From a11ac1bedef8c7a55b7e35ec89f5bdcbfcdc5025 Mon Sep 17 00:00:00 2001
From: Tom Sepez <tsepez@chromium.org>
Date: Mon, 27 Feb 2017 17:08:28 -0800
Subject: Avoid crash above CFWL_ListItem::GetText()

The issue at hand is caused by a raw pointer rather than a
retained pointer in InheritedData::m_pFontFamily. But the
larger issue is that it's bad to Get() raw pointers from
these, especially when its so cheap to pass them by const
reference.

One reason to Get() a raw pointer is to aid in down-casts, so
add a helper to CFX_RetainPtr to give us downcasted retained
pointers.

BUG=pdfium:665

Change-Id: Ic8624af09664ff603de2e1fda8dbde0cf889f80d
Reviewed-on: https://pdfium-review.googlesource.com/2871
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
---
 core/fxcrt/cfx_retain_ptr.h | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'core/fxcrt')

diff --git a/core/fxcrt/cfx_retain_ptr.h b/core/fxcrt/cfx_retain_ptr.h
index 62b26942ba..0267ae04cd 100644
--- a/core/fxcrt/cfx_retain_ptr.h
+++ b/core/fxcrt/cfx_retain_ptr.h
@@ -30,6 +30,11 @@ class CFX_RetainPtr {
   template <class U>
   CFX_RetainPtr(const CFX_RetainPtr<U>& that) : CFX_RetainPtr(that.Get()) {}
 
+  template <class U>
+  CFX_RetainPtr<U> As() const {
+    return CFX_RetainPtr<U>(static_cast<U*>(Get()));
+  }
+
   void Reset(T* obj = nullptr) {
     if (obj)
       obj->Retain();
-- 
cgit v1.2.3