[Merge M56] Add ObservedPtrs to PWL_CREATEPARAMchromium/2924

It's possible for both the provider and attached widget to be destroyed before
the PWL_CREATEPARAM objects which point to them. This causes issues when those
widgets access their attached widget or provider.

This CL wraps the pAttachedWidget and pProvider into ObservedPtrs so we will
know if the underlying pointer has gone away.

In order to merge I also had to add observed ptr copy and assign methods.

BUG=chromium:681351

Change-Id: Ic297753b5d020c5d9401cb3ff4d541b2498346e4
Reviewed-on: https://pdfium-review.googlesource.com/2351
Reviewed-by: Tom Sepez <tsepez@chromium.org>

7 files changed, 101 insertions, 48 deletions

diff --git a/BUILD.gn b/BUILD.gn
index f91ea0e96a..c43b074bf6 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -929,6 +929,7 @@ static_library("pdfwindow") {
     "fpdfsdk/pdfwindow/PWL_Utils.h",
     "fpdfsdk/pdfwindow/PWL_Wnd.cpp",
     "fpdfsdk/pdfwindow/PWL_Wnd.h",
+    "fpdfsdk/pdfwindow/cpwl_color.h",
   ]
   configs += [ ":pdfium_core_config" ]
   deps = [
diff --git a/core/fxcrt/cfx_observable.h b/core/fxcrt/cfx_observable.h
index dc869b1766..856ccc24b3 100644
--- a/core/fxcrt/cfx_observable.h
+++ b/core/fxcrt/cfx_observable.h
@@ -20,7 +20,7 @@ class CFX_Observable {
       if (m_pObservedPtr)
         m_pObservedPtr->AddObservedPtr(this);
     }
-    ObservedPtr(const ObservedPtr& that) = delete;
+    ObservedPtr(const ObservedPtr& that) : ObservedPtr(that.Get()) {}
     ~ObservedPtr() {
       if (m_pObservedPtr)
         m_pObservedPtr->RemoveObservedPtr(this);
@@ -36,7 +36,10 @@ class CFX_Observable {
       ASSERT(m_pObservedPtr);
       m_pObservedPtr = nullptr;
     }
-    ObservedPtr& operator=(const ObservedPtr& that) = delete;
+    ObservedPtr& operator=(const ObservedPtr& that) {
+      Reset(that.Get());
+      return *this;
+    }
     bool operator==(const ObservedPtr& that) const {
       return m_pObservedPtr == that.m_pObservedPtr;
     }
diff --git a/fpdfsdk/cpdfsdk_widget.h b/fpdfsdk/cpdfsdk_widget.h
index b630738995..69114d1295 100644
--- a/fpdfsdk/cpdfsdk_widget.h
+++ b/fpdfsdk/cpdfsdk_widget.h
@@ -16,7 +16,7 @@
 #include "core/fxcrt/fx_string.h"
 #include "fpdfsdk/cpdfsdk_baannot.h"
 #include "fpdfsdk/pdfsdk_fieldaction.h"
-#include "fpdfsdk/pdfwindow/PWL_Wnd.h"
+#include "fpdfsdk/pdfwindow/cpwl_color.h"
 
 class CFX_RenderDevice;
 class CPDF_Annot;
diff --git a/fpdfsdk/formfiller/cffl_formfiller.cpp b/fpdfsdk/formfiller/cffl_formfiller.cpp
index 7c1dec46b3..281057a6ac 100644
--- a/fpdfsdk/formfiller/cffl_formfiller.cpp
+++ b/fpdfsdk/formfiller/cffl_formfiller.cpp
@@ -289,7 +289,7 @@ PWL_CREATEPARAM CFFL_FormFiller::GetCreateParam() {
 
   PWL_CREATEPARAM cp;
   cp.pParentWnd = nullptr;
-  cp.pProvider = this;
+  cp.pProvider.Reset(this);
   cp.rcRectWnd = GetPDFWindowRect();
 
   uint32_t dwCreateFlags = PWS_BORDER | PWS_BACKGROUND | PWS_VISIBLE;
@@ -359,7 +359,7 @@ CPWL_Wnd* CFFL_FormFiller::GetPDFWindow(CPDFSDK_PageView* pPageView,
     }
   } else {
     PWL_CREATEPARAM cp = GetCreateParam();
-    cp.pAttachedWidget = m_pWidget;
+    cp.pAttachedWidget.Reset(m_pWidget);
 
     CFFL_PrivateData* pPrivateData = new CFFL_PrivateData;
     pPrivateData->pWidget = m_pWidget;
diff --git a/fpdfsdk/pdfwindow/PWL_Wnd.cpp b/fpdfsdk/pdfwindow/PWL_Wnd.cpp
index 78a4363aa5..d2e7437523 100644
--- a/fpdfsdk/pdfwindow/PWL_Wnd.cpp
+++ b/fpdfsdk/pdfwindow/PWL_Wnd.cpp
@@ -264,8 +264,8 @@ void CPWL_Wnd::InvalidateFocusHandler(IPWL_FocusHandler* handler) {
 }
 
 void CPWL_Wnd::InvalidateProvider(IPWL_Provider* provider) {
-  if (m_sPrivateParam.pProvider == provider)
-    m_sPrivateParam.pProvider = nullptr;
+  if (m_sPrivateParam.pProvider.Get() == provider)
+    m_sPrivateParam.pProvider.Reset();
 }
 
 void CPWL_Wnd::Destroy() {
@@ -289,7 +289,7 @@ void CPWL_Wnd::Destroy() {
 
   DestroyMsgControl();
 
-  FXSYS_memset(&m_sPrivateParam, 0, sizeof(PWL_CREATEPARAM));
+  m_sPrivateParam.Reset();
   m_aChildren.RemoveAll();
   m_pVScrollBar = nullptr;
 }
@@ -420,8 +420,10 @@ void CPWL_Wnd::InvalidateRect(CFX_FloatRect* pRect) {
     rcWin.bottom += PWL_INVALIDATE_INFLATE;
 
     if (CFX_SystemHandler* pSH = GetSystemHandler()) {
-      if (CPDFSDK_Widget* widget = m_sPrivateParam.pAttachedWidget)
+      if (CPDFSDK_Widget* widget = static_cast<CPDFSDK_Widget*>(
+              m_sPrivateParam.pAttachedWidget.Get())) {
         pSH->InvalidateRect(widget, rcWin);
+      }
     }
   }
 }
@@ -832,7 +834,7 @@ IPWL_FocusHandler* CPWL_Wnd::GetFocusHandler() const {
 }
 
 IPWL_Provider* CPWL_Wnd::GetProvider() const {
-  return m_sPrivateParam.pProvider;
+  return m_sPrivateParam.pProvider.Get();
 }
 
 IPVT_FontMap* CPWL_Wnd::GetFontMap() const {
@@ -880,9 +882,7 @@ CFX_Matrix CPWL_Wnd::GetWindowMatrix() const {
 
   if (IPWL_Provider* pProvider = GetProvider()) {
     mt.Concat(pProvider->GetWindowMatrix(GetAttachedData()));
-    return mt;
   }
-
   return mt;
 }
 
diff --git a/fpdfsdk/pdfwindow/PWL_Wnd.h b/fpdfsdk/pdfwindow/PWL_Wnd.h
index bba14f26bf..204fe32747 100644
--- a/fpdfsdk/pdfwindow/PWL_Wnd.h
+++ b/fpdfsdk/pdfwindow/PWL_Wnd.h
@@ -11,10 +11,12 @@
 #include <vector>
 
 #include "core/fpdfdoc/cpdf_formcontrol.h"
+#include "core/fxcrt/cfx_observable.h"
 #include "core/fxcrt/fx_basic.h"
 #include "fpdfsdk/cfx_systemhandler.h"
+#include "fpdfsdk/cpdfsdk_widget.h"
+#include "fpdfsdk/pdfwindow/cpwl_color.h"
 
-class CPDFSDK_Widget;
 class CPWL_MsgControl;
 class CPWL_ScrollBar;
 class CPWL_Timer;
@@ -91,42 +93,17 @@ struct CPWL_Dash {
   CPWL_Dash(int32_t dash, int32_t gap, int32_t phase)
       : nDash(dash), nGap(gap), nPhase(phase) {}
 
+  void Reset() {
+    nDash = 0;
+    nGap = 0;
+    nPhase = 0;
+  }
+
   int32_t nDash;
   int32_t nGap;
   int32_t nPhase;
 };
 
-struct CPWL_Color {
-  CPWL_Color(int32_t type = COLORTYPE_TRANSPARENT,
-             FX_FLOAT color1 = 0.0f,
-             FX_FLOAT color2 = 0.0f,
-             FX_FLOAT color3 = 0.0f,
-             FX_FLOAT color4 = 0.0f)
-      : nColorType(type),
-        fColor1(color1),
-        fColor2(color2),
-        fColor3(color3),
-        fColor4(color4) {}
-
-  CPWL_Color(int32_t r, int32_t g, int32_t b)
-      : nColorType(COLORTYPE_RGB),
-        fColor1(r / 255.0f),
-        fColor2(g / 255.0f),
-        fColor3(b / 255.0f),
-        fColor4(0) {}
-
-  void ConvertColorType(int32_t other_nColorType);
-
-  /*
-  COLORTYPE_TRANSPARENT
-  COLORTYPE_RGB
-  COLORTYPE_CMYK
-  COLORTYPE_GRAY
-  */
-  int32_t nColorType;
-  FX_FLOAT fColor1, fColor2, fColor3, fColor4;
-};
-
 inline bool operator==(const CPWL_Color& c1, const CPWL_Color& c2) {
   return c1.nColorType == c2.nColorType && c1.fColor1 - c2.fColor1 < 0.0001 &&
          c1.fColor1 - c2.fColor1 > -0.0001 &&
@@ -161,7 +138,7 @@ inline bool operator!=(const CPWL_Color& c1, const CPWL_Color& c2) {
 #define PWL_CBBUTTON_TRIANGLE_HALFLEN 3.0f
 #define PWL_INVALIDATE_INFLATE 2
 
-class IPWL_Provider {
+class IPWL_Provider : public CFX_Observable<IPWL_Provider> {
  public:
   virtual ~IPWL_Provider() {}
 
@@ -191,14 +168,38 @@ struct PWL_CREATEPARAM {
   PWL_CREATEPARAM();
   PWL_CREATEPARAM(const PWL_CREATEPARAM& other);
 
+  void Reset() {
+    rcRectWnd.Reset();
+    pSystemHandler = nullptr;
+    pFontMap = nullptr;
+    pProvider.Reset();
+    pFocusHandler = nullptr;
+    dwFlags = 0;
+    sBackgroundColor.Reset();
+    pAttachedWidget.Reset();
+    nBorderStyle = BorderStyle::SOLID;
+    dwBorderWidth = 0;
+    sBorderColor.Reset();
+    sTextColor.Reset();
+    sTextStrokeColor.Reset();
+    nTransparency = 0;
+    fFontSize = 0.0f;
+    sDash.Reset();
+    pAttachedData = nullptr;
+    pParentWnd = nullptr;
+    pMsgControl = nullptr;
+    eCursorType = 0;
+    mtChild.SetIdentity();
+  }
+
   CFX_FloatRect rcRectWnd;            // required
   CFX_SystemHandler* pSystemHandler;  // required
-  IPVT_FontMap* pFontMap;             // required for text window
-  IPWL_Provider* pProvider;           // required for self coordinate
+  IPVT_FontMap* pFontMap;             // required
+  IPWL_Provider::ObservedPtr pProvider;  // required
   IPWL_FocusHandler* pFocusHandler;   // optional
   uint32_t dwFlags;                   // optional
   CPWL_Color sBackgroundColor;        // optional
-  CPDFSDK_Widget* pAttachedWidget;    // required for no-reader framework
+  CPDFSDK_Widget::ObservedPtr pAttachedWidget;  // required
   BorderStyle nBorderStyle;           // optional
   int32_t dwBorderWidth;              // optional
   CPWL_Color sBorderColor;            // optional
diff --git a/fpdfsdk/pdfwindow/cpwl_color.h b/fpdfsdk/pdfwindow/cpwl_color.h
new file mode 100644
index 0000000000..c1f9e6ea97
--- /dev/null
+++ b/fpdfsdk/pdfwindow/cpwl_color.h
@@ -0,0 +1,48 @@
+// Copyright 2017 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
+
+#ifndef FPDFSDK_PDFWINDOW_CPWL_COLOR_H_
+#define FPDFSDK_PDFWINDOW_CPWL_COLOR_H_
+
+#include "core/fpdfdoc/cpdf_formcontrol.h"
+
+struct CPWL_Color {
+  CPWL_Color(int32_t type = COLORTYPE_TRANSPARENT,
+             FX_FLOAT color1 = 0.0f,
+             FX_FLOAT color2 = 0.0f,
+             FX_FLOAT color3 = 0.0f,
+             FX_FLOAT color4 = 0.0f)
+      : nColorType(type),
+        fColor1(color1),
+        fColor2(color2),
+        fColor3(color3),
+        fColor4(color4) {}
+
+  CPWL_Color(int32_t r, int32_t g, int32_t b)
+      : nColorType(COLORTYPE_RGB),
+        fColor1(r / 255.0f),
+        fColor2(g / 255.0f),
+        fColor3(b / 255.0f),
+        fColor4(0) {}
+
+  void ConvertColorType(int32_t other_nColorType);
+
+  void Reset() {
+    nColorType = COLORTYPE_TRANSPARENT;
+    fColor1 = 0.0f;
+    fColor2 = 0.0f;
+    fColor3 = 0.0f;
+    fColor4 = 0.0f;
+  }
+
+  int32_t nColorType;
+  FX_FLOAT fColor1;
+  FX_FLOAT fColor2;
+  FX_FLOAT fColor3;
+  FX_FLOAT fColor4;
+};
+
+#endif  // FPDFSDK_PDFWINDOW_CPWL_COLOR_H_