commit 6670c6e7f876e345bcf33742f02d9d85c07fe32c
author Tom Sepez <tsepez@chromium.org> Wed May 08 21:17:24 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Wed May 08 21:17:24 2019 +0000
tree 296c668d7a6e1bacec388a1b769a699ee7c56259
parent 69eae2d01bdf9c2badf25b207cf363f0950f758b

Call RemoveLayoutItem() before deleting layout items.

Deleting an item still in the tree may have unfortunate consequences.

Change-Id: I5317b482adcdf5f0ab95f1a2fea51bd30e166266
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/54111
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

xfa/fxfa/layout/cxfa_layoutpagemgr.cpp

diff --git a/xfa/fxfa/layout/cxfa_layoutpagemgr.cpp b/xfa/fxfa/layout/cxfa_layoutpagemgr.cpp
index 7863e6e..905c860 100644
--- a/xfa/fxfa/layout/cxfa_layoutpagemgr.cpp
+++ b/xfa/fxfa/layout/cxfa_layoutpagemgr.cpp
@@ -262,6 +262,7 @@
       SyncRemoveLayoutItem(pCurLayoutItem, pNotify, pDocLayout);
 
     pNotify->OnLayoutItemRemoving(pDocLayout, pCurLayoutItem);
+    RemoveLayoutItem(pCurLayoutItem);
     delete pCurLayoutItem;
     pCurLayoutItem = pNextLayoutItem;
   }
@@ -387,10 +388,7 @@
   ASSERT(m_pTemplatePageSetRoot);
 
   if (m_pPageSetLayoutItemRoot) {
-    m_pPageSetLayoutItemRoot->SetParent(nullptr);
-    m_pPageSetLayoutItemRoot->SetFirstChild(nullptr);
-    m_pPageSetLayoutItemRoot->SetNextSibling(nullptr);
-    m_pPageSetLayoutItemRoot->SetFormNode(m_pTemplatePageSetRoot);
+    RemoveLayoutItem(m_pPageSetLayoutItemRoot);
   } else {
     m_pPageSetLayoutItemRoot =
         new CXFA_ViewLayoutItem(m_pTemplatePageSetRoot, nullptr);
@@ -1610,10 +1608,9 @@
 }
 
 void CXFA_LayoutPageMgr::SaveLayoutItem(CXFA_LayoutItem* pParentLayoutItem) {
-  CXFA_LayoutItem* pNextLayoutItem;
   CXFA_LayoutItem* pCurLayoutItem = pParentLayoutItem->GetFirstChild();
   while (pCurLayoutItem) {
-    pNextLayoutItem = pCurLayoutItem->GetNextSibling();
+    CXFA_LayoutItem* pNextLayoutItem = pCurLayoutItem->GetNextSibling();
     if (pCurLayoutItem->IsContentLayoutItem()) {
       if (pCurLayoutItem->GetFormNode()->HasRemovedChildren()) {
         CXFA_FFNotify* pNotify =
@@ -1624,6 +1621,7 @@
           SyncRemoveLayoutItem(pCurLayoutItem, pNotify, pDocLayout);
 
         pNotify->OnLayoutItemRemoving(pDocLayout, pCurLayoutItem);
+        RemoveLayoutItem(pCurLayoutItem);
         delete pCurLayoutItem;
         pCurLayoutItem = pNextLayoutItem;
         continue;
@@ -1642,9 +1640,7 @@
     if (pCurLayoutItem->GetFirstChild())
       SaveLayoutItem(pCurLayoutItem);
 
-    pCurLayoutItem->SetParent(nullptr);
-    pCurLayoutItem->SetNextSibling(nullptr);
-    pCurLayoutItem->SetFirstChild(nullptr);
+    RemoveLayoutItem(pCurLayoutItem);
     if (!pCurLayoutItem->IsContentLayoutItem() &&
         pCurLayoutItem->GetFormNode()->GetElementType() !=
             XFA_Element::PageArea) {
@@ -1771,6 +1767,7 @@
                       pIter->JSObject()->GetLayoutItem();
                   if (pLayoutItem) {
                     pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem);
+                    RemoveLayoutItem(pLayoutItem);
                     delete pLayoutItem;
                   }
                 }
@@ -1836,6 +1833,7 @@
                   pChildNode->JSObject()->GetLayoutItem();
               if (pLayoutItem) {
                 pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem);
+                RemoveLayoutItem(pLayoutItem);
                 delete pLayoutItem;
               }
             }
@@ -1843,6 +1841,7 @@
             CXFA_LayoutItem* pLayoutItem = pNode->JSObject()->GetLayoutItem();
             if (pLayoutItem) {
               pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem);
+              RemoveLayoutItem(pLayoutItem);
               delete pLayoutItem;
             }
           }
@@ -1971,6 +1970,7 @@
   for (; pRootLayoutItem; pRootLayoutItem = pNextLayout) {
     pNextLayout = ToViewLayoutItem(pRootLayoutItem->GetNextSibling());
     SaveLayoutItem(pRootLayoutItem);
+    RemoveLayoutItem(pRootLayoutItem);
     delete pRootLayoutItem;
   }
   m_pPageSetLayoutItemRoot = nullptr;