[XFA] Force destruction order of font managers.

xfa/fxfa/app/xfa_ffapp.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fxfa/include/xfa_ffapp.h"
 
 #include <algorithm>
 #include <utility>
@@ skipping 70 matching lines @@
   CXFA_TimeZoneProvider::Create();
 }
 
 CXFA_FFApp::~CXFA_FFApp() {
   if (m_pFWLApp) {
     m_pFWLApp->Finalize();
     m_pFWLApp->Release();
   }
 
   CXFA_TimeZoneProvider::Destroy();
+
+  // The fonts stored in the font manager may have been created by the default
+  // font manager. The GEFont::LoadFont call takes the manager as a param and
+  // stores it internally. When you destroy the GEFont it tries to unregister
+  // from the font manager and if the default font manager was destroyed first
+  // get get a use-after-free. The m_pFWLTheme can try to cleanup a GEFont
+  // when it frees, so make sure it gets cleaned up first. That requires
+  // m_pFWLApp to be cleaned up as well.
+  //
+  // TODO(dsinclair): The GEFont should have the FontMgr as the pointer instead
+  // of the DEFFontMgr so this goes away. Bug 561.
+  m_pFWLApp.reset();
+  m_pFWLTheme.reset();
+  m_pFontMgr.reset();
+  m_pFDEFontMgr.reset();

[Wei Li, 2016/08/18 22:10:58]

Can you just exchange the order of |m_pFDEFontMgr| and |m_pFontMgr| in the
header? 

[dsinclair, 2016/08/23 13:59:43]

Done.

 }
 
 CXFA_FFDocHandler* CXFA_FFApp::GetDocHandler() {
   if (!m_pDocHandler)
     m_pDocHandler.reset(new CXFA_FFDocHandler);
   return m_pDocHandler.get();
 }
 
 CXFA_FFDoc* CXFA_FFApp::CreateDoc(IXFA_DocProvider* pProvider,
                                   IFX_FileRead* pStream,
@@ skipping 48 matching lines @@
     pDelegate->OnSetCapability(FWL_WGTMGR_DisableThread |
                                FWL_WGTMGR_DisableForm);
     m_pWidgetMgrDelegate = pDelegate;
   }
   return m_pAdapterWidgetMgr.get();
 }
 
 IFWL_AdapterTimerMgr* CXFA_FFApp::GetTimerMgr() const {
   return m_pProvider->GetTimerMgr();
 }