From 2db7eda9f51a4aa19df529ab12530542513c22a1 Mon Sep 17 00:00:00 2001
From: Tom Sepez <tsepez@chromium.org>
Date: Thu, 10 May 2018 17:05:26 +0000
Subject: Fix destruction order in CPDF_Dibsource.

The order of the elements in the header is correct, but we
were clearing it early in the destructor itself.

Bug: 840695
Change-Id: I1585722fed8dc672ffd5e1dc9a1eea1c7c80f310
Reviewed-on: https://pdfium-review.googlesource.com/32311
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
---
 core/fpdfapi/render/cpdf_dibsource.cpp | 1 -
 core/fpdfapi/render/cpdf_dibsource.h   | 3 +++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/core/fpdfapi/render/cpdf_dibsource.cpp b/core/fpdfapi/render/cpdf_dibsource.cpp
index bbf91da868..c76ae82bce 100644
--- a/core/fpdfapi/render/cpdf_dibsource.cpp
+++ b/core/fpdfapi/render/cpdf_dibsource.cpp
@@ -106,7 +106,6 @@ CPDF_DIBSource::CPDF_DIBSource() {}
 CPDF_DIBSource::~CPDF_DIBSource() {
   FX_Free(m_pMaskedLine);
   FX_Free(m_pLineBuf);
-  m_pCachedBitmap.Reset();  // TODO(tsepez): determine if required early here.
   FX_Free(m_pCompData);
   if (m_pColorSpace && m_pDocument) {
     auto* pPageData = m_pDocument->GetPageData();
diff --git a/core/fpdfapi/render/cpdf_dibsource.h b/core/fpdfapi/render/cpdf_dibsource.h
index a9f98e158d..452c347ac3 100644
--- a/core/fpdfapi/render/cpdf_dibsource.h
+++ b/core/fpdfapi/render/cpdf_dibsource.h
@@ -153,7 +153,10 @@ class CPDF_DIBSource : public CFX_DIBSource {
   RetainPtr<CPDF_DIBSource> m_pMask;
   RetainPtr<CPDF_StreamAcc> m_pGlobalStream;
   std::unique_ptr<CCodec_ScanlineDecoder> m_pDecoder;
+
+  // Must come after |m_pCachedBitmap|.
   std::unique_ptr<CCodec_Jbig2Context> m_pJbig2Context;
+
   UnownedPtr<CPDF_Stream> m_pMaskStream;
   LoadState m_Status = LoadState::kFail;
 };
-- 
cgit v1.2.3