Catch stray Retains() and Releases() outside of RetainPtr<>.

The previous CLs made the code clean, so now we can mark more things
private, and add friends as appropriate.

Review-Url: https://codereview.chromium.org/2560783003

3 files changed, 42 insertions, 22 deletions

diff --git a/core/fxcrt/cfx_retain_ptr.h b/core/fxcrt/cfx_retain_ptr.h
index 8c7bf289a7..bff1b9691c 100644
--- a/core/fxcrt/cfx_retain_ptr.h
+++ b/core/fxcrt/cfx_retain_ptr.h
@@ -60,15 +60,24 @@ class CFX_RetainPtr {
 // Trivial implementation - internal ref count with virtual destructor.
 class CFX_Retainable {
  public:
+  bool HasOneRef() const { return m_nRefCount == 1; }
+
+ protected:
+  virtual ~CFX_Retainable() {}
+
+ private:
+  template <typename U>
+  friend struct ReleaseDeleter;
+
+  template <typename U>
+  friend class CFX_RetainPtr;
+
   void Retain() { ++m_nRefCount; }
   void Release() {
     if (--m_nRefCount == 0)
       delete this;
   }
-  bool HasOneRef() const { return m_nRefCount == 1; }
 
- protected:
-  virtual ~CFX_Retainable() {}
   intptr_t m_nRefCount = 0;
 };
 
@@ -76,6 +85,8 @@ namespace pdfium {
 
 // Helper to make a CFX_RetainPtr along the lines of std::make_unique<>(),
 // or pdfium::MakeUnique<>(). Arguments are forwarded to T's constructor.
+// Classes managed by CFX_RetainPtr should have protected (or private)
+// constructors, and should friend this function.
 template <typename T, typename... Args>
 CFX_RetainPtr<T> MakeRetain(Args&&... args) {
   return CFX_RetainPtr<T>(new T(std::forward<Args>(args)...));
diff --git a/core/fxcrt/fx_extension.cpp b/core/fxcrt/fx_extension.cpp
index cbbb86f26b..630d4da2aa 100644
--- a/core/fxcrt/fx_extension.cpp
+++ b/core/fxcrt/fx_extension.cpp
@@ -74,8 +74,8 @@ bool CFX_CRTFileAccess::Init(const CFX_WideStringC& wsPath) {
 
 class CFX_CRTFileStream final : public IFX_SeekableStream {
  public:
-  explicit CFX_CRTFileStream(std::unique_ptr<IFXCRT_FileAccess> pFA);
-  ~CFX_CRTFileStream() override;
+  template <typename T, typename... Args>
+  friend CFX_RetainPtr<T> pdfium::MakeRetain(Args&&... args);
 
   // IFX_SeekableStream:
   FX_FILESIZE GetSize() override;
@@ -87,6 +87,9 @@ class CFX_CRTFileStream final : public IFX_SeekableStream {
   bool Flush() override;
 
  private:
+  explicit CFX_CRTFileStream(std::unique_ptr<IFXCRT_FileAccess> pFA);
+  ~CFX_CRTFileStream() override;
+
   std::unique_ptr<IFXCRT_FileAccess> m_pFile;
 };
 
@@ -133,9 +136,8 @@ bool CFX_CRTFileStream::Flush() {
 
 class CFX_MemoryStream final : public IFX_MemoryStream {
  public:
-  explicit CFX_MemoryStream(bool bConsecutive);
-  CFX_MemoryStream(uint8_t* pBuffer, size_t nSize, bool bTakeOver);
-  ~CFX_MemoryStream() override;
+  template <typename T, typename... Args>
+  friend CFX_RetainPtr<T> pdfium::MakeRetain(Args&&... args);
 
   // IFX_MemoryStream
   FX_FILESIZE GetSize() override;
@@ -154,6 +156,10 @@ class CFX_MemoryStream final : public IFX_MemoryStream {
   void DetachBuffer() override;
 
  private:
+  explicit CFX_MemoryStream(bool bConsecutive);
+  CFX_MemoryStream(uint8_t* pBuffer, size_t nSize, bool bTakeOver);
+  ~CFX_MemoryStream() override;
+
   bool ExpandBlocks(size_t size);
 
   CFX_ArrayTemplate<uint8_t*> m_Blocks;
@@ -396,8 +402,7 @@ CFX_RetainPtr<IFX_SeekableStream> IFX_SeekableStream::CreateFromFilename(
   std::unique_ptr<IFXCRT_FileAccess> pFA(IFXCRT_FileAccess::Create());
   if (!pFA->Open(filename, dwModes))
     return nullptr;
-  return CFX_RetainPtr<IFX_SeekableStream>(
-      new CFX_CRTFileStream(std::move(pFA)));
+  return pdfium::MakeRetain<CFX_CRTFileStream>(std::move(pFA));
 }
 
 // static
@@ -407,8 +412,7 @@ CFX_RetainPtr<IFX_SeekableStream> IFX_SeekableStream::CreateFromFilename(
   std::unique_ptr<IFXCRT_FileAccess> pFA(IFXCRT_FileAccess::Create());
   if (!pFA->Open(filename, dwModes))
     return nullptr;
-  return CFX_RetainPtr<IFX_SeekableStream>(
-      new CFX_CRTFileStream(std::move(pFA)));
+  return pdfium::MakeRetain<CFX_CRTFileStream>(std::move(pFA));
 }
 
 // static
@@ -421,13 +425,12 @@ IFX_SeekableReadStream::CreateFromFilename(const FX_CHAR* filename) {
 CFX_RetainPtr<IFX_MemoryStream> IFX_MemoryStream::Create(uint8_t* pBuffer,
                                                          size_t dwSize,
                                                          bool bTakeOver) {
-  return CFX_RetainPtr<IFX_MemoryStream>(
-      new CFX_MemoryStream(pBuffer, dwSize, bTakeOver));
+  return pdfium::MakeRetain<CFX_MemoryStream>(pBuffer, dwSize, bTakeOver);
 }
 
 // static
 CFX_RetainPtr<IFX_MemoryStream> IFX_MemoryStream::Create(bool bConsecutive) {
-  return CFX_RetainPtr<IFX_MemoryStream>(new CFX_MemoryStream(bConsecutive));
+  return pdfium::MakeRetain<CFX_MemoryStream>(bConsecutive);
 }
 
 FX_FLOAT FXSYS_tan(FX_FLOAT a) {
diff --git a/core/fxcrt/fx_xml_parser.cpp b/core/fxcrt/fx_xml_parser.cpp
index ab30926387..1b562c2083 100644
--- a/core/fxcrt/fx_xml_parser.cpp
+++ b/core/fxcrt/fx_xml_parser.cpp
@@ -70,8 +70,8 @@ bool g_FXCRT_XML_IsNameChar(uint8_t ch) {
 
 class CXML_DataBufAcc : public IFX_BufferedReadStream {
  public:
-  CXML_DataBufAcc(const uint8_t* pBuffer, size_t size);
-  ~CXML_DataBufAcc() override;
+  template <typename T, typename... Args>
+  friend CFX_RetainPtr<T> pdfium::MakeRetain(Args&&... args);
 
   // IFX_BufferedReadStream
   bool IsEOF() override;
@@ -83,6 +83,9 @@ class CXML_DataBufAcc : public IFX_BufferedReadStream {
   FX_FILESIZE GetBlockOffset() override;
 
  private:
+  CXML_DataBufAcc(const uint8_t* pBuffer, size_t size);
+  ~CXML_DataBufAcc() override;
+
   const uint8_t* m_pBuffer;
   size_t m_dwSize;
   size_t m_dwCurPos;
@@ -130,9 +133,8 @@ FX_FILESIZE CXML_DataBufAcc::GetBlockOffset() {
 
 class CXML_DataStmAcc : public IFX_BufferedReadStream {
  public:
-  explicit CXML_DataStmAcc(
-      const CFX_RetainPtr<IFX_SeekableReadStream>& pFileRead);
-  ~CXML_DataStmAcc() override;
+  template <typename T, typename... Args>
+  friend CFX_RetainPtr<T> pdfium::MakeRetain(Args&&... args);
 
   // IFX_BufferedReadStream
   bool IsEOF() override;
@@ -144,6 +146,10 @@ class CXML_DataStmAcc : public IFX_BufferedReadStream {
   FX_FILESIZE GetBlockOffset() override;
 
  private:
+  explicit CXML_DataStmAcc(
+      const CFX_RetainPtr<IFX_SeekableReadStream>& pFileRead);
+  ~CXML_DataStmAcc() override;
+
   CFX_RetainPtr<IFX_SeekableReadStream> m_pFileRead;
   uint8_t* m_pBuffer;
   FX_FILESIZE m_nStart;
@@ -215,12 +221,12 @@ CXML_Parser::CXML_Parser()
 CXML_Parser::~CXML_Parser() {}
 
 bool CXML_Parser::Init(uint8_t* pBuffer, size_t size) {
-  m_pDataAcc.Reset(new CXML_DataBufAcc(pBuffer, size));
+  m_pDataAcc = pdfium::MakeRetain<CXML_DataBufAcc>(pBuffer, size);
   return Init();
 }
 
 bool CXML_Parser::Init(const CFX_RetainPtr<IFX_SeekableReadStream>& pFileRead) {
-  m_pDataAcc.Reset(new CXML_DataStmAcc(pFileRead));
+  m_pDataAcc = pdfium::MakeRetain<CXML_DataStmAcc>(pFileRead);
   return Init();
 }