FWL refcounts never incremented (part 2).

xfa/include/fwl/core/fwl_note.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef _FWL_NOTE_H
 #define _FWL_NOTE_H
 class IFWL_Target;
 class IFWL_Widget;
@@ skipping 112 matching lines @@
 class CFWL_Note {
  public:
   virtual FX_DWORD Release() {
     m_dwRefCount--;
     FX_DWORD dwRefCount = m_dwRefCount;
     if (!m_dwRefCount) {
       delete this;
     }
     return dwRefCount;
   }
   virtual IFWL_Target* Retain() {

[Tom Sepez, 2015/11/16 20:07:11]

Doesn't override anything, provides its own m_dwRefcount.  I don't think these
objects belong in the same FWL hierarchy as the others, do they?

[Lei Zhang, 2015/11/16 20:34:49]

This is the root for a different class hierachy. I suspect this is a copy+paste
error from one of the other xfa/ Retain() methods.

     m_dwRefCount++;
-    return (IFWL_Target*)this;
+    return (IFWL_Target*)this;  // Illegal cast.
   }
   virtual FWL_ERR GetClassName(CFX_WideString& wsClass) const {
     wsClass = L"CFWL_Note";
     return FWL_ERR_Succeeded;
   }
   virtual FX_DWORD GetClassID() const { return 0; }
   virtual FX_BOOL IsInstance(const CFX_WideStringC& wsClass) const {
     return TRUE;
   }
   virtual CFWL_Note* Clone() { return NULL; }
@@ skipping 222 matching lines @@
 };
 FWL_ERR FWL_AddToolTipTarget(IFWL_ToolTipTarget* pTarget);
 FWL_ERR FWL_RemoveToolTipTarget(IFWL_ToolTipTarget* pTarget);
 FWL_ERR FWL_SetToolTipInitialDelay(int32_t iDelayTime);
 FWL_ERR FWL_SetToolTipAutoPopDelay(int32_t iDelayTime);
 typedef FX_BOOL (*FWLMessageHookCallback)(CFWL_Message* msg, void* info);
 FWL_ERR FWL_SetHook(IFWL_NoteDriver* driver,
                     FWLMessageHookCallback callback,
                     void* info);
 #endif