Make CFWL_Message and its subclasses stack-only types.

Hence the objects it references via ordinary pointers will be
valid for the lifetime of the message.

Bug: pdfium:1563
Change-Id: I4cb042933b6745b5cf660a699335e089b3e091b5
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/72918
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/xfa/fwl/cfwl_message.h b/xfa/fwl/cfwl_message.h
index 1ae559e..1ac2f27 100644
--- a/xfa/fwl/cfwl_message.h
+++ b/xfa/fwl/cfwl_message.h
@@ -10,20 +10,23 @@
 #include <memory>
 
 #include "core/fxcrt/fx_system.h"
-#include "core/fxcrt/observed_ptr.h"
-#include "xfa/fwl/cfwl_widget.h"
+#include "v8/include/cppgc/macros.h"
+
+class CFWL_Widget;
 
 class CFWL_Message {
+  CPPGC_STACK_ALLOCATED();  // Allow Raw/Unowned pointers.
+
  public:
   enum class Type { kKey, kKillFocus, kMouse, kMouseWheel, kSetFocus };
 
   virtual ~CFWL_Message();
 
   Type GetType() const { return m_type; }
-  CFWL_Widget* GetSrcTarget() const { return m_pSrcTarget.Get(); }
-  CFWL_Widget* GetDstTarget() const { return m_pDstTarget.Get(); }
-  void SetSrcTarget(CFWL_Widget* pWidget) { m_pSrcTarget.Reset(pWidget); }
-  void SetDstTarget(CFWL_Widget* pWidget) { m_pDstTarget.Reset(pWidget); }
+  CFWL_Widget* GetSrcTarget() const { return m_pSrcTarget; }
+  CFWL_Widget* GetDstTarget() const { return m_pDstTarget; }
+  void SetSrcTarget(CFWL_Widget* pWidget) { m_pSrcTarget = pWidget; }
+  void SetDstTarget(CFWL_Widget* pWidget) { m_pDstTarget = pWidget; }
 
  protected:
   CFWL_Message(Type type, CFWL_Widget* pSrcTarget, CFWL_Widget* pDstTarget);
@@ -32,8 +35,8 @@
 
  private:
   const Type m_type;
-  ObservedPtr<CFWL_Widget> m_pSrcTarget;
-  ObservedPtr<CFWL_Widget> m_pDstTarget;
+  CFWL_Widget* m_pSrcTarget = nullptr;
+  CFWL_Widget* m_pDstTarget = nullptr;
 };
 
 #endif  // XFA_FWL_CFWL_MESSAGE_H_
diff --git a/xfa/fwl/cfwl_notedriver.cpp b/xfa/fwl/cfwl_notedriver.cpp
index ab86d99..eefdc45 100644
--- a/xfa/fwl/cfwl_notedriver.cpp
+++ b/xfa/fwl/cfwl_notedriver.cpp
@@ -82,16 +82,16 @@
   UnregisterEventTarget(pNoteTarget);
 }
 
-void CFWL_NoteDriver::ProcessMessage(std::unique_ptr<CFWL_Message> pMessage) {
+void CFWL_NoteDriver::ProcessMessage(CFWL_Message* pMessage) {
   CFWL_Widget* pMessageForm = pMessage->GetDstTarget();
   if (!pMessageForm)
     return;
 
-  if (!DispatchMessage(pMessage.get(), pMessageForm))
+  if (!DispatchMessage(pMessage, pMessageForm))
     return;
 
   if (pMessage->GetType() == CFWL_Message::Type::kMouse)
-    MouseSecondary(pMessage.get());
+    MouseSecondary(pMessage);
 }
 
 bool CFWL_NoteDriver::DispatchMessage(CFWL_Message* pMessage,
diff --git a/xfa/fwl/cfwl_notedriver.h b/xfa/fwl/cfwl_notedriver.h
index 343625b..d5aa1e6 100644
--- a/xfa/fwl/cfwl_notedriver.h
+++ b/xfa/fwl/cfwl_notedriver.h
@@ -31,7 +31,7 @@
 
   void NotifyTargetHide(CFWL_Widget* pNoteTarget);
   void NotifyTargetDestroy(CFWL_Widget* pNoteTarget);
-  void ProcessMessage(std::unique_ptr<CFWL_Message> pMessage);
+  void ProcessMessage(CFWL_Message* pMessage);
 
  private:
   bool DispatchMessage(CFWL_Message* pMessage, CFWL_Widget* pMessageForm);
diff --git a/xfa/fwl/cfwl_widgetmgr.cpp b/xfa/fwl/cfwl_widgetmgr.cpp
index c53096d..5a33f34 100644
--- a/xfa/fwl/cfwl_widgetmgr.cpp
+++ b/xfa/fwl/cfwl_widgetmgr.cpp
@@ -172,14 +172,13 @@
                           pPopupRect);
 }
 
-void CFWL_WidgetMgr::OnProcessMessageToForm(
-    std::unique_ptr<CFWL_Message> pMessage) {
+void CFWL_WidgetMgr::OnProcessMessageToForm(CFWL_Message* pMessage) {
   CFWL_Widget* pDstWidget = pMessage->GetDstTarget();
   if (!pDstWidget)
     return;
 
   CFWL_NoteDriver* pNoteDriver = pDstWidget->GetFWLApp()->GetNoteDriver();
-  pNoteDriver->ProcessMessage(std::move(pMessage));
+  pNoteDriver->ProcessMessage(pMessage);
 }
 
 void CFWL_WidgetMgr::OnDrawWidget(CFWL_Widget* pWidget,
diff --git a/xfa/fwl/cfwl_widgetmgr.h b/xfa/fwl/cfwl_widgetmgr.h
index e4cbe0e..cae13fc 100644
--- a/xfa/fwl/cfwl_widgetmgr.h
+++ b/xfa/fwl/cfwl_widgetmgr.h
@@ -35,7 +35,7 @@
   explicit CFWL_WidgetMgr(AdapterIface* pAdapterNative);
   ~CFWL_WidgetMgr();
 
-  void OnProcessMessageToForm(std::unique_ptr<CFWL_Message> pMessage);
+  void OnProcessMessageToForm(CFWL_Message* pMessage);
   void OnDrawWidget(CFWL_Widget* pWidget,
                     CXFA_Graphics* pGraphics,
                     const CFX_Matrix& matrix);
diff --git a/xfa/fxfa/cxfa_ffcheckbutton.cpp b/xfa/fxfa/cxfa_ffcheckbutton.cpp
index d71335c..ca6edb2 100644
--- a/xfa/fxfa/cxfa_ffcheckbutton.cpp
+++ b/xfa/fxfa/cxfa_ffcheckbutton.cpp
@@ -260,10 +260,9 @@
     return false;
 
   SetButtonDown(false);
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::LeftButtonUp, dwFlags,
-      FWLToClient(point)));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::LeftButtonUp,
+                        dwFlags, FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
diff --git a/xfa/fxfa/cxfa_fffield.cpp b/xfa/fxfa/cxfa_fffield.cpp
index 8176090..319942b 100644
--- a/xfa/fxfa/cxfa_fffield.cpp
+++ b/xfa/fxfa/cxfa_fffield.cpp
@@ -378,9 +378,8 @@
   if (!GetNormalWidget())
     return false;
 
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::Enter));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::Enter);
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -388,9 +387,8 @@
   if (!GetNormalWidget())
     return false;
 
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::Leave));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::Leave);
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -415,10 +413,9 @@
 
 bool CXFA_FFField::OnLButtonDown(uint32_t dwFlags, const CFX_PointF& point) {
   SetButtonDown(true);
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::LeftButtonDown, dwFlags,
-      FWLToClient(point)));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::LeftButtonDown,
+                        dwFlags, FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -429,10 +426,10 @@
     return false;
 
   SetButtonDown(false);
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::LeftButtonUp, dwFlags,
-      FWLToClient(point)));
 
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::LeftButtonUp,
+                        dwFlags, FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -440,10 +437,9 @@
   if (!GetNormalWidget())
     return false;
 
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::LeftButtonDblClk, dwFlags,
-      FWLToClient(point)));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::LeftButtonDblClk,
+                        dwFlags, FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -451,9 +447,9 @@
   if (!GetNormalWidget())
     return false;
 
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::Move, dwFlags, FWLToClient(point)));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::Move, dwFlags,
+                        FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -463,18 +459,17 @@
   if (!GetNormalWidget())
     return false;
 
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouseWheel>(
-      GetNormalWidget(), FWLToClient(point), delta));
-
+  CFWL_MessageMouseWheel msg(GetNormalWidget(), FWLToClient(point), delta);
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
 bool CXFA_FFField::OnRButtonDown(uint32_t dwFlags, const CFX_PointF& point) {
   SetButtonDown(true);
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::RightButtonDown, dwFlags,
-      FWLToClient(point)));
 
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::RightButtonDown,
+                        dwFlags, FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -485,10 +480,9 @@
     return false;
 
   SetButtonDown(false);
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::RightButtonUp, dwFlags,
-      FWLToClient(point)));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::RightButtonUp,
+                        dwFlags, FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -496,10 +490,9 @@
   if (!GetNormalWidget())
     return false;
 
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::RightButtonDblClk, dwFlags,
-      FWLToClient(point)));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::RightButtonDblClk,
+                        dwFlags, FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -510,8 +503,8 @@
   if (!GetNormalWidget())
     return false;
 
-  SendMessageToFWLWidget(
-      std::make_unique<CFWL_MessageSetFocus>(nullptr, GetNormalWidget()));
+  CFWL_MessageSetFocus msg(nullptr, GetNormalWidget());
+  SendMessageToFWLWidget(&msg);
   GetLayoutItem()->SetStatusBits(XFA_WidgetStatus_Focused);
   InvalidateRect();
 
@@ -521,8 +514,8 @@
 bool CXFA_FFField::OnKillFocus(CXFA_FFWidget* pNewWidget) {
   ObservedPtr<CXFA_FFWidget> pNewWatched(pNewWidget);
   if (GetNormalWidget()) {
-    SendMessageToFWLWidget(
-        std::make_unique<CFWL_MessageKillFocus>(nullptr, GetNormalWidget()));
+    CFWL_MessageKillFocus msg(nullptr, GetNormalWidget());
+    SendMessageToFWLWidget(&msg);
     GetLayoutItem()->ClearStatusBits(XFA_WidgetStatus_Focused);
     InvalidateRect();
   }
@@ -533,9 +526,9 @@
   if (!GetNormalWidget() || !GetDoc()->GetXFADoc()->IsInteractive())
     return false;
 
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageKey>(
-      GetNormalWidget(), CFWL_MessageKey::Type::kKeyDown, dwFlags, dwKeyCode));
-
+  CFWL_MessageKey msg(GetNormalWidget(), CFWL_MessageKey::Type::kKeyDown,
+                      dwFlags, dwKeyCode);
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -543,9 +536,9 @@
   if (!GetNormalWidget() || !GetDoc()->GetXFADoc()->IsInteractive())
     return false;
 
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageKey>(
-      GetNormalWidget(), CFWL_MessageKey::Type::kKeyUp, dwFlags, dwKeyCode));
-
+  CFWL_MessageKey msg(GetNormalWidget(), CFWL_MessageKey::Type::kKeyUp, dwFlags,
+                      dwKeyCode);
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -559,9 +552,9 @@
   if (!m_pNode->IsOpenAccess())
     return false;
 
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageKey>(
-      GetNormalWidget(), CFWL_MessageKey::Type::kChar, dwFlags, dwChar));
-
+  CFWL_MessageKey msg(GetNormalWidget(), CFWL_MessageKey::Type::kChar, dwFlags,
+                      dwChar);
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -718,10 +711,9 @@
   return false;
 }
 
-void CXFA_FFField::SendMessageToFWLWidget(
-    std::unique_ptr<CFWL_Message> pMessage) {
+void CXFA_FFField::SendMessageToFWLWidget(CFWL_Message* pMessage) {
   ASSERT(pMessage);
-  GetApp()->GetFWLWidgetMgr()->OnProcessMessageToForm(std::move(pMessage));
+  GetApp()->GetFWLWidgetMgr()->OnProcessMessageToForm(pMessage);
 }
 
 void CXFA_FFField::OnProcessMessage(CFWL_Message* pMessage) {}
diff --git a/xfa/fxfa/cxfa_fffield.h b/xfa/fxfa/cxfa_fffield.h
index 08b4fa7..ca321c2 100644
--- a/xfa/fxfa/cxfa_fffield.h
+++ b/xfa/fxfa/cxfa_fffield.h
@@ -94,7 +94,7 @@
                      HighlightOption highlight,
                      ShapeOption shape);
   void DrawFocus(CXFA_Graphics* pGS, CFX_Matrix* pMatrix);
-  void SendMessageToFWLWidget(std::unique_ptr<CFWL_Message> pMessage);
+  void SendMessageToFWLWidget(CFWL_Message* pMessage);
   void CapPlacement();
   void CapTopBottomPlacement(const CXFA_Margin* margin,
                              const CFX_RectF& rtWidget,
diff --git a/xfa/fxfa/cxfa_ffimageedit.cpp b/xfa/fxfa/cxfa_ffimageedit.cpp
index 1195549..d0505b3 100644
--- a/xfa/fxfa/cxfa_ffimageedit.cpp
+++ b/xfa/fxfa/cxfa_ffimageedit.cpp
@@ -113,10 +113,9 @@
 bool CXFA_FFImageEdit::OnLButtonDown(uint32_t dwFlags,
                                      const CFX_PointF& point) {
   SetButtonDown(true);
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::LeftButtonDown, dwFlags,
-      FWLToClient(point)));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::LeftButtonDown,
+                        dwFlags, FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
diff --git a/xfa/fxfa/cxfa_fftextedit.cpp b/xfa/fxfa/cxfa_fftextedit.cpp
index 6d354c8..2c406ce 100644
--- a/xfa/fxfa/cxfa_fftextedit.cpp
+++ b/xfa/fxfa/cxfa_fftextedit.cpp
@@ -136,10 +136,9 @@
     InvalidateRect();
   }
   SetButtonDown(true);
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      GetNormalWidget(), FWL_MouseCommand::LeftButtonDown, dwFlags,
-      FWLToClient(point)));
-
+  CFWL_MessageMouse msg(GetNormalWidget(), FWL_MouseCommand::LeftButtonDown,
+                        dwFlags, FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -150,9 +149,9 @@
     InvalidateRect();
   }
   SetButtonDown(true);
-  SendMessageToFWLWidget(std::make_unique<CFWL_MessageMouse>(
-      nullptr, FWL_MouseCommand::RightButtonDown, dwFlags, FWLToClient(point)));
-
+  CFWL_MessageMouse msg(nullptr, FWL_MouseCommand::RightButtonDown, dwFlags,
+                        FWLToClient(point));
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
@@ -175,17 +174,15 @@
   if (!CXFA_FFWidget::OnSetFocus(pOldWatched.Get()))
     return false;
 
-  SendMessageToFWLWidget(
-      std::make_unique<CFWL_MessageSetFocus>(nullptr, GetNormalWidget()));
-
+  CFWL_MessageSetFocus msg(nullptr, GetNormalWidget());
+  SendMessageToFWLWidget(&msg);
   return true;
 }
 
 bool CXFA_FFTextEdit::OnKillFocus(CXFA_FFWidget* pNewWidget) {
   ObservedPtr<CXFA_FFWidget> pNewWatched(pNewWidget);
-  SendMessageToFWLWidget(
-      std::make_unique<CFWL_MessageKillFocus>(nullptr, GetNormalWidget()));
-
+  CFWL_MessageKillFocus msg(nullptr, GetNormalWidget());
+  SendMessageToFWLWidget(&msg);
   GetLayoutItem()->ClearStatusBits(XFA_WidgetStatus_Focused);
   SetEditScrollOffset();
   ProcessCommittedData();