Mass conversion of all const-lifetime class members

Sed + minimal conversions to compile, including moving some
constructors into the .cpp file. Any that caused ASAN issues
during the tests were omitted rather than trying to resolve
the underlying issue.

Change-Id: I00a421f33b253eb4071ffd9af3f2922c7443b335
Reviewed-on: https://pdfium-review.googlesource.com/5891
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

100 files changed, 286 insertions, 210 deletions

diff --git a/core/fpdfapi/font/font_int.h b/core/fpdfapi/font/font_int.h
index f434f2b41d..ebd08e258a 100644
--- a/core/fpdfapi/font/font_int.h
+++ b/core/fpdfapi/font/font_int.h
@@ -150,7 +150,7 @@ class CPDF_CMapParser {
                                 const CFX_ByteStringC& first,
                                 const CFX_ByteStringC& second);
 
-  CPDF_CMap* const m_pCMap;
+  CFX_UnownedPtr<CPDF_CMap> const m_pCMap;
   int m_Status;
   int m_CodeSeq;
   uint32_t m_CodePoints[4];
diff --git a/core/fpdfapi/page/cpdf_iccprofile.h b/core/fpdfapi/page/cpdf_iccprofile.h
index 05ac9bf1ba..a0cf744b9c 100644
--- a/core/fpdfapi/page/cpdf_iccprofile.h
+++ b/core/fpdfapi/page/cpdf_iccprofile.h
@@ -8,6 +8,7 @@
 #define CORE_FPDFAPI_PAGE_CPDF_ICCPROFILE_H_
 
 #include "core/fxcrt/cfx_retain_ptr.h"
+#include "core/fxcrt/cfx_unowned_ptr.h"
 
 class CPDF_Stream;
 
@@ -16,7 +17,7 @@ class CPDF_IccProfile : public CFX_Retainable {
   template <typename T, typename... Args>
   friend CFX_RetainPtr<T> pdfium::MakeRetain(Args&&... args);
 
-  CPDF_Stream* GetStream() const { return m_pStream; }
+  CPDF_Stream* GetStream() const { return m_pStream.Get(); }
   bool IsValid() const { return IsSRGB() || IsSupported(); }
   bool IsSRGB() const { return m_bsRGB; }
   bool IsSupported() const { return !!m_pTransform; }
@@ -28,7 +29,7 @@ class CPDF_IccProfile : public CFX_Retainable {
   ~CPDF_IccProfile() override;
 
   const bool m_bsRGB;
-  CPDF_Stream* const m_pStream;
+  CFX_UnownedPtr<CPDF_Stream> const m_pStream;
   void* m_pTransform = nullptr;
   uint32_t m_nSrcComponents = 0;
 };
diff --git a/core/fpdfapi/page/cpdf_meshstream.h b/core/fpdfapi/page/cpdf_meshstream.h
index e02c3bb4e8..af636a964d 100644
--- a/core/fpdfapi/page/cpdf_meshstream.h
+++ b/core/fpdfapi/page/cpdf_meshstream.h
@@ -67,8 +67,8 @@ class CPDF_MeshStream {
 
   const ShadingType m_type;
   const std::vector<std::unique_ptr<CPDF_Function>>& m_funcs;
-  CPDF_Stream* const m_pShadingStream;
-  CPDF_ColorSpace* const m_pCS;
+  CFX_UnownedPtr<CPDF_Stream> const m_pShadingStream;
+  CFX_UnownedPtr<CPDF_ColorSpace> const m_pCS;
   uint32_t m_nCoordBits;
   uint32_t m_nComponentBits;
   uint32_t m_nFlagBits;
diff --git a/core/fpdfapi/parser/cpdf_stream_acc.h b/core/fpdfapi/parser/cpdf_stream_acc.h
index 5bfdd186c4..bc03cb097b 100644
--- a/core/fpdfapi/parser/cpdf_stream_acc.h
+++ b/core/fpdfapi/parser/cpdf_stream_acc.h
@@ -27,7 +27,7 @@ class CPDF_StreamAcc : public CFX_Retainable {
                    uint32_t estimated_size = 0,
                    bool bImageAcc = false);
 
-  const CPDF_Stream* GetStream() const { return m_pStream; }
+  const CPDF_Stream* GetStream() const { return m_pStream.Get(); }
   CPDF_Dictionary* GetDict() const {
     return m_pStream ? m_pStream->GetDict() : nullptr;
   }
@@ -47,7 +47,7 @@ class CPDF_StreamAcc : public CFX_Retainable {
   bool m_bNewBuf;
   CFX_ByteString m_ImageDecoder;
   CPDF_Dictionary* m_pImageParam;
-  const CPDF_Stream* const m_pStream;
+  CFX_UnownedPtr<const CPDF_Stream> const m_pStream;
   uint8_t* m_pSrcData;
 };
 
diff --git a/core/fpdfapi/render/cpdf_pagerendercache.h b/core/fpdfapi/render/cpdf_pagerendercache.h
index 626e24bd2e..a874212392 100644
--- a/core/fpdfapi/render/cpdf_pagerendercache.h
+++ b/core/fpdfapi/render/cpdf_pagerendercache.h
@@ -10,6 +10,7 @@
 #include <map>
 
 #include "core/fxcrt/cfx_retain_ptr.h"
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_system.h"
 
 class CFX_DIBitmap;
@@ -29,7 +30,7 @@ class CPDF_PageRenderCache {
   uint32_t GetTimeCount() const { return m_nTimeCount; }
   void ResetBitmap(const CFX_RetainPtr<CPDF_Image>& pImage,
                    const CFX_RetainPtr<CFX_DIBitmap>& pBitmap);
-  CPDF_Page* GetPage() const { return m_pPage; }
+  CPDF_Page* GetPage() const { return m_pPage.Get(); }
   CPDF_ImageCacheEntry* GetCurImageCacheEntry() const {
     return m_pCurImageCacheEntry;
   }
@@ -45,7 +46,7 @@ class CPDF_PageRenderCache {
  private:
   void ClearImageCacheEntry(CPDF_Stream* pStream);
 
-  CPDF_Page* const m_pPage;
+  CFX_UnownedPtr<CPDF_Page> const m_pPage;
   CPDF_ImageCacheEntry* m_pCurImageCacheEntry;
   std::map<CPDF_Stream*, CPDF_ImageCacheEntry*> m_ImageCache;
   uint32_t m_nTimeCount;
diff --git a/core/fpdfapi/render/cpdf_progressiverenderer.cpp b/core/fpdfapi/render/cpdf_progressiverenderer.cpp
index c3cef1fc77..4505db6874 100644
--- a/core/fpdfapi/render/cpdf_progressiverenderer.cpp
+++ b/core/fpdfapi/render/cpdf_progressiverenderer.cpp
@@ -53,8 +53,9 @@ void CPDF_ProgressiveRenderer::Continue(IFX_Pause* pPause) {
           m_pCurrentLayer->m_pObjectHolder->GetPageObjectList()->end();
       m_pRenderStatus = pdfium::MakeUnique<CPDF_RenderStatus>();
       m_pRenderStatus->Initialize(
-          m_pContext, m_pDevice, nullptr, nullptr, nullptr, nullptr, m_pOptions,
-          m_pCurrentLayer->m_pObjectHolder->m_Transparency, false, nullptr);
+          m_pContext.Get(), m_pDevice.Get(), nullptr, nullptr, nullptr, nullptr,
+          m_pOptions, m_pCurrentLayer->m_pObjectHolder->m_Transparency, false,
+          nullptr);
       m_pDevice->SaveState();
       m_ClipRect = CFX_FloatRect(m_pDevice->GetClipBox());
       CFX_Matrix device2object;
diff --git a/core/fpdfapi/render/cpdf_progressiverenderer.h b/core/fpdfapi/render/cpdf_progressiverenderer.h
index f0b1579601..cadbd2d089 100644
--- a/core/fpdfapi/render/cpdf_progressiverenderer.h
+++ b/core/fpdfapi/render/cpdf_progressiverenderer.h
@@ -47,8 +47,8 @@ class CPDF_ProgressiveRenderer {
   static const int kStepLimit = 100;
 
   Status m_Status;
-  CPDF_RenderContext* const m_pContext;
-  CFX_RenderDevice* const m_pDevice;
+  CFX_UnownedPtr<CPDF_RenderContext> const m_pContext;
+  CFX_UnownedPtr<CFX_RenderDevice> const m_pDevice;
   const CPDF_RenderOptions* const m_pOptions;
   std::unique_ptr<CPDF_RenderStatus> m_pRenderStatus;
   CFX_FloatRect m_ClipRect;
diff --git a/core/fpdfapi/render/cpdf_renderstatus.cpp b/core/fpdfapi/render/cpdf_renderstatus.cpp
index 1d2218c166..7c17ff56b4 100644
--- a/core/fpdfapi/render/cpdf_renderstatus.cpp
+++ b/core/fpdfapi/render/cpdf_renderstatus.cpp
@@ -82,11 +82,11 @@ class CPDF_RefType3Cache {
 
   ~CPDF_RefType3Cache() {
     while (m_dwCount--)
-      ReleaseCachedType3(m_pType3Font);
+      ReleaseCachedType3(m_pType3Font.Get());
   }
 
   uint32_t m_dwCount;
-  CPDF_Type3Font* const m_pType3Font;
+  CFX_UnownedPtr<CPDF_Type3Font> const m_pType3Font;
 };
 
 uint32_t CountOutputs(
diff --git a/core/fpdfapi/render/cpdf_type3cache.h b/core/fpdfapi/render/cpdf_type3cache.h
index 3c7d95b8c0..36a1d6f98a 100644
--- a/core/fpdfapi/render/cpdf_type3cache.h
+++ b/core/fpdfapi/render/cpdf_type3cache.h
@@ -38,7 +38,7 @@ class CPDF_Type3Cache : public CFX_Retainable {
                                                float retinaScaleX,
                                                float retinaScaleY);
 
-  CPDF_Type3Font* const m_pFont;
+  CFX_UnownedPtr<CPDF_Type3Font> const m_pFont;
   std::map<CFX_ByteString, std::unique_ptr<CPDF_Type3Glyphs>> m_SizeMap;
 };
 
diff --git a/core/fpdfdoc/cpdf_aaction.cpp b/core/fpdfdoc/cpdf_aaction.cpp
index 7dc42828f4..033bf03a6a 100644
--- a/core/fpdfdoc/cpdf_aaction.cpp
+++ b/core/fpdfdoc/cpdf_aaction.cpp
@@ -14,6 +14,14 @@ const char* g_sAATypes[] = {"E",  "X",  "D",  "U",  "Fo", "Bl", "PO", "PC",
 
 }  // namespace
 
+CPDF_AAction::CPDF_AAction() {}
+
+CPDF_AAction::CPDF_AAction(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+
+CPDF_AAction::CPDF_AAction(const CPDF_AAction& that) = default;
+
+CPDF_AAction::~CPDF_AAction() {}
+
 bool CPDF_AAction::ActionExist(AActionType eType) const {
   return m_pDict && m_pDict->KeyExist(g_sAATypes[eType]);
 }
diff --git a/core/fpdfdoc/cpdf_aaction.h b/core/fpdfdoc/cpdf_aaction.h
index d615915ee3..b2b691fc26 100644
--- a/core/fpdfdoc/cpdf_aaction.h
+++ b/core/fpdfdoc/cpdf_aaction.h
@@ -37,15 +37,17 @@ class CPDF_AAction {
     DocumentPrinted
   };
 
-  CPDF_AAction() : m_pDict(nullptr) {}
-  explicit CPDF_AAction(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+  CPDF_AAction();
+  explicit CPDF_AAction(CPDF_Dictionary* pDict);
+  CPDF_AAction(const CPDF_AAction& that);
+  ~CPDF_AAction();
 
   bool ActionExist(AActionType eType) const;
   CPDF_Action GetAction(AActionType eType) const;
-  CPDF_Dictionary* GetDict() const { return m_pDict; }
+  CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
 
  private:
-  CPDF_Dictionary* const m_pDict;
+  CFX_UnownedPtr<CPDF_Dictionary> const m_pDict;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_AACTION_H_
diff --git a/core/fpdfdoc/cpdf_action.cpp b/core/fpdfdoc/cpdf_action.cpp
index f523f86b37..b40fdcd225 100644
--- a/core/fpdfdoc/cpdf_action.cpp
+++ b/core/fpdfdoc/cpdf_action.cpp
@@ -21,6 +21,14 @@ const char* const g_sATypes[] = {
 
 }  // namespace
 
+CPDF_Action::CPDF_Action() {}
+
+CPDF_Action::CPDF_Action(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+
+CPDF_Action::CPDF_Action(const CPDF_Action& that) = default;
+
+CPDF_Action::~CPDF_Action() {}
+
 CPDF_Dest CPDF_Action::GetDest(CPDF_Document* pDoc) const {
   if (!m_pDict)
     return CPDF_Dest();
diff --git a/core/fpdfdoc/cpdf_action.h b/core/fpdfdoc/cpdf_action.h
index 426edb12e9..bd1ce58ec6 100644
--- a/core/fpdfdoc/cpdf_action.h
+++ b/core/fpdfdoc/cpdf_action.h
@@ -37,10 +37,12 @@ class CPDF_Action {
     GoTo3DView
   };
 
-  CPDF_Action() : m_pDict(nullptr) {}
-  explicit CPDF_Action(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+  CPDF_Action();
+  explicit CPDF_Action(CPDF_Dictionary* pDict);
+  CPDF_Action(const CPDF_Action& that);
+  ~CPDF_Action();
 
-  CPDF_Dictionary* GetDict() const { return m_pDict; }
+  CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
   ActionType GetType() const;
   CPDF_Dest GetDest(CPDF_Document* pDoc) const;
   CFX_WideString GetFilePath() const;
@@ -53,7 +55,7 @@ class CPDF_Action {
   CPDF_Action GetSubAction(size_t iIndex) const;
 
  private:
-  CPDF_Dictionary* const m_pDict;
+  CFX_UnownedPtr<CPDF_Dictionary> const m_pDict;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_ACTION_H_
diff --git a/core/fpdfdoc/cpdf_actionfields.cpp b/core/fpdfdoc/cpdf_actionfields.cpp
index 35ec92c1b8..f3c3f5ed25 100644
--- a/core/fpdfdoc/cpdf_actionfields.cpp
+++ b/core/fpdfdoc/cpdf_actionfields.cpp
@@ -10,6 +10,11 @@
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfdoc/cpdf_action.h"
 
+CPDF_ActionFields::CPDF_ActionFields(const CPDF_Action* pAction)
+    : m_pAction(pAction) {}
+
+CPDF_ActionFields::~CPDF_ActionFields() {}
+
 size_t CPDF_ActionFields::GetFieldsCount() const {
   if (!m_pAction)
     return 0;
diff --git a/core/fpdfdoc/cpdf_actionfields.h b/core/fpdfdoc/cpdf_actionfields.h
index 9e0664cadb..71b42475a7 100644
--- a/core/fpdfdoc/cpdf_actionfields.h
+++ b/core/fpdfdoc/cpdf_actionfields.h
@@ -11,19 +11,22 @@
 
 #include <vector>
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
+
 class CPDF_Action;
 class CPDF_Object;
 
 class CPDF_ActionFields {
  public:
-  explicit CPDF_ActionFields(const CPDF_Action* pAction) : m_pAction(pAction) {}
+  explicit CPDF_ActionFields(const CPDF_Action* pAction);
+  ~CPDF_ActionFields();
 
   size_t GetFieldsCount() const;
   std::vector<CPDF_Object*> GetAllFields() const;
   CPDF_Object* GetField(size_t iIndex) const;
 
  private:
-  const CPDF_Action* const m_pAction;
+  CFX_UnownedPtr<const CPDF_Action> const m_pAction;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_ACTIONFIELDS_H_
diff --git a/core/fpdfdoc/cpdf_annot.cpp b/core/fpdfdoc/cpdf_annot.cpp
index 146c863cf3..eab6cd0145 100644
--- a/core/fpdfdoc/cpdf_annot.cpp
+++ b/core/fpdfdoc/cpdf_annot.cpp
@@ -90,23 +90,23 @@ void CPDF_Annot::GenerateAPIfNeeded() {
   CPDF_Dictionary* pDict = m_pAnnotDict.Get();
   bool result = false;
   if (m_nSubtype == CPDF_Annot::Subtype::CIRCLE)
-    result = CPVT_GenerateAP::GenerateCircleAP(m_pDocument, pDict);
+    result = CPVT_GenerateAP::GenerateCircleAP(m_pDocument.Get(), pDict);
   else if (m_nSubtype == CPDF_Annot::Subtype::HIGHLIGHT)
-    result = CPVT_GenerateAP::GenerateHighlightAP(m_pDocument, pDict);
+    result = CPVT_GenerateAP::GenerateHighlightAP(m_pDocument.Get(), pDict);
   else if (m_nSubtype == CPDF_Annot::Subtype::INK)
-    result = CPVT_GenerateAP::GenerateInkAP(m_pDocument, pDict);
+    result = CPVT_GenerateAP::GenerateInkAP(m_pDocument.Get(), pDict);
   else if (m_nSubtype == CPDF_Annot::Subtype::POPUP)
-    result = CPVT_GenerateAP::GeneratePopupAP(m_pDocument, pDict);
+    result = CPVT_GenerateAP::GeneratePopupAP(m_pDocument.Get(), pDict);
   else if (m_nSubtype == CPDF_Annot::Subtype::SQUARE)
-    result = CPVT_GenerateAP::GenerateSquareAP(m_pDocument, pDict);
+    result = CPVT_GenerateAP::GenerateSquareAP(m_pDocument.Get(), pDict);
   else if (m_nSubtype == CPDF_Annot::Subtype::SQUIGGLY)
-    result = CPVT_GenerateAP::GenerateSquigglyAP(m_pDocument, pDict);
+    result = CPVT_GenerateAP::GenerateSquigglyAP(m_pDocument.Get(), pDict);
   else if (m_nSubtype == CPDF_Annot::Subtype::STRIKEOUT)
-    result = CPVT_GenerateAP::GenerateStrikeOutAP(m_pDocument, pDict);
+    result = CPVT_GenerateAP::GenerateStrikeOutAP(m_pDocument.Get(), pDict);
   else if (m_nSubtype == CPDF_Annot::Subtype::TEXT)
-    result = CPVT_GenerateAP::GenerateTextAP(m_pDocument, pDict);
+    result = CPVT_GenerateAP::GenerateTextAP(m_pDocument.Get(), pDict);
   else if (m_nSubtype == CPDF_Annot::Subtype::UNDERLINE)
-    result = CPVT_GenerateAP::GenerateUnderlineAP(m_pDocument, pDict);
+    result = CPVT_GenerateAP::GenerateUnderlineAP(m_pDocument.Get(), pDict);
 
   if (result) {
     m_pAnnotDict->SetNewFor<CPDF_Boolean>(kPDFiumKey_HasGeneratedAP, result);
@@ -205,7 +205,7 @@ CPDF_Form* CPDF_Annot::GetAPForm(const CPDF_Page* pPage, AppearanceMode mode) {
     return it->second.get();
 
   auto pNewForm = pdfium::MakeUnique<CPDF_Form>(
-      m_pDocument, pPage->m_pResources.Get(), pStream);
+      m_pDocument.Get(), pPage->m_pResources.Get(), pStream);
   pNewForm->ParseContent(nullptr, nullptr, nullptr);
 
   CPDF_Form* pResult = pNewForm.get();
diff --git a/core/fpdfdoc/cpdf_annot.h b/core/fpdfdoc/cpdf_annot.h
index 188106acdf..85a205345e 100644
--- a/core/fpdfdoc/cpdf_annot.h
+++ b/core/fpdfdoc/cpdf_annot.h
@@ -82,7 +82,7 @@ class CPDF_Annot {
   CPDF_Annot::Subtype GetSubtype() const;
   uint32_t GetFlags() const;
   CFX_FloatRect GetRect() const;
-  CPDF_Document* GetDocument() const { return m_pDocument; }
+  CPDF_Document* GetDocument() const { return m_pDocument.Get(); }
   CPDF_Dictionary* GetAnnotDict() const { return m_pAnnotDict.Get(); }
 
   bool DrawAppearance(CPDF_Page* pPage,
@@ -112,7 +112,7 @@ class CPDF_Annot {
   CFX_FloatRect RectForDrawing() const;
 
   CFX_MaybeOwned<CPDF_Dictionary> m_pAnnotDict;
-  CPDF_Document* const m_pDocument;
+  CFX_UnownedPtr<CPDF_Document> const m_pDocument;
   CPDF_Annot::Subtype m_nSubtype;
   std::map<CPDF_Stream*, std::unique_ptr<CPDF_Form>> m_APMap;
   // |m_bOpenState| is only set for popup annotations.
diff --git a/core/fpdfdoc/cpdf_apsettings.cpp b/core/fpdfdoc/cpdf_apsettings.cpp
index 4c44f5a13e..ee205e01dc 100644
--- a/core/fpdfdoc/cpdf_apsettings.cpp
+++ b/core/fpdfdoc/cpdf_apsettings.cpp
@@ -14,6 +14,10 @@
 
 CPDF_ApSettings::CPDF_ApSettings(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
 
+CPDF_ApSettings::CPDF_ApSettings(const CPDF_ApSettings& that) = default;
+
+CPDF_ApSettings::~CPDF_ApSettings() {}
+
 bool CPDF_ApSettings::HasMKEntry(const CFX_ByteString& csEntry) const {
   return m_pDict && m_pDict->KeyExist(csEntry);
 }
diff --git a/core/fpdfdoc/cpdf_apsettings.h b/core/fpdfdoc/cpdf_apsettings.h
index ba0b05bd2b..2f8f9e49d9 100644
--- a/core/fpdfdoc/cpdf_apsettings.h
+++ b/core/fpdfdoc/cpdf_apsettings.h
@@ -8,6 +8,7 @@
 #define CORE_FPDFDOC_CPDF_APSETTINGS_H_
 
 #include "core/fpdfdoc/cpdf_iconfit.h"
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
 #include "core/fxge/fx_dib.h"
@@ -19,6 +20,8 @@ class CPDF_Stream;
 class CPDF_ApSettings {
  public:
   explicit CPDF_ApSettings(CPDF_Dictionary* pDict);
+  CPDF_ApSettings(const CPDF_ApSettings& that);
+  ~CPDF_ApSettings();
 
   bool HasMKEntry(const CFX_ByteString& csEntry) const;
   int GetRotation() const;
@@ -68,7 +71,7 @@ class CPDF_ApSettings {
   CFX_WideString GetCaption(const CFX_ByteString& csEntry) const;
   CPDF_Stream* GetIcon(const CFX_ByteString& csEntry) const;
 
-  CPDF_Dictionary* const m_pDict;
+  CFX_UnownedPtr<CPDF_Dictionary> const m_pDict;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_APSETTINGS_H_
diff --git a/core/fpdfdoc/cpdf_formcontrol.cpp b/core/fpdfdoc/cpdf_formcontrol.cpp
index d9740f7c99..54524a64e2 100644
--- a/core/fpdfdoc/cpdf_formcontrol.cpp
+++ b/core/fpdfdoc/cpdf_formcontrol.cpp
@@ -32,6 +32,8 @@ CPDF_FormControl::CPDF_FormControl(CPDF_FormField* pField,
       m_pWidgetDict(pWidgetDict),
       m_pForm(m_pField->GetForm()) {}
 
+CPDF_FormControl::~CPDF_FormControl() {}
+
 CFX_ByteString CPDF_FormControl::GetOnStateName() const {
   ASSERT(GetType() == CPDF_FormField::CheckBox ||
          GetType() == CPDF_FormField::RadioButton);
@@ -167,7 +169,7 @@ void CPDF_FormControl::DrawControl(CFX_RenderDevice* pDevice,
   if (m_pWidgetDict->GetIntegerFor("F") & ANNOTFLAG_HIDDEN)
     return;
 
-  CPDF_Stream* pStream = FPDFDOC_GetAnnotAP(m_pWidgetDict, mode);
+  CPDF_Stream* pStream = FPDFDOC_GetAnnotAP(m_pWidgetDict.Get(), mode);
   if (!pStream)
     return;
 
@@ -178,7 +180,7 @@ void CPDF_FormControl::DrawControl(CFX_RenderDevice* pDevice,
   CFX_Matrix matrix;
   matrix.MatchRect(arect, form_bbox);
   matrix.Concat(*pMatrix);
-  CPDF_Form form(m_pField->GetForm()->m_pDocument,
+  CPDF_Form form(m_pField->GetForm()->m_pDocument.Get(),
                  m_pField->GetForm()->m_pFormDict->GetDictFor("DR"), pStream);
   form.ParseContent(nullptr, nullptr, nullptr);
   CPDF_RenderContext context(pPage);
@@ -286,7 +288,7 @@ CPDF_Font* CPDF_FormControl::GetDefaultControlFont() {
   if (csFontNameTag.IsEmpty())
     return nullptr;
 
-  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pWidgetDict, "DR");
+  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pWidgetDict.Get(), "DR");
   if (CPDF_Dictionary* pDict = ToDictionary(pObj)) {
     CPDF_Dictionary* pFonts = pDict->GetDictFor("Font");
     if (pFonts) {
diff --git a/core/fpdfdoc/cpdf_formcontrol.h b/core/fpdfdoc/cpdf_formcontrol.h
index 154d592f32..eb63b5b6f0 100644
--- a/core/fpdfdoc/cpdf_formcontrol.h
+++ b/core/fpdfdoc/cpdf_formcontrol.h
@@ -47,11 +47,12 @@ class CPDF_FormControl {
   enum HighlightingMode { None = 0, Invert, Outline, Push, Toggle };
 
   CPDF_FormControl(CPDF_FormField* pField, CPDF_Dictionary* pWidgetDict);
+  ~CPDF_FormControl();
 
   CPDF_FormField::Type GetType() const { return m_pField->GetType(); }
-  const CPDF_InterForm* GetInterForm() const { return m_pForm; }
+  const CPDF_InterForm* GetInterForm() const { return m_pForm.Get(); }
   CPDF_FormField* GetField() const { return m_pField; }
-  CPDF_Dictionary* GetWidget() const { return m_pWidgetDict; }
+  CPDF_Dictionary* GetWidget() const { return m_pWidgetDict.Get(); }
   CFX_FloatRect GetRect() const { return m_pWidgetDict->GetRectFor("Rect"); }
 
   void DrawControl(CFX_RenderDevice* pDevice,
@@ -127,8 +128,8 @@ class CPDF_FormControl {
   CPDF_ApSettings GetMK() const;
 
   CPDF_FormField* const m_pField;
-  CPDF_Dictionary* const m_pWidgetDict;
-  const CPDF_InterForm* const m_pForm;
+  CFX_UnownedPtr<CPDF_Dictionary> const m_pWidgetDict;
+  CFX_UnownedPtr<const CPDF_InterForm> const m_pForm;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_FORMCONTROL_H_
diff --git a/core/fpdfdoc/cpdf_formfield.cpp b/core/fpdfdoc/cpdf_formfield.cpp
index 7a48826cbd..97ea052436 100644
--- a/core/fpdfdoc/cpdf_formfield.cpp
+++ b/core/fpdfdoc/cpdf_formfield.cpp
@@ -408,7 +408,7 @@ int CPDF_FormField::GetMaxLen() const {
   for (auto& pControl : m_ControlList) {
     if (!pControl)
       continue;
-    CPDF_Dictionary* pWidgetDict = pControl->m_pWidgetDict;
+    CPDF_Dictionary* pWidgetDict = pControl->m_pWidgetDict.Get();
     if (pWidgetDict->KeyExist("MaxLen"))
       return pWidgetDict->GetIntegerFor("MaxLen");
   }
diff --git a/core/fpdfdoc/cpdf_iconfit.cpp b/core/fpdfdoc/cpdf_iconfit.cpp
index 0f05d7de35..a28f3bc430 100644
--- a/core/fpdfdoc/cpdf_iconfit.cpp
+++ b/core/fpdfdoc/cpdf_iconfit.cpp
@@ -10,6 +10,12 @@
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fxcrt/fx_string.h"
 
+CPDF_IconFit::CPDF_IconFit(const CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+
+CPDF_IconFit::CPDF_IconFit(const CPDF_IconFit& that) = default;
+
+CPDF_IconFit::~CPDF_IconFit() {}
+
 CPDF_IconFit::ScaleMethod CPDF_IconFit::GetScaleMethod() {
   if (!m_pDict)
     return Always;
diff --git a/core/fpdfdoc/cpdf_iconfit.h b/core/fpdfdoc/cpdf_iconfit.h
index 6e3b8cf50a..0fa8d37e24 100644
--- a/core/fpdfdoc/cpdf_iconfit.h
+++ b/core/fpdfdoc/cpdf_iconfit.h
@@ -7,6 +7,7 @@
 #ifndef CORE_FPDFDOC_CPDF_ICONFIT_H_
 #define CORE_FPDFDOC_CPDF_ICONFIT_H_
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_system.h"
 
 class CPDF_Dictionary;
@@ -15,16 +16,18 @@ class CPDF_IconFit {
  public:
   enum ScaleMethod { Always = 0, Bigger, Smaller, Never };
 
-  explicit CPDF_IconFit(const CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+  explicit CPDF_IconFit(const CPDF_Dictionary* pDict);
+  CPDF_IconFit(const CPDF_IconFit& that);
+  ~CPDF_IconFit();
 
   ScaleMethod GetScaleMethod();
   bool IsProportionalScale();
   void GetIconPosition(float& fLeft, float& fBottom);
   bool GetFittingBounds();
-  const CPDF_Dictionary* GetDict() const { return m_pDict; }
+  const CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
 
  private:
-  const CPDF_Dictionary* const m_pDict;
+  CFX_UnownedPtr<const CPDF_Dictionary> const m_pDict;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_ICONFIT_H_
diff --git a/core/fpdfdoc/cpdf_interform.cpp b/core/fpdfdoc/cpdf_interform.cpp
index 455158b74d..de99a5de0f 100644
--- a/core/fpdfdoc/cpdf_interform.cpp
+++ b/core/fpdfdoc/cpdf_interform.cpp
@@ -961,7 +961,7 @@ int CPDF_InterForm::FindFieldInCalculationOrder(const CPDF_FormField* pField) {
 }
 
 CPDF_Font* CPDF_InterForm::GetFormFont(CFX_ByteString csNameTag) const {
-  return GetFont(m_pFormDict, m_pDocument, csNameTag);
+  return GetFont(m_pFormDict, m_pDocument.Get(), csNameTag);
 }
 
 CPDF_DefaultAppearance CPDF_InterForm::GetDefaultAppearance() const {
diff --git a/core/fpdfdoc/cpdf_interform.h b/core/fpdfdoc/cpdf_interform.h
index 23530e57b2..0a9b3e0e4a 100644
--- a/core/fpdfdoc/cpdf_interform.h
+++ b/core/fpdfdoc/cpdf_interform.h
@@ -108,7 +108,7 @@ class CPDF_InterForm {
 
   static bool s_bUpdateAP;
 
-  CPDF_Document* const m_pDocument;
+  CFX_UnownedPtr<CPDF_Document> const m_pDocument;
   CPDF_Dictionary* m_pFormDict;
   std::map<const CPDF_Dictionary*, std::unique_ptr<CPDF_FormControl>>
       m_ControlMap;
diff --git a/core/fpdfdoc/cpdf_numbertree.cpp b/core/fpdfdoc/cpdf_numbertree.cpp
index 5f2bc06666..952fb4ef1d 100644
--- a/core/fpdfdoc/cpdf_numbertree.cpp
+++ b/core/fpdfdoc/cpdf_numbertree.cpp
@@ -47,6 +47,10 @@ CPDF_Object* SearchNumberNode(const CPDF_Dictionary* pNode, int num) {
 
 }  // namespace
 
+CPDF_NumberTree::CPDF_NumberTree(CPDF_Dictionary* pRoot) : m_pRoot(pRoot) {}
+
+CPDF_NumberTree::~CPDF_NumberTree() {}
+
 CPDF_Object* CPDF_NumberTree::LookupValue(int num) const {
-  return SearchNumberNode(m_pRoot, num);
+  return SearchNumberNode(m_pRoot.Get(), num);
 }
diff --git a/core/fpdfdoc/cpdf_numbertree.h b/core/fpdfdoc/cpdf_numbertree.h
index bfe44fddb9..843e186208 100644
--- a/core/fpdfdoc/cpdf_numbertree.h
+++ b/core/fpdfdoc/cpdf_numbertree.h
@@ -7,17 +7,20 @@
 #ifndef CORE_FPDFDOC_CPDF_NUMBERTREE_H_
 #define CORE_FPDFDOC_CPDF_NUMBERTREE_H_
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
+
 class CPDF_Dictionary;
 class CPDF_Object;
 
 class CPDF_NumberTree {
  public:
-  explicit CPDF_NumberTree(CPDF_Dictionary* pRoot) : m_pRoot(pRoot) {}
+  explicit CPDF_NumberTree(CPDF_Dictionary* pRoot);
+  ~CPDF_NumberTree();
 
   CPDF_Object* LookupValue(int num) const;
 
  protected:
-  CPDF_Dictionary* const m_pRoot;
+  CFX_UnownedPtr<CPDF_Dictionary> const m_pRoot;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_NUMBERTREE_H_
diff --git a/core/fpdfdoc/cpdf_occontext.cpp b/core/fpdfdoc/cpdf_occontext.cpp
index c4272f4897..66950c9406 100644
--- a/core/fpdfdoc/cpdf_occontext.cpp
+++ b/core/fpdfdoc/cpdf_occontext.cpp
@@ -101,7 +101,7 @@ CPDF_OCContext::~CPDF_OCContext() {}
 bool CPDF_OCContext::LoadOCGStateFromConfig(
     const CFX_ByteString& csConfig,
     const CPDF_Dictionary* pOCGDict) const {
-  CPDF_Dictionary* pConfig = GetConfig(m_pDocument, pOCGDict);
+  CPDF_Dictionary* pConfig = GetConfig(m_pDocument.Get(), pOCGDict);
   if (!pConfig)
     return true;
 
diff --git a/core/fpdfdoc/cpdf_occontext.h b/core/fpdfdoc/cpdf_occontext.h
index 753aa5c176..ea8eea2489 100644
--- a/core/fpdfdoc/cpdf_occontext.h
+++ b/core/fpdfdoc/cpdf_occontext.h
@@ -38,7 +38,7 @@ class CPDF_OCContext : public CFX_Retainable {
   bool GetOCGVE(CPDF_Array* pExpression, int nLevel);
   bool LoadOCMDState(const CPDF_Dictionary* pOCMDDict);
 
-  CPDF_Document* const m_pDocument;
+  CFX_UnownedPtr<CPDF_Document> const m_pDocument;
   const UsageType m_eUsageType;
   std::map<const CPDF_Dictionary*, bool> m_OCGStates;
 };
diff --git a/core/fpdfdoc/cpdf_pagelabel.cpp b/core/fpdfdoc/cpdf_pagelabel.cpp
index 4200a28f64..3892abad5e 100644
--- a/core/fpdfdoc/cpdf_pagelabel.cpp
+++ b/core/fpdfdoc/cpdf_pagelabel.cpp
@@ -75,6 +75,8 @@ CFX_WideString GetLabelNumPortion(int num, const CFX_ByteString& bsStyle) {
 CPDF_PageLabel::CPDF_PageLabel(CPDF_Document* pDocument)
     : m_pDocument(pDocument) {}
 
+CPDF_PageLabel::~CPDF_PageLabel() {}
+
 bool CPDF_PageLabel::GetLabel(int nPage, CFX_WideString* wsLabel) const {
   if (!m_pDocument)
     return false;
diff --git a/core/fpdfdoc/cpdf_pagelabel.h b/core/fpdfdoc/cpdf_pagelabel.h
index 0f91f614d9..66324f87c6 100644
--- a/core/fpdfdoc/cpdf_pagelabel.h
+++ b/core/fpdfdoc/cpdf_pagelabel.h
@@ -14,13 +14,14 @@ class CPDF_Document;
 class CPDF_PageLabel {
  public:
   explicit CPDF_PageLabel(CPDF_Document* pDocument);
+  ~CPDF_PageLabel();
 
   bool GetLabel(int nPage, CFX_WideString* wsLabel) const;
   int32_t GetPageByLabel(const CFX_ByteStringC& bsLabel) const;
   int32_t GetPageByLabel(const CFX_WideStringC& wsLabel) const;
 
  private:
-  CPDF_Document* const m_pDocument;
+  CFX_UnownedPtr<CPDF_Document> const m_pDocument;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_PAGELABEL_H_
diff --git a/core/fpdfdoc/cpdf_structelement.cpp b/core/fpdfdoc/cpdf_structelement.cpp
index c85ae0dd42..c5f2b6bd79 100644
--- a/core/fpdfdoc/cpdf_structelement.cpp
+++ b/core/fpdfdoc/cpdf_structelement.cpp
@@ -133,5 +133,5 @@ void CPDF_StructElement::LoadKid(uint32_t PageObjNum,
   }
 
   pKid->m_pElement =
-      pdfium::MakeRetain<CPDF_StructElement>(m_pTree, this, pKidDict);
+      pdfium::MakeRetain<CPDF_StructElement>(m_pTree.Get(), this, pKidDict);
 }
diff --git a/core/fpdfdoc/cpdf_structelement.h b/core/fpdfdoc/cpdf_structelement.h
index d8820a141c..8fe73e51c8 100644
--- a/core/fpdfdoc/cpdf_structelement.h
+++ b/core/fpdfdoc/cpdf_structelement.h
@@ -41,7 +41,7 @@ class CPDF_StructElement : public CFX_Retainable {
 
   const CFX_ByteString& GetType() const { return m_Type; }
   const CFX_ByteString& GetTitle() const { return m_Title; }
-  CPDF_Dictionary* GetDict() const { return m_pDict; }
+  CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
 
   int CountKids() const;
   CPDF_StructElement* GetKidIfElement(int index) const;
@@ -56,9 +56,9 @@ class CPDF_StructElement : public CFX_Retainable {
   void LoadKids(CPDF_Dictionary* pDict);
   void LoadKid(uint32_t PageObjNum, CPDF_Object* pObj, CPDF_StructKid* pKid);
 
-  CPDF_StructTree* const m_pTree;
-  CPDF_StructElement* const m_pParent;
-  CPDF_Dictionary* const m_pDict;
+  CFX_UnownedPtr<CPDF_StructTree> const m_pTree;
+  CFX_UnownedPtr<CPDF_StructElement> const m_pParent;
+  CFX_UnownedPtr<CPDF_Dictionary> const m_pDict;
   CFX_ByteString m_Type;
   CFX_ByteString m_Title;
   std::vector<CPDF_StructKid> m_Kids;
diff --git a/core/fpdfdoc/cpdf_variabletext.h b/core/fpdfdoc/cpdf_variabletext.h
index 2e6caf63d6..a226350006 100644
--- a/core/fpdfdoc/cpdf_variabletext.h
+++ b/core/fpdfdoc/cpdf_variabletext.h
@@ -58,7 +58,7 @@ class CPDF_VariableText {
 
    private:
     CPVT_WordPlace m_CurPos;
-    CPDF_VariableText* const m_pVT;
+    CFX_UnownedPtr<CPDF_VariableText> const m_pVT;
   };
 
   class Provider {
diff --git a/core/fpdfdoc/csection.h b/core/fpdfdoc/csection.h
index b465d1d63d..aefdcaf7b2 100644
--- a/core/fpdfdoc/csection.h
+++ b/core/fpdfdoc/csection.h
@@ -57,7 +57,7 @@ class CSection final {
   void ClearRightWords(int32_t nWordIndex);
   void ClearMidWords(int32_t nBeginIndex, int32_t nEndIndex);
 
-  CPDF_VariableText* const m_pVT;
+  CFX_UnownedPtr<CPDF_VariableText> const m_pVT;
 };
 
 #endif  // CORE_FPDFDOC_CSECTION_H_
diff --git a/core/fpdfdoc/ctypeset.h b/core/fpdfdoc/ctypeset.h
index f769fe1311..1b016ea562 100644
--- a/core/fpdfdoc/ctypeset.h
+++ b/core/fpdfdoc/ctypeset.h
@@ -27,7 +27,7 @@ class CTypeset final {
   void OutputLines();
 
   CPVT_FloatRect m_rcRet;
-  CPDF_VariableText* const m_pVT;
+  CFX_UnownedPtr<CPDF_VariableText> const m_pVT;
   CSection* const m_pSection;
 };
 
diff --git a/core/fpdftext/cpdf_linkextract.h b/core/fpdftext/cpdf_linkextract.h
index 43306cf87a..564d552548 100644
--- a/core/fpdftext/cpdf_linkextract.h
+++ b/core/fpdftext/cpdf_linkextract.h
@@ -38,7 +38,7 @@ class CPDF_LinkExtract {
     CFX_WideString m_strUrl;
   };
 
-  const CPDF_TextPage* const m_pTextPage;
+  CFX_UnownedPtr<const CPDF_TextPage> const m_pTextPage;
   CFX_WideString m_strPageText;
   std::vector<Link> m_LinkArray;
 };
diff --git a/core/fxcodec/codec/cjpx_decoder.h b/core/fxcodec/codec/cjpx_decoder.h
index 2e63caac73..a62b41aafc 100644
--- a/core/fxcodec/codec/cjpx_decoder.h
+++ b/core/fxcodec/codec/cjpx_decoder.h
@@ -9,6 +9,7 @@
 
 #include <vector>
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "third_party/libopenjpeg20/openjpeg.h"
 
 class CPDF_ColorSpace;
@@ -30,7 +31,7 @@ class CJPX_Decoder {
   opj_image_t* image;
   opj_codec_t* l_codec;
   opj_stream_t* l_stream;
-  const CPDF_ColorSpace* const m_ColorSpace;
+  CFX_UnownedPtr<const CPDF_ColorSpace> const m_ColorSpace;
 };
 
 #endif  // CORE_FXCODEC_CODEC_CJPX_DECODER_H_
diff --git a/core/fxcodec/jbig2/JBig2_ArithDecoder.h b/core/fxcodec/jbig2/JBig2_ArithDecoder.h
index 24fb80cfbd..2ec64fe954 100644
--- a/core/fxcodec/jbig2/JBig2_ArithDecoder.h
+++ b/core/fxcodec/jbig2/JBig2_ArithDecoder.h
@@ -9,6 +9,8 @@
 
 #include <stdint.h>
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
+
 class CJBig2_BitStream;
 
 struct JBig2ArithCtx {
@@ -37,7 +39,7 @@ class CJBig2_ArithDecoder {
   unsigned int m_C;
   unsigned int m_A;
   unsigned int m_CT;
-  CJBig2_BitStream* const m_pStream;
+  CFX_UnownedPtr<CJBig2_BitStream> const m_pStream;
 };
 
 #endif  // CORE_FXCODEC_JBIG2_JBIG2_ARITHDECODER_H_
diff --git a/core/fxcodec/jbig2/JBig2_Context.h b/core/fxcodec/jbig2/JBig2_Context.h
index 8568aab7e7..4151fa356e 100644
--- a/core/fxcodec/jbig2/JBig2_Context.h
+++ b/core/fxcodec/jbig2/JBig2_Context.h
@@ -95,7 +95,7 @@ class CJBig2_Context {
   bool m_bInPage;
   bool m_bBufSpecified;
   int32_t m_PauseStep;
-  IFX_Pause* const m_pPause;
+  CFX_UnownedPtr<IFX_Pause> const m_pPause;
   FXCODEC_STATUS m_ProcessingStatus;
   std::vector<JBig2ArithCtx> m_gbContext;
   std::unique_ptr<CJBig2_ArithDecoder> m_pArithDecoder;
diff --git a/core/fxcodec/jbig2/JBig2_HuffmanDecoder.h b/core/fxcodec/jbig2/JBig2_HuffmanDecoder.h
index c72346ac18..c7192b74ed 100644
--- a/core/fxcodec/jbig2/JBig2_HuffmanDecoder.h
+++ b/core/fxcodec/jbig2/JBig2_HuffmanDecoder.h
@@ -18,7 +18,7 @@ class CJBig2_HuffmanDecoder {
   int decodeAValue(CJBig2_HuffmanTable* pTable, int* nResult);
 
  private:
-  CJBig2_BitStream* const m_pStream;
+  CFX_UnownedPtr<CJBig2_BitStream> const m_pStream;
 };
 
 #endif  // CORE_FXCODEC_JBIG2_JBIG2_HUFFMANDECODER_H_
diff --git a/core/fxcrt/xml/cxml_element.h b/core/fxcrt/xml/cxml_element.h
index 2eb6caf74c..d708032adb 100644
--- a/core/fxcrt/xml/cxml_element.h
+++ b/core/fxcrt/xml/cxml_element.h
@@ -30,7 +30,7 @@ class CXML_Element : public CXML_Object {
   CFX_ByteString GetTagName(bool bQualified = false) const;
   CFX_ByteString GetNamespace(bool bQualified = false) const;
   CFX_ByteString GetNamespaceURI(const CFX_ByteString& qName) const;
-  const CXML_Element* GetParent() const { return m_pParent; }
+  const CXML_Element* GetParent() const { return m_pParent.Get(); }
   uint32_t CountAttrs() const { return m_AttrMap.GetSize(); }
   void GetAttrByIndex(int index,
                       CFX_ByteString* space,
@@ -104,7 +104,7 @@ class CXML_Element : public CXML_Object {
   friend class CXML_Parser;
   friend class CXML_Composer;
 
-  const CXML_Element* const m_pParent;
+  CFX_UnownedPtr<const CXML_Element> const m_pParent;
   CFX_ByteString m_QSpaceName;
   CFX_ByteString m_TagName;
   CXML_AttrMap m_AttrMap;
diff --git a/core/fxge/cfx_fontmapper.h b/core/fxge/cfx_fontmapper.h
index 96630a77df..1b262bf0f4 100644
--- a/core/fxge/cfx_fontmapper.h
+++ b/core/fxge/cfx_fontmapper.h
@@ -80,7 +80,7 @@ class CFX_FontMapper {
   std::vector<FaceData> m_FaceArray;
   std::unique_ptr<IFX_SystemFontInfo> m_pFontInfo;
   FXFT_Face m_FoxitFaces[FOXIT_FACE_COUNT];
-  CFX_FontMgr* const m_pFontMgr;
+  CFX_UnownedPtr<CFX_FontMgr> const m_pFontMgr;
 };
 
 #endif  // CORE_FXGE_CFX_FONTMAPPER_H_
diff --git a/core/fxge/dib/cfx_imagestretcher.cpp b/core/fxge/dib/cfx_imagestretcher.cpp
index 809b72d1fb..3c0a065868 100644
--- a/core/fxge/dib/cfx_imagestretcher.cpp
+++ b/core/fxge/dib/cfx_imagestretcher.cpp
@@ -133,8 +133,8 @@ bool CFX_ImageStretcher::Continue(IFX_Pause* pPause) {
 
 bool CFX_ImageStretcher::StartStretch() {
   m_pStretchEngine = pdfium::MakeUnique<CStretchEngine>(
-      m_pDest, m_DestFormat, m_DestWidth, m_DestHeight, m_ClipRect, m_pSource,
-      m_Flags);
+      m_pDest.Get(), m_DestFormat, m_DestWidth, m_DestHeight, m_ClipRect,
+      m_pSource, m_Flags);
   m_pStretchEngine->StartStretchHorz();
   if (SourceSizeWithinLimit(m_pSource->GetWidth(), m_pSource->GetHeight())) {
     m_pStretchEngine->Continue(nullptr);
diff --git a/core/fxge/dib/cfx_imagestretcher.h b/core/fxge/dib/cfx_imagestretcher.h
index 63863cd1a9..45928ee141 100644
--- a/core/fxge/dib/cfx_imagestretcher.h
+++ b/core/fxge/dib/cfx_imagestretcher.h
@@ -37,7 +37,7 @@ class CFX_ImageStretcher {
   bool ContinueQuickStretch(IFX_Pause* pPause);
   bool ContinueStretch(IFX_Pause* pPause);
 
-  IFX_ScanlineComposer* const m_pDest;
+  CFX_UnownedPtr<IFX_ScanlineComposer> const m_pDest;
   CFX_RetainPtr<CFX_DIBSource> m_pSource;
   std::unique_ptr<CStretchEngine> m_pStretchEngine;
   std::unique_ptr<uint8_t, FxFreeDeleter> m_pScanline;
diff --git a/core/fxge/dib/cfx_imagetransformer.h b/core/fxge/dib/cfx_imagetransformer.h
index 52aca9792e..90f605dce9 100644
--- a/core/fxge/dib/cfx_imagetransformer.h
+++ b/core/fxge/dib/cfx_imagetransformer.h
@@ -33,7 +33,7 @@ class CFX_ImageTransformer {
 
  private:
   const CFX_RetainPtr<CFX_DIBSource> m_pSrc;
-  const CFX_Matrix* const m_pMatrix;
+  CFX_UnownedPtr<const CFX_Matrix> const m_pMatrix;
   const FX_RECT* const m_pClip;
   FX_RECT m_StretchClip;
   FX_RECT m_result;
diff --git a/fpdfsdk/cpdfsdk_baannot.cpp b/fpdfsdk/cpdfsdk_baannot.cpp
index 129491c210..4f11f77f0b 100644
--- a/fpdfsdk/cpdfsdk_baannot.cpp
+++ b/fpdfsdk/cpdfsdk_baannot.cpp
@@ -27,7 +27,7 @@ CPDFSDK_BAAnnot::CPDFSDK_BAAnnot(CPDF_Annot* pAnnot,
 CPDFSDK_BAAnnot::~CPDFSDK_BAAnnot() {}
 
 CPDF_Annot* CPDFSDK_BAAnnot::GetPDFAnnot() const {
-  return m_pAnnot;
+  return m_pAnnot.Get();
 }
 
 CPDF_Annot* CPDFSDK_BAAnnot::GetPDFPopupAnnot() const {
diff --git a/fpdfsdk/cpdfsdk_baannot.h b/fpdfsdk/cpdfsdk_baannot.h
index 2da5723eb4..4bf8f73823 100644
--- a/fpdfsdk/cpdfsdk_baannot.h
+++ b/fpdfsdk/cpdfsdk_baannot.h
@@ -100,7 +100,7 @@ class CPDFSDK_BAAnnot : public CPDFSDK_Annot {
   void SetOpenState(bool bState);
 
  protected:
-  CPDF_Annot* const m_pAnnot;
+  CFX_UnownedPtr<CPDF_Annot> const m_pAnnot;
 };
 
 #endif  // FPDFSDK_CPDFSDK_BAANNOT_H_
diff --git a/fpdfsdk/cpdfsdk_widget.h b/fpdfsdk/cpdfsdk_widget.h
index 9f58cc1d61..a5e5b702dc 100644
--- a/fpdfsdk/cpdfsdk_widget.h
+++ b/fpdfsdk/cpdfsdk_widget.h
@@ -117,7 +117,7 @@ class CPDFSDK_Widget : public CPDFSDK_BAAnnot {
                  PDFSDK_FieldAction& data,
                  CPDFSDK_PageView* pPageView);
 
-  CPDFSDK_InterForm* GetInterForm() const { return m_pInterForm; }
+  CPDFSDK_InterForm* GetInterForm() const { return m_pInterForm.Get(); }
   CPDF_FormField* GetFormField() const;
   CPDF_FormControl* GetFormControl() const;
   static CPDF_FormControl* GetFormControl(CPDF_InterForm* pInterForm,
@@ -160,7 +160,7 @@ class CPDFSDK_Widget : public CPDFSDK_BAAnnot {
   void AddImageToAppearance(const CFX_ByteString& sAPType, CPDF_Stream* pImage);
   void RemoveAppearance(const CFX_ByteString& sAPType);
 
-  CPDFSDK_InterForm* const m_pInterForm;
+  CFX_UnownedPtr<CPDFSDK_InterForm> const m_pInterForm;
   bool m_bAppModified;
   int32_t m_nAppAge;
   int32_t m_nValueAge;
diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_page.h b/fpdfsdk/fpdfxfa/cpdfxfa_page.h
index d990813282..de2d19837d 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_page.h
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_page.h
@@ -10,6 +10,7 @@
 #include <memory>
 
 #include "core/fxcrt/cfx_retain_ptr.h"
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_system.h"
 
 class CFX_Matrix;
@@ -25,7 +26,7 @@ class CPDFXFA_Page : public CFX_Retainable {
 
   bool LoadPage();
   bool LoadPDFPage(CPDF_Dictionary* pageDict);
-  CPDFXFA_Context* GetContext() const { return m_pContext; }
+  CPDFXFA_Context* GetContext() const { return m_pContext.Get(); }
   int GetPageIndex() const { return m_iPageIndex; }
   CPDF_Page* GetPDFPage() const { return m_pPDFPage.get(); }
   CXFA_FFPageView* GetXFAPageView() const { return m_pXFAPageView; }
@@ -73,7 +74,7 @@ class CPDFXFA_Page : public CFX_Retainable {
  private:
   std::unique_ptr<CPDF_Page> m_pPDFPage;
   CXFA_FFPageView* m_pXFAPageView;
-  CPDFXFA_Context* const m_pContext;
+  CFX_UnownedPtr<CPDFXFA_Context> const m_pContext;
   const int m_iPageIndex;
   int m_iRef;
 };
diff --git a/fpdfsdk/fsdk_pauseadapter.cpp b/fpdfsdk/fsdk_pauseadapter.cpp
index 237266b88b..cf99253ff9 100644
--- a/fpdfsdk/fsdk_pauseadapter.cpp
+++ b/fpdfsdk/fsdk_pauseadapter.cpp
@@ -12,5 +12,5 @@ IFSDK_PAUSE_Adapter::IFSDK_PAUSE_Adapter(IFSDK_PAUSE* IPause)
 IFSDK_PAUSE_Adapter::~IFSDK_PAUSE_Adapter() {}
 
 bool IFSDK_PAUSE_Adapter::NeedToPauseNow() {
-  return m_IPause->NeedToPauseNow && m_IPause->NeedToPauseNow(m_IPause);
+  return m_IPause->NeedToPauseNow && m_IPause->NeedToPauseNow(m_IPause.Get());
 }
diff --git a/fpdfsdk/fsdk_pauseadapter.h b/fpdfsdk/fsdk_pauseadapter.h
index bd302f2613..66a628aa09 100644
--- a/fpdfsdk/fsdk_pauseadapter.h
+++ b/fpdfsdk/fsdk_pauseadapter.h
@@ -19,7 +19,7 @@ class IFSDK_PAUSE_Adapter : public IFX_Pause {
   bool NeedToPauseNow() override;
 
  private:
-  IFSDK_PAUSE* const m_IPause;
+  CFX_UnownedPtr<IFSDK_PAUSE> const m_IPause;
 };
 
 #endif  // FPDFSDK_FSDK_PAUSEADAPTER_H_
diff --git a/fpdfsdk/javascript/Document.cpp b/fpdfsdk/javascript/Document.cpp
index 38a4c12177..a760ad9956 100644
--- a/fpdfsdk/javascript/Document.cpp
+++ b/fpdfsdk/javascript/Document.cpp
@@ -1646,5 +1646,5 @@ void Document::DoFieldDelay(const CFX_WideString& sFieldName,
 }
 
 CJS_Document* Document::GetCJSDoc() const {
-  return static_cast<CJS_Document*>(m_pJSObject);
+  return static_cast<CJS_Document*>(m_pJSObject.Get());
 }
diff --git a/fpdfsdk/javascript/JS_Object.h b/fpdfsdk/javascript/JS_Object.h
index 2e5c75c948..e32b8515b5 100644
--- a/fpdfsdk/javascript/JS_Object.h
+++ b/fpdfsdk/javascript/JS_Object.h
@@ -23,10 +23,10 @@ class CJS_EmbedObj {
   explicit CJS_EmbedObj(CJS_Object* pJSObject);
   virtual ~CJS_EmbedObj();
 
-  CJS_Object* GetJSObject() const { return m_pJSObject; }
+  CJS_Object* GetJSObject() const { return m_pJSObject.Get(); }
 
  protected:
-  CJS_Object* const m_pJSObject;
+  CFX_UnownedPtr<CJS_Object> const m_pJSObject;
 };
 
 class CJS_Object {
diff --git a/fpdfsdk/javascript/JS_Value.cpp b/fpdfsdk/javascript/JS_Value.cpp
index e9fa9a0fbe..dba0b76115 100644
--- a/fpdfsdk/javascript/JS_Value.cpp
+++ b/fpdfsdk/javascript/JS_Value.cpp
@@ -199,107 +199,107 @@ CJS_PropValue::~CJS_PropValue() {}
 
 void CJS_PropValue::operator<<(int iValue) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, iValue);
+  m_Value = CJS_Value(m_pJSRuntime.Get(), iValue);
 }
 
 void CJS_PropValue::operator>>(int& iValue) const {
   ASSERT(m_bIsSetting);
-  iValue = m_Value.ToInt(m_pJSRuntime);
+  iValue = m_Value.ToInt(m_pJSRuntime.Get());
 }
 
 void CJS_PropValue::operator<<(bool bValue) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, bValue);
+  m_Value = CJS_Value(m_pJSRuntime.Get(), bValue);
 }
 
 void CJS_PropValue::operator>>(bool& bValue) const {
   ASSERT(m_bIsSetting);
-  bValue = m_Value.ToBool(m_pJSRuntime);
+  bValue = m_Value.ToBool(m_pJSRuntime.Get());
 }
 
 void CJS_PropValue::operator<<(double dValue) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, dValue);
+  m_Value = CJS_Value(m_pJSRuntime.Get(), dValue);
 }
 
 void CJS_PropValue::operator>>(double& dValue) const {
   ASSERT(m_bIsSetting);
-  dValue = m_Value.ToDouble(m_pJSRuntime);
+  dValue = m_Value.ToDouble(m_pJSRuntime.Get());
 }
 
 void CJS_PropValue::operator<<(CJS_Object* pObj) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, pObj);
+  m_Value = CJS_Value(m_pJSRuntime.Get(), pObj);
 }
 
 void CJS_PropValue::operator>>(CJS_Object*& ppObj) const {
   ASSERT(m_bIsSetting);
-  ppObj = m_Value.ToCJSObject(m_pJSRuntime);
+  ppObj = m_Value.ToCJSObject(m_pJSRuntime.Get());
 }
 
 void CJS_PropValue::operator<<(CJS_Document* pJsDoc) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, pJsDoc);
+  m_Value = CJS_Value(m_pJSRuntime.Get(), pJsDoc);
 }
 
 void CJS_PropValue::operator>>(CJS_Document*& ppJsDoc) const {
   ASSERT(m_bIsSetting);
-  ppJsDoc = static_cast<CJS_Document*>(m_Value.ToCJSObject(m_pJSRuntime));
+  ppJsDoc = static_cast<CJS_Document*>(m_Value.ToCJSObject(m_pJSRuntime.Get()));
 }
 
 void CJS_PropValue::operator<<(v8::Local<v8::Object> pObj) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, pObj);
+  m_Value = CJS_Value(m_pJSRuntime.Get(), pObj);
 }
 
 void CJS_PropValue::operator>>(v8::Local<v8::Object>& ppObj) const {
   ASSERT(m_bIsSetting);
-  ppObj = m_Value.ToV8Object(m_pJSRuntime);
+  ppObj = m_Value.ToV8Object(m_pJSRuntime.Get());
 }
 
 void CJS_PropValue::operator<<(CFX_ByteString str) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, str.c_str());
+  m_Value = CJS_Value(m_pJSRuntime.Get(), str.c_str());
 }
 
 void CJS_PropValue::operator>>(CFX_ByteString& str) const {
   ASSERT(m_bIsSetting);
-  str = m_Value.ToCFXByteString(m_pJSRuntime);
+  str = m_Value.ToCFXByteString(m_pJSRuntime.Get());
 }
 
 void CJS_PropValue::operator<<(const wchar_t* str) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, str);
+  m_Value = CJS_Value(m_pJSRuntime.Get(), str);
 }
 
 void CJS_PropValue::operator>>(CFX_WideString& wide_string) const {
   ASSERT(m_bIsSetting);
-  wide_string = m_Value.ToCFXWideString(m_pJSRuntime);
+  wide_string = m_Value.ToCFXWideString(m_pJSRuntime.Get());
 }
 
 void CJS_PropValue::operator<<(CFX_WideString wide_string) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, wide_string.c_str());
+  m_Value = CJS_Value(m_pJSRuntime.Get(), wide_string.c_str());
 }
 
 void CJS_PropValue::operator>>(CJS_Array& array) const {
   ASSERT(m_bIsSetting);
-  m_Value.ConvertToArray(m_pJSRuntime, array);
+  m_Value.ConvertToArray(m_pJSRuntime.Get(), array);
 }
 
 void CJS_PropValue::operator<<(CJS_Array& array) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, array.ToV8Array(m_pJSRuntime));
+  m_Value = CJS_Value(m_pJSRuntime.Get(), array.ToV8Array(m_pJSRuntime.Get()));
 }
 
 void CJS_PropValue::operator>>(CJS_Date& date) const {
   ASSERT(m_bIsSetting);
-  m_Value.ConvertToDate(m_pJSRuntime, date);
+  m_Value.ConvertToDate(m_pJSRuntime.Get(), date);
 }
 
 void CJS_PropValue::operator<<(CJS_Date& date) {
   ASSERT(!m_bIsSetting);
-  m_Value = CJS_Value(m_pJSRuntime, date);
+  m_Value = CJS_Value(m_pJSRuntime.Get(), date);
 }
 
 CJS_Array::CJS_Array() {}
diff --git a/fpdfsdk/javascript/JS_Value.h b/fpdfsdk/javascript/JS_Value.h
index 0c19701587..1a6d47fcea 100644
--- a/fpdfsdk/javascript/JS_Value.h
+++ b/fpdfsdk/javascript/JS_Value.h
@@ -89,7 +89,7 @@ class CJS_PropValue {
   void StartGetting() { m_bIsSetting = false; }
   bool IsSetting() const { return m_bIsSetting; }
   bool IsGetting() const { return !m_bIsSetting; }
-  CJS_Runtime* GetJSRuntime() const { return m_pJSRuntime; }
+  CJS_Runtime* GetJSRuntime() const { return m_pJSRuntime.Get(); }
   CJS_Value* GetJSValue() { return &m_Value; }
 
   // These calls may re-enter JS (and hence invalidate objects).
@@ -118,7 +118,7 @@ class CJS_PropValue {
  private:
   bool m_bIsSetting;
   CJS_Value m_Value;
-  CJS_Runtime* const m_pJSRuntime;
+  CFX_UnownedPtr<CJS_Runtime> const m_pJSRuntime;
 };
 
 class CJS_Array {
diff --git a/fpdfsdk/pdfwindow/PWL_FontMap.h b/fpdfsdk/pdfwindow/PWL_FontMap.h
index 2a532197cb..ca3ab231bd 100644
--- a/fpdfsdk/pdfwindow/PWL_FontMap.h
+++ b/fpdfsdk/pdfwindow/PWL_FontMap.h
@@ -90,7 +90,7 @@ class CPWL_FontMap : public IPVT_FontMap {
                            uint8_t nCharset);
 
   std::unique_ptr<CPDF_Document> m_pPDFDoc;
-  CFX_SystemHandler* const m_pSystemHandler;
+  CFX_UnownedPtr<CFX_SystemHandler> const m_pSystemHandler;
 };
 
 #endif  // FPDFSDK_PDFWINDOW_PWL_FONTMAP_H_
diff --git a/fxbarcode/common/reedsolomon/BC_ReedSolomon.cpp b/fxbarcode/common/reedsolomon/BC_ReedSolomon.cpp
index ca65f72043..2be74c7fa3 100644
--- a/fxbarcode/common/reedsolomon/BC_ReedSolomon.cpp
+++ b/fxbarcode/common/reedsolomon/BC_ReedSolomon.cpp
@@ -36,7 +36,7 @@ CBC_ReedSolomonEncoder::~CBC_ReedSolomonEncoder() {}
 
 void CBC_ReedSolomonEncoder::Init() {
   m_cachedGenerators.push_back(
-      pdfium::MakeUnique<CBC_ReedSolomonGF256Poly>(m_field, 1));
+      pdfium::MakeUnique<CBC_ReedSolomonGF256Poly>(m_field.Get(), 1));
 }
 
 CBC_ReedSolomonGF256Poly* CBC_ReedSolomonEncoder::BuildGenerator(
@@ -46,7 +46,7 @@ CBC_ReedSolomonGF256Poly* CBC_ReedSolomonEncoder::BuildGenerator(
     for (size_t d = m_cachedGenerators.size(); d <= degree; ++d) {
       std::vector<int32_t> temp = {1, m_field->Exp(d - 1)};
       CBC_ReedSolomonGF256Poly temp_poly;
-      if (!temp_poly.Init(m_field, &temp))
+      if (!temp_poly.Init(m_field.Get(), &temp))
         return nullptr;
 
       auto nextGenerator = lastGenerator->Multiply(&temp_poly);
@@ -78,7 +78,7 @@ bool CBC_ReedSolomonEncoder::Encode(std::vector<int32_t>* toEncode,
     infoCoefficients[x] = (*toEncode)[x];
 
   CBC_ReedSolomonGF256Poly info;
-  if (!info.Init(m_field, &infoCoefficients))
+  if (!info.Init(m_field.Get(), &infoCoefficients))
     return false;
 
   auto infoTemp = info.MultiplyByMonomial(ecBytes, 1);
diff --git a/fxbarcode/common/reedsolomon/BC_ReedSolomon.h b/fxbarcode/common/reedsolomon/BC_ReedSolomon.h
index 68d4ee0624..2838e13cee 100644
--- a/fxbarcode/common/reedsolomon/BC_ReedSolomon.h
+++ b/fxbarcode/common/reedsolomon/BC_ReedSolomon.h
@@ -26,7 +26,7 @@ class CBC_ReedSolomonEncoder {
  private:
   CBC_ReedSolomonGF256Poly* BuildGenerator(size_t degree);
 
-  CBC_ReedSolomonGF256* const m_field;
+  CFX_UnownedPtr<CBC_ReedSolomonGF256> const m_field;
   std::vector<std::unique_ptr<CBC_ReedSolomonGF256Poly>> m_cachedGenerators;
 };
 
diff --git a/xfa/fde/cfde_txtedtpage.cpp b/xfa/fde/cfde_txtedtpage.cpp
index f3127e7708..4f1e8fb7f0 100644
--- a/xfa/fde/cfde_txtedtpage.cpp
+++ b/xfa/fde/cfde_txtedtpage.cpp
@@ -38,7 +38,7 @@ CFDE_TxtEdtPage::CFDE_TxtEdtPage(CFDE_TxtEdtEngine* pEngine, int32_t nPageIndex)
 CFDE_TxtEdtPage::~CFDE_TxtEdtPage() {}
 
 CFDE_TxtEdtEngine* CFDE_TxtEdtPage::GetEngine() const {
-  return m_pEditEngine;
+  return m_pEditEngine.Get();
 }
 
 FDE_VISUALOBJTYPE CFDE_TxtEdtPage::GetType() {
diff --git a/xfa/fde/cfde_txtedtpage.h b/xfa/fde/cfde_txtedtpage.h
index c715c45062..aa88801ba7 100644
--- a/xfa/fde/cfde_txtedtpage.h
+++ b/xfa/fde/cfde_txtedtpage.h
@@ -59,7 +59,7 @@ class CFDE_TxtEdtPage : public IFDE_VisualSet {
 
   std::unique_ptr<IFX_CharIter> m_pIter;
   std::unique_ptr<CFDE_TxtEdtTextSet> m_pTextSet;
-  CFDE_TxtEdtEngine* const m_pEditEngine;
+  CFX_UnownedPtr<CFDE_TxtEdtEngine> const m_pEditEngine;
   std::deque<FDE_TEXTEDITPIECE> m_Pieces;
   CFDE_TxtEdtParag* m_pBgnParag;
   CFDE_TxtEdtParag* m_pEndParag;
diff --git a/xfa/fde/cfde_txtedttextset.cpp b/xfa/fde/cfde_txtedttextset.cpp
index dd68d42618..0785754e1f 100644
--- a/xfa/fde/cfde_txtedttextset.cpp
+++ b/xfa/fde/cfde_txtedttextset.cpp
@@ -60,7 +60,7 @@ int32_t CFDE_TxtEdtTextSet::GetDisplayPos(const FDE_TEXTEDITPIECE& piece,
   CFX_TxtBreak* pBreak = pEngine->GetTextBreak();
   uint32_t dwLayoutStyle = pBreak->GetLayoutStyles();
   FX_TXTRUN tr;
-  tr.pAccess = m_pPage;
+  tr.pAccess = m_pPage.Get();
   tr.pIdentity = &piece;
   tr.iLength = nLength;
   tr.pFont = pTextParams->pFont;
@@ -82,7 +82,7 @@ std::vector<CFX_RectF> CFDE_TxtEdtTextSet::GetCharRects(
   const FDE_TXTEDTPARAMS* pTextParams = pEngine->GetEditParams();
   uint32_t dwLayoutStyle = pEngine->GetTextBreak()->GetLayoutStyles();
   FX_TXTRUN tr;
-  tr.pAccess = m_pPage;
+  tr.pAccess = m_pPage.Get();
   tr.pIdentity = pPiece;
   tr.iLength = pPiece->nCount;
   tr.pFont = pTextParams->pFont;
diff --git a/xfa/fde/cfde_txtedttextset.h b/xfa/fde/cfde_txtedttextset.h
index 8e4c4d01bf..29303373da 100644
--- a/xfa/fde/cfde_txtedttextset.h
+++ b/xfa/fde/cfde_txtedttextset.h
@@ -34,7 +34,7 @@ class CFDE_TxtEdtTextSet : public IFDE_VisualSet {
                                       bool bBBox);
 
  private:
-  CFDE_TxtEdtPage* const m_pPage;
+  CFX_UnownedPtr<CFDE_TxtEdtPage> const m_pPage;
 };
 
 #endif  // XFA_FDE_CFDE_TXTEDTTEXTSET_H_
diff --git a/xfa/fde/css/cfde_cssstyleselector.cpp b/xfa/fde/css/cfde_cssstyleselector.cpp
index 024c8a86e2..461192e976 100644
--- a/xfa/fde/css/cfde_cssstyleselector.cpp
+++ b/xfa/fde/css/cfde_cssstyleselector.cpp
@@ -48,7 +48,7 @@ void CFDE_CSSStyleSelector::SetUAStyleSheet(
 
 void CFDE_CSSStyleSelector::UpdateStyleIndex() {
   m_UARules.Clear();
-  m_UARules.AddRulesFrom(m_UAStyles.get(), m_pFontMgr);
+  m_UARules.AddRulesFrom(m_UAStyles.get(), m_pFontMgr.Get());
 }
 
 std::vector<const CFDE_CSSDeclaration*>
diff --git a/xfa/fde/css/cfde_cssstyleselector.h b/xfa/fde/css/cfde_cssstyleselector.h
index 0783e72541..6f40c968c7 100644
--- a/xfa/fde/css/cfde_cssstyleselector.h
+++ b/xfa/fde/css/cfde_cssstyleselector.h
@@ -78,7 +78,7 @@ class CFDE_CSSStyleSelector {
   uint32_t ToTextDecoration(const CFX_RetainPtr<CFDE_CSSValueList>& pList);
   FDE_CSSFontVariant ToFontVariant(FDE_CSSPropertyValue eValue);
 
-  CFGAS_FontMgr* const m_pFontMgr;
+  CFX_UnownedPtr<CFGAS_FontMgr> const m_pFontMgr;
   float m_fDefFontSize;
   std::unique_ptr<CFDE_CSSStyleSheet> m_UAStyles;
   CFDE_CSSRuleCollection m_UARules;
diff --git a/xfa/fwl/cfwl_app.h b/xfa/fwl/cfwl_app.h
index c2779e8a25..04f140f451 100644
--- a/xfa/fwl/cfwl_app.h
+++ b/xfa/fwl/cfwl_app.h
@@ -32,12 +32,12 @@ class CFWL_App {
   explicit CFWL_App(CXFA_FFApp* pAdapter);
   ~CFWL_App();
 
-  CXFA_FFApp* GetAdapterNative() const { return m_pAdapterNative; }
+  CXFA_FFApp* GetAdapterNative() const { return m_pAdapterNative.Get(); }
   CFWL_WidgetMgr* GetWidgetMgr() const { return m_pWidgetMgr.get(); }
   CFWL_NoteDriver* GetNoteDriver() const { return m_pNoteDriver.get(); }
 
  private:
-  CXFA_FFApp* const m_pAdapterNative;
+  CFX_UnownedPtr<CXFA_FFApp> const m_pAdapterNative;
   std::unique_ptr<CFWL_WidgetMgr> m_pWidgetMgr;
   std::unique_ptr<CFWL_NoteDriver> m_pNoteDriver;
 };
diff --git a/xfa/fwl/cfwl_combobox.cpp b/xfa/fwl/cfwl_combobox.cpp
index b5931d1c04..ba72d3d2b2 100644
--- a/xfa/fwl/cfwl_combobox.cpp
+++ b/xfa/fwl/cfwl_combobox.cpp
@@ -49,12 +49,12 @@ CFWL_ComboBox::CFWL_ComboBox(const CFWL_App* app)
   auto prop = pdfium::MakeUnique<CFWL_WidgetProperties>();
   prop->m_pThemeProvider = m_pProperties->m_pThemeProvider;
   prop->m_dwStyles |= FWL_WGTSTYLE_Border | FWL_WGTSTYLE_VScroll;
-  m_pListBox =
-      pdfium::MakeUnique<CFWL_ComboList>(m_pOwnerApp, std::move(prop), this);
+  m_pListBox = pdfium::MakeUnique<CFWL_ComboList>(m_pOwnerApp.Get(),
+                                                  std::move(prop), this);
 
   if ((m_pProperties->m_dwStyleExes & FWL_STYLEEXT_CMB_DropDown) && !m_pEdit) {
     m_pEdit = pdfium::MakeUnique<CFWL_ComboEdit>(
-        m_pOwnerApp, pdfium::MakeUnique<CFWL_WidgetProperties>(), this);
+        m_pOwnerApp.Get(), pdfium::MakeUnique<CFWL_WidgetProperties>(), this);
     m_pEdit->SetOuter(this);
   }
   if (m_pEdit)
@@ -92,7 +92,8 @@ void CFWL_ComboBox::ModifyStylesEx(uint32_t dwStylesExAdded,
   bool bRemoveDropDown = !!(dwStylesExRemoved & FWL_STYLEEXT_CMB_DropDown);
   if (bAddDropDown && !m_pEdit) {
     m_pEdit = pdfium::MakeUnique<CFWL_ComboEdit>(
-        m_pOwnerApp, pdfium::MakeUnique<CFWL_WidgetProperties>(), nullptr);
+        m_pOwnerApp.Get(), pdfium::MakeUnique<CFWL_WidgetProperties>(),
+        nullptr);
     m_pEdit->SetOuter(this);
     m_pEdit->SetParent(this);
   } else if (bRemoveDropDown && m_pEdit) {
@@ -496,8 +497,8 @@ void CFWL_ComboBox::InitProxyForm() {
 
   // TODO(dsinclair): Does this leak? I don't see a delete, but I'm not sure
   // if the SetParent call is going to transfer ownership.
-  m_pComboBoxProxy = new CFWL_ComboBoxProxy(this, m_pOwnerApp, std::move(prop),
-                                            m_pListBox.get());
+  m_pComboBoxProxy = new CFWL_ComboBoxProxy(this, m_pOwnerApp.Get(),
+                                            std::move(prop), m_pListBox.get());
   m_pListBox->SetParent(m_pComboBoxProxy);
 }
 
@@ -510,8 +511,8 @@ void CFWL_ComboBox::DisForm_InitComboList() {
   prop->m_dwStyles = FWL_WGTSTYLE_Border | FWL_WGTSTYLE_VScroll;
   prop->m_dwStates = FWL_WGTSTATE_Invisible;
   prop->m_pThemeProvider = m_pProperties->m_pThemeProvider;
-  m_pListBox =
-      pdfium::MakeUnique<CFWL_ComboList>(m_pOwnerApp, std::move(prop), this);
+  m_pListBox = pdfium::MakeUnique<CFWL_ComboList>(m_pOwnerApp.Get(),
+                                                  std::move(prop), this);
 }
 
 void CFWL_ComboBox::DisForm_InitComboEdit() {
@@ -522,8 +523,8 @@ void CFWL_ComboBox::DisForm_InitComboEdit() {
   prop->m_pParent = this;
   prop->m_pThemeProvider = m_pProperties->m_pThemeProvider;
 
-  m_pEdit =
-      pdfium::MakeUnique<CFWL_ComboEdit>(m_pOwnerApp, std::move(prop), this);
+  m_pEdit = pdfium::MakeUnique<CFWL_ComboEdit>(m_pOwnerApp.Get(),
+                                               std::move(prop), this);
   m_pEdit->SetOuter(this);
 }
 
diff --git a/xfa/fwl/cfwl_datetimepicker.cpp b/xfa/fwl/cfwl_datetimepicker.cpp
index e1d3a748d6..a49785e987 100644
--- a/xfa/fwl/cfwl_datetimepicker.cpp
+++ b/xfa/fwl/cfwl_datetimepicker.cpp
@@ -40,8 +40,8 @@ CFWL_DateTimePicker::CFWL_DateTimePicker(const CFWL_App* app)
   monthProp->m_dwStates = FWL_WGTSTATE_Invisible;
   monthProp->m_pParent = this;
   monthProp->m_pThemeProvider = m_pProperties->m_pThemeProvider;
-  m_pMonthCal.reset(
-      new CFWL_MonthCalendar(m_pOwnerApp, std::move(monthProp), this));
+  m_pMonthCal = pdfium::MakeUnique<CFWL_MonthCalendar>(
+      m_pOwnerApp.Get(), std::move(monthProp), this);
 
   m_pMonthCal->SetWidgetRect(
       CFX_RectF(0, 0, m_pMonthCal->GetAutosizedWidgetRect().Size()));
@@ -50,7 +50,7 @@ CFWL_DateTimePicker::CFWL_DateTimePicker(const CFWL_App* app)
   editProp->m_pParent = this;
   editProp->m_pThemeProvider = m_pProperties->m_pThemeProvider;
 
-  m_pEdit = pdfium::MakeUnique<CFWL_DateTimeEdit>(m_pOwnerApp,
+  m_pEdit = pdfium::MakeUnique<CFWL_DateTimeEdit>(m_pOwnerApp.Get(),
                                                   std::move(editProp), this);
   RegisterEventTarget(m_pMonthCal.get());
   RegisterEventTarget(m_pEdit.get());
@@ -332,8 +332,8 @@ void CFWL_DateTimePicker::InitProxyForm() {
   prop->m_dwStates = FWL_WGTSTATE_Invisible;
   prop->m_pOwner = this;
 
-  m_pForm = pdfium::MakeUnique<CFWL_FormProxy>(m_pOwnerApp, std::move(prop),
-                                               m_pMonthCal.get());
+  m_pForm = pdfium::MakeUnique<CFWL_FormProxy>(
+      m_pOwnerApp.Get(), std::move(prop), m_pMonthCal.get());
   m_pMonthCal->SetParent(m_pForm.get());
 }
 
diff --git a/xfa/fwl/cfwl_edit.cpp b/xfa/fwl/cfwl_edit.cpp
index 28948cca21..eff76ffabf 100644
--- a/xfa/fwl/cfwl_edit.cpp
+++ b/xfa/fwl/cfwl_edit.cpp
@@ -1063,8 +1063,8 @@ void CFWL_Edit::InitVerticalScrollBar() {
   prop->m_dwStates = FWL_WGTSTATE_Disabled | FWL_WGTSTATE_Invisible;
   prop->m_pParent = this;
   prop->m_pThemeProvider = m_pProperties->m_pThemeProvider;
-  m_pVertScrollBar =
-      pdfium::MakeUnique<CFWL_ScrollBar>(m_pOwnerApp, std::move(prop), this);
+  m_pVertScrollBar = pdfium::MakeUnique<CFWL_ScrollBar>(m_pOwnerApp.Get(),
+                                                        std::move(prop), this);
 }
 
 void CFWL_Edit::InitHorizontalScrollBar() {
@@ -1076,8 +1076,8 @@ void CFWL_Edit::InitHorizontalScrollBar() {
   prop->m_dwStates = FWL_WGTSTATE_Disabled | FWL_WGTSTATE_Invisible;
   prop->m_pParent = this;
   prop->m_pThemeProvider = m_pProperties->m_pThemeProvider;
-  m_pHorzScrollBar =
-      pdfium::MakeUnique<CFWL_ScrollBar>(m_pOwnerApp, std::move(prop), this);
+  m_pHorzScrollBar = pdfium::MakeUnique<CFWL_ScrollBar>(m_pOwnerApp.Get(),
+                                                        std::move(prop), this);
 }
 
 void CFWL_Edit::ShowCaret(CFX_RectF* pRect) {
diff --git a/xfa/fwl/cfwl_listbox.cpp b/xfa/fwl/cfwl_listbox.cpp
index 9d9bf72f4c..0fd43efa08 100644
--- a/xfa/fwl/cfwl_listbox.cpp
+++ b/xfa/fwl/cfwl_listbox.cpp
@@ -630,8 +630,8 @@ void CFWL_ListBox::InitVerticalScrollBar() {
   prop->m_dwStates = FWL_WGTSTATE_Invisible;
   prop->m_pParent = this;
   prop->m_pThemeProvider = m_pScrollBarTP;
-  m_pVertScrollBar =
-      pdfium::MakeUnique<CFWL_ScrollBar>(m_pOwnerApp, std::move(prop), this);
+  m_pVertScrollBar = pdfium::MakeUnique<CFWL_ScrollBar>(m_pOwnerApp.Get(),
+                                                        std::move(prop), this);
 }
 
 void CFWL_ListBox::InitHorizontalScrollBar() {
@@ -643,8 +643,8 @@ void CFWL_ListBox::InitHorizontalScrollBar() {
   prop->m_dwStates = FWL_WGTSTATE_Invisible;
   prop->m_pParent = this;
   prop->m_pThemeProvider = m_pScrollBarTP;
-  m_pHorzScrollBar =
-      pdfium::MakeUnique<CFWL_ScrollBar>(m_pOwnerApp, std::move(prop), this);
+  m_pHorzScrollBar = pdfium::MakeUnique<CFWL_ScrollBar>(m_pOwnerApp.Get(),
+                                                        std::move(prop), this);
 }
 
 bool CFWL_ListBox::IsShowScrollBar(bool bVert) {
diff --git a/xfa/fwl/cfwl_widget.h b/xfa/fwl/cfwl_widget.h
index dd8fb5654b..9bcbf55cbc 100644
--- a/xfa/fwl/cfwl_widget.h
+++ b/xfa/fwl/cfwl_widget.h
@@ -104,7 +104,7 @@ class CFWL_Widget : public IFWL_WidgetDelegate {
     return m_pDelegate ? m_pDelegate.Get() : this;
   }
 
-  const CFWL_App* GetOwnerApp() const { return m_pOwnerApp; }
+  const CFWL_App* GetOwnerApp() const { return m_pOwnerApp.Get(); }
   uint32_t GetEventKey() const { return m_nEventKey; }
   void SetEventKey(uint32_t key) { m_nEventKey = key; }
 
@@ -148,8 +148,8 @@ class CFWL_Widget : public IFWL_WidgetDelegate {
                   IFWL_ThemeProvider* pTheme,
                   const CFX_Matrix* pMatrix);
 
-  const CFWL_App* const m_pOwnerApp;
-  CFWL_WidgetMgr* const m_pWidgetMgr;
+  CFX_UnownedPtr<const CFWL_App> const m_pOwnerApp;
+  CFX_UnownedPtr<CFWL_WidgetMgr> const m_pWidgetMgr;
   std::unique_ptr<CFWL_WidgetProperties> m_pProperties;
   CFWL_Widget* m_pOuter;
   int32_t m_iLock;
diff --git a/xfa/fwl/cfwl_widgetmgr.h b/xfa/fwl/cfwl_widgetmgr.h
index c3dca31d76..4c12e707f6 100644
--- a/xfa/fwl/cfwl_widgetmgr.h
+++ b/xfa/fwl/cfwl_widgetmgr.h
@@ -116,7 +116,7 @@ class CFWL_WidgetMgr : public CFWL_WidgetMgrDelegate {
 
   uint32_t m_dwCapability;
   std::map<CFWL_Widget*, std::unique_ptr<Item>> m_mapWidgetItem;
-  CXFA_FWLAdapterWidgetMgr* const m_pAdapter;
+  CFX_UnownedPtr<CXFA_FWLAdapterWidgetMgr> const m_pAdapter;
 #if (_FX_OS_ == _FX_WIN32_DESKTOP_) || (_FX_OS_ == _FX_WIN64_)
   CFX_RectF m_rtScreen;
 #endif
diff --git a/xfa/fxfa/app/xfa_ffcheckbutton.cpp b/xfa/fxfa/app/xfa_ffcheckbutton.cpp
index 9837e0aa7b..76531cecdd 100644
--- a/xfa/fxfa/app/xfa_ffcheckbutton.cpp
+++ b/xfa/fxfa/app/xfa_ffcheckbutton.cpp
@@ -320,7 +320,7 @@ void CXFA_FFCheckButton::OnProcessEvent(CFWL_Event* pEvent) {
           m_pDocView->AddCalculateWidgetAcc(pFFExclGroup);
           pFFExclGroup->ProcessEvent(XFA_ATTRIBUTEENUM_Change, &eParam);
         }
-        eParam.m_pTarget = m_pDataAcc;
+        eParam.m_pTarget = m_pDataAcc.Get();
         m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_Change, &eParam);
       } else {
         SetFWLCheckState(m_pDataAcc->GetCheckState());
@@ -329,7 +329,7 @@ void CXFA_FFCheckButton::OnProcessEvent(CFWL_Event* pEvent) {
         eParam.m_pTarget = pFFExclGroup;
         pFFExclGroup->ProcessEvent(XFA_ATTRIBUTEENUM_Click, &eParam);
       }
-      eParam.m_pTarget = m_pDataAcc;
+      eParam.m_pTarget = m_pDataAcc.Get();
       m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_Click, &eParam);
       break;
     }
diff --git a/xfa/fxfa/app/xfa_ffchoicelist.cpp b/xfa/fxfa/app/xfa_ffchoicelist.cpp
index b191f838ce..e24e7f77b7 100644
--- a/xfa/fxfa/app/xfa_ffchoicelist.cpp
+++ b/xfa/fxfa/app/xfa_ffchoicelist.cpp
@@ -166,7 +166,7 @@ bool CXFA_FFListBox::UpdateFWLData() {
 void CXFA_FFListBox::OnSelectChanged(CFWL_Widget* pWidget) {
   CXFA_EventParam eParam;
   eParam.m_eType = XFA_EVENT_Change;
-  eParam.m_pTarget = m_pDataAcc;
+  eParam.m_pTarget = m_pDataAcc.Get();
   m_pDataAcc->GetValue(eParam.m_wsPrevText, XFA_VALUEPICTURE_Raw);
 
   auto* pListBox = ToListBox(m_pNormalWidget.get());
@@ -342,7 +342,7 @@ bool CXFA_FFComboBox::IsDataChanged() {
 
 void CXFA_FFComboBox::FWLEventSelChange(CXFA_EventParam* pParam) {
   pParam->m_eType = XFA_EVENT_Change;
-  pParam->m_pTarget = m_pDataAcc;
+  pParam->m_pTarget = m_pDataAcc.Get();
   pParam->m_wsNewText = ToComboBox(m_pNormalWidget.get())->GetEditText();
   m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_Change, pParam);
 }
@@ -514,14 +514,14 @@ void CXFA_FFComboBox::OnSelectChanged(CFWL_Widget* pWidget, bool bLButtonUp) {
 void CXFA_FFComboBox::OnPreOpen(CFWL_Widget* pWidget) {
   CXFA_EventParam eParam;
   eParam.m_eType = XFA_EVENT_PreOpen;
-  eParam.m_pTarget = m_pDataAcc;
+  eParam.m_pTarget = m_pDataAcc.Get();
   m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_PreOpen, &eParam);
 }
 
 void CXFA_FFComboBox::OnPostOpen(CFWL_Widget* pWidget) {
   CXFA_EventParam eParam;
   eParam.m_eType = XFA_EVENT_PostOpen;
-  eParam.m_pTarget = m_pDataAcc;
+  eParam.m_pTarget = m_pDataAcc.Get();
   m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_PostOpen, &eParam);
 }
 
diff --git a/xfa/fxfa/app/xfa_fffield.cpp b/xfa/fxfa/app/xfa_fffield.cpp
index 186f573182..425ba30843 100644
--- a/xfa/fxfa/app/xfa_fffield.cpp
+++ b/xfa/fxfa/app/xfa_fffield.cpp
@@ -639,14 +639,14 @@ bool CXFA_FFField::ProcessCommittedData() {
     return false;
 
   m_pDocView->SetChangeMark();
-  m_pDocView->AddValidateWidget(m_pDataAcc);
+  m_pDocView->AddValidateWidget(m_pDataAcc.Get());
   return true;
 }
 
 int32_t CXFA_FFField::CalculateOverride() {
   CXFA_WidgetAcc* pAcc = m_pDataAcc->GetExclGroup();
   if (!pAcc)
-    return CalculateWidgetAcc(m_pDataAcc);
+    return CalculateWidgetAcc(m_pDataAcc.Get());
   if (CalculateWidgetAcc(pAcc) == 0)
     return 0;
 
@@ -745,26 +745,26 @@ void CXFA_FFField::OnProcessMessage(CFWL_Message* pMessage) {}
 void CXFA_FFField::OnProcessEvent(CFWL_Event* pEvent) {
   switch (pEvent->GetType()) {
     case CFWL_Event::Type::Mouse: {
-      CFWL_EventMouse* event = (CFWL_EventMouse*)pEvent;
+      CFWL_EventMouse* event = static_cast<CFWL_EventMouse*>(pEvent);
       if (event->m_dwCmd == FWL_MouseCommand::Enter) {
         CXFA_EventParam eParam;
         eParam.m_eType = XFA_EVENT_MouseEnter;
-        eParam.m_pTarget = m_pDataAcc;
+        eParam.m_pTarget = m_pDataAcc.Get();
         m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_MouseEnter, &eParam);
       } else if (event->m_dwCmd == FWL_MouseCommand::Leave) {
         CXFA_EventParam eParam;
         eParam.m_eType = XFA_EVENT_MouseExit;
-        eParam.m_pTarget = m_pDataAcc;
+        eParam.m_pTarget = m_pDataAcc.Get();
         m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_MouseExit, &eParam);
       } else if (event->m_dwCmd == FWL_MouseCommand::LeftButtonDown) {
         CXFA_EventParam eParam;
         eParam.m_eType = XFA_EVENT_MouseDown;
-        eParam.m_pTarget = m_pDataAcc;
+        eParam.m_pTarget = m_pDataAcc.Get();
         m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_MouseDown, &eParam);
       } else if (event->m_dwCmd == FWL_MouseCommand::LeftButtonUp) {
         CXFA_EventParam eParam;
         eParam.m_eType = XFA_EVENT_MouseUp;
-        eParam.m_pTarget = m_pDataAcc;
+        eParam.m_pTarget = m_pDataAcc.Get();
         m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_MouseUp, &eParam);
       }
       break;
@@ -772,7 +772,7 @@ void CXFA_FFField::OnProcessEvent(CFWL_Event* pEvent) {
     case CFWL_Event::Type::Click: {
       CXFA_EventParam eParam;
       eParam.m_eType = XFA_EVENT_Click;
-      eParam.m_pTarget = m_pDataAcc;
+      eParam.m_pTarget = m_pDataAcc.Get();
       m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_Click, &eParam);
       break;
     }
diff --git a/xfa/fxfa/app/xfa_ffnotify.cpp b/xfa/fxfa/app/xfa_ffnotify.cpp
index 475fa09eda..b07b625538 100644
--- a/xfa/fxfa/app/xfa_ffnotify.cpp
+++ b/xfa/fxfa/app/xfa_ffnotify.cpp
@@ -251,7 +251,7 @@ void CXFA_FFNotify::AddCalcValidate(CXFA_Node* pNode) {
 }
 
 CXFA_FFDoc* CXFA_FFNotify::GetHDOC() {
-  return m_pDoc;
+  return m_pDoc.Get();
 }
 
 IXFA_DocEnvironment* CXFA_FFNotify::GetDocEnvironment() const {
@@ -468,7 +468,7 @@ void CXFA_FFNotify::OnChildAdded(CXFA_Node* pSender) {
       !(pDocView->m_bInLayoutStatus) &&
       (pDocView->GetLayoutStatus() == XFA_DOCVIEW_LAYOUTSTATUS_End);
   if (bLayoutReady)
-    m_pDoc->GetDocEnvironment()->SetChangeMark(m_pDoc);
+    m_pDoc->GetDocEnvironment()->SetChangeMark(m_pDoc.Get());
 }
 
 void CXFA_FFNotify::OnChildRemoved() {
@@ -480,7 +480,7 @@ void CXFA_FFNotify::OnChildRemoved() {
       !(pDocView->m_bInLayoutStatus) &&
       (pDocView->GetLayoutStatus() == XFA_DOCVIEW_LAYOUTSTATUS_End);
   if (bLayoutReady)
-    m_pDoc->GetDocEnvironment()->SetChangeMark(m_pDoc);
+    m_pDoc->GetDocEnvironment()->SetChangeMark(m_pDoc.Get());
 }
 
 void CXFA_FFNotify::OnLayoutItemAdded(CXFA_LayoutProcessor* pLayout,
diff --git a/xfa/fxfa/app/xfa_ffnotify.h b/xfa/fxfa/app/xfa_ffnotify.h
index c002ed4c15..930d3b6a90 100644
--- a/xfa/fxfa/app/xfa_ffnotify.h
+++ b/xfa/fxfa/app/xfa_ffnotify.h
@@ -71,7 +71,7 @@ class CXFA_FFNotify {
   void SetFocusWidgetNode(CXFA_Node* pNode);
 
  private:
-  CXFA_FFDoc* const m_pDoc;
+  CFX_UnownedPtr<CXFA_FFDoc> const m_pDoc;
 };
 
 #endif  // XFA_FXFA_APP_XFA_FFNOTIFY_H_
diff --git a/xfa/fxfa/app/xfa_ffpushbutton.cpp b/xfa/fxfa/app/xfa_ffpushbutton.cpp
index 9d9cf070b4..b596996b6c 100644
--- a/xfa/fxfa/app/xfa_ffpushbutton.cpp
+++ b/xfa/fxfa/app/xfa_ffpushbutton.cpp
@@ -141,7 +141,7 @@ void CXFA_FFPushButton::LoadHighlightCaption() {
   if (m_pDataAcc->GetButtonRollover(wsRollover, bRichText)) {
     if (!m_pRollProvider) {
       m_pRollProvider = pdfium::MakeUnique<CXFA_TextProvider>(
-          m_pDataAcc, XFA_TEXTPROVIDERTYPE_Rollover);
+          m_pDataAcc.Get(), XFA_TEXTPROVIDERTYPE_Rollover);
     }
     m_pRolloverTextLayout =
         pdfium::MakeUnique<CXFA_TextLayout>(m_pRollProvider.get());
@@ -150,7 +150,7 @@ void CXFA_FFPushButton::LoadHighlightCaption() {
   if (m_pDataAcc->GetButtonDown(wsDown, bRichText)) {
     if (!m_pDownProvider) {
       m_pDownProvider = pdfium::MakeUnique<CXFA_TextProvider>(
-          m_pDataAcc, XFA_TEXTPROVIDERTYPE_Down);
+          m_pDataAcc.Get(), XFA_TEXTPROVIDERTYPE_Down);
     }
     m_pDownTextLayout =
         pdfium::MakeUnique<CXFA_TextLayout>(m_pDownProvider.get());
diff --git a/xfa/fxfa/app/xfa_fftextedit.cpp b/xfa/fxfa/app/xfa_fftextedit.cpp
index a1030f538a..41305efcc8 100644
--- a/xfa/fxfa/app/xfa_fftextedit.cpp
+++ b/xfa/fxfa/app/xfa_fftextedit.cpp
@@ -307,7 +307,7 @@ void CXFA_FFTextEdit::OnTextChanged(CFWL_Widget* pWidget,
   CXFA_EventParam eParam;
   eParam.m_eType = XFA_EVENT_Change;
   eParam.m_wsChange = wsChanged;
-  eParam.m_pTarget = m_pDataAcc;
+  eParam.m_pTarget = m_pDataAcc.Get();
   eParam.m_wsPrevText = wsPrevText;
   CFWL_Edit* pEdit = static_cast<CFWL_Edit*>(m_pNormalWidget.get());
   if (m_pDataAcc->GetUIType() == XFA_Element::DateTimeEdit) {
@@ -328,7 +328,7 @@ void CXFA_FFTextEdit::OnTextChanged(CFWL_Widget* pWidget,
 void CXFA_FFTextEdit::OnTextFull(CFWL_Widget* pWidget) {
   CXFA_EventParam eParam;
   eParam.m_eType = XFA_EVENT_Full;
-  eParam.m_pTarget = m_pDataAcc;
+  eParam.m_pTarget = m_pDataAcc.Get();
   m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_Full, &eParam);
 }
 
@@ -450,7 +450,7 @@ bool CXFA_FFNumericEdit::OnValidate(CFWL_Widget* pWidget,
   m_pDataAcc->GetFracDigits(iFracs);
 
   CFX_WideString wsFormat;
-  CXFA_LocaleValue widgetValue = XFA_GetLocaleValue(m_pDataAcc);
+  CXFA_LocaleValue widgetValue = XFA_GetLocaleValue(m_pDataAcc.Get());
   widgetValue.GetNumbericFormat(wsFormat, iLeads, iFracs);
   return widgetValue.ValidateNumericTemp(wsText, wsFormat,
                                          m_pDataAcc->GetLocal());
@@ -545,7 +545,7 @@ bool CXFA_FFDateTimeEdit::LoadWidget() {
     switch (value.GetChildValueClassID()) {
       case XFA_Element::Date: {
         if (!wsText.IsEmpty()) {
-          CXFA_LocaleValue lcValue = XFA_GetLocaleValue(m_pDataAcc);
+          CXFA_LocaleValue lcValue = XFA_GetLocaleValue(m_pDataAcc.Get());
           CFX_DateTime date = lcValue.GetDate();
           if (date.IsSet())
             pWidget->SetCurSel(date.GetYear(), date.GetMonth(), date.GetDay());
@@ -647,7 +647,7 @@ bool CXFA_FFDateTimeEdit::UpdateFWLData() {
   auto* normalWidget = static_cast<CFWL_DateTimePicker*>(m_pNormalWidget.get());
   normalWidget->SetEditText(wsText);
   if (IsFocused() && !wsText.IsEmpty()) {
-    CXFA_LocaleValue lcValue = XFA_GetLocaleValue(m_pDataAcc);
+    CXFA_LocaleValue lcValue = XFA_GetLocaleValue(m_pDataAcc.Get());
     CFX_DateTime date = lcValue.GetDate();
     if (lcValue.IsValid()) {
       if (date.IsSet())
@@ -690,7 +690,7 @@ void CXFA_FFDateTimeEdit::OnSelectChanged(CFWL_Widget* pWidget,
 
   CXFA_EventParam eParam;
   eParam.m_eType = XFA_EVENT_Change;
-  eParam.m_pTarget = m_pDataAcc;
+  eParam.m_pTarget = m_pDataAcc.Get();
   m_pDataAcc->GetValue(eParam.m_wsNewText, XFA_VALUEPICTURE_Raw);
   m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_Change, &eParam);
 }
diff --git a/xfa/fxfa/app/xfa_fwltheme.h b/xfa/fxfa/app/xfa_fwltheme.h
index 33ea8e80a5..7563c69ed9 100644
--- a/xfa/fxfa/app/xfa_fwltheme.h
+++ b/xfa/fxfa/app/xfa_fwltheme.h
@@ -61,7 +61,7 @@ class CXFA_FWLTheme final : public IFWL_ThemeProvider {
   std::unique_ptr<CFDE_TextOut> m_pTextOut;
   CFX_RetainPtr<CFGAS_GEFont> m_pCalendarFont;
   CFX_WideString m_wsResource;
-  CXFA_FFApp* const m_pApp;
+  CFX_UnownedPtr<CXFA_FFApp> const m_pApp;
   CFX_RectF m_Rect;
 };
 
diff --git a/xfa/fxfa/cxfa_ffapp.h b/xfa/fxfa/cxfa_ffapp.h
index 1ae2073d82..0da4e79173 100644
--- a/xfa/fxfa/cxfa_ffapp.h
+++ b/xfa/fxfa/cxfa_ffapp.h
@@ -40,7 +40,7 @@ class CXFA_FFApp {
   CFGAS_FontMgr* GetFDEFontMgr();
   CXFA_FWLTheme* GetFWLTheme();
 
-  IXFA_AppProvider* GetAppProvider() const { return m_pProvider; }
+  IXFA_AppProvider* GetAppProvider() const { return m_pProvider.Get(); }
   const CFWL_App* GetFWLApp() const { return m_pFWLApp.get(); }
   IFWL_AdapterTimerMgr* GetTimerMgr() const;
   CXFA_FontMgr* GetXFAFontMgr() const;
@@ -52,7 +52,7 @@ class CXFA_FFApp {
 
  private:
   std::unique_ptr<CXFA_FFDocHandler> m_pDocHandler;
-  IXFA_AppProvider* const m_pProvider;
+  CFX_UnownedPtr<IXFA_AppProvider> const m_pProvider;
 
   // The fonts stored in the font manager may have been created by the default
   // font manager. The GEFont::LoadFont call takes the manager as a param and
diff --git a/xfa/fxfa/cxfa_ffpageview.cpp b/xfa/fxfa/cxfa_ffpageview.cpp
index d027a83ce1..c83ffaea7e 100644
--- a/xfa/fxfa/cxfa_ffpageview.cpp
+++ b/xfa/fxfa/cxfa_ffpageview.cpp
@@ -115,7 +115,7 @@ CXFA_FFPageView::CXFA_FFPageView(CXFA_FFDocView* pDocView, CXFA_Node* pPageArea)
 CXFA_FFPageView::~CXFA_FFPageView() {}
 
 CXFA_FFDocView* CXFA_FFPageView::GetDocView() const {
-  return m_pDocView;
+  return m_pDocView.Get();
 }
 
 CFX_RectF CXFA_FFPageView::GetPageViewRect() const {
diff --git a/xfa/fxfa/cxfa_ffpageview.h b/xfa/fxfa/cxfa_ffpageview.h
index 01409f3403..f2451fbd26 100644
--- a/xfa/fxfa/cxfa_ffpageview.h
+++ b/xfa/fxfa/cxfa_ffpageview.h
@@ -31,7 +31,7 @@ class CXFA_FFPageView : public CXFA_ContainerLayoutItem {
       uint32_t dwWidgetFilter);
 
  protected:
-  CXFA_FFDocView* const m_pDocView;
+  CFX_UnownedPtr<CXFA_FFDocView> const m_pDocView;
 };
 
 using CXFA_LayoutItemIterator =
@@ -68,11 +68,11 @@ class CXFA_TabParam {
 
   void AppendTabParam(CXFA_TabParam* pParam);
   void ClearChildren();
-  CXFA_FFWidget* GetWidget() { return m_pWidget; }
+  CXFA_FFWidget* GetWidget() const { return m_pWidget.Get(); }
   const std::vector<CXFA_FFWidget*>& GetChildren() const { return m_Children; }
 
  private:
-  CXFA_FFWidget* const m_pWidget;
+  CFX_UnownedPtr<CXFA_FFWidget> const m_pWidget;
   std::vector<CXFA_FFWidget*> m_Children;
 };
 
diff --git a/xfa/fxfa/cxfa_ffwidget.cpp b/xfa/fxfa/cxfa_ffwidget.cpp
index 78bc5ed598..9de99255ab 100644
--- a/xfa/fxfa/cxfa_ffwidget.cpp
+++ b/xfa/fxfa/cxfa_ffwidget.cpp
@@ -98,7 +98,7 @@ CFX_RectF CXFA_FFWidget::GetBBox(uint32_t dwStatus, bool bDrawFocus) {
 }
 
 CXFA_WidgetAcc* CXFA_FFWidget::GetDataAcc() {
-  return m_pDataAcc;
+  return m_pDataAcc.Get();
 }
 
 bool CXFA_FFWidget::GetToolTip(CFX_WideString& wsToolTip) {
@@ -238,7 +238,7 @@ bool CXFA_FFWidget::OnSetFocus(CXFA_FFWidget* pOldWidget) {
   m_dwStatus |= XFA_WidgetStatus_Focused;
   CXFA_EventParam eParam;
   eParam.m_eType = XFA_EVENT_Enter;
-  eParam.m_pTarget = m_pDataAcc;
+  eParam.m_pTarget = m_pDataAcc.Get();
   m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_Enter, &eParam);
   return true;
 }
@@ -490,7 +490,7 @@ void CXFA_FFWidget::EventKillFocus() {
   }
   CXFA_EventParam eParam;
   eParam.m_eType = XFA_EVENT_Exit;
-  eParam.m_pTarget = m_pDataAcc;
+  eParam.m_pTarget = m_pDataAcc.Get();
   m_pDataAcc->ProcessEvent(XFA_ATTRIBUTEENUM_Exit, &eParam);
 }
 bool CXFA_FFWidget::IsButtonDown() {
diff --git a/xfa/fxfa/cxfa_ffwidget.h b/xfa/fxfa/cxfa_ffwidget.h
index 2ca27c1303..b7bb123bda 100644
--- a/xfa/fxfa/cxfa_ffwidget.h
+++ b/xfa/fxfa/cxfa_ffwidget.h
@@ -185,7 +185,7 @@ class CXFA_FFWidget : public CXFA_ContentLayoutItem {
 
   CXFA_FFDocView* m_pDocView;
   CXFA_FFPageView* m_pPageView;
-  CXFA_WidgetAcc* const m_pDataAcc;
+  CFX_UnownedPtr<CXFA_WidgetAcc> const m_pDataAcc;
   mutable CFX_RectF m_rtWidget;
 };
 
diff --git a/xfa/fxfa/cxfa_pdffontmgr.h b/xfa/fxfa/cxfa_pdffontmgr.h
index d0a824067a..df8ab28e08 100644
--- a/xfa/fxfa/cxfa_pdffontmgr.h
+++ b/xfa/fxfa/cxfa_pdffontmgr.h
@@ -50,7 +50,7 @@ class CXFA_PDFFontMgr : public CFX_Observable<CXFA_PDFFontMgr> {
                              const CFX_ByteString& bsDRFontName,
                              bool bStrictMatch);
 
-  CXFA_FFDoc* const m_pDoc;
+  CFX_UnownedPtr<CXFA_FFDoc> const m_pDoc;
   std::map<CFX_RetainPtr<CFGAS_GEFont>, CPDF_Font*> m_FDE2PDFFont;
   std::map<CFX_ByteString, CFX_RetainPtr<CFGAS_GEFont>> m_FontMap;
 };
diff --git a/xfa/fxfa/fm2js/cxfa_fm2jscontext.h b/xfa/fxfa/fm2js/cxfa_fm2jscontext.h
index 0de3cc74b5..63fc0f42bd 100644
--- a/xfa/fxfa/fm2js/cxfa_fm2jscontext.h
+++ b/xfa/fxfa/fm2js/cxfa_fm2jscontext.h
@@ -434,7 +434,7 @@ class CXFA_FM2JSContext : public CFXJSE_HostObject {
 
  private:
   v8::Isolate* GetScriptRuntime() const { return m_pIsolate; }
-  CXFA_Document* GetDocument() const { return m_pDocument; }
+  CXFA_Document* GetDocument() const { return m_pDocument.Get(); }
 
   void ThrowNoDefaultPropertyException(const CFX_ByteStringC& name) const;
   void ThrowCompilerErrorException() const;
@@ -449,7 +449,7 @@ class CXFA_FM2JSContext : public CFXJSE_HostObject {
   v8::Isolate* m_pIsolate;
   CFXJSE_Class* m_pFMClass;
   std::unique_ptr<CFXJSE_Value> m_pValue;
-  CXFA_Document* const m_pDocument;
+  CFX_UnownedPtr<CXFA_Document> const m_pDocument;
 };
 
 #endif  // XFA_FXFA_FM2JS_CXFA_FM2JSCONTEXT_H_
diff --git a/xfa/fxfa/parser/cscript_layoutpseudomodel.cpp b/xfa/fxfa/parser/cscript_layoutpseudomodel.cpp
index 693d4029a3..6e6a1086ff 100644
--- a/xfa/fxfa/parser/cscript_layoutpseudomodel.cpp
+++ b/xfa/fxfa/parser/cscript_layoutpseudomodel.cpp
@@ -368,7 +368,8 @@ void CScript_LayoutPseudoModel::PageContent(CFXJSE_Arguments* pArguments) {
   if (!pDocLayout)
     return;
 
-  auto pArrayNodeList = pdfium::MakeUnique<CXFA_ArrayNodeList>(m_pDocument);
+  auto pArrayNodeList =
+      pdfium::MakeUnique<CXFA_ArrayNodeList>(m_pDocument.Get());
   pArrayNodeList->SetArrayNodeList(
       GetObjArray(pDocLayout, iIndex, wsType, bOnPageArea));
   pArguments->GetReturnValue()->SetObject(
diff --git a/xfa/fxfa/parser/cxfa_dataexporter.cpp b/xfa/fxfa/parser/cxfa_dataexporter.cpp
index dda93a36fc..49a1f5857b 100644
--- a/xfa/fxfa/parser/cxfa_dataexporter.cpp
+++ b/xfa/fxfa/parser/cxfa_dataexporter.cpp
@@ -458,6 +458,8 @@ CXFA_DataExporter::CXFA_DataExporter(CXFA_Document* pDocument)
   ASSERT(m_pDocument);
 }
 
+CXFA_DataExporter::~CXFA_DataExporter() {}
+
 bool CXFA_DataExporter::Export(
     const CFX_RetainPtr<IFX_SeekableStream>& pWrite) {
   return Export(pWrite, m_pDocument->GetRoot(), 0, nullptr);
diff --git a/xfa/fxfa/parser/cxfa_dataexporter.h b/xfa/fxfa/parser/cxfa_dataexporter.h
index cd949be964..4c0d90af9e 100644
--- a/xfa/fxfa/parser/cxfa_dataexporter.h
+++ b/xfa/fxfa/parser/cxfa_dataexporter.h
@@ -18,6 +18,7 @@ class CFX_SeekableStreamProxy;
 class CXFA_DataExporter {
  public:
   explicit CXFA_DataExporter(CXFA_Document* pDocument);
+  ~CXFA_DataExporter();
 
   bool Export(const CFX_RetainPtr<IFX_SeekableStream>& pWrite);
   bool Export(const CFX_RetainPtr<IFX_SeekableStream>& pWrite,
@@ -31,7 +32,7 @@ class CXFA_DataExporter {
               uint32_t dwFlag,
               const char* pChecksum);
 
-  CXFA_Document* const m_pDocument;
+  CFX_UnownedPtr<CXFA_Document> const m_pDocument;
 };
 
 #endif  // XFA_FXFA_PARSER_CXFA_DATAEXPORTER_H_
diff --git a/xfa/fxfa/parser/cxfa_dataimporter.cpp b/xfa/fxfa/parser/cxfa_dataimporter.cpp
index d83b92b08d..e4ae3d0796 100644
--- a/xfa/fxfa/parser/cxfa_dataimporter.cpp
+++ b/xfa/fxfa/parser/cxfa_dataimporter.cpp
@@ -22,10 +22,12 @@ CXFA_DataImporter::CXFA_DataImporter(CXFA_Document* pDocument)
   ASSERT(m_pDocument);
 }
 
+CXFA_DataImporter::~CXFA_DataImporter() {}
+
 bool CXFA_DataImporter::ImportData(
     const CFX_RetainPtr<IFX_SeekableStream>& pDataDocument) {
   auto pDataDocumentParser =
-      pdfium::MakeUnique<CXFA_SimpleParser>(m_pDocument, false);
+      pdfium::MakeUnique<CXFA_SimpleParser>(m_pDocument.Get(), false);
   if (pDataDocumentParser->StartParse(pDataDocument, XFA_XDPPACKET_Datasets) !=
       XFA_PARSESTATUS_Ready) {
     return false;
diff --git a/xfa/fxfa/parser/cxfa_dataimporter.h b/xfa/fxfa/parser/cxfa_dataimporter.h
index e76475cd1e..d3af1de517 100644
--- a/xfa/fxfa/parser/cxfa_dataimporter.h
+++ b/xfa/fxfa/parser/cxfa_dataimporter.h
@@ -8,6 +8,7 @@
 #define XFA_FXFA_PARSER_CXFA_DATAIMPORTER_H_
 
 #include "core/fxcrt/cfx_retain_ptr.h"
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_system.h"
 
 class CXFA_Document;
@@ -16,11 +17,12 @@ class IFX_SeekableStream;
 class CXFA_DataImporter {
  public:
   explicit CXFA_DataImporter(CXFA_Document* pDocument);
+  ~CXFA_DataImporter();
 
   bool ImportData(const CFX_RetainPtr<IFX_SeekableStream>& pDataDocument);
 
  private:
-  CXFA_Document* const m_pDocument;
+  CFX_UnownedPtr<CXFA_Document> const m_pDocument;
 };
 
 #endif  // XFA_FXFA_PARSER_CXFA_DATAIMPORTER_H_
diff --git a/xfa/fxfa/parser/cxfa_layoutprocessor.cpp b/xfa/fxfa/parser/cxfa_layoutprocessor.cpp
index 0fbae9e368..765f8b2fe7 100644
--- a/xfa/fxfa/parser/cxfa_layoutprocessor.cpp
+++ b/xfa/fxfa/parser/cxfa_layoutprocessor.cpp
@@ -24,7 +24,7 @@ CXFA_LayoutProcessor::CXFA_LayoutProcessor(CXFA_Document* pDocument)
 CXFA_LayoutProcessor::~CXFA_LayoutProcessor() {}
 
 CXFA_Document* CXFA_LayoutProcessor::GetDocument() const {
-  return m_pDocument;
+  return m_pDocument.Get();
 }
 
 int32_t CXFA_LayoutProcessor::StartLayout(bool bForceRestart) {
diff --git a/xfa/fxfa/parser/cxfa_layoutprocessor.h b/xfa/fxfa/parser/cxfa_layoutprocessor.h
index 5a48560f26..360a9df685 100644
--- a/xfa/fxfa/parser/cxfa_layoutprocessor.h
+++ b/xfa/fxfa/parser/cxfa_layoutprocessor.h
@@ -10,6 +10,7 @@
 #include <memory>
 #include <vector>
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_system.h"
 
 class CXFA_ContainerLayoutItem;
@@ -44,7 +45,7 @@ class CXFA_LayoutProcessor {
  private:
   bool IsNeedLayout();
 
-  CXFA_Document* const m_pDocument;
+  CFX_UnownedPtr<CXFA_Document> const m_pDocument;
   std::unique_ptr<CXFA_ItemLayoutProcessor> m_pRootItemLayoutProcessor;
   std::unique_ptr<CXFA_LayoutPageMgr> m_pLayoutPageMgr;
   std::vector<CXFA_Node*> m_rgChangedContainers;
diff --git a/xfa/fxfa/parser/cxfa_node.cpp b/xfa/fxfa/parser/cxfa_node.cpp
index e7ec4cf890..2daa49e066 100644
--- a/xfa/fxfa/parser/cxfa_node.cpp
+++ b/xfa/fxfa/parser/cxfa_node.cpp
@@ -1040,7 +1040,7 @@ void CXFA_Node::Script_Som_ResolveNodeList(CFXJSE_Value* pValue,
     refNode = this;
   pScriptContext->ResolveObjects(refNode, wsExpression.AsStringC(),
                                  resoveNodeRS, dwFlag);
-  CXFA_ArrayNodeList* pNodeList = new CXFA_ArrayNodeList(m_pDocument);
+  CXFA_ArrayNodeList* pNodeList = new CXFA_ArrayNodeList(m_pDocument.Get());
   if (resoveNodeRS.dwFlags == XFA_RESOVENODE_RSTYPE_Nodes) {
     for (CXFA_Object* pObject : resoveNodeRS.objects) {
       if (pObject->IsNode())
@@ -1083,7 +1083,8 @@ void CXFA_Node::Script_TreeClass_Nodes(CFXJSE_Value* pValue,
     CFX_WideString wsMessage = L"Unable to set ";
     FXJSE_ThrowMessage(wsMessage.UTF8Encode().AsStringC());
   } else {
-    CXFA_AttachNodeList* pNodeList = new CXFA_AttachNodeList(m_pDocument, this);
+    CXFA_AttachNodeList* pNodeList =
+        new CXFA_AttachNodeList(m_pDocument.Get(), this);
     pValue->SetObject(pNodeList, pScriptContext->GetJseNormalClass());
   }
 }
@@ -1282,7 +1283,8 @@ void CXFA_Node::Script_NodeClass_LoadXML(CFXJSE_Arguments* pArguments) {
     bIgnoreRoot = !!pArguments->GetInt32(1);
   if (iLength >= 3)
     bOverwrite = !!pArguments->GetInt32(2);
-  auto pParser = pdfium::MakeUnique<CXFA_SimpleParser>(m_pDocument, false);
+  auto pParser =
+      pdfium::MakeUnique<CXFA_SimpleParser>(m_pDocument.Get(), false);
   if (!pParser)
     return;
   CFX_XMLNode* pXMLNode = pParser->ParseXMLData(wsExpression);
@@ -1524,7 +1526,7 @@ void CXFA_Node::Script_NodeClass_OneOfChild(CFXJSE_Value* pValue,
 void CXFA_Node::Script_ContainerClass_GetDelta(CFXJSE_Arguments* pArguments) {}
 
 void CXFA_Node::Script_ContainerClass_GetDeltas(CFXJSE_Arguments* pArguments) {
-  CXFA_ArrayNodeList* pFormNodes = new CXFA_ArrayNodeList(m_pDocument);
+  CXFA_ArrayNodeList* pFormNodes = new CXFA_ArrayNodeList(m_pDocument.Get());
   pArguments->GetReturnValue()->SetObject(
       pFormNodes, m_pDocument->GetScriptContext()->GetJseNormalClass());
 }
@@ -3269,7 +3271,7 @@ void CXFA_Node::Script_Form_FormNodes(CFXJSE_Arguments* pArguments) {
   }
 
   std::vector<CXFA_Node*> formItems;
-  CXFA_ArrayNodeList* pFormNodes = new CXFA_ArrayNodeList(m_pDocument);
+  CXFA_ArrayNodeList* pFormNodes = new CXFA_ArrayNodeList(m_pDocument.Get());
   pFormNodes->SetArrayNodeList(formItems);
   pArguments->GetReturnValue()->SetObject(
       pFormNodes, m_pDocument->GetScriptContext()->GetJseNormalClass());
diff --git a/xfa/fxfa/parser/cxfa_nodelocale.h b/xfa/fxfa/parser/cxfa_nodelocale.h
index 2465650b47..e051bb6ac3 100644
--- a/xfa/fxfa/parser/cxfa_nodelocale.h
+++ b/xfa/fxfa/parser/cxfa_nodelocale.h
@@ -47,7 +47,7 @@ class CXFA_NodeLocale : public IFX_Locale {
                                    int index,
                                    bool bAbbr) const;
 
-  CXFA_Node* const m_pLocale;
+  CFX_UnownedPtr<CXFA_Node> const m_pLocale;
 };
 
 #endif  // XFA_FXFA_PARSER_CXFA_NODELOCALE_H_
diff --git a/xfa/fxfa/parser/cxfa_object.h b/xfa/fxfa/parser/cxfa_object.h
index 9596453712..4f1850f14c 100644
--- a/xfa/fxfa/parser/cxfa_object.h
+++ b/xfa/fxfa/parser/cxfa_object.h
@@ -38,7 +38,7 @@ class CXFA_Object : public CFXJSE_HostObject {
               const CFX_WideStringC& elementName);
   ~CXFA_Object() override;
 
-  CXFA_Document* GetDocument() const { return m_pDocument; }
+  CXFA_Document* GetDocument() const { return m_pDocument.Get(); }
   XFA_ObjectType GetObjectType() const { return m_objectType; }
 
   bool IsNode() const {
@@ -86,7 +86,7 @@ class CXFA_Object : public CFXJSE_HostObject {
  protected:
   void ThrowException(const wchar_t* str, ...) const;
 
-  CXFA_Document* const m_pDocument;
+  CFX_UnownedPtr<CXFA_Document> const m_pDocument;
   const XFA_ObjectType m_objectType;
   const XFA_Element m_elementType;
 
diff --git a/xfa/fxfa/parser/cxfa_scriptcontext.cpp b/xfa/fxfa/parser/cxfa_scriptcontext.cpp
index cf6467e240..49da63eee3 100644
--- a/xfa/fxfa/parser/cxfa_scriptcontext.cpp
+++ b/xfa/fxfa/parser/cxfa_scriptcontext.cpp
@@ -150,7 +150,7 @@ bool CXFA_ScriptContext::RunScript(XFA_SCRIPTLANGTYPE eScriptType,
   if (eScriptType == XFA_SCRIPTLANGTYPE_Formcalc) {
     if (!m_FM2JSContext) {
       m_FM2JSContext = pdfium::MakeUnique<CXFA_FM2JSContext>(
-          m_pIsolate, m_JsContext.get(), m_pDocument);
+          m_pIsolate, m_JsContext.get(), m_pDocument.Get());
     }
     CFX_WideTextBuf wsJavaScript;
     if (!CXFA_FM2JSContext::Translate(wsScript, &wsJavaScript)) {
diff --git a/xfa/fxfa/parser/cxfa_scriptcontext.h b/xfa/fxfa/parser/cxfa_scriptcontext.h
index d3a9609769..45e6897a4c 100644
--- a/xfa/fxfa/parser/cxfa_scriptcontext.h
+++ b/xfa/fxfa/parser/cxfa_scriptcontext.h
@@ -92,7 +92,7 @@ class CXFA_ScriptContext {
   bool IsStrictScopeInJavaScript();
   XFA_SCRIPTLANGTYPE GetType();
   std::vector<CXFA_Node*>* GetUpObjectArray() { return &m_upObjectArray; }
-  CXFA_Document* GetDocument() const { return m_pDocument; }
+  CXFA_Document* GetDocument() const { return m_pDocument.Get(); }
 
   static CXFA_Object* ToObject(CFXJSE_Value* pValue, CFXJSE_Class* pClass);
 
@@ -103,7 +103,7 @@ class CXFA_ScriptContext {
   void DefineJsClass();
   void RemoveBuiltInObjs(CFXJSE_Context* pContext) const;
 
-  CXFA_Document* const m_pDocument;
+  CFX_UnownedPtr<CXFA_Document> const m_pDocument;
   std::unique_ptr<CFXJSE_Context> m_JsContext;
   v8::Isolate* m_pIsolate;
   CFXJSE_Class* m_pJsClass;