commit fb0203df7e33cfc29e7b61c483d7eca283483eb2
author Tom Sepez <tsepez@chromium.org> Wed Jan 08 20:49:21 2020 +0000
committer Chromium commit bot <commit-bot@chromium.org> Wed Jan 08 20:49:21 2020 +0000
tree 2d069f050be41bef2132332ce17f427d3ec9f75c
parent a11520ea073cb8d1f15f2a15f6843137ab8cbcd8

Clean up stale pointer in CXFA_ViewLayoutProcessor::MergePageSetContents()

Avoids an UnownedPtr<> warning when the node is finally cleaned up.

Bug: chromium:1038489
Change-Id: If426232d69d215aea9cd3dca90628928620e1301
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/64553
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp

diff --git a/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp b/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp
index 485ca64..f6bce36 100644
--- a/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp
+++ b/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp
@@ -1686,8 +1686,13 @@
       switch (pNode->GetElementType()) {
         case XFA_Element::PageSet: {
           CXFA_Node* pParentNode = pViewItem->GetParent()->GetFormNode();
-          pViewItem->SetFormNode(XFA_NodeMerge_CloneOrMergeContainer(
-              pDocument, pParentNode, pViewItem->GetFormNode(), true, nullptr));
+          CXFA_Node* pOldNode = pViewItem->GetFormNode();
+          CXFA_Node* pNewNode = XFA_NodeMerge_CloneOrMergeContainer(
+              pDocument, pParentNode, pOldNode, true, nullptr);
+          if (pOldNode != pNewNode) {
+            pOldNode->JSObject()->SetLayoutItem(nullptr);
+            pViewItem->SetFormNode(pNewNode);
+          }
           break;
         }
         case XFA_Element::PageArea: {
@@ -1733,10 +1738,15 @@
             }
             pViewItem->m_pOldSubform = pNewSubform;
           }
-          pViewItem->SetFormNode(pDocument->DataMerge_CopyContainer(
-              pViewItem->GetFormNode(), pParentNode,
+          CXFA_Node* pOldNode = pViewItem->GetFormNode();
+          CXFA_Node* pNewNode = pDocument->DataMerge_CopyContainer(
+              pOldNode, pParentNode,
               ToNode(pDocument->GetXFAObject(XFA_HASHCODE_Record)), true, true,
-              true));
+              true);
+          if (pOldNode != pNewNode) {
+            pOldNode->JSObject()->SetLayoutItem(nullptr);
+            pViewItem->SetFormNode(pNewNode);
+          }
           break;
         }
         case XFA_Element::ContentArea: {