Avoid order-of-evaluation issues in CJS_Field::set_display().

Manual patch, based on Gemini suggestions.

Bug: 513536416
Change-Id: I51ac96627adb28a0ad9b8ccc77f906e2202a39e6
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/147710
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

fxjs/cjs_field.cpp

diff --git a/fxjs/cjs_field.cpp b/fxjs/cjs_field.cpp
index f090062..d886c58 100644
--- a/fxjs/cjs_field.cpp
+++ b/fxjs/cjs_field.cpp
@@ -1271,12 +1271,14 @@
   if (!can_set_) {
     return CJS_Result::Failure(JSMessage::kReadOnlyError);
   }
-
+  int value = pRuntime->ToInt32(vp);  // Re-entrant.
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
+  }
   if (delay_) {
-    AddDelay_Int(FP_DISPLAY, pRuntime->ToInt32(vp));
+    AddDelay_Int(FP_DISPLAY, value);
   } else {
-    SetDisplay(form_fill_env_.Get(), field_name_, form_control_index_,
-               pRuntime->ToInt32(vp));
+    SetDisplay(form_fill_env_.Get(), field_name_, form_control_index_, value);
   }
   return CJS_Result::Success();
 }