Fix some iterator invalidation issues while traversing CPDF_Dictionary.

core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/include/fpdfapi/fpdf_objects.h"
 
 #include <algorithm>
 
@@ skipping 716 matching lines @@
 void CPDF_Dictionary::ReplaceKey(const CFX_ByteStringC& oldkey,
                                  const CFX_ByteStringC& newkey) {
   ASSERT(m_Type == PDFOBJ_DICTIONARY);
   auto old_it = m_Map.find(oldkey);
   if (old_it == m_Map.end())
     return;
 
   // Avoid 2 constructions of CFX_ByteString.
   CFX_ByteString newkey_bytestring = newkey;
   auto new_it = m_Map.find(newkey_bytestring);
+  if (new_it == old_it)

[Lei Zhang, 2016/01/14 01:32:29]

Can't we move this to the top and check if |oldkey| and |newkey| are equivalent?

[Oliver Chang, 2016/01/14 01:44:21]

Hmm, I did that at first, but thought that this was probably a bit more
efficient for the common case (keys are different)?

+    return;
+
   if (new_it != m_Map.end()) {
     new_it->second->Release();
     new_it->second = old_it->second;
   } else {
     m_Map.insert(std::make_pair(newkey_bytestring, old_it->second));
   }
   m_Map.erase(old_it);
 }
 FX_BOOL CPDF_Dictionary::Identical(CPDF_Dictionary* pOther) const {
   if (!pOther) {
@@ skipping 383 matching lines @@
       pObj->Destroy();
       return FALSE;
     }
     it->second->Destroy();
   }
   pObj->m_ObjNum = objnum;
   m_IndirectObjs[objnum] = pObj;
   m_LastObjNum = std::max(m_LastObjNum, objnum);
   return TRUE;
 }