Fix a potential nullptr deref in CFX_MapPtrToPtr.

core/fxcrt/fx_basic_maps.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcrt/include/fx_basic.h"
 #include "core/fxcrt/plex.h"
 
 CFX_MapPtrToPtr::CFX_MapPtrToPtr(int nBlockSize)
     : m_pHashTable(NULL),
       m_nHashTableSize(17),
       m_nCount(0),
       m_pFreeList(NULL),
       m_pBlocks(NULL),
       m_nBlockSize(nBlockSize) {
   ASSERT(m_nBlockSize > 0);
 }
 void CFX_MapPtrToPtr::RemoveAll() {
   FX_Free(m_pHashTable);
   m_pHashTable = NULL;
   m_nCount = 0;
   m_pFreeList = NULL;
-  m_pBlocks->FreeDataChain();
+  if (m_pBlocks)

[Tom Sepez, 2016/05/19 17:02:01]

ditto: conditionalize NULL assign, nullptrs.

[Lei Zhang, 2016/05/19 20:48:50]

Done.

+    m_pBlocks->FreeDataChain();
   m_pBlocks = NULL;
 }
 CFX_MapPtrToPtr::~CFX_MapPtrToPtr() {
   RemoveAll();
   ASSERT(m_nCount == 0);
 }
 uint32_t CFX_MapPtrToPtr::HashKey(void* key) const {
   return ((uint32_t)(uintptr_t)key) >> 4;
 }
 void CFX_MapPtrToPtr::GetNextAssoc(FX_POSITION& rNextPosition,
@@ skipping 112 matching lines @@
 }
 void CFX_MapPtrToPtr::FreeAssoc(CFX_MapPtrToPtr::CAssoc* pAssoc) {
   pAssoc->pNext = m_pFreeList;
   m_pFreeList = pAssoc;
   m_nCount--;
   ASSERT(m_nCount >= 0);
   if (m_nCount == 0) {
     RemoveAll();
   }
 }