Fixup CPDFSDK_PageView and CPDF_Page interactions.

fpdfsdk/fsdk_mgr.cpp

Index: fpdfsdk/fsdk_mgr.cpp
diff --git a/fpdfsdk/fsdk_mgr.cpp b/fpdfsdk/fsdk_mgr.cpp
index 0fc61dac7a251ba9a56a3969df7303320415de80..0850654581df120a93d8b7e3db2999e7be0fb539 100644
--- a/fpdfsdk/fsdk_mgr.cpp
+++ b/fpdfsdk/fsdk_mgr.cpp
@@ -299,6 +299,8 @@ CPDFSDK_PageView* CPDFSDK_Document::GetPageView(int nIndex) {
     return nullptr;
 
   auto it = m_pageMap.find(pTempPage);
+  if (it == m_pageMap.end())

[Tom Sepez, 2016/09/07 16:17:40]

nit: maybe ? operator

[dsinclair, 2016/09/07 16:36:36]

Done.

+    return nullptr;
   return it->second;
 }
 
@@ -505,6 +507,13 @@ CPDFSDK_PageView::CPDFSDK_PageView(CPDFSDK_Document* pSDKDoc,
 }
 
 CPDFSDK_PageView::~CPDFSDK_PageView() {
+#ifndef PDF_ENABLE_XFA
+  // The call to |ReleaseAnnot| can cause the page pointed to by |m_page| to
+  // be freed, which will cause issues if we try to cleanup the pageview pointer
+  // in |m_page|. So, reset the pageview pointer before doing anything else.
+  m_page->SetView(nullptr);
+#endif  // PDF_ENABLE_XFA
+
   CPDFDoc_Environment* pEnv = m_pSDKDoc->GetEnv();
   CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
   for (CPDFSDK_Annot* pAnnot : m_fxAnnotArray)
@@ -512,11 +521,10 @@ CPDFSDK_PageView::~CPDFSDK_PageView() {
 
   m_fxAnnotArray.clear();
   m_pAnnotList.reset();
+
 #ifndef PDF_ENABLE_XFA
-  m_page->SetView(nullptr);
-  if (m_bTakeOverPage) {
+  if (m_bTakeOverPage)

[Tom Sepez, 2016/09/07 16:17:40]

nit: someday call it m_bOwnsPage

[dsinclair, 2016/09/07 16:36:36]

Done.

     delete m_page;
-  }
 #endif  // PDF_ENABLE_XFA
 }