Use Unowned/Observed pointers between doc and FF onwership hierarchies.

See the explanation in CPDFSDK_FormFillEnvironment.h

Change-Id: I52feb25fb358831233a636e3ead5aa70e98c5baa
Reviewed-on: https://pdfium-review.googlesource.com/5658
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

16 files changed, 64 insertions, 36 deletions

diff --git a/fpdfsdk/cfx_systemhandler.cpp b/fpdfsdk/cfx_systemhandler.cpp
index 277e34b18c..d38c6270f7 100644
--- a/fpdfsdk/cfx_systemhandler.cpp
+++ b/fpdfsdk/cfx_systemhandler.cpp
@@ -35,6 +35,11 @@ int CharSet2CP(int charset) {
 
 }  // namespace
 
+CFX_SystemHandler::CFX_SystemHandler(CPDFSDK_FormFillEnvironment* pFormFillEnv)
+    : m_pFormFillEnv(pFormFillEnv) {}
+
+CFX_SystemHandler::~CFX_SystemHandler() {}
+
 void CFX_SystemHandler::InvalidateRect(CPDFSDK_Widget* widget, FX_RECT rect) {
   CPDFSDK_PageView* pPageView = widget->GetPageView();
   UnderlyingPageType* pPage = widget->GetUnderlyingPage();
diff --git a/fpdfsdk/cfx_systemhandler.h b/fpdfsdk/cfx_systemhandler.h
index 82cfc531ca..aa243c0e11 100644
--- a/fpdfsdk/cfx_systemhandler.h
+++ b/fpdfsdk/cfx_systemhandler.h
@@ -7,6 +7,7 @@
 #ifndef FPDFSDK_CFX_SYSTEMHANDLER_H_
 #define FPDFSDK_CFX_SYSTEMHANDLER_H_
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_system.h"
 
@@ -49,16 +50,13 @@ class CPDFSDK_Widget;
 
 class CFX_SystemHandler {
  public:
-  explicit CFX_SystemHandler(CPDFSDK_FormFillEnvironment* pFormFillEnv)
-      : m_pFormFillEnv(pFormFillEnv) {}
-  ~CFX_SystemHandler() {}
+  explicit CFX_SystemHandler(CPDFSDK_FormFillEnvironment* pFormFillEnv);
+  ~CFX_SystemHandler();
 
   void InvalidateRect(CPDFSDK_Widget* widget, FX_RECT rect);
   void OutputSelectedRect(CFFL_FormFiller* pFormFiller, CFX_FloatRect& rect);
   bool IsSelectionImplemented() const;
-
   void SetCursor(int32_t nCursorType);
-
   bool FindNativeTrueTypeFont(CFX_ByteString sFontFaceName);
   CPDF_Font* AddNativeTrueTypeFontToPDF(CPDF_Document* pDoc,
                                         CFX_ByteString sFontFaceName,
@@ -66,13 +64,12 @@ class CFX_SystemHandler {
 
   int32_t SetTimer(int32_t uElapse, TimerCallback lpTimerFunc);
   void KillTimer(int32_t nID);
-
   bool IsSHIFTKeyDown(uint32_t nFlag) const;
   bool IsCTRLKeyDown(uint32_t nFlag) const;
   bool IsALTKeyDown(uint32_t nFlag) const;
 
  private:
-  CPDFSDK_FormFillEnvironment* const m_pFormFillEnv;
+  CFX_UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
 };
 
 #endif  // FPDFSDK_CFX_SYSTEMHANDLER_H_
diff --git a/fpdfsdk/cpdfsdk_annothandlermgr.h b/fpdfsdk/cpdfsdk_annothandlermgr.h
index cbda02cbed..f36c3fb70e 100644
--- a/fpdfsdk/cpdfsdk_annothandlermgr.h
+++ b/fpdfsdk/cpdfsdk_annothandlermgr.h
@@ -11,6 +11,7 @@
 #include <memory>
 
 #include "core/fpdfdoc/cpdf_annot.h"
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_basic.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "fpdfsdk/cpdfsdk_annot.h"
@@ -112,7 +113,7 @@ class CPDFSDK_AnnotHandlerMgr {
   std::unique_ptr<CPDFSDK_XFAWidgetHandler> m_pXFAWidgetHandler;
 #endif  // PDF_ENABLE_XFA
 
-  CPDFSDK_FormFillEnvironment* m_pFormFillEnv;
+  CFX_UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
 };
 
 #endif  // FPDFSDK_CPDFSDK_ANNOTHANDLERMGR_H_
diff --git a/fpdfsdk/cpdfsdk_formfillenvironment.cpp b/fpdfsdk/cpdfsdk_formfillenvironment.cpp
index f17d28b9b6..cb5509681a 100644
--- a/fpdfsdk/cpdfsdk_formfillenvironment.cpp
+++ b/fpdfsdk/cpdfsdk_formfillenvironment.cpp
@@ -580,13 +580,13 @@ CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetPageView(
 
 CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetCurrentView() {
   UnderlyingPageType* pPage =
-      UnderlyingFromFPDFPage(GetCurrentPage(m_pUnderlyingDoc));
+      UnderlyingFromFPDFPage(GetCurrentPage(m_pUnderlyingDoc.Get()));
   return pPage ? GetPageView(pPage, true) : nullptr;
 }
 
 CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetPageView(int nIndex) {
   UnderlyingPageType* pTempPage =
-      UnderlyingFromFPDFPage(GetPage(m_pUnderlyingDoc, nIndex));
+      UnderlyingFromFPDFPage(GetPage(m_pUnderlyingDoc.Get(), nIndex));
   if (!pTempPage)
     return nullptr;
 
@@ -665,7 +665,7 @@ void CPDFSDK_FormFillEnvironment::RemovePageView(
 }
 
 UnderlyingPageType* CPDFSDK_FormFillEnvironment::GetPage(int nIndex) {
-  return UnderlyingFromFPDFPage(GetPage(m_pUnderlyingDoc, nIndex));
+  return UnderlyingFromFPDFPage(GetPage(m_pUnderlyingDoc.Get(), nIndex));
 }
 
 CPDFSDK_InterForm* CPDFSDK_FormFillEnvironment::GetInterForm() {
diff --git a/fpdfsdk/cpdfsdk_formfillenvironment.h b/fpdfsdk/cpdfsdk_formfillenvironment.h
index 5aead04191..0462426e0f 100644
--- a/fpdfsdk/cpdfsdk_formfillenvironment.h
+++ b/fpdfsdk/cpdfsdk_formfillenvironment.h
@@ -29,6 +29,17 @@ class CPDFSDK_InterForm;
 class CPDFSDK_PageView;
 class IJS_Runtime;
 
+// The CPDFSDK_FormFillEnvironment is "owned" by the embedder across the
+// C API as a FPDF_FormHandle, and may pop out of existence at any time,
+// so long as the associated embedder-owned FPDF_Document outlives it.
+// Pointers from objects in the FPDF_Document ownership hierarchy should
+// be ObservedPtr<> so as to clear themselves when the embedder "exits"
+// the form fill environment.  Pointers from objects in this ownership
+// heirarcy to objects in the FPDF_Document ownership hierarcy should be
+// UnownedPtr<>, as should pointers from objects in this ownership
+// hierarcy back to the form fill environment itself, so as to flag any
+// lingering lifetime issues via the memory tools.
+
 class CPDFSDK_FormFillEnvironment
     : public CFX_Observable<CPDFSDK_FormFillEnvironment> {
  public:
@@ -95,7 +106,7 @@ class CPDFSDK_FormFillEnvironment
                     int sizeOfArray);
 
   UnderlyingDocumentType* GetUnderlyingDocument() const {
-    return m_pUnderlyingDoc;
+    return m_pUnderlyingDoc.Get();
   }
 
 #ifdef PDF_ENABLE_XFA
@@ -103,7 +114,7 @@ class CPDFSDK_FormFillEnvironment
     return m_pUnderlyingDoc ? m_pUnderlyingDoc->GetPDFDoc() : nullptr;
   }
 
-  CPDFXFA_Context* GetXFAContext() const { return m_pUnderlyingDoc; }
+  CPDFXFA_Context* GetXFAContext() const { return m_pUnderlyingDoc.Get(); }
   void ResetXFADocument() { m_pUnderlyingDoc = nullptr; }
 
   int GetPageViewCount() const { return m_PageMap.size(); }
@@ -154,7 +165,7 @@ class CPDFSDK_FormFillEnvironment
 
   void PageEvent(int iPageCount, uint32_t dwEventType) const;
 #else   // PDF_ENABLE_XFA
-  CPDF_Document* GetPDFDocument() const { return m_pUnderlyingDoc; }
+  CPDF_Document* GetPDFDocument() const { return m_pUnderlyingDoc.Get(); }
 #endif  // PDF_ENABLE_XFA
 
   int JS_appAlert(const wchar_t* Msg,
@@ -203,14 +214,14 @@ class CPDFSDK_FormFillEnvironment
   CPDFSDK_InterForm* GetInterForm();              // Creates if not present.
 
  private:
+  FPDF_FORMFILLINFO* const m_pInfo;
   std::unique_ptr<CPDFSDK_AnnotHandlerMgr> m_pAnnotHandlerMgr;
   std::unique_ptr<CPDFSDK_ActionHandler> m_pActionHandler;
   std::unique_ptr<IJS_Runtime> m_pJSRuntime;
-  FPDF_FORMFILLINFO* const m_pInfo;
   std::map<UnderlyingPageType*, std::unique_ptr<CPDFSDK_PageView>> m_PageMap;
   std::unique_ptr<CPDFSDK_InterForm> m_pInterForm;
   CPDFSDK_Annot::ObservedPtr m_pFocusAnnot;
-  UnderlyingDocumentType* m_pUnderlyingDoc;
+  CFX_UnownedPtr<UnderlyingDocumentType> m_pUnderlyingDoc;
   std::unique_ptr<CFFL_InteractiveFormFiller> m_pFormFiller;
   std::unique_ptr<CFX_SystemHandler> m_pSysHandler;
   bool m_bChangeMask;
diff --git a/fpdfsdk/cpdfsdk_widgethandler.h b/fpdfsdk/cpdfsdk_widgethandler.h
index 6e4d50b272..a772471418 100644
--- a/fpdfsdk/cpdfsdk_widgethandler.h
+++ b/fpdfsdk/cpdfsdk_widgethandler.h
@@ -7,6 +7,7 @@
 #ifndef FPDFSDK_CPDFSDK_WIDGETHANDLER_H_
 #define FPDFSDK_CPDFSDK_WIDGETHANDLER_H_
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_basic.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "fpdfsdk/ipdfsdk_annothandler.h"
@@ -102,7 +103,7 @@ class CPDFSDK_WidgetHandler : public IPDFSDK_AnnotHandler {
   CFFL_InteractiveFormFiller* GetFormFiller() { return m_pFormFiller; }
 
  private:
-  CPDFSDK_FormFillEnvironment* m_pFormFillEnv;
+  CFX_UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
   CFFL_InteractiveFormFiller* m_pFormFiller;
 };
 
diff --git a/fpdfsdk/cpdfsdk_xfawidgethandler.h b/fpdfsdk/cpdfsdk_xfawidgethandler.h
index 3903103eeb..2aea49b366 100644
--- a/fpdfsdk/cpdfsdk_xfawidgethandler.h
+++ b/fpdfsdk/cpdfsdk_xfawidgethandler.h
@@ -7,6 +7,7 @@
 #ifndef FPDFSDK_CPDFSDK_XFAWIDGETHANDLER_H_
 #define FPDFSDK_CPDFSDK_XFAWIDGETHANDLER_H_
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_basic.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "fpdfsdk/ipdfsdk_annothandler.h"
@@ -92,7 +93,7 @@ class CPDFSDK_XFAWidgetHandler : public IPDFSDK_AnnotHandler {
   CXFA_FFWidgetHandler* GetXFAWidgetHandler(CPDFSDK_Annot* pAnnot);
   uint32_t GetFWLFlags(uint32_t dwFlag);
 
-  CPDFSDK_FormFillEnvironment* m_pFormFillEnv;
+  CFX_UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
 };
 
 #endif  // FPDFSDK_CPDFSDK_XFAWIDGETHANDLER_H_
diff --git a/fpdfsdk/formfiller/cffl_formfiller.h b/fpdfsdk/formfiller/cffl_formfiller.h
index c6b1e59786..f9a155be86 100644
--- a/fpdfsdk/formfiller/cffl_formfiller.h
+++ b/fpdfsdk/formfiller/cffl_formfiller.h
@@ -9,6 +9,7 @@
 
 #include <map>
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "fpdfsdk/formfiller/cba_fontmap.h"
 #include "fpdfsdk/formfiller/cffl_interactiveformfiller.h"
 #include "fpdfsdk/pdfsdk_fieldaction.h"
@@ -152,7 +153,7 @@ class CFFL_FormFiller : public IPWL_Provider, public CPWL_TimerHandler {
   // until the PWL_Edit is done with it. pdfium:566
   void DestroyWindows();
 
-  CPDFSDK_FormFillEnvironment* m_pFormFillEnv;
+  CFX_UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
   CPDFSDK_Widget* m_pWidget;
   CPDFSDK_Annot* m_pAnnot;
   bool m_bValid;
diff --git a/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp b/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
index 8a9bd35781..bd08c67b2c 100644
--- a/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
+++ b/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
@@ -483,22 +483,22 @@ CFFL_FormFiller* CFFL_InteractiveFormFiller::GetFormFiller(
   CFFL_FormFiller* pFormFiller;
   switch (nFieldType) {
     case FIELDTYPE_PUSHBUTTON:
-      pFormFiller = new CFFL_PushButton(m_pFormFillEnv, pWidget);
+      pFormFiller = new CFFL_PushButton(m_pFormFillEnv.Get(), pWidget);
       break;
     case FIELDTYPE_CHECKBOX:
-      pFormFiller = new CFFL_CheckBox(m_pFormFillEnv, pWidget);
+      pFormFiller = new CFFL_CheckBox(m_pFormFillEnv.Get(), pWidget);
       break;
     case FIELDTYPE_RADIOBUTTON:
-      pFormFiller = new CFFL_RadioButton(m_pFormFillEnv, pWidget);
+      pFormFiller = new CFFL_RadioButton(m_pFormFillEnv.Get(), pWidget);
       break;
     case FIELDTYPE_TEXTFIELD:
-      pFormFiller = new CFFL_TextField(m_pFormFillEnv, pWidget);
+      pFormFiller = new CFFL_TextField(m_pFormFillEnv.Get(), pWidget);
       break;
     case FIELDTYPE_LISTBOX:
-      pFormFiller = new CFFL_ListBox(m_pFormFillEnv, pWidget);
+      pFormFiller = new CFFL_ListBox(m_pFormFillEnv.Get(), pWidget);
       break;
     case FIELDTYPE_COMBOBOX:
-      pFormFiller = new CFFL_ComboBox(m_pFormFillEnv, pWidget);
+      pFormFiller = new CFFL_ComboBox(m_pFormFillEnv.Get(), pWidget);
       break;
     case FIELDTYPE_UNKNOWN:
     default:
diff --git a/fpdfsdk/formfiller/cffl_interactiveformfiller.h b/fpdfsdk/formfiller/cffl_interactiveformfiller.h
index 3c23a6e2f8..751abf6e79 100644
--- a/fpdfsdk/formfiller/cffl_interactiveformfiller.h
+++ b/fpdfsdk/formfiller/cffl_interactiveformfiller.h
@@ -10,6 +10,7 @@
 #include <map>
 #include <memory>
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "fpdfsdk/cpdfsdk_annot.h"
 #include "fpdfsdk/fsdk_define.h"
 #include "fpdfsdk/pdfwindow/PWL_Edit.h"
@@ -161,7 +162,7 @@ class CFFL_InteractiveFormFiller : public IPWL_Filler_Notify {
 #endif  // PDF_ENABLE_XFA
   void UnRegisterFormFiller(CPDFSDK_Annot* pAnnot);
 
-  CPDFSDK_FormFillEnvironment* const m_pFormFillEnv;
+  CFX_UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
   CFFL_Widget2Filler m_Maps;
   bool m_bNotifying;
 };
diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp b/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
index 1345bc8a08..1032d49edc 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
@@ -58,7 +58,7 @@ CPDFXFA_Context::~CPDFXFA_Context() {
     // Once we're deleted the FormFillEnvironment will point at a bad underlying
     // doc so we need to reset it ...
     m_pFormFillEnv->ResetXFADocument();
-    m_pFormFillEnv = nullptr;
+    m_pFormFillEnv.Reset();
   }
 
   m_nLoadStatus = FXFA_LOADSTATUS_CLOSED;
@@ -81,7 +81,7 @@ void CPDFXFA_Context::SetFormFillEnv(
   if (m_pXFADoc && m_pXFADoc->GetXFADoc())
     m_pXFADoc->GetXFADoc()->ClearLayoutData();
 
-  m_pFormFillEnv = pFormFillEnv;
+  m_pFormFillEnv.Reset(pFormFillEnv);
 }
 
 bool CPDFXFA_Context::LoadXFADoc() {
diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_context.h b/fpdfsdk/fpdfxfa/cpdfxfa_context.h
index 6d7e33b689..586e12d5be 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_context.h
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_context.h
@@ -10,6 +10,7 @@
 #include <memory>
 #include <vector>
 
+#include "core/fxcrt/cfx_observable.h"
 #include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_system.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h"
@@ -103,7 +104,7 @@ class CPDFXFA_Context : public IXFA_AppProvider {
   XFA_DocType m_iDocType;
   std::unique_ptr<CPDF_Document> m_pPDFDoc;
   std::unique_ptr<CXFA_FFDoc> m_pXFADoc;
-  CFX_UnownedPtr<CPDFSDK_FormFillEnvironment> m_pFormFillEnv;
+  CFX_Observable<CPDFSDK_FormFillEnvironment>::ObservedPtr m_pFormFillEnv;
   CFX_UnownedPtr<CXFA_FFDocView> m_pXFADocView;
   std::unique_ptr<CXFA_FFApp> m_pXFAApp;
   std::unique_ptr<CJS_Runtime> m_pRuntime;
diff --git a/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.cpp b/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.cpp
index c03ee45ac4..c7201c3fbd 100644
--- a/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.cpp
+++ b/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.cpp
@@ -29,6 +29,12 @@ class CFWL_FWLAdapterTimerInfo : public CFWL_TimerInfo {
 
 std::vector<CFWL_TimerInfo*>* CXFA_FWLAdapterTimerMgr::s_TimerArray = nullptr;
 
+CXFA_FWLAdapterTimerMgr::CXFA_FWLAdapterTimerMgr(
+    CPDFSDK_FormFillEnvironment* pFormFillEnv)
+    : m_pFormFillEnv(pFormFillEnv) {}
+
+CXFA_FWLAdapterTimerMgr::~CXFA_FWLAdapterTimerMgr() {}
+
 void CXFA_FWLAdapterTimerMgr::Start(CFWL_Timer* pTimer,
                                     uint32_t dwElapse,
                                     bool bImmediately,
diff --git a/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h b/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h
index fdb5635ff0..2b22c5fb75 100644
--- a/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h
+++ b/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h
@@ -10,14 +10,15 @@
 #include <memory>
 #include <vector>
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
 #include "xfa/fwl/cfwl_timerinfo.h"
 #include "xfa/fwl/ifwl_adaptertimermgr.h"
 
 class CXFA_FWLAdapterTimerMgr : public IFWL_AdapterTimerMgr {
  public:
-  explicit CXFA_FWLAdapterTimerMgr(CPDFSDK_FormFillEnvironment* pFormFillEnv)
-      : m_pFormFillEnv(pFormFillEnv) {}
+  explicit CXFA_FWLAdapterTimerMgr(CPDFSDK_FormFillEnvironment* pFormFillEnv);
+  ~CXFA_FWLAdapterTimerMgr();
 
   void Start(CFWL_Timer* pTimer,
              uint32_t dwElapse,
@@ -29,7 +30,7 @@ class CXFA_FWLAdapterTimerMgr : public IFWL_AdapterTimerMgr {
   static void TimerProc(int32_t idEvent);
 
   static std::vector<CFWL_TimerInfo*>* s_TimerArray;
-  CPDFSDK_FormFillEnvironment* const m_pFormFillEnv;
+  CFX_UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
 };
 
 #endif  // FPDFSDK_FPDFXFA_CXFA_FWLADAPTERTIMERMGR_H_
diff --git a/fpdfsdk/javascript/JS_Runtime_Stub.cpp b/fpdfsdk/javascript/JS_Runtime_Stub.cpp
index dcd8ceb97c..73a38fcfa6 100644
--- a/fpdfsdk/javascript/JS_Runtime_Stub.cpp
+++ b/fpdfsdk/javascript/JS_Runtime_Stub.cpp
@@ -6,6 +6,7 @@
 
 #include <memory>
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "fpdfsdk/javascript/ijs_event_context.h"
 #include "fpdfsdk/javascript/ijs_runtime.h"
 #include "third_party/base/ptr_util.h"
@@ -133,7 +134,7 @@ class CJS_RuntimeStub final : public IJS_Runtime {
   void ReleaseEventContext(IJS_EventContext* pContext) override {}
 
   CPDFSDK_FormFillEnvironment* GetFormFillEnv() const override {
-    return m_pFormFillEnv;
+    return m_pFormFillEnv.Get();
   }
 
 #ifdef PDF_ENABLE_XFA
@@ -152,7 +153,7 @@ class CJS_RuntimeStub final : public IJS_Runtime {
   }
 
  protected:
-  CPDFSDK_FormFillEnvironment* m_pFormFillEnv;
+  CFX_UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
   std::unique_ptr<CJS_EventContextStub> m_pContext;
 };
 
diff --git a/fpdfsdk/javascript/cjs_event_context.h b/fpdfsdk/javascript/cjs_event_context.h
index 7bfe52816d..715bd9462b 100644
--- a/fpdfsdk/javascript/cjs_event_context.h
+++ b/fpdfsdk/javascript/cjs_event_context.h
@@ -9,6 +9,7 @@
 
 #include <memory>
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
 #include "fpdfsdk/javascript/ijs_event_context.h"
@@ -121,13 +122,13 @@ class CJS_EventContext : public IJS_EventContext {
   void OnConsole_Exec() override;
   void OnExternal_Exec() override;
 
-  CJS_Runtime* GetJSRuntime() const { return m_pRuntime; }
+  CJS_Runtime* GetJSRuntime() const { return m_pRuntime.Get(); }
   CJS_EventHandler* GetEventHandler() const { return m_pEventHandler.get(); }
 
   CPDFSDK_FormFillEnvironment* GetFormFillEnv();
 
  private:
-  CJS_Runtime* const m_pRuntime;
+  CFX_UnownedPtr<CJS_Runtime> const m_pRuntime;
   std::unique_ptr<CJS_EventHandler> m_pEventHandler;
   bool m_bBusy;
 };