commit 027cbf10093d6ac18a3558bf3c289179f1c0f0e1
author Tom Sepez <tsepez@chromium.org> Thu Jun 15 17:09:39 2023 +0000
committer Lei Zhang <thestig@chromium.org> Thu Jun 15 17:09:39 2023 +0000
tree 72bdc97f004a94b9354ba3cd4564452e49afb236
parent 49cfa407428a46e473579ba7cb5a8453047d2048

[M108-LTS] Observe widget across SetOptionSelection() calls.

Call may re-enter JavaScript.

Bug: chromium:1444581
Change-Id: Id7a2f17b3b81f822ca8f4496ac08c19b7794c48a
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/107394
Commit-Queue: Tom Sepez <tsepez@chromium.org>
(cherry picked from commit a9ff918a86d700c3bdf9b5820faed35490c0cd25)
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/108171
Reviewed-by: Lei Zhang <thestig@chromium.org>
Auto-Submit: Roger Felipe Zanoni da Silva <rzanoni@google.com>
Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>

fpdfsdk/formfiller/cffl_listbox.cpp

diff --git a/fpdfsdk/formfiller/cffl_listbox.cpp b/fpdfsdk/formfiller/cffl_listbox.cpp
index 4bb1000..6fe5d91 100644
--- a/fpdfsdk/formfiller/cffl_listbox.cpp
+++ b/fpdfsdk/formfiller/cffl_listbox.cpp
@@ -116,11 +116,18 @@
   }
   if (m_pWidget->GetFieldFlags() & pdfium::form_flags::kChoiceMultiSelect) {
     for (int32_t i = 0, sz = pListBox->GetCount(); i < sz; i++) {
-      if (pListBox->IsItemSelected(i))
+      if (pListBox->IsItemSelected(i)) {
         m_pWidget->SetOptionSelection(i);
+        if (!observed_box) {
+          return;
+        }
+      }
     }
   } else {
     m_pWidget->SetOptionSelection(pListBox->GetCurSel());
+    if (!observed_box) {
+      return;
+    }
   }
   ObservedPtr<CPDFSDK_Widget> observed_widget(m_pWidget.Get());
   ObservedPtr<CFFL_ListBox> observed_this(this);