Font is used after release in CPDF_TextStateData::~CPDF_TextStateData

core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp

Index: core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
diff --git a/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp b/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
index 097bd61e6c5b1cf6827f9abc5cfd060cf9912380..3f724db81a4e0e86f7d1dd89a1fa1da33eb191b6 100644
--- a/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
+++ b/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp
@@ -128,6 +128,7 @@ void CPDF_Document::RemoveColorSpaceFromPageData(CPDF_Object* pCSObj)
 }
 CPDF_DocPageData::CPDF_DocPageData(CPDF_Document *pPDFDoc)
     : m_pPDFDoc(pPDFDoc)
+    , m_bForceClear(FALSE)

[Tom Sepez, 2014/08/18 22:16:01]

this should move down til after the m_FontFileMap initializer, so that these get
initialized in the same order they're declared in the .h file.

[jun_fang, 2014/08/18 22:59:31]

Acknowledge.

     , m_FontMap()
     , m_ColorSpaceMap()
     , m_PatternMap()
@@ -145,6 +146,7 @@ CPDF_DocPageData::CPDF_DocPageData(CPDF_Document *pPDFDoc)
 CPDF_DocPageData::~CPDF_DocPageData()
 {
     Clear(FALSE);
+    m_bForceClear = TRUE;

[Tom Sepez, 2014/08/18 22:09:22]

Let's move this down to Clear() itself. The first line of Clear() could be:

  if (bRelease)
      m_bForceClear = TRUE;

that way, should this get called elsewhere someday, its still ok.

[jun_fang, 2014/08/18 22:59:31]

Good.

     Clear(TRUE);
 }
 void CPDF_DocPageData::Clear(FX_BOOL bRelease)