Remove CXFA_NodeOwner::FreeOwnedNode(). Nodes live essentially in an "arena" and live for the duration of the document. This appears to be an anachronism from earlier node ownership models. - use vector since lookup for removal not required. - remove a no-op assignment near the call as well. Bug: chromium:1042956 Change-Id: Ic1b4789766a6dc4b6e7a14ff289cc53090c93539 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/65330 Commit-Queue: Tom Sepez <tsepez@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org>

diff --git a/fxjs/xfa/cjx_object.cpp b/fxjs/xfa/cjx_object.cpp
index a49bb78..78aa74c 100644
--- a/fxjs/xfa/cjx_object.cpp
+++ b/fxjs/xfa/cjx_object.cpp

@@ -1138,8 +1138,6 @@
     ToNode(GetXFAObject())->InsertChildAndNotify(pHeadChild, nullptr);
     pHeadChild = pSibling;
   }
-  GetDocument()->FreeOwnedNode(pProtoForm);
-  pProtoForm = nullptr;
 }
 
 void CJX_Object::ScriptAttributeBool(CFXJSE_Value* pValue,

diff --git a/testing/resources/javascript/xfa_specific/bug_1042956.pdf b/testing/resources/javascript/xfa_specific/bug_1042956.pdf
new file mode 100644
index 0000000..cc42fd7
--- /dev/null
+++ b/testing/resources/javascript/xfa_specific/bug_1042956.pdf

@@ -0,0 +1,19 @@
+%PDF-1.7
+1 0 obj
+<</Type /Catalog /Pages 2 0 R /AcroForm <</XFA 30 0 R>> /NeedsRendering true>>
+endobj
+2 0 obj
+<</Type /Pages /Kids [3 0 R] /Count 1>>
+endobj
+3 0 obj
+<</Type /Page /Parent 2 0 R /MediaBox [0 0 3 3]>>
+endobj
+30 0 obj
+<</Length 285>>
+stream
+<xdp xmlns="http://ns.adobe.com/xdp/"><config><acrobat><acrobat7><dynamicRender>required</dynamicRender></acrobat7></acrobat></config><template><subform><desc name="N01" use=" .[N01.use=&quot; .[N01.#use]&quot;]"></desc><proto><bindItems></bindItems></proto></subform></template></xdp>
+endstream
+endobj
+trailer
+<</Root 1 0 R /Size 31>>
+%%EOF
\ No newline at end of file

diff --git a/xfa/fxfa/parser/cxfa_nodeowner.cpp b/xfa/fxfa/parser/cxfa_nodeowner.cpp
index 6ee9fd8..9baf16c 100644
--- a/xfa/fxfa/parser/cxfa_nodeowner.cpp
+++ b/xfa/fxfa/parser/cxfa_nodeowner.cpp

@@ -8,7 +8,6 @@
 
 #include <utility>
 
-#include "third_party/base/stl_util.h"
 #include "xfa/fxfa/parser/cxfa_node.h"
 
 CXFA_NodeOwner::CXFA_NodeOwner() = default;
@@ -22,16 +21,6 @@
     return nullptr;
 
   CXFA_Node* ret = node.get();
-  nodes_.insert(std::move(node));
+  nodes_.push_back(std::move(node));
   return ret;
 }
-
-void CXFA_NodeOwner::FreeOwnedNode(CXFA_Node* node) {
-  if (!node)
-    return;
-
-  pdfium::FakeUniquePtr<CXFA_Node> search(node);
-  auto it = nodes_.find(search);
-  ASSERT(it != nodes_.end());
-  nodes_.erase(it);
-}

diff --git a/xfa/fxfa/parser/cxfa_nodeowner.h b/xfa/fxfa/parser/cxfa_nodeowner.h
index e7247cd..8f6abca 100644
--- a/xfa/fxfa/parser/cxfa_nodeowner.h
+++ b/xfa/fxfa/parser/cxfa_nodeowner.h

@@ -8,7 +8,7 @@
 #define XFA_FXFA_PARSER_CXFA_NODEOWNER_H_
 
 #include <memory>
-#include <set>
+#include <vector>
 
 class CXFA_Node;
 
@@ -17,14 +17,13 @@
   virtual ~CXFA_NodeOwner();
 
   CXFA_Node* AddOwnedNode(std::unique_ptr<CXFA_Node> node);
-  void FreeOwnedNode(CXFA_Node* node);
   bool IsBeingDestroyed() const { return is_being_destroyed_; }
 
  protected:
   CXFA_NodeOwner();
 
   bool is_being_destroyed_ = false;
-  std::set<std::unique_ptr<CXFA_Node>> nodes_;
+  std::vector<std::unique_ptr<CXFA_Node>> nodes_;
 };
 
 #endif  // XFA_FXFA_PARSER_CXFA_NODEOWNER_H_