Store the address of the page data map's value for proper referencing.

core/include/fpdfapi/fpdf_resource.h

Index: core/include/fpdfapi/fpdf_resource.h
diff --git a/core/include/fpdfapi/fpdf_resource.h b/core/include/fpdfapi/fpdf_resource.h
index 7bad01501a2b2495cb7268cda8080447dd0f92ab..1f63adcf1d45df7d4a8b21c1cfc094fcbacd2cd0 100644
--- a/core/include/fpdfapi/fpdf_resource.h
+++ b/core/include/fpdfapi/fpdf_resource.h
@@ -792,6 +792,7 @@ public:
 
     CPDF_ColorSpace*	m_pCS;
 
+    CPDF_ColorSpace**	m_pPtrCS;

[Tom Sepez, 2014/10/14 18:49:23]

What if there's more than one Color that has a reference to this CS? If so, then
this seems like a use case for something like chromium's base/linked_ptr.h. 
Otherwise, it it always a Color object that contains the stale pointer?  If so,
I'd make this a CPDF_Color* m_pBackPointer; and later clear
pattern->m_pBackPointer->m_pPattern (or whatever its called).

[Bo Xu, 2014/10/14 20:41:06]

Sorry, I didn't quite get the meaning of CPDF_Color* m_pBackPointer;

m_pCS is counted by m_ColorSpaceMap and it can be referenced by more than one
CPDF_Color object or CPDF_Pattern object (by inc or dec the counter).

Suppose in m_ColorSpaceMap, there is a <key, value> pair:
<pCSObj, csData> that corresponds to m_pCS, then m_pPtrCS = &(csData->m_Obj)

 
     CPDF_Function*		m_pFunctions[4];