBitmap) {
   CPDF_ImageCacheEntry* pEntry;
+  CPDF_Stream* pStream = pImage->GetStream();
   const auto it = m_ImageCache.find(pStream);
   if (it == m_ImageCache.end()) {
     if (!pBitmap)
       return;
 
-    pEntry = new CPDF_ImageCacheEntry(m_pPage->m_pDocument.Get(), pStream);
+    pEntry = new CPDF_ImageCacheEntry(m_pPage->m_pDocument.Get(), pImage);
     m_ImageCache[pStream] = pEntry;
   } else {
     pEntry = it->second;
diff --git a/core/fpdfapi/render/cpdf_pagerendercache.h b/core/fpdfapi/render/cpdf_pagerendercache.h
index 5d9ae03a1c..626e24bd2e 100644
--- a/core/fpdfapi/render/cpdf_pagerendercache.h
+++ b/core/fpdfapi/render/cpdf_pagerendercache.h
@@ -12,11 +12,12 @@
 #include "core/fxcrt/cfx_retain_ptr.h"
 #include "core/fxcrt/fx_system.h"
 
-class CPDF_Stream;
+class CFX_DIBitmap;
+class CPDF_Image;
 class CPDF_ImageCacheEntry;
 class CPDF_Page;
 class CPDF_RenderStatus;
-class CFX_DIBitmap;
+class CPDF_Stream;
 class IFX_Pause;
 
 class CPDF_PageRenderCache {
@@ -26,15 +27,14 @@ class CPDF_PageRenderCache {
 
   void CacheOptimization(int32_t dwLimitCacheSize);
   uint32_t GetTimeCount() const { return m_nTimeCount; }
-
-  void ResetBitmap(CPDF_Stream* pStream,
+  void ResetBitmap(const CFX_RetainPtr<CPDF_Image>& pImage,
                    const CFX_RetainPtr<CFX_DIBitmap>& pBitmap);
   CPDF_Page* GetPage() const { return m_pPage; }
   CPDF_ImageCacheEntry* GetCurImageCacheEntry() const {
     return m_pCurImageCacheEntry;
   }
 
-  bool StartGetCachedBitmap(CPDF_Stream* pStream,
+  bool StartGetCachedBitmap(const CFX_RetainPtr<CPDF_Image>& pImage,
                             bool bStdCS,
                             uint32_t GroupFamily,
                             bool bLoadMask,