Catch stray Retains() and Releases() outside of RetainPtr<>.

core/fxcrt/cfx_retain_ptr.h

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CORE_FXCRT_CFX_RETAIN_PTR_H_
 #define CORE_FXCRT_CFX_RETAIN_PTR_H_
 
 #include <memory>
 #include <utility>
 
@@ skipping 42 matching lines @@
   T& operator*() const { return *m_pObj.get(); }
   T* operator->() const { return m_pObj.get(); }
 
  private:
   std::unique_ptr<T, ReleaseDeleter<T>> m_pObj;
 };
 
 // Trivial implementation - internal ref count with virtual destructor.
 class CFX_Retainable {
  public:
+  bool HasOneRef() const { return m_nRefCount == 1; }
+
+ protected:
+  virtual ~CFX_Retainable() {}
+
+ private:
+  template <typename U>
+  friend struct ReleaseDeleter;
+
+  template <typename U>
+  friend class CFX_RetainPtr;
+
   void Retain() { ++m_nRefCount; }
   void Release() {
     if (--m_nRefCount == 0)
       delete this;
   }
-  bool HasOneRef() const { return m_nRefCount == 1; }
 
- protected:
-  virtual ~CFX_Retainable() {}
   intptr_t m_nRefCount = 0;
 };
 
 namespace pdfium {
 
 // Helper to make a CFX_RetainPtr along the lines of std::make_unique<>(),
 // or pdfium::MakeUnique<>(). Arguments are forwarded to T's constructor.
+// Classes managed by CFX_RetainPtr should have protected (or private)
+// constructors, and should friend this function.
 template <typename T, typename... Args>
 CFX_RetainPtr<T> MakeRetain(Args&&... args) {
   return CFX_RetainPtr<T>(new T(std::forward<Args>(args)...));
 }
 
 }  // namespace pdfium
 
 #endif  // CORE_FXCRT_CFX_RETAIN_PTR_H_