3 files changed, 42 insertions, 14 deletions

diff --git a/core/fpdfapi/edit/cpdf_creator.cpp b/core/fpdfapi/edit/cpdf_creator.cpp
index 9176c21e45..872860b0ed 100644
--- a/core/fpdfapi/edit/cpdf_creator.cpp
+++ b/core/fpdfapi/edit/cpdf_creator.cpp
@@ -169,7 +169,7 @@ bool CPDF_Creator::WriteStream(const CPDF_Object* pStream,
   if (static_cast<uint32_t>(encoder.GetDict()->GetIntegerFor("Length")) !=
       encryptor.GetSize()) {
     encoder.CloneDict();
-    encoder.GetDict()->SetNewFor<CPDF_Number>(
+    encoder.GetClonedDict()->SetNewFor<CPDF_Number>(
         "Length", static_cast<int>(encryptor.GetSize()));
   }
 
@@ -240,7 +240,7 @@ bool CPDF_Creator::WriteDirectObj(uint32_t objnum,
       if (static_cast<uint32_t>(encoder.GetDict()->GetIntegerFor("Length")) !=
           encryptor.GetSize()) {
         encoder.CloneDict();
-        encoder.GetDict()->SetNewFor<CPDF_Number>(
+        encoder.GetClonedDict()->SetNewFor<CPDF_Number>(
             "Length", static_cast<int>(encryptor.GetSize()));
       }
       if (!WriteDirectObj(objnum, encoder.GetDict(), true) ||
diff --git a/core/fpdfapi/edit/cpdf_flateencoder.cpp b/core/fpdfapi/edit/cpdf_flateencoder.cpp
index f6125b8847..a290da6dac 100644
--- a/core/fpdfapi/edit/cpdf_flateencoder.cpp
+++ b/core/fpdfapi/edit/cpdf_flateencoder.cpp
@@ -25,14 +25,16 @@ CPDF_FlateEncoder::CPDF_FlateEncoder(const CPDF_Stream* pStream,
 
     m_dwSize = pDestAcc->GetSize();
     m_pData = pDestAcc->DetachData();
-    m_pDict = ToDictionary(pStream->GetDict()->Clone());
-    m_pDict->RemoveFor("Filter");
+    m_pClonedDict = ToDictionary(pStream->GetDict()->Clone());
+    m_pClonedDict->RemoveFor("Filter");
+    ASSERT(!m_pDict);
     return;
   }
   if (bHasFilter || !bFlateEncode) {
     m_pData = m_pAcc->GetData();
     m_dwSize = m_pAcc->GetSize();
     m_pDict = pStream->GetDict();
+    ASSERT(!m_pClonedDict);
     return;
   }
 
@@ -41,18 +43,36 @@ CPDF_FlateEncoder::CPDF_FlateEncoder(const CPDF_Stream* pStream,
   ::FlateEncode(m_pAcc->GetData(), m_pAcc->GetSize(), &buffer, &m_dwSize);
 
   m_pData = std::unique_ptr<uint8_t, FxFreeDeleter>(buffer);
-  m_pDict = ToDictionary(pStream->GetDict()->Clone());
-  m_pDict->SetNewFor<CPDF_Number>("Length", static_cast<int>(m_dwSize));
-  m_pDict->SetNewFor<CPDF_Name>("Filter", "FlateDecode");
-  m_pDict->RemoveFor(pdfium::stream::kDecodeParms);
+  m_pClonedDict = ToDictionary(pStream->GetDict()->Clone());
+  m_pClonedDict->SetNewFor<CPDF_Number>("Length", static_cast<int>(m_dwSize));
+  m_pClonedDict->SetNewFor<CPDF_Name>("Filter", "FlateDecode");
+  m_pClonedDict->RemoveFor(pdfium::stream::kDecodeParms);
+  ASSERT(!m_pDict);
 }
 
 CPDF_FlateEncoder::~CPDF_FlateEncoder() {}
 
 void CPDF_FlateEncoder::CloneDict() {
-  if (m_pDict.IsOwned())
+  if (m_pClonedDict) {
+    ASSERT(!m_pDict);
     return;
+  }
+
+  m_pClonedDict = ToDictionary(m_pDict->Clone());
+  ASSERT(m_pClonedDict);
+  m_pDict.Release();
+}
+
+CPDF_Dictionary* CPDF_FlateEncoder::GetClonedDict() {
+  ASSERT(!m_pDict);
+  return m_pClonedDict.get();
+}
+
+const CPDF_Dictionary* CPDF_FlateEncoder::GetDict() const {
+  if (m_pClonedDict) {
+    ASSERT(!m_pDict);
+    return m_pClonedDict.get();
+  }
 
-  m_pDict = ToDictionary(m_pDict->Clone());
-  ASSERT(m_pDict.IsOwned());
+  return m_pDict.Get();
 }
diff --git a/core/fpdfapi/edit/cpdf_flateencoder.h b/core/fpdfapi/edit/cpdf_flateencoder.h
index b2213de5f3..b69b54d93b 100644
--- a/core/fpdfapi/edit/cpdf_flateencoder.h
+++ b/core/fpdfapi/edit/cpdf_flateencoder.h
@@ -7,6 +7,8 @@
 #ifndef CORE_FPDFAPI_EDIT_CPDF_FLATEENCODER_H_
 #define CORE_FPDFAPI_EDIT_CPDF_FLATEENCODER_H_
 
+#include <memory>
+
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_stream_acc.h"
 #include "core/fxcrt/fx_memory.h"
@@ -21,16 +23,22 @@ class CPDF_FlateEncoder {
   ~CPDF_FlateEncoder();
 
   void CloneDict();
+  CPDF_Dictionary* GetClonedDict();
+
+  // Returns |m_pClonedDict| if it is valid. Otherwise returns |m_pDict|.
+  const CPDF_Dictionary* GetDict() const;
 
   uint32_t GetSize() const { return m_dwSize; }
   const uint8_t* GetData() const { return m_pData.Get(); }
 
-  CPDF_Dictionary* GetDict() { return m_pDict.Get(); }
-
  private:
   uint32_t m_dwSize;
   MaybeOwned<uint8_t, FxFreeDeleter> m_pData;
-  MaybeOwned<CPDF_Dictionary> m_pDict;
+
+  // Only one of these two pointers is valid at any time.
+  UnownedPtr<const CPDF_Dictionary> m_pDict;
+  std::unique_ptr<CPDF_Dictionary> m_pClonedDict;
+
   RetainPtr<CPDF_StreamAcc> m_pAcc;
 };