commit 931dd1b56c0398258c68500fff04f04330bde73b
author Tom Sepez <tsepez@chromium.org> Thu Aug 15 18:36:39 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Thu Aug 15 18:36:39 2019 +0000
tree fbb05c00251f3c39e46f6e93053b9dc49cb93526
parent b9c940d699f6f893efe6a8a479b2b7934cde4b02

Observe m_pFocusWidget across m_ArrayKeepItems.clear()

Bug: chromium:993771
Change-Id: I24d2d0cb2ea1779b8aa1def9aa6a1dd639284a85
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/59332
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

xfa/fxfa/cxfa_ffdocview.cpp

diff --git a/xfa/fxfa/cxfa_ffdocview.cpp b/xfa/fxfa/cxfa_ffdocview.cpp
index 9016c55..97a2883 100644
--- a/xfa/fxfa/cxfa_ffdocview.cpp
+++ b/xfa/fxfa/cxfa_ffdocview.cpp
@@ -300,10 +300,10 @@
   if (pNewFocus) {
     CXFA_Node* node = pNewFocus->GetNode();
     m_pFocusNode = node->IsWidgetReady() ? node : nullptr;
-    m_pFocusWidget = pNewFocus;
+    m_pFocusWidget.Reset(pNewFocus);
   } else {
     m_pFocusNode = nullptr;
-    m_pFocusWidget = nullptr;
+    m_pFocusWidget.Reset();
   }
 
   return true;
@@ -329,7 +329,7 @@
     return;
 
   m_pFocusNode = nullptr;
-  m_pFocusWidget = nullptr;
+  m_pFocusWidget.Reset();
 }
 
 static XFA_EventError XFA_ProcessEvent(CXFA_FFDocView* pDocView,

xfa/fxfa/cxfa_ffdocview.h

diff --git a/xfa/fxfa/cxfa_ffdocview.h b/xfa/fxfa/cxfa_ffdocview.h
index e9a094f..092616e 100644
--- a/xfa/fxfa/cxfa_ffdocview.h
+++ b/xfa/fxfa/cxfa_ffdocview.h
@@ -11,14 +11,15 @@
 #include <memory>
 #include <vector>
 
+#include "core/fxcrt/observed_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "xfa/fxfa/cxfa_eventparam.h"
 #include "xfa/fxfa/cxfa_ffdoc.h"
+#include "xfa/fxfa/cxfa_ffwidget.h"
 #include "xfa/fxfa/fxfa.h"
 
 class CXFA_BindItems;
 class CXFA_FFDoc;
-class CXFA_FFWidget;
 class CXFA_FFWidgetHandler;
 class CXFA_Node;
 class CXFA_ReadyNodeIterator;
@@ -120,7 +121,7 @@
   std::unique_ptr<CXFA_FFWidgetHandler> m_pWidgetHandler;
   UnownedPtr<CXFA_LayoutProcessor> m_pXFADocLayout;
   UnownedPtr<CXFA_Node> m_pFocusNode;
-  UnownedPtr<CXFA_FFWidget> m_pFocusWidget;
+  ObservedPtr<CXFA_FFWidget> m_pFocusWidget;
   std::deque<CXFA_Node*> m_ValidateNodes;
   std::vector<CXFA_Node*> m_CalculateNodes;
   std::deque<CXFA_BindItems*> m_BindItems;