Convert to CFX_UnownedPtr, part 3.

Remove an explicit clear to re-order the member
destruction order.

Change-Id: I33da3f3de4b8e8e0cfbdceaf5140e98f5d6f904a
Reviewed-on: https://pdfium-review.googlesource.com/5791
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

13 files changed, 134 insertions, 102 deletions

diff --git a/core/fpdfapi/parser/cpdf_document.h b/core/fpdfapi/parser/cpdf_document.h
index f7fb6308c1..493c1edb32 100644
--- a/core/fpdfapi/parser/cpdf_document.h
+++ b/core/fpdfapi/parser/cpdf_document.h
@@ -50,7 +50,7 @@ class CPDF_Document : public CPDF_IndirectObjectHolder {
 
   CPDF_Parser* GetParser() const { return m_pParser.get(); }
   CPDF_Dictionary* GetRoot() const { return m_pRootDict; }
-  CPDF_Dictionary* GetInfo() const { return m_pInfoDict; }
+  CPDF_Dictionary* GetInfo() const { return m_pInfoDict.Get(); }
 
   void DeletePage(int iPage);
   int GetPageCount() const;
@@ -131,13 +131,18 @@ class CPDF_Document : public CPDF_IndirectObjectHolder {
   void ResetTraversal();
 
   std::unique_ptr<CPDF_Parser> m_pParser;
-  CPDF_Dictionary* m_pRootDict;
-  CPDF_Dictionary* m_pInfoDict;
+
+  // TODO(tsepez): figure out why tests break if this is an UnownedPtr.
+  CPDF_Dictionary* m_pRootDict;  // Not owned.
+
+  CFX_UnownedPtr<CPDF_Dictionary> m_pInfoDict;
+
   // Vector of pairs to know current position in the page tree. The index in the
   // vector corresponds to the level being described. The pair contains a
   // pointer to the dictionary being processed at the level, and an index of the
   // of the child being processed within the dictionary's /Kids array.
   std::vector<std::pair<CPDF_Dictionary*, size_t>> m_pTreeTraversal;
+
   // Index of the next page that will be traversed from the page tree.
   int m_iNextPageToTraverse;
   bool m_bReachedMaxPageLevel;
diff --git a/core/fpdfapi/parser/cpdf_parser.cpp b/core/fpdfapi/parser/cpdf_parser.cpp
index 54b8ea0aa3..bf8bc7b542 100644
--- a/core/fpdfapi/parser/cpdf_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_parser.cpp
@@ -245,12 +245,12 @@ CPDF_Parser::Error CPDF_Parser::SetEncryptHandler() {
 
     std::unique_ptr<CPDF_SecurityHandler> pSecurityHandler =
         pdfium::MakeUnique<CPDF_SecurityHandler>();
-    if (!pSecurityHandler->OnInit(this, m_pEncryptDict))
+    if (!pSecurityHandler->OnInit(this, m_pEncryptDict.Get()))
       return PASSWORD_ERROR;
 
     m_pSecurityHandler = std::move(pSecurityHandler);
     auto pCryptoHandler = pdfium::MakeRetain<CPDF_CryptoHandler>();
-    if (!pCryptoHandler->Init(m_pEncryptDict, m_pSecurityHandler.get()))
+    if (!pCryptoHandler->Init(m_pEncryptDict.Get(), m_pSecurityHandler.get()))
       return HANDLER_ERROR;
     m_pSyntax->SetEncrypt(pCryptoHandler);
   }
diff --git a/core/fpdfapi/parser/cpdf_parser.h b/core/fpdfapi/parser/cpdf_parser.h
index c444c99f28..8f55ddb325 100644
--- a/core/fpdfapi/parser/cpdf_parser.h
+++ b/core/fpdfapi/parser/cpdf_parser.h
@@ -59,7 +59,7 @@ class CPDF_Parser {
   uint32_t GetInfoObjNum();
   CPDF_Array* GetIDArray();
 
-  CPDF_Dictionary* GetEncryptDict() const { return m_pEncryptDict; }
+  CPDF_Dictionary* GetEncryptDict() const { return m_pEncryptDict.Get(); }
 
   std::unique_ptr<CPDF_Object> ParseIndirectObject(
       CPDF_IndirectObjectHolder* pObjList,
@@ -156,7 +156,7 @@ class CPDF_Parser {
   bool m_bXRefStream;
   bool m_bVersionUpdated;
   int m_FileVersion;
-  CPDF_Dictionary* m_pEncryptDict;
+  CFX_UnownedPtr<CPDF_Dictionary> m_pEncryptDict;
   FX_FILESIZE m_LastXRefOffset;
   std::unique_ptr<CPDF_SecurityHandler> m_pSecurityHandler;
   CFX_ByteString m_Password;
diff --git a/core/fpdfapi/parser/cpdf_security_handler.cpp b/core/fpdfapi/parser/cpdf_security_handler.cpp
index 85a3805eea..4cdf545d63 100644
--- a/core/fpdfapi/parser/cpdf_security_handler.cpp
+++ b/core/fpdfapi/parser/cpdf_security_handler.cpp
@@ -413,7 +413,7 @@ bool CPDF_SecurityHandler::CheckUserPassword(const uint8_t* password,
                                              bool bIgnoreEncryptMeta,
                                              uint8_t* key,
                                              int32_t key_len) {
-  CalcEncryptKey(m_pEncryptDict, password, pass_size, key, key_len,
+  CalcEncryptKey(m_pEncryptDict.Get(), password, pass_size, key, key_len,
                  bIgnoreEncryptMeta, m_pParser->GetIDArray());
   CFX_ByteString ukey =
       m_pEncryptDict ? m_pEncryptDict->GetStringFor("U") : CFX_ByteString();
@@ -578,8 +578,8 @@ void CPDF_SecurityHandler::OnCreate(CPDF_Dictionary* pEncryptDict,
     pEncryptDict->SetNewFor<CPDF_String>("O", CFX_ByteString(passcode, 32),
                                          false);
   }
-  CalcEncryptKey(m_pEncryptDict, (uint8_t*)user_pass, user_size, m_EncryptKey,
-                 key_len, false, pIdArray);
+  CalcEncryptKey(m_pEncryptDict.Get(), (uint8_t*)user_pass, user_size,
+                 m_EncryptKey, key_len, false, pIdArray);
   if (m_Revision < 3) {
     uint8_t tempbuf[32];
     memcpy(tempbuf, defpasscode, 32);
diff --git a/core/fpdfapi/parser/cpdf_security_handler.h b/core/fpdfapi/parser/cpdf_security_handler.h
index 93a4e4ff61..27f7f7c610 100644
--- a/core/fpdfapi/parser/cpdf_security_handler.h
+++ b/core/fpdfapi/parser/cpdf_security_handler.h
@@ -97,8 +97,8 @@ class CPDF_SecurityHandler {
 
   int m_Version;
   int m_Revision;
-  CPDF_Parser* m_pParser;
-  CPDF_Dictionary* m_pEncryptDict;
+  CFX_UnownedPtr<CPDF_Parser> m_pParser;
+  CFX_UnownedPtr<CPDF_Dictionary> m_pEncryptDict;
   uint32_t m_Permissions;
   int m_Cipher;
   uint8_t m_EncryptKey[32];
diff --git a/core/fpdfdoc/cpdf_bookmark.cpp b/core/fpdfdoc/cpdf_bookmark.cpp
index 8ca5d128f5..29303f1d32 100644
--- a/core/fpdfdoc/cpdf_bookmark.cpp
+++ b/core/fpdfdoc/cpdf_bookmark.cpp
@@ -14,6 +14,14 @@
 #include "core/fpdfdoc/cpdf_nametree.h"
 #include "core/fxge/fx_dib.h"
 
+CPDF_Bookmark::CPDF_Bookmark() {}
+
+CPDF_Bookmark::CPDF_Bookmark(const CPDF_Bookmark& that) = default;
+
+CPDF_Bookmark::CPDF_Bookmark(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+
+CPDF_Bookmark::~CPDF_Bookmark() {}
+
 uint32_t CPDF_Bookmark::GetColorRef() const {
   if (!m_pDict)
     return FXSYS_RGB(0, 0, 0);
diff --git a/core/fpdfdoc/cpdf_bookmark.h b/core/fpdfdoc/cpdf_bookmark.h
index 30a8a512cc..b9a1ac650e 100644
--- a/core/fpdfdoc/cpdf_bookmark.h
+++ b/core/fpdfdoc/cpdf_bookmark.h
@@ -9,6 +9,7 @@
 
 #include "core/fpdfdoc/cpdf_action.h"
 #include "core/fpdfdoc/cpdf_dest.h"
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_string.h"
 
 class CPDF_Dictionary;
@@ -16,10 +17,12 @@ class CPDF_Document;
 
 class CPDF_Bookmark {
  public:
-  CPDF_Bookmark() : m_pDict(nullptr) {}
-  explicit CPDF_Bookmark(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+  CPDF_Bookmark();
+  CPDF_Bookmark(const CPDF_Bookmark& that);
+  explicit CPDF_Bookmark(CPDF_Dictionary* pDict);
+  ~CPDF_Bookmark();
 
-  CPDF_Dictionary* GetDict() const { return m_pDict; }
+  CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
   uint32_t GetColorRef() const;
   uint32_t GetFontStyle() const;
   CFX_WideString GetTitle() const;
@@ -27,7 +30,7 @@ class CPDF_Bookmark {
   CPDF_Action GetAction() const;
 
  private:
-  CPDF_Dictionary* m_pDict;
+  CFX_UnownedPtr<CPDF_Dictionary> m_pDict;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_BOOKMARK_H_
diff --git a/core/fpdfdoc/cpdf_dest.cpp b/core/fpdfdoc/cpdf_dest.cpp
index ca380be957..3e1988dd5e 100644
--- a/core/fpdfdoc/cpdf_dest.cpp
+++ b/core/fpdfdoc/cpdf_dest.cpp
@@ -18,8 +18,16 @@ const char* const g_sZoomModes[] = {"XYZ",  "Fit",   "FitH",  "FitV", "FitR",
 
 }  // namespace
 
+CPDF_Dest::CPDF_Dest() {}
+
+CPDF_Dest::CPDF_Dest(const CPDF_Dest& pObj) = default;
+
+CPDF_Dest::CPDF_Dest(CPDF_Object* pObj) : m_pObj(pObj) {}
+
+CPDF_Dest::~CPDF_Dest() {}
+
 int CPDF_Dest::GetPageIndex(CPDF_Document* pDoc) {
-  CPDF_Array* pArray = ToArray(m_pObj);
+  CPDF_Array* pArray = ToArray(m_pObj.Get());
   if (!pArray)
     return 0;
 
@@ -34,7 +42,7 @@ int CPDF_Dest::GetPageIndex(CPDF_Document* pDoc) {
 }
 
 uint32_t CPDF_Dest::GetPageObjNum() {
-  CPDF_Array* pArray = ToArray(m_pObj);
+  CPDF_Array* pArray = ToArray(m_pObj.Get());
   if (!pArray)
     return 0;
 
@@ -49,7 +57,7 @@ uint32_t CPDF_Dest::GetPageObjNum() {
 }
 
 int CPDF_Dest::GetZoomMode() {
-  CPDF_Array* pArray = ToArray(m_pObj);
+  CPDF_Array* pArray = ToArray(m_pObj.Get());
   if (!pArray)
     return 0;
 
@@ -76,7 +84,7 @@ bool CPDF_Dest::GetXYZ(bool* pHasX,
   *pHasY = false;
   *pHasZoom = false;
 
-  CPDF_Array* pArray = ToArray(m_pObj);
+  CPDF_Array* pArray = ToArray(m_pObj.Get());
   if (!pArray)
     return false;
 
@@ -114,7 +122,7 @@ bool CPDF_Dest::GetXYZ(bool* pHasX,
 }
 
 float CPDF_Dest::GetParam(int index) {
-  CPDF_Array* pArray = ToArray(m_pObj);
+  CPDF_Array* pArray = ToArray(m_pObj.Get());
   return pArray ? pArray->GetNumberAt(2 + index) : 0;
 }
 
diff --git a/core/fpdfdoc/cpdf_dest.h b/core/fpdfdoc/cpdf_dest.h
index 47559495a4..f029d4c031 100644
--- a/core/fpdfdoc/cpdf_dest.h
+++ b/core/fpdfdoc/cpdf_dest.h
@@ -7,6 +7,7 @@
 #ifndef CORE_FPDFDOC_CPDF_DEST_H_
 #define CORE_FPDFDOC_CPDF_DEST_H_
 
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
 
@@ -15,10 +16,12 @@ class CPDF_Object;
 
 class CPDF_Dest {
  public:
-  CPDF_Dest() : m_pObj(nullptr) {}
-  explicit CPDF_Dest(CPDF_Object* pObj) : m_pObj(pObj) {}
+  CPDF_Dest();
+  CPDF_Dest(const CPDF_Dest& that);
+  explicit CPDF_Dest(CPDF_Object* pObj);
+  ~CPDF_Dest();
 
-  CPDF_Object* GetObject() const { return m_pObj; }
+  CPDF_Object* GetObject() const { return m_pObj.Get(); }
   CFX_ByteString GetRemoteName();
   int GetPageIndex(CPDF_Document* pDoc);
   uint32_t GetPageObjNum();
@@ -33,7 +36,7 @@ class CPDF_Dest {
               float* pZoom) const;
 
  private:
-  CPDF_Object* m_pObj;
+  CFX_UnownedPtr<CPDF_Object> m_pObj;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_DEST_H_
diff --git a/core/fpdfdoc/cpdf_dest_unittest.cpp b/core/fpdfdoc/cpdf_dest_unittest.cpp
index 7c35371085..2b3c86a882 100644
--- a/core/fpdfdoc/cpdf_dest_unittest.cpp
+++ b/core/fpdfdoc/cpdf_dest_unittest.cpp
@@ -19,43 +19,48 @@ TEST(cpdf_dest, GetXYZ) {
   float y;
   float zoom;
 
-  auto dest = pdfium::MakeUnique<CPDF_Dest>();
-  EXPECT_FALSE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
-
+  // |array| must outlive |dest|.
   auto array = pdfium::MakeUnique<CPDF_Array>();
   array->AddNew<CPDF_Number>(0);  // Page Index.
   array->AddNew<CPDF_Name>("XYZ");
   array->AddNew<CPDF_Number>(4);  // X
-
-  // Not enough entries.
-  dest = pdfium::MakeUnique<CPDF_Dest>(array.get());
-  EXPECT_FALSE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
-
+  {
+    auto dest = pdfium::MakeUnique<CPDF_Dest>();
+    EXPECT_FALSE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
+  }
+  {
+    // Not enough entries.
+    auto dest = pdfium::MakeUnique<CPDF_Dest>(array.get());
+    EXPECT_FALSE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
+  }
   array->AddNew<CPDF_Number>(5);  // Y
   array->AddNew<CPDF_Number>(6);  // Zoom.
-
-  dest = pdfium::MakeUnique<CPDF_Dest>(array.get());
-  EXPECT_TRUE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
-  EXPECT_TRUE(hasX);
-  EXPECT_TRUE(hasY);
-  EXPECT_TRUE(hasZoom);
-  EXPECT_EQ(4, x);
-  EXPECT_EQ(5, y);
-  EXPECT_EQ(6, zoom);
-
+  {
+    auto dest = pdfium::MakeUnique<CPDF_Dest>(array.get());
+    EXPECT_TRUE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
+    EXPECT_TRUE(hasX);
+    EXPECT_TRUE(hasY);
+    EXPECT_TRUE(hasZoom);
+    EXPECT_EQ(4, x);
+    EXPECT_EQ(5, y);
+    EXPECT_EQ(6, zoom);
+  }
   // Set zoom to 0.
   array->SetNewAt<CPDF_Number>(4, 0);
-  dest = pdfium::MakeUnique<CPDF_Dest>(array.get());
-  EXPECT_TRUE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
-  EXPECT_FALSE(hasZoom);
-
+  {
+    auto dest = pdfium::MakeUnique<CPDF_Dest>(array.get());
+    EXPECT_TRUE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
+    EXPECT_FALSE(hasZoom);
+  }
   // Set values to null.
   array->SetNewAt<CPDF_Null>(2);
   array->SetNewAt<CPDF_Null>(3);
   array->SetNewAt<CPDF_Null>(4);
-  dest = pdfium::MakeUnique<CPDF_Dest>(array.get());
-  EXPECT_TRUE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
-  EXPECT_FALSE(hasX);
-  EXPECT_FALSE(hasY);
-  EXPECT_FALSE(hasZoom);
+  {
+    auto dest = pdfium::MakeUnique<CPDF_Dest>(array.get());
+    EXPECT_TRUE(dest->GetXYZ(&hasX, &hasY, &hasZoom, &x, &y, &zoom));
+    EXPECT_FALSE(hasX);
+    EXPECT_FALSE(hasY);
+    EXPECT_FALSE(hasZoom);
+  }
 }
diff --git a/core/fpdfdoc/cpdf_formfield.cpp b/core/fpdfdoc/cpdf_formfield.cpp
index 9007d8b0da..7a48826cbd 100644
--- a/core/fpdfdoc/cpdf_formfield.cpp
+++ b/core/fpdfdoc/cpdf_formfield.cpp
@@ -97,12 +97,10 @@ CPDF_FormField::CPDF_FormField(CPDF_InterForm* pForm, CPDF_Dictionary* pDict)
 CPDF_FormField::~CPDF_FormField() {}
 
 void CPDF_FormField::SyncFieldFlags() {
-  CFX_ByteString type_name = FPDF_GetFieldAttr(m_pDict, "FT")
-                                 ? FPDF_GetFieldAttr(m_pDict, "FT")->GetString()
-                                 : CFX_ByteString();
-  uint32_t flags = FPDF_GetFieldAttr(m_pDict, "Ff")
-                       ? FPDF_GetFieldAttr(m_pDict, "Ff")->GetInteger()
-                       : 0;
+  CPDF_Object* ft_attr = FPDF_GetFieldAttr(m_pDict.Get(), "FT");
+  CFX_ByteString type_name = ft_attr ? ft_attr->GetString() : CFX_ByteString();
+  CPDF_Object* ff_attr = FPDF_GetFieldAttr(m_pDict.Get(), "Ff");
+  uint32_t flags = ff_attr ? ff_attr->GetInteger() : 0;
   m_Flags = 0;
   if (flags & FORMFLAG_READONLY)
     m_Flags |= FORMFLAG_READONLY;
@@ -157,7 +155,7 @@ void CPDF_FormField::SyncFieldFlags() {
 }
 
 CFX_WideString CPDF_FormField::GetFullName() const {
-  return FPDF_GetFullName(m_pDict);
+  return FPDF_GetFullName(m_pDict.Get());
 }
 
 bool CPDF_FormField::ResetField(bool bNotify) {
@@ -200,17 +198,17 @@ bool CPDF_FormField::ResetField(bool bNotify) {
     case CPDF_FormField::RichText:
     case CPDF_FormField::File:
     default: {
-      CPDF_Object* pDV = FPDF_GetFieldAttr(m_pDict, "DV");
+      CPDF_Object* pDV = FPDF_GetFieldAttr(m_pDict.Get(), "DV");
       CFX_WideString csDValue;
       if (pDV)
         csDValue = pDV->GetUnicodeText();
 
-      CPDF_Object* pV = FPDF_GetFieldAttr(m_pDict, "V");
+      CPDF_Object* pV = FPDF_GetFieldAttr(m_pDict.Get(), "V");
       CFX_WideString csValue;
       if (pV)
         csValue = pV->GetUnicodeText();
 
-      CPDF_Object* pRV = FPDF_GetFieldAttr(m_pDict, "RV");
+      CPDF_Object* pRV = FPDF_GetFieldAttr(m_pDict.Get(), "RV");
       if (!pRV && (csDValue == csValue))
         return false;
 
@@ -270,32 +268,32 @@ int CPDF_FormField::GetFieldType() const {
 }
 
 CPDF_AAction CPDF_FormField::GetAdditionalAction() const {
-  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict, "AA");
+  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict.Get(), "AA");
   return CPDF_AAction(pObj ? pObj->GetDict() : nullptr);
 }
 
 CFX_WideString CPDF_FormField::GetAlternateName() const {
-  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict, "TU");
+  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict.Get(), "TU");
   return pObj ? pObj->GetUnicodeText() : L"";
 }
 
 CFX_WideString CPDF_FormField::GetMappingName() const {
-  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict, "TM");
+  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict.Get(), "TM");
   return pObj ? pObj->GetUnicodeText() : L"";
 }
 
 uint32_t CPDF_FormField::GetFieldFlags() const {
-  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict, "Ff");
+  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict.Get(), "Ff");
   return pObj ? pObj->GetInteger() : 0;
 }
 
 CFX_ByteString CPDF_FormField::GetDefaultStyle() const {
-  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict, "DS");
+  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict.Get(), "DS");
   return pObj ? pObj->GetString() : "";
 }
 
 CFX_WideString CPDF_FormField::GetRichTextString() const {
-  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict, "RV");
+  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict.Get(), "RV");
   return pObj ? pObj->GetUnicodeText() : L"";
 }
 
@@ -303,13 +301,13 @@ CFX_WideString CPDF_FormField::GetValue(bool bDefault) const {
   if (GetType() == CheckBox || GetType() == RadioButton)
     return GetCheckValue(bDefault);
 
-  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict, bDefault ? "DV" : "V");
+  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict.Get(), bDefault ? "DV" : "V");
   if (!pValue) {
     if (!bDefault) {
       if (m_Type == RichText)
-        pValue = FPDF_GetFieldAttr(m_pDict, "V");
+        pValue = FPDF_GetFieldAttr(m_pDict.Get(), "V");
       if (!pValue && m_Type != Text)
-        pValue = FPDF_GetFieldAttr(m_pDict, "DV");
+        pValue = FPDF_GetFieldAttr(m_pDict.Get(), "DV");
     }
     if (!pValue)
       return CFX_WideString();
@@ -404,10 +402,10 @@ bool CPDF_FormField::SetValue(const CFX_WideString& value, bool bNotify) {
 }
 
 int CPDF_FormField::GetMaxLen() const {
-  if (CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict, "MaxLen"))
+  if (CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict.Get(), "MaxLen"))
     return pObj->GetInteger();
 
-  for (auto* pControl : m_ControlList) {
+  for (auto& pControl : m_ControlList) {
     if (!pControl)
       continue;
     CPDF_Dictionary* pWidgetDict = pControl->m_pWidgetDict;
@@ -418,9 +416,9 @@ int CPDF_FormField::GetMaxLen() const {
 }
 
 int CPDF_FormField::CountSelectedItems() const {
-  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict, "V");
+  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict.Get(), "V");
   if (!pValue) {
-    pValue = FPDF_GetFieldAttr(m_pDict, "I");
+    pValue = FPDF_GetFieldAttr(m_pDict.Get(), "I");
     if (!pValue)
       return 0;
   }
@@ -433,9 +431,9 @@ int CPDF_FormField::CountSelectedItems() const {
 }
 
 int CPDF_FormField::GetSelectedIndex(int index) const {
-  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict, "V");
+  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict.Get(), "V");
   if (!pValue) {
-    pValue = FPDF_GetFieldAttr(m_pDict, "I");
+    pValue = FPDF_GetFieldAttr(m_pDict.Get(), "I");
     if (!pValue)
       return -1;
   }
@@ -494,9 +492,9 @@ bool CPDF_FormField::IsItemSelected(int index) const {
     return true;
 
   CFX_WideString opt_value = GetOptionValue(index);
-  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict, "V");
+  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict.Get(), "V");
   if (!pValue) {
-    pValue = FPDF_GetFieldAttr(m_pDict, "I");
+    pValue = FPDF_GetFieldAttr(m_pDict.Get(), "I");
     if (!pValue)
       return false;
   }
@@ -558,7 +556,7 @@ bool CPDF_FormField::SetItemSelection(int index, bool bSelected, bool bNotify) {
       pI->AddNew<CPDF_Number>(index);
     }
   } else {
-    CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict, "V");
+    CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict.Get(), "V");
     if (pValue) {
       if (GetType() == ListBox) {
         SelectOption(index, false);
@@ -597,7 +595,7 @@ bool CPDF_FormField::IsItemDefaultSelected(int index) const {
 
 int CPDF_FormField::GetDefaultSelectedItem() const {
   ASSERT(GetType() == ComboBox || GetType() == ListBox);
-  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict, "DV");
+  CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict.Get(), "DV");
   if (!pValue)
     return -1;
   CFX_WideString csDV = pValue->GetUnicodeText();
@@ -611,12 +609,12 @@ int CPDF_FormField::GetDefaultSelectedItem() const {
 }
 
 int CPDF_FormField::CountOptions() const {
-  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict, "Opt"));
+  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict.Get(), "Opt"));
   return pArray ? pArray->GetCount() : 0;
 }
 
 CFX_WideString CPDF_FormField::GetOptionText(int index, int sub_index) const {
-  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict, "Opt"));
+  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict.Get(), "Opt"));
   if (!pArray)
     return CFX_WideString();
 
@@ -666,7 +664,7 @@ int CPDF_FormField::InsertOption(CFX_WideString csOptLabel,
 
   CFX_ByteString csStr =
       PDF_EncodeText(csOptLabel.c_str(), csOptLabel.GetLength());
-  CPDF_Array* pOpt = ToArray(FPDF_GetFieldAttr(m_pDict, "Opt"));
+  CPDF_Array* pOpt = ToArray(FPDF_GetFieldAttr(m_pDict.Get(), "Opt"));
   if (!pOpt)
     pOpt = m_pDict->SetNewFor<CPDF_Array>("Opt");
 
@@ -740,13 +738,13 @@ bool CPDF_FormField::CheckControl(int iControlIndex,
     }
   }
 
-  CPDF_Object* pOpt = FPDF_GetFieldAttr(m_pDict, "Opt");
+  CPDF_Object* pOpt = FPDF_GetFieldAttr(m_pDict.Get(), "Opt");
   if (!ToArray(pOpt)) {
     if (bChecked) {
       m_pDict->SetNewFor<CPDF_Name>("V", csBExport);
     } else {
       CFX_ByteString csV;
-      CPDF_Object* pV = FPDF_GetFieldAttr(m_pDict, "V");
+      CPDF_Object* pV = FPDF_GetFieldAttr(m_pDict.Get(), "V");
       if (pV)
         csV = pV->GetString();
       if (csV == csBExport)
@@ -798,17 +796,17 @@ bool CPDF_FormField::SetCheckValue(const CFX_WideString& value,
 }
 
 int CPDF_FormField::GetTopVisibleIndex() const {
-  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict, "TI");
+  CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict.Get(), "TI");
   return pObj ? pObj->GetInteger() : 0;
 }
 
 int CPDF_FormField::CountSelectedOptions() const {
-  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict, "I"));
+  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict.Get(), "I"));
   return pArray ? pArray->GetCount() : 0;
 }
 
 int CPDF_FormField::GetSelectedOptionIndex(int index) const {
-  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict, "I"));
+  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict.Get(), "I"));
   if (!pArray)
     return -1;
 
@@ -819,7 +817,7 @@ int CPDF_FormField::GetSelectedOptionIndex(int index) const {
 }
 
 bool CPDF_FormField::IsOptionSelected(int iOptIndex) const {
-  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict, "I"));
+  CPDF_Array* pArray = ToArray(FPDF_GetFieldAttr(m_pDict.Get(), "I"));
   if (!pArray)
     return false;
 
@@ -906,7 +904,7 @@ void CPDF_FormField::LoadDA() {
     return;
 
   CFX_ByteString DA;
-  if (CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict, "DA"))
+  if (CPDF_Object* pObj = FPDF_GetFieldAttr(m_pDict.Get(), "DA"))
     DA = pObj->GetString();
 
   if (DA.IsEmpty())
diff --git a/core/fpdfdoc/cpdf_formfield.h b/core/fpdfdoc/cpdf_formfield.h
index 6ec7a5b414..f2038e41bd 100644
--- a/core/fpdfdoc/cpdf_formfield.h
+++ b/core/fpdfdoc/cpdf_formfield.h
@@ -13,6 +13,7 @@
 
 #include "core/fpdfdoc/cpdf_aaction.h"
 #include "core/fpdfdoc/cpdf_formfield.h"
+#include "core/fxcrt/cfx_unowned_ptr.h"
 #include "core/fxcrt/fx_basic.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
@@ -65,7 +66,7 @@ class CPDF_FormField {
   Type GetType() const { return m_Type; }
   uint32_t GetFlags() const { return m_Flags; }
 
-  CPDF_Dictionary* GetFieldDict() const { return m_pDict; }
+  CPDF_Dictionary* GetFieldDict() const { return m_pDict.Get(); }
   void SetFieldDict(CPDF_Dictionary* pDict) { m_pDict = pDict; }
 
   bool ResetField(bool bNotify = false);
@@ -74,7 +75,9 @@ class CPDF_FormField {
     return pdfium::CollectionSize<int>(m_ControlList);
   }
 
-  CPDF_FormControl* GetControl(int index) const { return m_ControlList[index]; }
+  CPDF_FormControl* GetControl(int index) const {
+    return m_ControlList[index].Get();
+  }
 
   int GetControlIndex(const CPDF_FormControl* pControl) const;
   int GetFieldType() const;
@@ -133,13 +136,13 @@ class CPDF_FormField {
   float GetFontSize() const { return m_FontSize; }
   CPDF_Font* GetFont() const { return m_pFont; }
 
-  const CPDF_Dictionary* GetDict() const { return m_pDict; }
-  const CPDF_InterForm* GetForm() const { return m_pForm; }
+  const CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
+  const CPDF_InterForm* GetForm() const { return m_pForm.Get(); }
 
   CFX_WideString GetCheckValue(bool bDefault) const;
 
   void AddFormControl(CPDF_FormControl* pFormControl) {
-    m_ControlList.push_back(pFormControl);
+    m_ControlList.emplace_back(pFormControl);
   }
 
   void SetOpt(std::unique_ptr<CPDF_Object> pOpt) {
@@ -168,9 +171,10 @@ class CPDF_FormField {
 
   CPDF_FormField::Type m_Type;
   uint32_t m_Flags;
-  CPDF_InterForm* const m_pForm;
-  CPDF_Dictionary* m_pDict;
-  std::vector<CPDF_FormControl*> m_ControlList;  // Owned by InterForm parent.
+  CFX_UnownedPtr<CPDF_InterForm> const m_pForm;
+  CFX_UnownedPtr<CPDF_Dictionary> m_pDict;
+  // Owned by InterForm parent.
+  std::vector<CFX_UnownedPtr<CPDF_FormControl>> m_ControlList;
   float m_FontSize;
   CPDF_Font* m_pFont;
 };
diff --git a/core/fpdfdoc/cpdf_interform.cpp b/core/fpdfdoc/cpdf_interform.cpp
index 21e2244703..455158b74d 100644
--- a/core/fpdfdoc/cpdf_interform.cpp
+++ b/core/fpdfdoc/cpdf_interform.cpp
@@ -659,9 +659,7 @@ CPDF_InterForm::CPDF_InterForm(CPDF_Document* pDocument)
     LoadField(pFields->GetDictAt(i), 0);
 }
 
-CPDF_InterForm::~CPDF_InterForm() {
-  m_ControlMap.clear();
-}
+CPDF_InterForm::~CPDF_InterForm() {}
 
 bool CPDF_InterForm::s_bUpdateAP = true;