Invalidate IPWL_FocusHandler and IPWL_Provider on destruction.

BUG=572871
TBR=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1564773003 .

(cherry picked from commit dcac57bc8b64fdc870d79d11a498ae7021cf8ae7)

Review URL: https://codereview.chromium.org/1569663002 .

8 files changed, 232 insertions, 2 deletions

diff --git a/fpdfsdk/include/pdfwindow/PWL_Wnd.h b/fpdfsdk/include/pdfwindow/PWL_Wnd.h
index 91baafa03d..0ea48b570d 100644
--- a/fpdfsdk/include/pdfwindow/PWL_Wnd.h
+++ b/fpdfsdk/include/pdfwindow/PWL_Wnd.h
@@ -288,6 +288,8 @@ class CPWL_Wnd : public CPWL_TimerHandler {
 
   void Create(const PWL_CREATEPARAM& cp);
   virtual CFX_ByteString GetClassName() const;
+  void InvalidateFocusHandler(IPWL_FocusHandler* handler);
+  void InvalidateProvider(IPWL_Provider* provider);
   void Destroy();
   void Move(const CPDF_Rect& rcNew, FX_BOOL bReset, FX_BOOL bRefresh);
   virtual void InvalidateRect(CPDF_Rect* pRect = NULL);
diff --git a/fpdfsdk/src/formfiller/FFL_ComboBox.cpp b/fpdfsdk/src/formfiller/FFL_ComboBox.cpp
index 49d76bb265..5e88a5d133 100644
--- a/fpdfsdk/src/formfiller/FFL_ComboBox.cpp
+++ b/fpdfsdk/src/formfiller/FFL_ComboBox.cpp
@@ -21,6 +21,8 @@ CFFL_ComboBox::CFFL_ComboBox(CPDFDoc_Environment* pApp, CPDFSDK_Annot* pAnnot)
 }
 
 CFFL_ComboBox::~CFFL_ComboBox() {
+  for (const auto& it : m_Maps)
+    it.second->InvalidateFocusHandler(this);
   delete m_pFontMap;
 }
 
diff --git a/fpdfsdk/src/formfiller/FFL_FormFiller.cpp b/fpdfsdk/src/formfiller/FFL_FormFiller.cpp
index 2e73b491c9..ce73f7d4cb 100644
--- a/fpdfsdk/src/formfiller/FFL_FormFiller.cpp
+++ b/fpdfsdk/src/formfiller/FFL_FormFiller.cpp
@@ -24,9 +24,10 @@ CFFL_FormFiller::CFFL_FormFiller(CPDFDoc_Environment* pApp,
 }
 
 CFFL_FormFiller::~CFFL_FormFiller() {
-  for (auto& it : m_Maps) {
+  for (const auto& it : m_Maps) {
     CPWL_Wnd* pWnd = it.second;
     CFFL_PrivateData* pData = (CFFL_PrivateData*)pWnd->GetAttachedData();
+    pWnd->InvalidateProvider(this);
     pWnd->Destroy();
     delete pWnd;
     delete pData;
diff --git a/fpdfsdk/src/formfiller/FFL_TextField.cpp b/fpdfsdk/src/formfiller/FFL_TextField.cpp
index 8d39b82dd5..ca4e07be4d 100644
--- a/fpdfsdk/src/formfiller/FFL_TextField.cpp
+++ b/fpdfsdk/src/formfiller/FFL_TextField.cpp
@@ -16,6 +16,8 @@ CFFL_TextField::CFFL_TextField(CPDFDoc_Environment* pApp, CPDFSDK_Annot* pAnnot)
 }
 
 CFFL_TextField::~CFFL_TextField() {
+  for (const auto& it : m_Maps)
+    it.second->InvalidateFocusHandler(this);
   delete m_pFontMap;
 }
 
diff --git a/fpdfsdk/src/fpdfview_embeddertest.cpp b/fpdfsdk/src/fpdfview_embeddertest.cpp
index 0f4666836f..6eb5fb95cd 100644
--- a/fpdfsdk/src/fpdfview_embeddertest.cpp
+++ b/fpdfsdk/src/fpdfview_embeddertest.cpp
@@ -196,10 +196,14 @@ TEST_F(FPDFViewEmbeddertest, Crasher_452455) {
 }
 
 TEST_F(FPDFViewEmbeddertest, Crasher_454695) {
-  // Document is damanged and can't be opened.
+  // Document is damaged and can't be opened.
   EXPECT_FALSE(OpenDocument("bug_454695.pdf"));
 }
 
+TEST_F(FPDFViewEmbeddertest, Crasher_572871) {
+  EXPECT_TRUE(OpenDocument("bug_572871.pdf"));
+}
+
 // The following tests pass if the document opens without infinite looping.
 TEST_F(FPDFViewEmbeddertest, Hang_298) {
   EXPECT_FALSE(OpenDocument("bug_298.pdf"));
diff --git a/fpdfsdk/src/pdfwindow/PWL_Wnd.cpp b/fpdfsdk/src/pdfwindow/PWL_Wnd.cpp
index 9c4e21713b..5bedad127a 100644
--- a/fpdfsdk/src/pdfwindow/PWL_Wnd.cpp
+++ b/fpdfsdk/src/pdfwindow/PWL_Wnd.cpp
@@ -237,6 +237,16 @@ void CPWL_Wnd::OnCreated() {}
 
 void CPWL_Wnd::OnDestroy() {}
 
+void CPWL_Wnd::InvalidateFocusHandler(IPWL_FocusHandler* handler) {
+  if (m_sPrivateParam.pFocusHandler == handler)
+    m_sPrivateParam.pFocusHandler = nullptr;
+}
+
+void CPWL_Wnd::InvalidateProvider(IPWL_Provider* provider) {
+  if (m_sPrivateParam.pProvider == provider)
+    m_sPrivateParam.pProvider = nullptr;
+}
+
 void CPWL_Wnd::Destroy() {
   KillFocus();
 
diff --git a/testing/resources/bug_572871.in b/testing/resources/bug_572871.in
new file mode 100644
index 0000000000..20cb94394e
--- /dev/null
+++ b/testing/resources/bug_572871.in
@@ -0,0 +1,96 @@
+{{header}}
+{{object 1 0}} <<
+  /Type /Catalog
+  /Pages 2 0 R
+  /AcroForm 3 0 R
+  /AA 11 0 R
+>>
+endobj
+{{object 2 0}} <<
+  /Type /Pages
+  /Count 3
+  /Kids [4 0 R 5 0 R 6 0 R ]
+>>
+endobj
+{{object 3 0}} <<
+  /CO [9 0 R]
+  /Fields [9 0 R 7 0 R]
+>>
+endobj
+{{object 4 0}} <<
+  /Type /Page
+  /Parent 2 0 R
+  /MediaBox [0 0 612 792]
+  /Resources <<>>
+>>
+endobj
+{{object 5 0}} <<
+  /Type /Page
+  /Parent 2 0 R
+  /MediaBox [0 0 612 792]
+  /Resources <<>>
+>>
+endobj
+{{object 6 0}} <<
+  /Type /Page
+  /Parent 2 0 R
+  /MediaBox [0 0 612 792]
+  /Resources <<>>
+  /Annots [7 0 R 9 0 R]
+>>
+endobj
+{{object 7 0}} <<
+  /FT /Tx
+  /Type /Annot
+  /Subtype /Widget
+  /T (txtName2)
+  /F 4
+  /AP <</N 8 0 R>>
+  /Rect [20 20 400 60]
+>>
+endobj
+{{object 8 0}} <<
+  /Type /XObject
+  /Subtype /Form
+  /FormType 1
+>>
+endobj
+{{object 9 0}} <<
+  /FT /Tx
+  /Type /Annot
+  /Subtype /Widget
+  /T (txtName1)
+  /F 4
+  /AP <</N 10 0 R>>
+  /Rect [200 200 400 260]
+>>
+endobj
+{{object 10 0}} <<
+  /Type /XObject
+  /Subtype /Form
+  /FormType 1
+>>
+endobj
+{{object 11 0}} <<
+  /WC 12 0 R
+>>
+endobj
+{{object 12 0}} <<
+  /Type /Action
+  /S /JavaScript
+  /JS 13 0 R
+>>
+endobj
+{{object 13 0}} <<>>
+stream
+t = this.getField('txtName2');
+t.setFocus();
+endstream
+endobj
+{{xref}}
+trailer <<
+  /Size 14
+  /Root 1 0 R
+>>
+{{startxref}}
+%%EOF
diff --git a/testing/resources/bug_572871.pdf b/testing/resources/bug_572871.pdf
new file mode 100644
index 0000000000..1f26bc56a2
--- /dev/null
+++ b/testing/resources/bug_572871.pdf
@@ -0,0 +1,113 @@
+%PDF-1.7
+% ò¤ô
+1 0 obj <<
+  /Type /Catalog
+  /Pages 2 0 R
+  /AcroForm 3 0 R
+  /AA 11 0 R
+>>
+endobj
+2 0 obj <<
+  /Type /Pages
+  /Count 3
+  /Kids [4 0 R 5 0 R 6 0 R ]
+>>
+endobj
+3 0 obj <<
+  /CO [9 0 R]
+  /Fields [9 0 R 7 0 R]
+>>
+endobj
+4 0 obj <<
+  /Type /Page
+  /Parent 2 0 R
+  /MediaBox [0 0 612 792]
+  /Resources <<>>
+>>
+endobj
+5 0 obj <<
+  /Type /Page
+  /Parent 2 0 R
+  /MediaBox [0 0 612 792]
+  /Resources <<>>
+>>
+endobj
+6 0 obj <<
+  /Type /Page
+  /Parent 2 0 R
+  /MediaBox [0 0 612 792]
+  /Resources <<>>
+  /Annots [7 0 R 9 0 R]
+>>
+endobj
+7 0 obj <<
+  /FT /Tx
+  /Type /Annot
+  /Subtype /Widget
+  /T (txtName2)
+  /F 4
+  /AP <</N 8 0 R>>
+  /Rect [20 20 400 60]
+>>
+endobj
+8 0 obj <<
+  /Type /XObject
+  /Subtype /Form
+  /FormType 1
+>>
+endobj
+9 0 obj <<
+  /FT /Tx
+  /Type /Annot
+  /Subtype /Widget
+  /T (txtName1)
+  /F 4
+  /AP <</N 10 0 R>>
+  /Rect [200 200 400 260]
+>>
+endobj
+10 0 obj <<
+  /Type /XObject
+  /Subtype /Form
+  /FormType 1
+>>
+endobj
+11 0 obj <<
+  /WC 12 0 R
+>>
+endobj
+12 0 obj <<
+  /Type /Action
+  /S /JavaScript
+  /JS 13 0 R
+>>
+endobj
+13 0 obj <<>>
+stream
+t = this.getField('txtName2');
+t.setFocus();
+endstream
+endobj
+xref
+0 14
+0000000000 65535 f 
+0000000015 00000 n 
+0000000099 00000 n 
+0000000175 00000 n 
+0000000234 00000 n 
+0000000329 00000 n 
+0000000424 00000 n 
+0000000543 00000 n 
+0000000673 00000 n 
+0000000742 00000 n 
+0000000876 00000 n 
+0000000946 00000 n 
+0000000981 00000 n 
+0000001049 00000 n 
+trailer <<
+  /Size 14
+  /Root 1 0 R
+>>
+startxref
+1132
+%%EOF