Ensure CPDF_CountedObjects only made from owned references.

core/fpdfapi/render/cpdf_docrenderdata.cpp

Index: core/fpdfapi/render/cpdf_docrenderdata.cpp
diff --git a/core/fpdfapi/render/cpdf_docrenderdata.cpp b/core/fpdfapi/render/cpdf_docrenderdata.cpp
index c17b4d594eb11de9b26db7a93309ae3af815a5dd..7ac0353d42aac76638796189c777d4d2e8512d4f 100644
--- a/core/fpdfapi/render/cpdf_docrenderdata.cpp
+++ b/core/fpdfapi/render/cpdf_docrenderdata.cpp
@@ -55,8 +55,8 @@ CPDF_Type3Cache* CPDF_DocRenderData::GetCachedType3(CPDF_Type3Font* pFont) {
   CPDF_CountedObject<CPDF_Type3Cache>* pCache;
   auto it = m_Type3FaceMap.find(pFont);
   if (it == m_Type3FaceMap.end()) {
-    CPDF_Type3Cache* pType3 = new CPDF_Type3Cache(pFont);
-    pCache = new CPDF_CountedObject<CPDF_Type3Cache>(pType3);
+    pCache = new CPDF_CountedObject<CPDF_Type3Cache>(
+        pdfium::MakeUnique<CPDF_Type3Cache>(pFont));
     m_Type3FaceMap[pFont] = pCache;
   } else {
     pCache = it->second;
@@ -104,9 +104,10 @@ CPDF_TransferFunc* CPDF_DocRenderData::GetTransferFunc(CPDF_Object* pObj) {
     if (!pFuncs[0])
       return nullptr;
   }
-  CPDF_TransferFunc* pTransfer = new CPDF_TransferFunc(m_pPDFDoc);
   CPDF_CountedObject<CPDF_TransferFunc>* pTransferCounter =
-      new CPDF_CountedObject<CPDF_TransferFunc>(pTransfer);
+      new CPDF_CountedObject<CPDF_TransferFunc>(
+          pdfium::MakeUnique<CPDF_TransferFunc>(m_pPDFDoc));
+  CPDF_TransferFunc* pTransfer = pTransferCounter->get();
   m_TransferFuncMap[pObj] = pTransferCounter;
   FX_FLOAT output[kMaxOutputs];
   FXSYS_memset(output, 0, sizeof(output));