Pdfium: Fix fonts leaking on ClosePage.

core/fpdfapi/fpdf_page/fpdf_page_doc.cpp

Index: core/fpdfapi/fpdf_page/fpdf_page_doc.cpp
diff --git a/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp b/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp
index e7f68224a42660e9c76264a72d0fda6168200987..b81b4a3de386695f3ee4faa0288e807f527eeb85 100644
--- a/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp
+++ b/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp
@@ -214,7 +214,8 @@ void CPDF_DocPageData::ReleaseFont(CPDF_Dictionary* pFontDict) {
   CPDF_CountedFont* fontData = it->second;
   if (fontData->get()) {
     fontData->RemoveRef();
-    if (fontData->use_count() == 0) {
+    if (fontData->use_count() == 1) {
+      // We have font data only in m_FontMap cache. Clean it.
       fontData->clear();
     }
   }
@@ -328,7 +329,8 @@ void CPDF_DocPageData::ReleaseColorSpace(CPDF_Object* pColorSpace) {
   CPDF_CountedColorSpace* csData = it->second;
   if (csData->get()) {
     csData->RemoveRef();
-    if (csData->use_count() == 0) {
+    if (csData->use_count() == 1) {
+      // We have item only in m_ColorSpaceMap cache. Clean it.
       csData->get()->ReleaseCS();
       csData->reset(nullptr);
     }
@@ -387,7 +389,8 @@ void CPDF_DocPageData::ReleasePattern(CPDF_Object* pPatternObj) {
   CPDF_CountedPattern* ptData = it->second;
   if (ptData->get()) {
     ptData->RemoveRef();
-    if (ptData->use_count() == 0) {
+    if (ptData->use_count() == 1) {
+      // We have item only in m_PatternMap cache. Clean it.
       ptData->clear();
     }
   }
@@ -424,7 +427,8 @@ void CPDF_DocPageData::ReleaseImage(CPDF_Object* pImageStream) {
     return;
 
   image->RemoveRef();
-  if (image->use_count() == 0) {
+  if (image->use_count() == 1) {
+    // We have item only in m_ImageMap cache. Clean it.
     delete image->get();
     delete image;
     m_ImageMap.erase(it);
@@ -449,7 +453,8 @@ CPDF_IccProfile* CPDF_DocPageData::GetIccProfile(
   auto hash_it = m_HashProfileMap.find(bsDigest);
   if (hash_it != m_HashProfileMap.end()) {
     auto it_copied_stream = m_IccProfileMap.find(hash_it->second);
-    return it_copied_stream->second->AddRef();
+    if (it_copied_stream != m_IccProfileMap.end())

[dsinclair, 2016/07/18 20:13:48]

Should we be removing the entry from IccProfileMap at the same time we remove it
from it_copied_stream instead of doing this?

[snake, 2016/07/19 18:55:14]

No, To remove it, we should walk within full m_IccProfileMap, to find entry. And
this will be on each document unload. It is slow operation.
But the entry of IccProfileMap is tiny, and it will be reused on next document
load, and not necessary to remove it.  

+      return it_copied_stream->second->AddRef();
   }
   CPDF_IccProfile* pProfile =
       new CPDF_IccProfile(stream.GetData(), stream.GetSize());
@@ -468,7 +473,8 @@ void CPDF_DocPageData::ReleaseIccProfile(CPDF_IccProfile* pIccProfile) {
       continue;
 
     profile->RemoveRef();
-    if (profile->use_count() == 0) {
+    if (profile->use_count() == 1) {
+      // We have item only in m_IccProfileMap cache. Clean it.
       delete profile->get();
       delete profile;
       m_IccProfileMap.erase(it);
@@ -514,7 +520,8 @@ void CPDF_DocPageData::ReleaseFontFileStreamAcc(CPDF_Stream* pFontStream,
     return;
 
   findData->RemoveRef();
-  if (findData->use_count() == 0 || bForce) {
+  if (findData->use_count() == 1 || bForce) {
+    // We have item only in m_FontFileMap cache. Clean it.
     delete findData->get();
     delete findData;
     m_FontFileMap.erase(it);