commit dd97e79717c83fdd68d6fb8134348060f2884b40
author huyna <huyna89@gmail.com> Thu Aug 22 18:22:33 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Thu Aug 22 18:22:33 2019 +0000
tree c1f85d6b2bfc2623c81725f70ad7b858299588dd
parent 88c370baef61ca4904b34e81d8b52f2ee2fc1521

Observe CXFA_FFWidget across a function SetFocusWidget().

CXFA_FFWidget object is destroyed by JS code of field's exit event
triggered by calling SetFocusWidget().
Use ObservedPtr to catch this destruction.

Bug: chromium:993553
Change-Id: I694d63bb62cd01e4a9a038afdcd009425b0284b5
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/59410
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

fxjs/xfa/cjx_hostpseudomodel.cpp

diff --git a/fxjs/xfa/cjx_hostpseudomodel.cpp b/fxjs/xfa/cjx_hostpseudomodel.cpp
index 2437a30..0cfffa6 100644
--- a/fxjs/xfa/cjx_hostpseudomodel.cpp
+++ b/fxjs/xfa/cjx_hostpseudomodel.cpp
@@ -310,8 +310,13 @@
   if (!hWidget)
     return CJS_Result::Success();
 
+  // SetFocusWidget() may destroy |hWidget| object by JS callback.
+  ObservedPtr<CXFA_FFWidget> pObservedWidget(hWidget);
   CXFA_FFDoc* hDoc = pNotify->GetHDOC();
   hDoc->GetDocEnvironment()->SetFocusWidget(hDoc, hWidget);
+  if (!pObservedWidget)
+    return CJS_Result::Success();
+
   pNotify->OpenDropDownList(hWidget);
   return CJS_Result::Success();
 }