Preserve m_pDynamicObjsMap until FXJS_PerIsolateData is destroyed

fpdfsdk/jsapi/fxjs_v8.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "fpdfsdk/include/jsapi/fxjs_v8.h"
 
 #include <vector>
 
@@ skipping 112 matching lines @@
   return malloc(length);
 }
 
 void FXJS_ArrayBufferAllocator::Free(void* data, size_t length) {
   free(data);
 }
 
 void V8TemplateMapTraits::Dispose(v8::Isolate* isolate,
                                   v8::Global<v8::Object> value,
                                   void* key) {
   v8::Local<v8::Object> obj = value.Get(isolate);

[Tom Sepez, 2016/03/23 21:34:46]

Jochen: does this routine need to remove the disposed object from the map?

   if (obj.IsEmpty())
     return;
   int id = FXJS_GetObjDefnID(obj);
   if (id == -1)
     return;
 
   CFXJS_ObjDefinition* pObjDef = CFXJS_ObjDefinition::ForID(isolate, id);
   if (!pObjDef)
     return;
   if (pObjDef->m_pDestructor)
@@ skipping 220 matching lines @@
                          std::vector<v8::Global<v8::Object>*>* pStaticObjects) {
   v8::Isolate::Scope isolate_scope(pIsolate);
 #ifdef PDF_ENABLE_XFA
   v8::Locker locker(pIsolate);
 #endif  // PDF_ENABLE_XFA
   v8::HandleScope handle_scope(pIsolate);
   v8::Local<v8::Context> context =
       v8::Local<v8::Context>::New(pIsolate, *pV8PersistentContext);
   v8::Context::Scope context_scope(context);
 
-  FXJS_PerIsolateData* pData = FXJS_PerIsolateData::Get(pIsolate);
-  if (!pData)
-    return;
-  pData->ReleaseDynamicObjsMap();
-
   int maxID = CFXJS_ObjDefinition::MaxID(pIsolate);
   for (int i = 0; i < maxID; ++i) {
     CFXJS_ObjDefinition* pObjDef = CFXJS_ObjDefinition::ForID(pIsolate, i);
     v8::Local<v8::Object> pObj;
     if (pObjDef->m_ObjType == FXJSOBJTYPE_GLOBAL) {
       pObj =
           context->Global()->GetPrototype()->ToObject(context).ToLocalChecked();
     } else if (pStaticObjects->at(i) && !pStaticObjects->at(i)->IsEmpty()) {
       pObj = v8::Local<v8::Object>::New(pIsolate, *pStaticObjects->at(i));
       delete pStaticObjects->at(i);
       pStaticObjects->at(i) = nullptr;
     }
 
     if (!pObj.IsEmpty()) {
       if (pObjDef->m_pDestructor)
         pObjDef->m_pDestructor(pObj);
       FXJS_FreePrivate(pObj);
     }
   }
 
   if (pIsolate == g_isolate && --g_isolate_ref_count > 0)
     return;
 
   for (int i = 0; i < maxID; ++i)
     delete CFXJS_ObjDefinition::ForID(pIsolate, i);
 
-  pIsolate->SetData(g_embedderDataSlot, nullptr);
-  delete pData;
+  FXJS_PerIsolateData* pData = FXJS_PerIsolateData::Get(pIsolate);
+  if (pData) {
+    pData->ReleaseDynamicObjsMap();
+    pIsolate->SetData(g_embedderDataSlot, nullptr);
+    delete pData;
+  }
 }
 
 IJS_Runtime* FXJS_GetRuntimeFromIsolate(v8::Isolate* pIsolate) {
   v8::Local<v8::Context> context = pIsolate->GetCurrentContext();
   return static_cast<IJS_Runtime*>(
       context->GetAlignedPointerFromEmbedderData(kPerContextDataIndex));
 }
 
 #ifdef PDF_ENABLE_XFA
 void FXJS_SetRuntimeForV8Context(v8::Local<v8::Context> v8Context,
@@ skipping 397 matching lines @@
                                   v8::Local<v8::Value> pValue) {
   if (pValue.IsEmpty())
     return v8::Local<v8::Array>();
   v8::Local<v8::Context> context = pIsolate->GetCurrentContext();
   return v8::Local<v8::Array>::Cast(pValue->ToObject(context).ToLocalChecked());
 }
 
 void FXJS_ValueCopy(v8::Local<v8::Value>& pTo, v8::Local<v8::Value> pFrom) {
   pTo = pFrom;
 }