Mark CFX_RenderDevice::SetDeviceDriver() as protected.

The method is meant to be used by derived classes to fully initialize
the object. Add some comments to explain this and an ASSERT() to prevent
double initialization.

Change-Id: I29e84f7ba0020bdd5b202f791bedc4067b45620b
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/70191
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
diff --git a/core/fxge/cfx_renderdevice.cpp b/core/fxge/cfx_renderdevice.cpp
index c1eba0c..c7e039d 100644
--- a/core/fxge/cfx_renderdevice.cpp
+++ b/core/fxge/cfx_renderdevice.cpp
@@ -398,6 +398,8 @@
 
 void CFX_RenderDevice::SetDeviceDriver(
     std::unique_ptr<RenderDeviceDriverIface> pDriver) {
+  ASSERT(pDriver);
+  ASSERT(!m_pDeviceDriver);
   m_pDeviceDriver = std::move(pDriver);
   InitDeviceInfo();
 }
diff --git a/core/fxge/cfx_renderdevice.h b/core/fxge/cfx_renderdevice.h
index 56e9329..5ff9130 100644
--- a/core/fxge/cfx_renderdevice.h
+++ b/core/fxge/cfx_renderdevice.h
@@ -29,6 +29,9 @@
 
 enum class BorderStyle { SOLID, DASH, BEVELED, INSET, UNDERLINE };
 
+// Base class for all render devices. Derived classes must call
+// SetDeviceDriver() to fully initialize the class. Until then, class methods
+// are not safe to call, or may return invalid results.
 class CFX_RenderDevice {
  public:
   class StateRestorer {
@@ -47,7 +50,6 @@
                                   float left,
                                   float top);
 
-  void SetDeviceDriver(std::unique_ptr<RenderDeviceDriverIface> pDriver);
   RenderDeviceDriverIface* GetDeviceDriver() const {
     return m_pDeviceDriver.get();
   }
@@ -224,6 +226,8 @@
  protected:
   CFX_RenderDevice();
 
+  void SetDeviceDriver(std::unique_ptr<RenderDeviceDriverIface> pDriver);
+
  private:
   void InitDeviceInfo();
   void UpdateClipBox();