Fix ownership when making a private annot dictionary into a shared one.

There's no way to take ownership back from the CPDF_Array
without deleting the object, so add a new primitive to make
elements become indirect rather than manipulating them
outside the class.

This should solve the ASSERT(objnum == 0) issue that
blocked the previous roll.

Review-Url: https://codereview.chromium.org/2391883003

1 files changed, 13 insertions, 0 deletions

diff --git a/core/fpdfapi/parser/cpdf_array.cpp b/core/fpdfapi/parser/cpdf_array.cpp
index 61e69e8a53..e9a92eeae6 100644
--- a/core/fpdfapi/parser/cpdf_array.cpp
+++ b/core/fpdfapi/parser/cpdf_array.cpp
@@ -146,6 +146,19 @@ void CPDF_Array::RemoveAt(size_t i, size_t nCount) {
   m_Objects.erase(m_Objects.begin() + i, m_Objects.begin() + i + nCount);
 }
 
+void CPDF_Array::ConvertToIndirectObjectAt(size_t i,
+                                           CPDF_IndirectObjectHolder* pHolder) {
+  if (i >= m_Objects.size())
+    return;
+
+  CPDF_Object* pObj = m_Objects[i];
+  if (!pObj || pObj->GetObjNum() != 0)
+    return;
+
+  uint32_t dwObjNum = pHolder->AddIndirectObject(pObj);
+  m_Objects[i] = new CPDF_Reference(pHolder, dwObjNum);
+}
+
 void CPDF_Array::SetAt(size_t i, CPDF_Object* pObj) {
   ASSERT(IsArray());
   CHECK(!pObj || pObj->GetObjNum() == 0);