Track CJX_Objects in CFXJSE_Engine::m_mapVariableToContext. Follow-on from https://pdfium-review.googlesource.com/c/pdfium/+/72570. Make the same change to the other map in the CFXJSE_Engine. Change-Id: I65ce5db5a47b95e77dbdc68cc50ca876f524bbdd Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/72531 Commit-Queue: Tom Sepez <tsepez@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org>

diff --git a/fxjs/xfa/cfxjse_engine.cpp b/fxjs/xfa/cfxjse_engine.cpp
index 2d32a67..77f22517 100644
--- a/fxjs/xfa/cfxjse_engine.cpp
+++ b/fxjs/xfa/cfxjse_engine.cpp

@@ -507,7 +507,7 @@
   RemoveBuiltInObjs(pNewContext.get());
   pNewContext->EnableCompatibleMode();
   CFXJSE_Context* pResult = pNewContext.get();
-  m_mapVariableToContext[pScriptNode] = std::move(pNewContext);
+  m_mapVariableToContext[pScriptNode->JSObject()] = std::move(pNewContext);
   return pResult;
 }
 
@@ -531,7 +531,7 @@
   if (!pParent || pParent->GetElementType() != XFA_Element::Variables)
     return false;
 
-  auto it = m_mapVariableToContext.find(pScriptNode);
+  auto it = m_mapVariableToContext.find(pScriptNode->JSObject());
   if (it != m_mapVariableToContext.end() && it->second)
     return true;
 
@@ -567,7 +567,7 @@
       variablesNode->GetElementType() != XFA_Element::Variables)
     return false;
 
-  auto it = m_mapVariableToContext.find(pScriptNode);
+  auto it = m_mapVariableToContext.find(pScriptNode->JSObject());
   if (it == m_mapVariableToContext.end() || !it->second)
     return false;
 

diff --git a/fxjs/xfa/cfxjse_engine.h b/fxjs/xfa/cfxjse_engine.h
index 8d9ae25..8ca1d01 100644
--- a/fxjs/xfa/cfxjse_engine.h
+++ b/fxjs/xfa/cfxjse_engine.h

@@ -127,8 +127,7 @@
   // |m_mapObjectToValue| is what ensures the v8 object bound to a
   // CJX_Object remains valid for the lifetime of the engine.
   std::map<CJX_Object*, std::unique_ptr<CFXJSE_Value>> m_mapObjectToValue;
-  std::map<CXFA_Object*, std::unique_ptr<CFXJSE_Context>>
-      m_mapVariableToContext;
+  std::map<CJX_Object*, std::unique_ptr<CFXJSE_Context>> m_mapVariableToContext;
   UnownedPtr<CXFA_EventParam> m_eventParam;
   std::vector<CXFA_Node*> m_upObjectArray;
   UnownedPtr<std::vector<CXFA_Node*>> m_pScriptNodeArray;