Release unowned m_pTiffContext before deleting through it

Workaround for murky ownership. Note the member will now get cleared
as a consequence of Release()

Bug: 726887
Change-Id: I3eac3d1aa915497f66a57c5effa892a15d10f583
Reviewed-on: https://pdfium-review.googlesource.com/6079
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

core/fxcodec/codec/ccodec_progressivedecoder.h

diff --git a/core/fxcodec/codec/ccodec_progressivedecoder.h b/core/fxcodec/codec/ccodec_progressivedecoder.h
index 6dd7357..42d0ee3 100644
--- a/core/fxcodec/codec/ccodec_progressivedecoder.h
+++ b/core/fxcodec/codec/ccodec_progressivedecoder.h
@@ -129,6 +129,8 @@
 
   CFX_RetainPtr<IFX_SeekableReadStream> m_pFile;
   CFX_UnownedPtr<CCodec_ModuleMgr> m_pCodecMgr;
+
+  // TODO(tsepez): All these contexts probably should be unique_ptrs.
   FXJPEG_Context* m_pJpegContext;
   FXPNG_Context* m_pPngContext;
   std::unique_ptr<CGifContext> m_pGifContext;

core/fxcodec/codec/fx_codec_progress.cpp

diff --git a/core/fxcodec/codec/fx_codec_progress.cpp b/core/fxcodec/codec/fx_codec_progress.cpp
index 209a973..dba0e20 100644
--- a/core/fxcodec/codec/fx_codec_progress.cpp
+++ b/core/fxcodec/codec/fx_codec_progress.cpp
@@ -302,7 +302,7 @@
   if (m_pPngContext)
     m_pCodecMgr->GetPngModule()->Finish(m_pPngContext);
   if (m_pTiffContext)
-    m_pCodecMgr->GetTiffModule()->DestroyDecoder(m_pTiffContext.Get());
+    m_pCodecMgr->GetTiffModule()->DestroyDecoder(m_pTiffContext.Release());
   FX_Free(m_pSrcBuf);
   FX_Free(m_pDecodeBuf);
   FX_Free(m_pSrcPalette);
@@ -1219,8 +1219,7 @@
       m_SrcComponents = 4;
       m_clipBox = FX_RECT(0, 0, m_SrcWidth, m_SrcHeight);
       if (!ret) {
-        pTiffModule->DestroyDecoder(m_pTiffContext.Get());
-        m_pTiffContext = nullptr;
+        pTiffModule->DestroyDecoder(m_pTiffContext.Release());
         m_status = FXCODEC_STATUS_ERR_FORMAT;
         return false;
       }