Fix memory management errors for font loading and copying

A few issues are fixed:
--Change variable |m_bLogic| in CFX_Font to |m_bShallowCopy| to
reflect its meaning better;
--For a shallow copy of font, we must guarantee that the copied font
will not be deleted until the shallow copy is deleted. So need to
increase the src font's refcount when copying it;
--The stream |m_pOwnedStream| needs to have matched new/delete

These errors need to be fixed before we can properly delete all the
fonts to address the leaks.

BUG=pdfium:242

Review-Url: https://codereview.chromium.org/2322043002

2 files changed, 15 insertions, 6 deletions

diff --git a/xfa/fgas/font/fgas_gefont.cpp b/xfa/fgas/font/fgas_gefont.cpp
index 1507fa4840..d3be9dcb48 100644
--- a/xfa/fgas/font/fgas_gefont.cpp
+++ b/xfa/fgas/font/fgas_gefont.cpp
@@ -77,26 +77,29 @@ CFGAS_GEFont::CFGAS_GEFont(IFGAS_FontMgr* pFontMgr)
       m_dwLogFontStyle(0),
 #endif
       m_pFont(nullptr),
+      m_pSrcFont(nullptr),
       m_pFontMgr(pFontMgr),
       m_iRefCount(1),
       m_bExtFont(FALSE),
       m_pProvider(nullptr) {
 }
 
-CFGAS_GEFont::CFGAS_GEFont(const CFGAS_GEFont& src, uint32_t dwFontStyles)
+CFGAS_GEFont::CFGAS_GEFont(CFGAS_GEFont* src, uint32_t dwFontStyles)
     :
 #if _FXM_PLATFORM_ != _FXM_PLATFORM_WINDOWS_
       m_bUseLogFontStyle(FALSE),
       m_dwLogFontStyle(0),
 #endif
       m_pFont(nullptr),
-      m_pFontMgr(src.m_pFontMgr),
+      m_pSrcFont(src),
+      m_pFontMgr(src->m_pFontMgr),
       m_iRefCount(1),
       m_bExtFont(FALSE),
       m_pProvider(nullptr) {
-  ASSERT(src.m_pFont);
+  ASSERT(m_pSrcFont->m_pFont);
+  m_pSrcFont->Retain();
   m_pFont = new CFX_Font;
-  m_pFont->LoadClone(src.m_pFont);
+  m_pFont->LoadClone(m_pSrcFont->m_pFont);
   CFX_SubstFont* pSubst = m_pFont->GetSubstFont();
   if (!pSubst) {
     pSubst = new CFX_SubstFont;
@@ -119,6 +122,11 @@ CFGAS_GEFont::~CFGAS_GEFont() {
 
   if (!m_bExtFont)
     delete m_pFont;
+
+  // If it is a shallow copy of another source font,
+  // decrease the refcount of the source font.
+  if (m_pSrcFont)
+    m_pSrcFont->Release();
 }
 
 void CFGAS_GEFont::Release() {
@@ -239,7 +247,7 @@ FX_BOOL CFGAS_GEFont::InitFont() {
 CFGAS_GEFont* CFGAS_GEFont::Derive(uint32_t dwFontStyles, uint16_t wCodePage) {
   if (GetFontStyles() == dwFontStyles)
     return Retain();
-  return new CFGAS_GEFont(*this, dwFontStyles);
+  return new CFGAS_GEFont(this, dwFontStyles);
 }
 
 void CFGAS_GEFont::GetFamilyName(CFX_WideString& wsFamily) const {
diff --git a/xfa/fgas/font/fgas_gefont.h b/xfa/fgas/font/fgas_gefont.h
index cdb19338a2..d139d445f4 100644
--- a/xfa/fgas/font/fgas_gefont.h
+++ b/xfa/fgas/font/fgas_gefont.h
@@ -65,7 +65,7 @@ class CFGAS_GEFont {
 
  protected:
   explicit CFGAS_GEFont(IFGAS_FontMgr* pFontMgr);
-  CFGAS_GEFont(const CFGAS_GEFont& src, uint32_t dwFontStyles);
+  CFGAS_GEFont(CFGAS_GEFont* src, uint32_t dwFontStyles);
 
 #if _FXM_PLATFORM_ == _FXM_PLATFORM_WINDOWS_
   FX_BOOL LoadFontInternal(const FX_WCHAR* pszFontFamily,
@@ -94,6 +94,7 @@ class CFGAS_GEFont {
   uint32_t m_dwLogFontStyle;
 #endif
   CFX_Font* m_pFont;
+  CFGAS_GEFont* const m_pSrcFont;
   IFGAS_FontMgr* const m_pFontMgr;
   int32_t m_iRefCount;
   FX_BOOL m_bExtFont;