Fix a crasher in rendering rich text in XFA files

Increase ref number of pStyle when it's being used. In this way,
it won't be released when it's being used.

BUG=pdfium:267
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1468123003 .

1 files changed, 6 insertions, 2 deletions

diff --git a/xfa/src/fxfa/src/app/xfa_textlayout.cpp b/xfa/src/fxfa/src/app/xfa_textlayout.cpp
index ffc471d506..667fc11b4c 100644
--- a/xfa/src/fxfa/src/app/xfa_textlayout.cpp
+++ b/xfa/src/fxfa/src/app/xfa_textlayout.cpp
@@ -1826,10 +1826,13 @@ void CXFA_TextLayout::AppendTextLine(FX_DWORD dwStatus,
       m_pLoader->m_lineHeights.Add(fHeight);

     }

   }

+  if (pStyle) {

+    pStyle->AddRef();

+  }

   m_pBreak->ClearBreakPieces();

   if (dwStatus == FX_RTFBREAK_ParagraphBreak) {

     m_pBreak->Reset();

-    if (pStyle == NULL && bEndBreak) {

+    if (!pStyle && bEndBreak) {

       CXFA_Para para = m_pTextProvider->GetParaNode();

       if (para.IsExistInXML()) {

         FX_FLOAT fStartPos = para.GetMarginLeft();

@@ -1846,7 +1849,7 @@ void CXFA_TextLayout::AppendTextLine(FX_DWORD dwStatus,
       }

     }

   }

-  if (pStyle != NULL) {

+  if (pStyle) {

     FX_FLOAT fStart = 0;

     const FDE_CSSRECT* pRect = pStyle->GetBoundaryStyles()->GetMarginWidth();

     if (pRect) {

@@ -1858,6 +1861,7 @@ void CXFA_TextLayout::AppendTextLine(FX_DWORD dwStatus,
       fStart -= fTextIndent;

     }

     m_pBreak->SetLinePos(fStart);

+    pStyle->Release();

   }

   m_iLines++;

 }