Guard against double deletion of page views.

fpdfsdk/cpdfsdk_document.cpp

Index: fpdfsdk/cpdfsdk_document.cpp
diff --git a/fpdfsdk/cpdfsdk_document.cpp b/fpdfsdk/cpdfsdk_document.cpp
index ad4516d53c1b2606bcce360720b5d6d67c5ca77d..66851c0ebb9493df4b38b354225ce82761620687 100644
--- a/fpdfsdk/cpdfsdk_document.cpp
+++ b/fpdfsdk/cpdfsdk_document.cpp
@@ -135,9 +135,13 @@ void CPDFSDK_Document::RemovePageView(UnderlyingPageType* pUnderlyingPage) {
     return;
 
   CPDFSDK_PageView* pPageView = it->second;
-  if (pPageView->IsLocked())
+  if (pPageView->IsLocked() || pPageView->IsBeingDestroyed())
     return;
 
+  // Mark the page view so we do not come into |RemovePageView| a second
+  // time while we're in the process of removing.
+  pPageView->SetBeingDestroyed();

[Tom Sepez, 2016/10/03 18:37:57]

Can we this to the dtor? Then the dtor checks for this and bails if set.

[dsinclair, 2016/10/03 18:47:08]

No, because we have to guard the map erasing and the killing of annotations. In
this specific bug, we get the iterator, get the KillFocusAnnotation, then we end
up back in here, get the iterator again and call erase(it). We then pop out the
stack and call erase(it) a second time, and the map doesn't like it when you
erase the same iterator value twice.

Maybe Destroyed was a bad name, IsBeingRemoved?

+
   // This must happen before we remove |pPageView| from the map because
   // |KillFocusAnnotIfNeeded| can call into the |GetPage| method which will
   // look for this page view in the map, if it doesn't find it a new one will