Fix heap-use-after-free in CXFA_PDFFontMgr::~CXFA_PDFFontMgr()

xfa/src/fxfa/src/app/xfa_fontmgr.cpp

Index: xfa/src/fxfa/src/app/xfa_fontmgr.cpp
diff --git a/xfa/src/fxfa/src/app/xfa_fontmgr.cpp b/xfa/src/fxfa/src/app/xfa_fontmgr.cpp
index 23a1b29c014152ee7bc8548df2e85802312a03ab..f63c4f281039c4abfbdd5b54f48c98731eb1f4ca 100644
--- a/xfa/src/fxfa/src/app/xfa_fontmgr.cpp
+++ b/xfa/src/fxfa/src/app/xfa_fontmgr.cpp
@@ -1864,15 +1864,8 @@ CXFA_PDFFontMgr::CXFA_PDFFontMgr(CXFA_FFDoc* pDoc) {
   m_pDoc = pDoc;
 }
 CXFA_PDFFontMgr::~CXFA_PDFFontMgr() {
-  FX_POSITION ps = m_FDE2PDFFont.GetStartPosition();
-  while (ps) {
-    IFX_Font* pFDEFont;
-    void* pPDFFont;
-    m_FDE2PDFFont.GetNextAssoc(ps, (void*&)pFDEFont, pPDFFont);
-    pFDEFont->SetFontProvider(NULL);

[jun_fang, 2015/12/09 13:29:08]

We believe that PDFFontMgr always lives longer than DefFontMgr. During the
deconstruction of PDFFontMgr, DefFontMgr and the default fonts have been
released. So it doesn't need to inform the default font that PDFFontMgr is being
destroyed. 

-  }
   m_FDE2PDFFont.RemoveAll();
-  ps = m_FontArray.GetStartPosition();
+  FX_POSITION ps = m_FontArray.GetStartPosition();
   while (ps) {
     CFX_ByteString strKey;
     IFX_Font* pFont = NULL;