Make m_pShadingObj a CPDF_Stream instead of CPDF_Object.

This object is required to be a stream and was being converted as such. With
the new type checking this caused us to pass a nullptr where previously we'd
have, incorrectly, cast a CPDF_Dictionary to a CPDF_Stream.

This CL changes the m_pShadingObj to always be a CPDF_Stream. Then, we never
go down the bad code path because we check if m_pShadingObj is nullptr earlier
and bail out.

BUG=chromium:547706
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1426713002 .

1 files changed, 3 insertions, 4 deletions

diff --git a/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp b/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp
index b12a65a844..bd4319df11 100644
--- a/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp
+++ b/core/src/fpdfapi/fpdf_page/fpdf_page_parser.cpp
@@ -1128,10 +1128,9 @@ void CPDF_StreamContentParser::Handle_ShadeFill() {
     bbox = m_BBox;
   }
   if (pShading->m_ShadingType >= 4) {
-    bbox.Intersect(_GetShadingBBox(ToStream(pShading->m_pShadingObj),
-                                   pShading->m_ShadingType, &pObj->m_Matrix,
-                                   pShading->m_pFunctions, pShading->m_nFuncs,
-                                   pShading->m_pCS));
+    bbox.Intersect(_GetShadingBBox(
+        pShading->m_pShadingObj, pShading->m_ShadingType, &pObj->m_Matrix,
+        pShading->m_pFunctions, pShading->m_nFuncs, pShading->m_pCS));
   }
   pObj->m_Left = bbox.left;
   pObj->m_Right = bbox.right;