Observe pagview across JS invocation in cpdfxfa_page.cpp

Bug: chromium:1069700
Change-Id: I68db0b17dc8cc7146a18d7caf88334f75b3d31fc
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/68710
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

fpdfsdk/fpdfxfa/cpdfxfa_page.cpp

diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_page.cpp b/fpdfsdk/fpdfxfa/cpdfxfa_page.cpp
index d9868ab..fc9cf9d 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_page.cpp
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_page.cpp
@@ -207,13 +207,17 @@
   CXFA_FFPageView* xfa_page_view = GetXFAPageView();
   if (!xfa_page_view)
     return nullptr;
+
+  ObservedPtr<CPDFSDK_PageView> watched_page_view(page_view);
   std::unique_ptr<IXFA_WidgetIterator> it =
       xfa_page_view->CreateTraverseWidgetIterator(XFA_WidgetStatus_Visible |
                                                   XFA_WidgetStatus_Viewable |
                                                   XFA_WidgetStatus_Focused);
+  if (!watched_page_view)
+    return nullptr;
 
-  return page_view->GetAnnotByXFAWidget(last ? it->MoveToLast()
-                                             : it->MoveToFirst());
+  CXFA_FFWidget* pWidget = last ? it->MoveToLast() : it->MoveToFirst();
+  return watched_page_view->GetAnnotByXFAWidget(pWidget);
 }
 
 int CPDFXFA_Page::HasFormFieldAtPoint(const CFX_PointF& point) const {

testing/resources/javascript/xfa_specific/bug_1069700.evt

diff --git a/testing/resources/javascript/xfa_specific/bug_1069700.evt b/testing/resources/javascript/xfa_specific/bug_1069700.evt
new file mode 100644
index 0000000..069f712
--- /dev/null
+++ b/testing/resources/javascript/xfa_specific/bug_1069700.evt
@@ -0,0 +1,3 @@
+mousedown,left,200,200
+mouseup,left,200,200
+keycode,9,shift

testing/resources/javascript/xfa_specific/bug_1069700.in

diff --git a/testing/resources/javascript/xfa_specific/bug_1069700.in b/testing/resources/javascript/xfa_specific/bug_1069700.in
new file mode 100644
index 0000000..13c56a9
--- /dev/null
+++ b/testing/resources/javascript/xfa_specific/bug_1069700.in
@@ -0,0 +1,73 @@
+{{header}}
+{{include ../../xfa_catalog_1_0.fragment}}
+{{include ../../xfa_object_2_0.fragment}}
+{{include ../../xfa_preamble_3_0.fragment}}
+{{include ../../xfa_config_4_0.fragment}}
+{{object 5 0}} <<
+  {{streamlen}}
+>>
+stream
+<template xmlns="http://www.xfa.org/schema/xfa-template/2.6/">
+  <subform name="form1">
+    <pageSet>
+      <pageArea id="Page1" name="Page1">
+        <contentArea h="10.5in" w="8in" x="0.25in" y="0.25in"/>
+        <medium long="11in" short="8.5in" stock="letter"/>
+      </pageArea>
+    </pageSet>
+    <subform h="10.5in" w="8in" name="subform2">
+      <field h="10mm" name="DropDownList1" w="10mm" x="0mm" y="20mm">
+        <ui>
+          <choiceList/>
+        </ui>
+        <items save="1">
+          <text>Single</text>
+          <text>Married</text>
+          <text>Other</text>
+        </items>
+      </field>
+      <field h="200mm" name="DropDownList2" w="2mm" x="0mm" y="30mm">
+        <ui>
+          <textEdit/>
+       </ui>
+      </field>
+      <subform name="subform3" x="0mm" y="5mm">
+        <occur max="-1"/>
+        <traversal>
+          <traverse operation="next" ref="$xfa.(eval('try { if (aaaa == 1) {bb();} } catch(e){}') == 0)"/>
+        </traversal>
+      </subform>
+      <bookend leader="$"/>
+      <keep intact="none" previous="contentArea"/>
+    </subform>
+    <subform name="subform4" x="0mm">
+      <occur max="-1"/>
+      <field name="choiceList3" minH="32in">
+        <ui>
+          <choiceList/>
+        </ui>
+      </field>
+    </subform>
+    <event activity="docReady">
+      <script contentType="application/x-javascript">
+        aaaa = 1;
+        bb = function() {
+          xfa.host.setFocus(f1);
+          d = xfa.resolveNode("xfa.form..subform4");
+          d.instanceManager.addInstance(1);
+          xfa.host.openList(f1);
+        }
+        f1 = xfa.resolveNode("xfa.form..DropDownList1");
+      </script>
+    </event>
+  </subform>
+</template>
+endstream
+endobj
+{include ../../xfa_locale_6_0.fragment}}
+{{include ../../xfa_postamble_7_0.fragment}}
+{{include ../../xfa_pages_8_0.fragment}}
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF