From 26019d4a79c84843c710cd9505bd40e9da0ca4c6 Mon Sep 17 00:00:00 2001
From: Jun Fang <jun_fang@foxitsoftware.com>
Date: Fri, 19 Sep 2014 14:51:51 -0700
Subject: Adjust the order of clearing resource in CPDF_DocPageData::Clear

Images are basic resource and are referred or used by other objects in some cases. Images should be released after the objects who uses these objects. In this case, an image object is accessed in the process of CPDF_TilingPattern's destroy. Unlikely, this image has been destroyed before.

BUG=414046
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/582993002
---
 core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp | 64 ++++++++++++++++++----------
 1 file changed, 41 insertions(+), 23 deletions(-)

diff --git a/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp b/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
index 77db4534fb..8e578f6f8f 100644
--- a/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
+++ b/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
@@ -151,39 +151,34 @@ CPDF_DocPageData::~CPDF_DocPageData()
 void CPDF_DocPageData::Clear(FX_BOOL bForceRelease)
 {
     FX_POSITION pos;
-    FX_DWORD	nCount;
 
     m_bForceClear = bForceRelease;
+
+    // Release objects saved in the resource maps like font map and color space map.
+    // The compound objects shall be released before simple ones.
     pos = m_FontMap.GetStartPosition();
     while (pos) {
         CPDF_Dictionary* fontDict;
         CPDF_CountedObject<CPDF_Font*>* fontData;
         m_FontMap.GetNextAssoc(pos, fontDict, fontData);
-        nCount = fontData->m_nCount;
-        if (bForceRelease || nCount < 2) {
+        if (!fontData->m_Obj) {
+            continue;
+        }
+        if (bForceRelease || fontData->m_nCount < 2) {
             delete fontData->m_Obj;
             fontData->m_Obj = NULL;
         }
     }
-    pos = m_ImageMap.GetStartPosition();
-    while (pos) {
-        FX_DWORD objNum;
-        CPDF_CountedObject<CPDF_Image*>* imageData;
-        m_ImageMap.GetNextAssoc(pos, objNum, imageData);
-        nCount = imageData->m_nCount;
-        if (bForceRelease || nCount < 2) {
-            delete imageData->m_Obj;
-            delete imageData;
-            m_ImageMap.RemoveKey(objNum);
-        }
-    }
     pos = m_ColorSpaceMap.GetStartPosition();
     while (pos) {
         CPDF_Object* csKey;
         CPDF_CountedObject<CPDF_ColorSpace*>* csData;
         m_ColorSpaceMap.GetNextAssoc(pos, csKey, csData);
-        nCount = csData->m_nCount;
-        if (bForceRelease || nCount < 2) {
+        if (!csData->m_Obj) {
+            continue;
+        }
+        if (bForceRelease || csData->m_nCount < 2) {
+            // csData->m_Obj is deleted in the function of ReleaseCS().
             csData->m_Obj->ReleaseCS();
             csData->m_Obj = NULL;
         }
@@ -193,8 +188,10 @@ void CPDF_DocPageData::Clear(FX_BOOL bForceRelease)
         CPDF_Stream* ipKey;
         CPDF_CountedObject<CPDF_IccProfile*>* ipData;
         m_IccProfileMap.GetNextAssoc(pos, ipKey, ipData);
-        nCount = ipData->m_nCount;
-        if (bForceRelease || nCount < 2) {
+        if (!ipData->m_Obj) {
+            continue;
+        }
+        if (bForceRelease || ipData->m_nCount < 2) {
             FX_POSITION pos2 = m_HashProfileMap.GetStartPosition();
             while (pos2) {
                 CFX_ByteString bsKey;
@@ -206,6 +203,7 @@ void CPDF_DocPageData::Clear(FX_BOOL bForceRelease)
                 }
             }
             delete ipData->m_Obj;
+            ipData->m_Obj = NULL;
             delete ipData;
             m_IccProfileMap.RemoveKey(ipKey);
         }
@@ -215,9 +213,12 @@ void CPDF_DocPageData::Clear(FX_BOOL bForceRelease)
         CPDF_Stream* ftKey;
         CPDF_CountedObject<CPDF_StreamAcc*>* ftData;
         m_FontFileMap.GetNextAssoc(pos, ftKey, ftData);
-        nCount = ftData->m_nCount;
-        if (bForceRelease || nCount < 2) {
+        if (!ftData->m_Obj) {
+            continue;
+        }
+        if (bForceRelease || ftData->m_nCount < 2) {
             delete ftData->m_Obj;
+            ftData->m_Obj = NULL;
             delete ftData;
             m_FontFileMap.RemoveKey(ftKey);
         }
@@ -227,13 +228,30 @@ void CPDF_DocPageData::Clear(FX_BOOL bForceRelease)
         CPDF_Object* ptObj;
         CPDF_CountedObject<CPDF_Pattern*>* ptData;
         m_PatternMap.GetNextAssoc(pos, ptObj, ptData);
-        nCount = ptData->m_nCount;
-        if (bForceRelease || nCount < 2) {
+        if (!ptData->m_Obj) {
+            continue;
+        }
+        if (bForceRelease || ptData->m_nCount < 2) {
             ptData->m_Obj->SetForceClear(bForceRelease);
             delete ptData->m_Obj;
             ptData->m_Obj = NULL;
         }
     }
+    pos = m_ImageMap.GetStartPosition();
+    while (pos) {
+        FX_DWORD objNum;
+        CPDF_CountedObject<CPDF_Image*>* imageData;
+        m_ImageMap.GetNextAssoc(pos, objNum, imageData);
+        if (!imageData->m_Obj) {
+            continue;
+        }
+        if (bForceRelease || imageData->m_nCount < 2) {
+            delete imageData->m_Obj;
+            imageData->m_Obj = NULL;
+            delete imageData;
+            m_ImageMap.RemoveKey(objNum);
+        }
+    }
 }
 CPDF_Font* CPDF_DocPageData::GetFont(CPDF_Dictionary* pFontDict, FX_BOOL findOnly)
 {
-- 
cgit v1.2.3