commit 58b36676759814d93d3144c18b9cf25fbafff4d6
author Tom Sepez <tsepez@chromium.org> Mon Jul 01 18:32:32 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Mon Jul 01 18:32:32 2019 +0000
tree 81e6ad28df7a5c81f239944f015b3037beea5ffb
parent 620d9aeed7100e3d3bc761cc286cadac29787a44

Fix destruction order in CFX_Font

- Also ensure caller takes ownership of stream in LoadFileImp().

Bug: chromium:978180
Change-Id: I1a1ac942fe5fdcb675ca0495f0cf8645e0d38c24
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/57011
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

core/fxge/cfx_font.cpp

diff --git a/core/fxge/cfx_font.cpp b/core/fxge/cfx_font.cpp
index 3bf8c69..53f9b5d 100644
--- a/core/fxge/cfx_font.cpp
+++ b/core/fxge/cfx_font.cpp
@@ -75,9 +75,7 @@
   if (!face)
     return nullptr;
 
-  if (stream)
-    *stream = std::move(stream1);
-
+  *stream = std::move(stream1);
   return face;
 }
 #endif  // PDF_ENABLE_XFA

core/fxge/cfx_font.h

diff --git a/core/fxge/cfx_font.h b/core/fxge/cfx_font.h
index 83b8057..d5a4a7e 100644
--- a/core/fxge/cfx_font.h
+++ b/core/fxge/cfx_font.h
@@ -131,12 +131,12 @@
 #endif
   ByteString GetFamilyNameOrUntitled() const;
 
+#if defined(PDF_ENABLE_XFA)
+  std::unique_ptr<FXFT_StreamRec> m_pOwnedStream;  // Must outlive |m_Face|.
+#endif
   mutable RetainPtr<CFX_Face> m_Face;
   mutable RetainPtr<CFX_GlyphCache> m_GlyphCache;
   std::unique_ptr<CFX_SubstFont> m_pSubstFont;
-#if defined(PDF_ENABLE_XFA)
-  std::unique_ptr<FXFT_StreamRec> m_pOwnedStream;
-#endif  // defined(PDF_ENABLE_XFA)
   std::unique_ptr<uint8_t, FxFreeDeleter> m_pGsubData;
   std::vector<uint8_t> m_pFontDataAllocation;
   pdfium::span<uint8_t> m_FontData;