Use observed ptrs from CFGAS_GEFont back to its font mgrs.chromium/3106

CFGAS_GEFonts are ref counted, and its a good thing since they
are managed by at least three different font managers: 
CFGAS_FontMgr, CXFA_PDFFontMgr, and CXFA_FontMgr.  None of these
have a clear claim to ownership of the CFGAS_GEFont.

CFGAS_GEFont has back-pointers to two of these, CFGAS_FontMgr, and
CXFA_PDFFontMgr, and they could each outlive the other.  Thus the
font needs to watch for destruction of either of its managers, so
as to stop using it after its gone.

Bug: 724640
Change-Id: I907ec35e300e11e532e13545d51fb200ac86b4f9
Reviewed-on: https://pdfium-review.googlesource.com/5735
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

1 files changed, 7 insertions, 5 deletions

diff --git a/xfa/fgas/font/cfgas_gefont.h b/xfa/fgas/font/cfgas_gefont.h
index 5fe73bbb40..cc9e56a110 100644
--- a/xfa/fgas/font/cfgas_gefont.h
+++ b/xfa/fgas/font/cfgas_gefont.h
@@ -15,12 +15,12 @@
 #include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_memory.h"
 #include "xfa/fgas/font/cfgas_fontmgr.h"
+#include "xfa/fxfa/cxfa_pdffontmgr.h"
 
 #define FXFONT_SUBST_ITALIC 0x02
 
 class CFGAS_FontMgr;
 class CFX_UnicodeEncoding;
-class CXFA_PDFFontMgr;
 
 class CFGAS_GEFont : public CFX_Retainable {
  public:
@@ -50,7 +50,9 @@ class CFGAS_GEFont : public CFX_Retainable {
   bool GetBBox(CFX_Rect* bbox);
   CFX_RetainPtr<CFGAS_GEFont> GetSubstFont(int32_t iGlyphIndex);
   CFX_Font* GetDevFont() const { return m_pFont; }
-  void SetFontProvider(CXFA_PDFFontMgr* pProvider) { m_pProvider = pProvider; }
+  void SetFontProvider(CXFA_PDFFontMgr* pProvider) {
+    m_pProvider.Reset(pProvider);
+  }
 #if _FXM_PLATFORM_ != _FXM_PLATFORM_WINDOWS_
   void SetLogicalFontStyle(uint32_t dwLogFontStyle) {
     m_bUseLogFontStyle = true;
@@ -94,15 +96,15 @@ class CFGAS_GEFont : public CFX_Retainable {
   uint32_t m_dwLogFontStyle;
 #endif
   CFX_Font* m_pFont;
-  CFX_RetainPtr<CFGAS_GEFont> m_pSrcFont;  // Only set by ctor, so no cycles.
-  CFGAS_FontMgr* const m_pFontMgr;
   bool m_bExternalFont;
+  CFX_RetainPtr<CFGAS_GEFont> m_pSrcFont;  // Only set by ctor, so no cycles.
+  CFGAS_FontMgr::ObservedPtr m_pFontMgr;
+  CXFA_PDFFontMgr::ObservedPtr m_pProvider;
   CFX_RetainPtr<CFX_SeekableStreamProxy> m_pStream;
   CFX_RetainPtr<IFX_SeekableReadStream> m_pFileRead;
   std::unique_ptr<CFX_UnicodeEncoding> m_pFontEncoding;
   std::map<wchar_t, int32_t> m_CharWidthMap;
   std::map<wchar_t, CFX_Rect> m_BBoxMap;
-  CFX_UnownedPtr<CXFA_PDFFontMgr> m_pProvider;
   std::vector<CFX_RetainPtr<CFGAS_GEFont>> m_SubstFonts;
   std::map<wchar_t, CFX_RetainPtr<CFGAS_GEFont>> m_FontMapper;
 };