commit 334b73bf9f717629d110ff160978f691cee80a92
author Tom Sepez <tsepez@chromium.org> Sat Aug 08 00:01:37 2020 +0000
committer Chromium commit bot <commit-bot@chromium.org> Sat Aug 08 00:01:37 2020 +0000
tree f1d900c1955de07271e8461f8288b4372d9b0a17
parent 3c738eb4f1deb83d8e336f15da610e76626c1670

Track CJX_Objects in CFXJSE_Engine::m_mapVariableToContext.

Follow-on from https://pdfium-review.googlesource.com/c/pdfium/+/72570.
Make the same change to the other map in the CFXJSE_Engine.

Change-Id: I65ce5db5a47b95e77dbdc68cc50ca876f524bbdd
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/72531
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

fxjs/xfa/cfxjse_engine.cpp

diff --git a/fxjs/xfa/cfxjse_engine.cpp b/fxjs/xfa/cfxjse_engine.cpp
index 2d32a67..77f22517 100644
--- a/fxjs/xfa/cfxjse_engine.cpp
+++ b/fxjs/xfa/cfxjse_engine.cpp
@@ -507,7 +507,7 @@
   RemoveBuiltInObjs(pNewContext.get());
   pNewContext->EnableCompatibleMode();
   CFXJSE_Context* pResult = pNewContext.get();
-  m_mapVariableToContext[pScriptNode] = std::move(pNewContext);
+  m_mapVariableToContext[pScriptNode->JSObject()] = std::move(pNewContext);
   return pResult;
 }
 
@@ -531,7 +531,7 @@
   if (!pParent || pParent->GetElementType() != XFA_Element::Variables)
     return false;
 
-  auto it = m_mapVariableToContext.find(pScriptNode);
+  auto it = m_mapVariableToContext.find(pScriptNode->JSObject());
   if (it != m_mapVariableToContext.end() && it->second)
     return true;
 
@@ -567,7 +567,7 @@
       variablesNode->GetElementType() != XFA_Element::Variables)
     return false;
 
-  auto it = m_mapVariableToContext.find(pScriptNode);
+  auto it = m_mapVariableToContext.find(pScriptNode->JSObject());
   if (it == m_mapVariableToContext.end() || !it->second)
     return false;
 

fxjs/xfa/cfxjse_engine.h

diff --git a/fxjs/xfa/cfxjse_engine.h b/fxjs/xfa/cfxjse_engine.h
index 8d9ae25..8ca1d01 100644
--- a/fxjs/xfa/cfxjse_engine.h
+++ b/fxjs/xfa/cfxjse_engine.h
@@ -127,8 +127,7 @@
   // |m_mapObjectToValue| is what ensures the v8 object bound to a
   // CJX_Object remains valid for the lifetime of the engine.
   std::map<CJX_Object*, std::unique_ptr<CFXJSE_Value>> m_mapObjectToValue;
-  std::map<CXFA_Object*, std::unique_ptr<CFXJSE_Context>>
-      m_mapVariableToContext;
+  std::map<CJX_Object*, std::unique_ptr<CFXJSE_Context>> m_mapVariableToContext;
   UnownedPtr<CXFA_EventParam> m_eventParam;
   std::vector<CXFA_Node*> m_upObjectArray;
   UnownedPtr<std::vector<CXFA_Node*>> m_pScriptNodeArray;