Store the address of the page data map's value for proper referencing.

core/include/fpdfapi/fpdf_resource.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef _FPDF_RESOURCE_
 #define _FPDF_RESOURCE_
 #ifndef _FPDF_PARSER_
 #include "fpdf_parser.h"
@@ skipping 774 matching lines @@
     FX_BOOL                             m_bShadingObj;
 
     FX_BOOL                             Load();
 
     FX_BOOL                             Reload();
 
     int                                 m_ShadingType;
 
     CPDF_ColorSpace*    m_pCS;
 
+    CPDF_ColorSpace**   m_pPtrCS;

[Tom Sepez, 2014/10/14 18:49:23]

What if there's more than one Color that has a reference to this CS? If so, then
this seems like a use case for something like chromium's base/linked_ptr.h. 
Otherwise, it it always a Color object that contains the stale pointer?  If so,
I'd make this a CPDF_Color* m_pBackPointer; and later clear
pattern->m_pBackPointer->m_pPattern (or whatever its called).

[Bo Xu, 2014/10/14 20:41:06]

Sorry, I didn't quite get the meaning of CPDF_Color* m_pBackPointer;

m_pCS is counted by m_ColorSpaceMap and it can be referenced by more than one
CPDF_Color object or CPDF_Pattern object (by inc or dec the counter).

Suppose in m_ColorSpaceMap, there is a <key, value> pair:
<pCSObj, csData> that corresponds to m_pCS, then m_pPtrCS = &(csData->m_Obj)

 
     CPDF_Function*              m_pFunctions[4];
 
     int                                 m_nFuncs;
 protected:
     void        Clear();
 };
 struct CPDF_MeshVertex {
     FX_FLOAT x, y;
     FX_FLOAT r, g, b;
@@ skipping 143 matching lines @@
     FX_BOOL                                     m_bIsMask;
 
     FX_BOOL                                     m_bInterpolate;
 
     CPDF_Document*                      m_pDocument;
 
     CPDF_Dictionary*            m_pOC;
     CPDF_Dictionary*    InitJPEG(FX_LPBYTE pData, FX_DWORD size);
 };
 #endif