Use UnownedPtr instead of T* in MaybeOwned.

Always check the liftime in the unowned case. Doing so unearthed
the following issues:

Transient lifetime issue in jbig2_image when doing realloc().
Stale (but unused) dictionary pointer in CPDF_Image.
Destruction order in error branch in cpdf_dibsource.cpp

Change-Id: I12b758aafeefedc7abe1e8b21a18db959929e95f
Reviewed-on: https://pdfium-review.googlesource.com/24552
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

1 files changed, 16 insertions, 6 deletions

diff --git a/core/fxcrt/maybe_owned.h b/core/fxcrt/maybe_owned.h
index 11dd68642d..130d2bdc3c 100644
--- a/core/fxcrt/maybe_owned.h
+++ b/core/fxcrt/maybe_owned.h
@@ -11,6 +11,7 @@
 
 #include "core/fxcrt/fx_memory.h"
 #include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/unowned_ptr.h"
 
 namespace fxcrt {
 
@@ -33,25 +34,34 @@ class MaybeOwned {
   }
 
   void Reset(std::unique_ptr<T, D> ptr) {
+    m_pObj = ptr.get();
     m_pOwnedObj = std::move(ptr);
-    m_pObj = m_pOwnedObj.get();
   }
   void Reset(T* ptr = nullptr) {
-    m_pOwnedObj.reset();
     m_pObj = ptr;
+    m_pOwnedObj.reset();
   }
 
+  T* Get() const { return m_pObj.Get(); }
   bool IsOwned() const { return !!m_pOwnedObj; }
-  T* Get() const { return m_pObj; }
+
+  // Downgrades to unowned, caller takes ownership.
   std::unique_ptr<T, D> Release() {
     ASSERT(IsOwned());
     return std::move(m_pOwnedObj);
   }
 
+  // Downgrades to empty, caller takes ownership.
+  std::unique_ptr<T, D> ReleaseAndClear() {
+    ASSERT(IsOwned());
+    m_pObj = nullptr;
+    return std::move(m_pOwnedObj);
+  }
+
   MaybeOwned& operator=(const MaybeOwned& that) = delete;
   MaybeOwned& operator=(MaybeOwned&& that) {
-    m_pOwnedObj = std::move(that.m_pOwnedObj);
     m_pObj = that.m_pObj;
+    m_pOwnedObj = std::move(that.m_pOwnedObj);
     that.m_pObj = nullptr;
     return *this;
   }
@@ -78,11 +88,11 @@ class MaybeOwned {
 
   explicit operator bool() const { return !!m_pObj; }
   T& operator*() const { return *m_pObj; }
-  T* operator->() const { return m_pObj; }
+  T* operator->() const { return m_pObj.Get(); }
 
  private:
   std::unique_ptr<T, D> m_pOwnedObj;
-  T* m_pObj;
+  UnownedPtr<T> m_pObj;
 };
 
 }  // namespace fxcrt