Make FXJSE variable context compatible with FXJS.

Allows FXJS to be entered directly from V8 when the variable context
gets a reference to an FXJS object.

Bug: pdfium:1066

Change-Id: I48e39ed9104cc6df31c19d94fa7e0f8c7760932f
Reviewed-on: https://pdfium-review.googlesource.com/33450
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/fxjs/cfxjse_engine.cpp b/fxjs/cfxjse_engine.cpp
index ff2bcc4..6c88309 100644
--- a/fxjs/cfxjse_engine.cpp
+++ b/fxjs/cfxjse_engine.cpp
@@ -96,6 +96,7 @@
 CFXJSE_Engine::CFXJSE_Engine(CXFA_Document* pDocument,
                              CFXJS_Engine* fxjs_engine)
     : CFX_V8(fxjs_engine->GetIsolate()),
+      m_pSubordinateEngine(fxjs_engine),
       m_pDocument(pDocument),
       m_JsContext(CFXJSE_Context::Create(fxjs_engine->GetIsolate(),
                                          fxjs_engine,
@@ -447,9 +448,9 @@
   if (!pScriptNode || !pSubform)
     return nullptr;
 
-  auto pNewContext =
-      CFXJSE_Context::Create(GetIsolate(), nullptr, &VariablesClassDescriptor,
-                             new CXFA_ThisProxy(pSubform, pScriptNode));
+  auto pNewContext = CFXJSE_Context::Create(
+      GetIsolate(), m_pSubordinateEngine.Get(), &VariablesClassDescriptor,
+      new CXFA_ThisProxy(pSubform, pScriptNode));
   RemoveBuiltInObjs(pNewContext.get());
   pNewContext->EnableCompatibleMode();
   CFXJSE_Context* pResult = pNewContext.get();
diff --git a/fxjs/cfxjse_engine.h b/fxjs/cfxjse_engine.h
index 33723ad..dc05f0d 100644
--- a/fxjs/cfxjse_engine.h
+++ b/fxjs/cfxjse_engine.h
@@ -107,6 +107,7 @@
                           bool bGetter);
   bool RunVariablesScript(CXFA_Node* pScriptNode);
 
+  UnownedPtr<CFXJS_Engine> const m_pSubordinateEngine;
   UnownedPtr<CXFA_Document> const m_pDocument;
   std::unique_ptr<CFXJSE_Context> m_JsContext;
   CFXJSE_Class* m_pJsClass;