Null CPDF_CountedObj::m_pObj prior to deletion

core/fxcrt/include/cfx_count_ref.h

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef CORE_FXCRT_INCLUDE_CFX_COUNT_REF_H_
 #define CORE_FXCRT_INCLUDE_CFX_COUNT_REF_H_
 
 #include "core/fxcrt/include/cfx_retain_ptr.h"
@@ skipping 38 matching lines @@
   bool operator!=(const CFX_CountRef& that) const { return !(*this == that); }
   explicit operator bool() const { return !!m_pObject; }
 
  private:
   class CountedObj : public ObjClass {
    public:
     template <typename... Args>
     CountedObj(Args... params) : ObjClass(params...), m_RefCount(0) {}
 
     CountedObj(const CountedObj& src) : ObjClass(src), m_RefCount(0) {}
+    ~CountedObj() { m_RefCount = 0; }
 
     bool HasOneRef() const { return m_RefCount == 1; }
     void Retain() { m_RefCount++; }
     void Release() {
-      if (--m_RefCount <= 0)
+      ASSERT(m_RefCount);
+      if (--m_RefCount == 0)
         delete this;
     }
 
    private:
     intptr_t m_RefCount;

[dsinclair, 2016/09/22 18:01:44]

Any idea why this is intptr_t?

[Tom Sepez, 2016/09/22 18:10:19]

Funny you should ask.  Just discussing this on another thread.
See comment in cfx_string_data_template.h   

   };
 
   CFX_RetainPtr<CountedObj> m_pObject;
 };
 
 #endif  // CORE_FXCRT_INCLUDE_CFX_COUNT_REF_H_