Fix issue when firing TimerProc() destroys timer

fpdfsdk/javascript/JS_Object.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "fpdfsdk/javascript/JS_Object.h"
 
 #include "fpdfsdk/include/fsdk_mgr.h"
 #include "fpdfsdk/javascript/JS_Define.h"
@@ skipping 97 matching lines @@
       CFX_SystemHandler* pHandler = m_pApp->GetSysHandler();
       pHandler->KillTimer(m_nTimerID);
     }
     GetGlobalTimerMap()->erase(m_nTimerID);
     m_nTimerID = 0;
   }
 }
 
 // static
 void CJS_Timer::TimerProc(int idEvent) {
-  const auto it = GetGlobalTimerMap()->find(idEvent);
-  if (it != GetGlobalTimerMap()->end()) {
-    CJS_Timer* pTimer = it->second;
-    if (!pTimer->m_bProcessing) {
-      CFX_AutoRestorer<bool> scoped_processing(&pTimer->m_bProcessing);
-      pTimer->m_bProcessing = true;
-      if (pTimer->m_pEmbedObj)
-        pTimer->m_pEmbedObj->TimerProc(pTimer);
-    }
-  }
+  auto it = GetGlobalTimerMap()->find(idEvent);
+  if (it == GetGlobalTimerMap()->end())
+    return;
+
+  CJS_Timer* pTimer = it->second;
+  if (pTimer->m_bProcessing)
+    return;
+
+  pTimer->m_bProcessing = true;
+  if (pTimer->m_pEmbedObj)
+    pTimer->m_pEmbedObj->TimerProc(pTimer);
+
+  // Timer proc may have destroyed timer, find it again.

[Lei Zhang, 2016/08/04 19:02:40]

Is it possible for a new timer with the same |idEvent| to get set from running
the timer proc, thus destroying |pTimer|, but putting a new timer into the same
slot in the map?

[Tom Sepez, 2016/08/04 19:12:40]

It's up to the embedder, and doesn't happen AFAICT with our various embedders,
but doesn't hurt to check.  Other things probably go off the rails if they are
reused ...

+  it = GetGlobalTimerMap()->find(idEvent);
+  if (it == GetGlobalTimerMap()->end())
+    return;
+
+  pTimer->m_bProcessing = false;
 }
 
 // static
 CJS_Timer::TimerMap* CJS_Timer::GetGlobalTimerMap() {
   // Leak the timer array at shutdown.
   static auto* s_TimerMap = new TimerMap;
   return s_TimerMap;
 }
 
 void CJS_Timer::OnDestroyed() {
   m_bValid = false;
 }