Fix memory management errors for font loading and copying

xfa/fgas/font/fgas_gefont.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fgas/font/fgas_gefont.h"
 
 #include "core/fxge/include/cfx_substfont.h"
 #include "core/fxge/include/cfx_unicodeencoding.h"
@@ skipping 59 matching lines @@
 }
 #endif  // _FXM_PLATFORM_ == _FXM_PLATFORM_WINDOWS_
 
 CFGAS_GEFont::CFGAS_GEFont(IFGAS_FontMgr* pFontMgr)
     :
 #if _FXM_PLATFORM_ != _FXM_PLATFORM_WINDOWS_
       m_bUseLogFontStyle(FALSE),
       m_dwLogFontStyle(0),
 #endif
       m_pFont(nullptr),
+      m_pSrcFont(nullptr),
       m_pFontMgr(pFontMgr),
       m_iRefCount(1),
       m_bExtFont(FALSE),
       m_pProvider(nullptr) {
 }
 
-CFGAS_GEFont::CFGAS_GEFont(const CFGAS_GEFont& src, uint32_t dwFontStyles)
+CFGAS_GEFont::CFGAS_GEFont(CFGAS_GEFont* src, uint32_t dwFontStyles)
     :
 #if _FXM_PLATFORM_ != _FXM_PLATFORM_WINDOWS_
       m_bUseLogFontStyle(FALSE),
       m_dwLogFontStyle(0),
 #endif
       m_pFont(nullptr),
-      m_pFontMgr(src.m_pFontMgr),
+      m_pSrcFont(src),
+      m_pFontMgr(src->m_pFontMgr),
       m_iRefCount(1),
       m_bExtFont(FALSE),
       m_pProvider(nullptr) {
-  ASSERT(src.m_pFont);
+  ASSERT(src->m_pFont);

[dsinclair, 2016/09/08 18:27:22]

Can we change the src-> to m_pSrcFont-> in here to be consistent?

[Wei Li, 2016/09/08 18:42:01]

Done.

+  m_pSrcFont->Retain();
   m_pFont = new CFX_Font;
-  m_pFont->LoadClone(src.m_pFont);
+  m_pFont->LoadClone(src->m_pFont);
   CFX_SubstFont* pSubst = m_pFont->GetSubstFont();
   if (!pSubst) {
     pSubst = new CFX_SubstFont;
     m_pFont->SetSubstFont(std::unique_ptr<CFX_SubstFont>(pSubst));
   }
   pSubst->m_Weight =
       (dwFontStyles & FX_FONTSTYLE_Bold) ? FXFONT_FW_BOLD : FXFONT_FW_NORMAL;
   if (dwFontStyles & FX_FONTSTYLE_Italic) {
     pSubst->m_SubstFlags |= FXFONT_SUBST_ITALIC;
   }
   InitFont();
 }
 
 CFGAS_GEFont::~CFGAS_GEFont() {
   for (int32_t i = 0; i < m_SubstFonts.GetSize(); i++)
     m_SubstFonts[i]->Release();
 
   m_SubstFonts.RemoveAll();
   m_FontMapper.clear();
 
   if (!m_bExtFont)
     delete m_pFont;
+
+  // If it is a shallow copy of another source font,
+  // decrease the refcount of the source font.
+  if (m_pSrcFont)
+    m_pSrcFont->Release();
 }
 
 void CFGAS_GEFont::Release() {
   if (--m_iRefCount < 1) {
     if (m_pFontMgr) {
       m_pFontMgr->RemoveFont(this);
     }
     delete this;
   }
 }
@@ skipping 100 matching lines @@
     m_pRectArray.reset(new CFX_MassArrayTemplate<CFX_Rect>(16));
   if (!m_pBBoxMap)
     m_pBBoxMap.reset(new CFX_MapPtrToPtr(16));
 
   return TRUE;
 }
 
 CFGAS_GEFont* CFGAS_GEFont::Derive(uint32_t dwFontStyles, uint16_t wCodePage) {
   if (GetFontStyles() == dwFontStyles)
     return Retain();
-  return new CFGAS_GEFont(*this, dwFontStyles);
+  return new CFGAS_GEFont(this, dwFontStyles);
 }
 
 void CFGAS_GEFont::GetFamilyName(CFX_WideString& wsFamily) const {
   if (!m_pFont->GetSubstFont() ||
       m_pFont->GetSubstFont()->m_Family.GetLength() == 0) {
     wsFamily = CFX_WideString::FromLocal(m_pFont->GetFamilyName().AsStringC());
   } else {
     wsFamily = CFX_WideString::FromLocal(
         m_pFont->GetSubstFont()->m_Family.AsStringC());
   }
@@ skipping 198 matching lines @@
   }
   if (m_pRectArray) {
     m_pRectArray->RemoveAll(FALSE);
   }
 }
 CFGAS_GEFont* CFGAS_GEFont::GetSubstFont(int32_t iGlyphIndex) const {
   iGlyphIndex = ((uint32_t)iGlyphIndex) >> 24;
   return iGlyphIndex == 0 ? const_cast<CFGAS_GEFont*>(this)
                           : m_SubstFonts[iGlyphIndex - 1];
 }