Fix ownership when making a private annot dictionary into a shared one.

There's no way to take ownership back from the CPDF_Array
without deleting the object, so add a new primitive to make
elements become indirect rather than manipulating them
outside the class.

This should solve the ASSERT(objnum == 0) issue that
blocked the previous roll.

Review-Url: https://codereview.chromium.org/2391883003

3 files changed, 15 insertions, 4 deletions

diff --git a/core/fpdfapi/parser/cpdf_array.cpp b/core/fpdfapi/parser/cpdf_array.cpp
index 61e69e8a53..e9a92eeae6 100644
--- a/core/fpdfapi/parser/cpdf_array.cpp
+++ b/core/fpdfapi/parser/cpdf_array.cpp
@@ -146,6 +146,19 @@ void CPDF_Array::RemoveAt(size_t i, size_t nCount) {
   m_Objects.erase(m_Objects.begin() + i, m_Objects.begin() + i + nCount);
 }
 
+void CPDF_Array::ConvertToIndirectObjectAt(size_t i,
+                                           CPDF_IndirectObjectHolder* pHolder) {
+  if (i >= m_Objects.size())
+    return;
+
+  CPDF_Object* pObj = m_Objects[i];
+  if (!pObj || pObj->GetObjNum() != 0)
+    return;
+
+  uint32_t dwObjNum = pHolder->AddIndirectObject(pObj);
+  m_Objects[i] = new CPDF_Reference(pHolder, dwObjNum);
+}
+
 void CPDF_Array::SetAt(size_t i, CPDF_Object* pObj) {
   ASSERT(IsArray());
   CHECK(!pObj || pObj->GetObjNum() == 0);
diff --git a/core/fpdfapi/parser/cpdf_array.h b/core/fpdfapi/parser/cpdf_array.h
index 25bbdd56f2..da9677e927 100644
--- a/core/fpdfapi/parser/cpdf_array.h
+++ b/core/fpdfapi/parser/cpdf_array.h
@@ -46,6 +46,7 @@ class CPDF_Array : public CPDF_Object {
   void SetAt(size_t index, CPDF_Object* pObj);
   void InsertAt(size_t index, CPDF_Object* pObj);
   void RemoveAt(size_t index, size_t nCount = 1);
+  void ConvertToIndirectObjectAt(size_t index, CPDF_IndirectObjectHolder* pDoc);
 
   void Add(CPDF_Object* pObj);
   void AddNumber(FX_FLOAT f);
diff --git a/core/fpdfdoc/cpdf_annotlist.cpp b/core/fpdfdoc/cpdf_annotlist.cpp
index 0d9c613e91..940cf324f4 100644
--- a/core/fpdfdoc/cpdf_annotlist.cpp
+++ b/core/fpdfdoc/cpdf_annotlist.cpp
@@ -73,10 +73,7 @@ CPDF_AnnotList::CPDF_AnnotList(CPDF_Page* pPage)
 
     uint32_t dwObjNum = pDict->GetObjNum();
     if (dwObjNum == 0) {
-      dwObjNum = m_pDocument->AddIndirectObject(pDict);
-      CPDF_Reference* pAction = new CPDF_Reference(m_pDocument, dwObjNum);
-      pAnnots->InsertAt(i, pAction);
-      pAnnots->RemoveAt(i + 1);
+      pAnnots->ConvertToIndirectObjectAt(i, m_pDocument);
       pDict = pAnnots->GetDictAt(i);
     }