commit a983336ddf1099e4f3ffbcdf82adca1a4be8141c
author Tom Sepez <tsepez@chromium.org> Thu Jan 30 19:14:32 2020 +0000
committer Chromium commit bot <commit-bot@chromium.org> Thu Jan 30 19:14:32 2020 +0000
tree 54fde0fab065fb3d0b298d19001d304cf8a7a155
parent 60ca7defc0eb970d7a5c881056e961020581276e

Null out CXFA_FF* layout item reference in layout item dtor.

First step towards avoiding a re-entry on a partially destructed
object, but does not fully fix the referenced issue.  Provides symmetry
with what happens during the constructor when the reference is set.

Bug: chromium:1042915
Change-Id: Ic561c243db31fabc95a3da1c12b451665901e4ac
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/65850
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

xfa/fxfa/layout/cxfa_contentlayoutitem.cpp

diff --git a/xfa/fxfa/layout/cxfa_contentlayoutitem.cpp b/xfa/fxfa/layout/cxfa_contentlayoutitem.cpp
index b6e4545..250cd57 100644
--- a/xfa/fxfa/layout/cxfa_contentlayoutitem.cpp
+++ b/xfa/fxfa/layout/cxfa_contentlayoutitem.cpp
@@ -22,6 +22,9 @@
 }
 
 CXFA_ContentLayoutItem::~CXFA_ContentLayoutItem() {
+  if (m_pFFWidget)
+    m_pFFWidget->SetLayoutItem(nullptr);
+
   RemoveSelf();
 }
 

xfa/fxfa/layout/cxfa_viewlayoutitem.cpp

diff --git a/xfa/fxfa/layout/cxfa_viewlayoutitem.cpp b/xfa/fxfa/layout/cxfa_viewlayoutitem.cpp
index 2920cb4..fcef2ab 100644
--- a/xfa/fxfa/layout/cxfa_viewlayoutitem.cpp
+++ b/xfa/fxfa/layout/cxfa_viewlayoutitem.cpp
@@ -24,7 +24,10 @@
     m_pFFPageView->SetLayoutItem(this);
 }
 
-CXFA_ViewLayoutItem::~CXFA_ViewLayoutItem() = default;
+CXFA_ViewLayoutItem::~CXFA_ViewLayoutItem() {
+  if (m_pFFPageView)
+    m_pFFPageView->SetLayoutItem(nullptr);
+}
 
 CXFA_LayoutProcessor* CXFA_ViewLayoutItem::GetLayout() const {
   return CXFA_LayoutProcessor::FromDocument(GetFormNode()->GetDocument());