The root cause of this issue is shown as below:
authorJun Fang <jun_fang@foxitsoftware.com>
Tue, 5 Aug 2014 09:38:22 +0000 (02:38 -0700)
committerJun Fang <jun_fang@foxitsoftware.com>
Tue, 5 Aug 2014 09:38:22 +0000 (02:38 -0700)
commit1b9c5c4dc41956b8c5ab17b9a882adf8a2513768
tree5ec68ec6965397b29bfe174894c021618db4c42e
parent06a8c8737b731d601af11cd9d61308c097cacc5f
The root cause of this issue is shown as below:
Patterns are managed in CPDF_DocPageData. When
a document is closed, all patterns will be
released in the deconstruction of CPDF_DocPageData.
However, some patterns which are referenced in
CPDF_Color can't get the notification from the
destroy of CPDF_DocPageData. It will cause
use-after-free in CPDF_Color::~CPDF_Color.

BUG=392719
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/439693002
core/include/fpdfapi/fpdf_resource.h
core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp
core/src/fpdfapi/fpdf_page/fpdf_page_pattern.cpp