commit ef4bef706e3f7aa0cd6b62df839be44392a3bff0
author Lei Zhang <thestig@chromium.org> Fri Apr 17 17:09:53 2020 +0000
committer Chromium commit bot <commit-bot@chromium.org> Fri Apr 17 17:09:53 2020 +0000
tree c4f9f3ee0e6c9de99e52868e427303d81f34e5e4
parent 44005193b7eba10e4193135cb51ee25ff0f16b2b

Assert timer IDs are unique.

Make sure the embedder is handing out sane timer IDs.

Bug: chromium:1071689
Change-Id: Idb4ec6300a90ef2b519d8a7f8f0b892bb803ed22
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/68872
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

fxjs/global_timer.cpp

diff --git a/fxjs/global_timer.cpp b/fxjs/global_timer.cpp
index b837508..2d5ca17 100644
--- a/fxjs/global_timer.cpp
+++ b/fxjs/global_timer.cpp
@@ -11,6 +11,7 @@
 #include "core/fxcrt/timerhandler_iface.h"
 #include "fxjs/cjs_app.h"
 #include "third_party/base/no_destructor.h"
+#include "third_party/base/stl_util.h"
 
 namespace {
 
@@ -34,8 +35,10 @@
       m_swJScript(script),
       m_pRuntime(pRuntime),
       m_pEmbedApp(pObj) {
-  if (HasValidID())
+  if (HasValidID()) {
+    ASSERT(!pdfium::ContainsKey(GetGlobalTimerMap(), m_nTimerID));
     GetGlobalTimerMap()[m_nTimerID] = this;
+  }
 }
 
 GlobalTimer::~GlobalTimer() {
@@ -45,6 +48,7 @@
   if (m_pRuntime && m_pRuntime->GetTimerHandler())
     m_pRuntime->GetTimerHandler()->KillTimer(m_nTimerID);
 
+  ASSERT(pdfium::ContainsKey(GetGlobalTimerMap(), m_nTimerID));
   GetGlobalTimerMap().erase(m_nTimerID);
 }