Fix ownership when making a private annot dictionary into a shared one.

There's no way to take ownership back from the CPDF_Array
without deleting the object, so add a new primitive to make
elements become indirect rather than manipulating them
outside the class.

This should solve the ASSERT(objnum == 0) issue that
blocked the previous roll.

Review-Url: https://codereview.chromium.org/2391883003

2 files changed, 14 insertions, 0 deletions

diff --git a/core/fpdfapi/parser/cpdf_array.cpp b/core/fpdfapi/parser/cpdf_array.cpp
index 61e69e8a53..e9a92eeae6 100644
--- a/core/fpdfapi/parser/cpdf_array.cpp
+++ b/core/fpdfapi/parser/cpdf_array.cpp
@@ -146,6 +146,19 @@ void CPDF_Array::RemoveAt(size_t i, size_t nCount) {
   m_Objects.erase(m_Objects.begin() + i, m_Objects.begin() + i + nCount);
 }
 
+void CPDF_Array::ConvertToIndirectObjectAt(size_t i,
+                                           CPDF_IndirectObjectHolder* pHolder) {
+  if (i >= m_Objects.size())
+    return;
+
+  CPDF_Object* pObj = m_Objects[i];
+  if (!pObj || pObj->GetObjNum() != 0)
+    return;
+
+  uint32_t dwObjNum = pHolder->AddIndirectObject(pObj);
+  m_Objects[i] = new CPDF_Reference(pHolder, dwObjNum);
+}
+
 void CPDF_Array::SetAt(size_t i, CPDF_Object* pObj) {
   ASSERT(IsArray());
   CHECK(!pObj || pObj->GetObjNum() == 0);
diff --git a/core/fpdfapi/parser/cpdf_array.h b/core/fpdfapi/parser/cpdf_array.h
index 25bbdd56f2..da9677e927 100644
--- a/core/fpdfapi/parser/cpdf_array.h
+++ b/core/fpdfapi/parser/cpdf_array.h
@@ -46,6 +46,7 @@ class CPDF_Array : public CPDF_Object {
   void SetAt(size_t index, CPDF_Object* pObj);
   void InsertAt(size_t index, CPDF_Object* pObj);
   void RemoveAt(size_t index, size_t nCount = 1);
+  void ConvertToIndirectObjectAt(size_t index, CPDF_IndirectObjectHolder* pDoc);
 
   void Add(CPDF_Object* pObj);
   void AddNumber(FX_FLOAT f);