Fix loading page using hint tables.

core/fpdfapi/parser/cpdf_data_avail.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/parser/cpdf_data_avail.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 1607 matching lines @@
     }
 
     DocAvailStatus nResult = CheckLinearizedData(pHints);
     if (nResult != DataAvailable)
       return nResult;
 
     if (m_pHintTables) {
       nResult = m_pHintTables->CheckPage(dwPage, pHints);
       if (nResult != DataAvailable)
         return nResult;
+      // We should say to the document, which object is the page.
+      m_pDocument->SetPageObjNum(dwPage, GetPage(dwPage)->GetObjNum());

[Lei Zhang, 2016/10/20 21:43:36]

Can GetPage() return a nullptr here?

[Lei Zhang, 2016/10/21 17:15:53]

Based on the new crashes that caused this revert... yes, it can.

[snake, 2016/10/24 15:38:31]

But should not, because the page should be available at this moment.

       m_pagesLoadState.insert(dwPage);
       return DataAvailable;
     }
 
     if (m_bMainXRefLoadedOK) {
       if (m_bTotalLoadPageTree) {
         if (!LoadPages(pHints))
           return DataNotAvailable;
       } else {
         if (!m_bCurPageDictLoadOK && !CheckPage(dwPage, pHints))
@@ skipping 118 matching lines @@
     CPDF_Dictionary* pDict = m_pLinearized->GetDict();
     CPDF_Object* pObj = pDict ? pDict->GetDirectObjectFor("P") : nullptr;
 
     int pageNum = pObj ? pObj->GetInteger() : 0;
     if (m_pHintTables && index != pageNum) {
       FX_FILESIZE szPageStartPos = 0;
       FX_FILESIZE szPageLength = 0;
       uint32_t dwObjNum = 0;
       bool bPagePosGot = m_pHintTables->GetPagePos(index, &szPageStartPos,
                                                    &szPageLength, &dwObjNum);
+      if (!dwObjNum)

[Lei Zhang, 2016/10/20 21:43:36]

You should check |bPagePosGot| first, because if it returns false, then we
already know |dwObjNum| is not valid.

i.e. how about:

if (!bPagePosGot || !dwObjNum)
  return nullptr;

...  // continue with GetIndirectObject()

+        return nullptr;
+      // Page object already can be parsed in document.
+      CPDF_Object* pPageDict = m_pDocument->GetIndirectObject(dwObjNum);
+      if (pPageDict)
+        return pPageDict->GetDict();
+
       if (!bPagePosGot)
         return nullptr;
 
       m_syntaxParser.InitParser(m_pFileRead, (uint32_t)szPageStartPos);
-      CPDF_Object* pPageDict = ParseIndirectObjectAt(0, dwObjNum, m_pDocument);
+      pPageDict = ParseIndirectObjectAt(0, dwObjNum, m_pDocument);
       if (!pPageDict)
         return nullptr;
 
       if (!m_pDocument->ReplaceIndirectObjectIfHigherGeneration(dwObjNum,
                                                                 pPageDict)) {
         return nullptr;
       }
       return pPageDict->GetDict();
     }
   }
@@ skipping 35 matching lines @@
   return FormAvailable;
 }
 
 CPDF_DataAvail::PageNode::PageNode() : m_type(PDF_PAGENODE_UNKNOWN) {}
 
 CPDF_DataAvail::PageNode::~PageNode() {
   for (int32_t i = 0; i < m_childNode.GetSize(); ++i)
     delete m_childNode[i];
   m_childNode.RemoveAll();
 }