Assert that only 0-numbered objects are Released()

core/fpdfapi/fpdf_parser/cpdf_stream.cpp

Index: core/fpdfapi/fpdf_parser/cpdf_stream.cpp
diff --git a/core/fpdfapi/fpdf_parser/cpdf_stream.cpp b/core/fpdfapi/fpdf_parser/cpdf_stream.cpp
index 88d04203a11dae5e074e8806d0e0f933e1ec9e0c..3d691fae848b627b124b2a6933cc571fdfaf34a3 100644
--- a/core/fpdfapi/fpdf_parser/cpdf_stream.cpp
+++ b/core/fpdfapi/fpdf_parser/cpdf_stream.cpp
@@ -19,7 +19,11 @@ CPDF_Stream::CPDF_Stream(uint8_t* pData, uint32_t size, CPDF_Dictionary* pDict)
       m_dwSize(size),
       m_pDataBuf(pData) {}
 
-CPDF_Stream::~CPDF_Stream() {}
+CPDF_Stream::~CPDF_Stream() {
+  m_ObjNum = kInvalidObjNum;
+  if (m_pDict && m_pDict->GetObjNum() == kInvalidObjNum)
+    m_pDict.release();  // lowercase release, release ownership.

[Lei Zhang, 2016/09/30 23:49:01]

Does this leak or is this to avoid a (future) double free? If CPDF_Stream owns
the dictionary object, isn't it bad if someone already freed it?

[Tom Sepez, 2016/10/01 00:13:11]

Yes, this is only for the possibility of cycles, where someone has
freed the dict through an unowned pointer.  We do this in the tests.
 

[Lei Zhang, 2016/10/01 00:34:15]

Which test? Not seeing it / missed it.

[Lei Zhang, 2016/10/01 01:24:06]

I don't see PDFObjectTest.CloneCheckLoop creating any CPDF_Streams.

+}
 
 CPDF_Object::Type CPDF_Stream::GetType() const {
   return STREAM;