Ensure CFWL_Widgets are not locked during destruction.

This is a strong signal that there is active code below us on
the stack that requires the widget to persist, yet through a twisty
series of callbacks we may reach this spot. Ideally, we'd notice
this earlier and unwind cleanly, but for now it is likely that the
only documents that would reach this case are trying to muck with us,
so aborting may be appropriate.

Bug: chromium:1032422
Change-Id: I78e242cbc157c38666ffb1f248edcde2d79dbca3
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/63751
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/xfa/fwl/cfwl_widget.cpp b/xfa/fwl/cfwl_widget.cpp
index a252cd2..39b706b 100644
--- a/xfa/fwl/cfwl_widget.cpp
+++ b/xfa/fwl/cfwl_widget.cpp
@@ -45,6 +45,7 @@
 }
 
 CFWL_Widget::~CFWL_Widget() {
+  CHECK(!IsLocked());  // Prefer hard stop to UaF.
   NotifyDriver();
   m_pWidgetMgr->RemoveWidget(this);
 }