Fix CPDF_PageRenderContext cleanup

Make CFX_RenderDevice, which owns the IFX_RenderDeviceDriver, responsible
for restoring driver state as part of its destruction so that its callers
don't have to do so out of turn.

Then re-order CPDF_PageRenderContext destruction order so that
the progressive renderer is destroyed before the device, and the
device destroyed before the options because of unowned pointers
to objects owned by these.

Bug: 726755
Change-Id: I9a6f23da12140b2758b86e6f33f715ad1c679c3f
Reviewed-on: https://pdfium-review.googlesource.com/6073
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

3 files changed, 10 insertions, 12 deletions

diff --git a/core/fpdfapi/cpdf_pagerendercontext.h b/core/fpdfapi/cpdf_pagerendercontext.h
index 27244e7fc3..5cbcdb7759 100644
--- a/core/fpdfapi/cpdf_pagerendercontext.h
+++ b/core/fpdfapi/cpdf_pagerendercontext.h
@@ -21,11 +21,12 @@ class CPDF_PageRenderContext {
   CPDF_PageRenderContext();
   ~CPDF_PageRenderContext();
 
+  // Specific destruction order required.
   std::unique_ptr<CPDF_AnnotList> m_pAnnots;
+  std::unique_ptr<CPDF_RenderOptions> m_pOptions;
   std::unique_ptr<CFX_RenderDevice> m_pDevice;
   std::unique_ptr<CPDF_RenderContext> m_pContext;
   std::unique_ptr<CPDF_ProgressiveRenderer> m_pRenderer;
-  std::unique_ptr<CPDF_RenderOptions> m_pOptions;
 };
 
 #endif  // CORE_FPDFAPI_CPDF_PAGERENDERCONTEXT_H_
diff --git a/core/fxge/ge/cfx_renderdevice.cpp b/core/fxge/ge/cfx_renderdevice.cpp
index 4404833758..34c974439a 100644
--- a/core/fxge/ge/cfx_renderdevice.cpp
+++ b/core/fxge/ge/cfx_renderdevice.cpp
@@ -371,6 +371,7 @@ CFX_RenderDevice::CFX_RenderDevice()
       m_DeviceClass(0) {}
 
 CFX_RenderDevice::~CFX_RenderDevice() {
+  RestoreState(false);
 #if defined _SKIA_SUPPORT_ || defined _SKIA_SUPPORT_PATHS_
   Flush();
 #endif
@@ -407,13 +408,16 @@ void CFX_RenderDevice::SaveState() {
 }
 
 void CFX_RenderDevice::RestoreState(bool bKeepSaved) {
-  m_pDeviceDriver->RestoreState(bKeepSaved);
-  UpdateClipBox();
+  if (m_pDeviceDriver) {
+    m_pDeviceDriver->RestoreState(bKeepSaved);
+    UpdateClipBox();
+  }
 }
 
 int CFX_RenderDevice::GetDeviceCaps(int caps_id) const {
   return m_pDeviceDriver->GetDeviceCaps(caps_id);
 }
+
 CFX_Matrix CFX_RenderDevice::GetCTM() const {
   return m_pDeviceDriver->GetCTM();
 }
diff --git a/fpdfsdk/fpdf_progressive.cpp b/fpdfsdk/fpdf_progressive.cpp
index fc6ceab38e..2d8f125128 100644
--- a/fpdfsdk/fpdf_progressive.cpp
+++ b/fpdfsdk/fpdf_progressive.cpp
@@ -88,13 +88,6 @@ DLLEXPORT int STDCALL FPDF_RenderPage_Continue(FPDF_PAGE page,
 
 DLLEXPORT void STDCALL FPDF_RenderPage_Close(FPDF_PAGE page) {
   CPDF_Page* pPage = CPDFPageFromFPDFPage(page);
-  if (!pPage)
-    return;
-
-  CPDF_PageRenderContext* pContext = pPage->GetRenderContext();
-  if (!pContext)
-    return;
-
-  pContext->m_pDevice->RestoreState(false);
-  pPage->SetRenderContext(nullptr);
+  if (pPage)
+    pPage->SetRenderContext(nullptr);
 }