Pdfium: Fix fonts leaking on ClosePage.

core/fpdfapi/fpdf_page/fpdf_page_doc.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/pageint.h"
 
 #include "core/fdrm/crypto/include/fx_crypt.h"
 #include "core/fpdfapi/fpdf_font/cpdf_type1font.h"
@@ skipping 196 matching lines @@
   if (!pFontDict)
     return;
 
   auto it = m_FontMap.find(pFontDict);
   if (it == m_FontMap.end())
     return;
 
   CPDF_CountedFont* fontData = it->second;
   if (fontData->get()) {
     fontData->RemoveRef();
-    if (fontData->use_count() == 0) {
+    if (fontData->use_count() == 1) {
+      // We have font data only in m_FontMap cache. Clean it.
       fontData->clear();
     }
   }
 }
 
 CPDF_ColorSpace* CPDF_DocPageData::GetColorSpace(
     CPDF_Object* pCSObj,
     const CPDF_Dictionary* pResources) {
   std::set<CPDF_Object*> visited;
   return GetColorSpaceImpl(pCSObj, pResources, &visited);
@@ skipping 93 matching lines @@
   if (!pColorSpace)
     return;
 
   auto it = m_ColorSpaceMap.find(pColorSpace);
   if (it == m_ColorSpaceMap.end())
     return;
 
   CPDF_CountedColorSpace* csData = it->second;
   if (csData->get()) {
     csData->RemoveRef();
-    if (csData->use_count() == 0) {
+    if (csData->use_count() == 1) {
+      // We have item only in m_ColorSpaceMap cache. Clean it.
       csData->get()->ReleaseCS();
       csData->reset(nullptr);
     }
   }
 }
 
 CPDF_Pattern* CPDF_DocPageData::GetPattern(CPDF_Object* pPatternObj,
                                            FX_BOOL bShading,
                                            const CFX_Matrix& matrix) {
   if (!pPatternObj)
@@ skipping 38 matching lines @@
   if (!pPatternObj)
     return;
 
   auto it = m_PatternMap.find(pPatternObj);
   if (it == m_PatternMap.end())
     return;
 
   CPDF_CountedPattern* ptData = it->second;
   if (ptData->get()) {
     ptData->RemoveRef();
-    if (ptData->use_count() == 0) {
+    if (ptData->use_count() == 1) {
+      // We have item only in m_PatternMap cache. Clean it.
       ptData->clear();
     }
   }
 }
 
 CPDF_Image* CPDF_DocPageData::GetImage(CPDF_Object* pImageStream) {
   if (!pImageStream)
     return nullptr;
 
   const uint32_t dwImageObjNum = pImageStream->GetObjNum();
@@ skipping 16 matching lines @@
 
   auto it = m_ImageMap.find(pImageStream->GetObjNum());
   if (it == m_ImageMap.end())
     return;
 
   CPDF_CountedImage* image = it->second;
   if (!image)
     return;
 
   image->RemoveRef();
-  if (image->use_count() == 0) {
+  if (image->use_count() == 1) {
+    // We have item only in m_ImageMap cache. Clean it.
     delete image->get();
     delete image;
     m_ImageMap.erase(it);
   }
 }
 
 CPDF_IccProfile* CPDF_DocPageData::GetIccProfile(
     CPDF_Stream* pIccProfileStream) {
   if (!pIccProfileStream)
     return nullptr;
 
   auto it = m_IccProfileMap.find(pIccProfileStream);
   if (it != m_IccProfileMap.end()) {
     return it->second->AddRef();
   }
 
   CPDF_StreamAcc stream;
   stream.LoadAllData(pIccProfileStream, FALSE);
   uint8_t digest[20];
   CRYPT_SHA1Generate(stream.GetData(), stream.GetSize(), digest);
   CFX_ByteString bsDigest(digest, 20);
   auto hash_it = m_HashProfileMap.find(bsDigest);
   if (hash_it != m_HashProfileMap.end()) {
     auto it_copied_stream = m_IccProfileMap.find(hash_it->second);
-    return it_copied_stream->second->AddRef();
+    if (it_copied_stream != m_IccProfileMap.end())

[dsinclair, 2016/07/18 20:13:48]

Should we be removing the entry from IccProfileMap at the same time we remove it
from it_copied_stream instead of doing this?

[snake, 2016/07/19 18:55:14]

No, To remove it, we should walk within full m_IccProfileMap, to find entry. And
this will be on each document unload. It is slow operation.
But the entry of IccProfileMap is tiny, and it will be reused on next document
load, and not necessary to remove it.  

+      return it_copied_stream->second->AddRef();
   }
   CPDF_IccProfile* pProfile =
       new CPDF_IccProfile(stream.GetData(), stream.GetSize());
   CPDF_CountedIccProfile* ipData = new CPDF_CountedIccProfile(pProfile);
   m_IccProfileMap[pIccProfileStream] = ipData;
   m_HashProfileMap[bsDigest] = pIccProfileStream;
   return ipData->AddRef();
 }
 
 void CPDF_DocPageData::ReleaseIccProfile(CPDF_IccProfile* pIccProfile) {
   ASSERT(pIccProfile);
 
   for (auto it = m_IccProfileMap.begin(); it != m_IccProfileMap.end(); ++it) {
     CPDF_CountedIccProfile* profile = it->second;
     if (profile->get() != pIccProfile)
       continue;
 
     profile->RemoveRef();
-    if (profile->use_count() == 0) {
+    if (profile->use_count() == 1) {
+      // We have item only in m_IccProfileMap cache. Clean it.
       delete profile->get();
       delete profile;
       m_IccProfileMap.erase(it);
       return;
     }
   }
 }
 
 CPDF_StreamAcc* CPDF_DocPageData::GetFontFileStreamAcc(
     CPDF_Stream* pFontStream) {
@@ skipping 25 matching lines @@
 
   auto it = m_FontFileMap.find(pFontStream);
   if (it == m_FontFileMap.end())
     return;
 
   CPDF_CountedStreamAcc* findData = it->second;
   if (!findData)
     return;
 
   findData->RemoveRef();
-  if (findData->use_count() == 0 || bForce) {
+  if (findData->use_count() == 1 || bForce) {
+    // We have item only in m_FontFileMap cache. Clean it.
     delete findData->get();
     delete findData;
     m_FontFileMap.erase(it);
   }
 }
 
 CPDF_CountedColorSpace* CPDF_DocPageData::FindColorSpacePtr(
     CPDF_Object* pCSObj) const {
   if (!pCSObj)
     return nullptr;
 
   auto it = m_ColorSpaceMap.find(pCSObj);
   return it != m_ColorSpaceMap.end() ? it->second : nullptr;
 }
 
 CPDF_CountedPattern* CPDF_DocPageData::FindPatternPtr(
     CPDF_Object* pPatternObj) const {
   if (!pPatternObj)
     return nullptr;
 
   auto it = m_PatternMap.find(pPatternObj);
   return it != m_PatternMap.end() ? it->second : nullptr;
 }