Fix CPLW_Wnd ownership model in CFFL_FormFiller.

CFFL_FormFiller::DestroyPDFWindow() might get re-entered, so
do not leave any dangling references in maps. Use unique_ptr
to be more sure that we have it right.

Bug: chromium:898531
Change-Id: I7b61940ff4e88c8a7e3219fefb0479f33bbbfae1
Reviewed-on: https://pdfium-review.googlesource.com/c/44542
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

1 files changed, 9 insertions, 12 deletions

diff --git a/fpdfsdk/formfiller/cffl_formfiller.h b/fpdfsdk/formfiller/cffl_formfiller.h
index 95f5ac8427..a6f7cdc78f 100644
--- a/fpdfsdk/formfiller/cffl_formfiller.h
+++ b/fpdfsdk/formfiller/cffl_formfiller.h
@@ -8,6 +8,7 @@
 #define FPDFSDK_FORMFILLER_CFFL_FORMFILLER_H_
 
 #include <map>
+#include <memory>
 
 #include "core/fxcrt/unowned_ptr.h"
 #include "fpdfsdk/cpdfsdk_fieldaction.h"
@@ -104,19 +105,20 @@ class CFFL_FormFiller : public CPWL_Wnd::ProviderIface,
                                    const CPDFSDK_FieldAction& faOld,
                                    const CPDFSDK_FieldAction& faNew);
 
-  virtual void SaveState(CPDFSDK_PageView* pPageView);
-  virtual void RestoreState(CPDFSDK_PageView* pPageView);
-
+  virtual CPWL_Wnd::CreateParams GetCreateParam();
+  virtual std::unique_ptr<CPWL_Wnd> NewPDFWindow(
+      const CPWL_Wnd::CreateParams& cp) = 0;
   virtual CPWL_Wnd* ResetPDFWindow(CPDFSDK_PageView* pPageView,
                                    bool bRestoreValue);
+  virtual void SaveState(CPDFSDK_PageView* pPageView);
+  virtual void RestoreState(CPDFSDK_PageView* pPageView);
+  virtual CFX_FloatRect GetFocusBox(CPDFSDK_PageView* pPageView);
 
   CFX_Matrix GetCurMatrix();
-
   CFX_FloatRect FFLtoPWL(const CFX_FloatRect& rect);
   CFX_FloatRect PWLtoFFL(const CFX_FloatRect& rect);
   CFX_PointF FFLtoPWL(const CFX_PointF& point);
   CFX_PointF PWLtoFFL(const CFX_PointF& point);
-
   CFX_PointF WndtoPWL(CPDFSDK_PageView* pPageView, const CFX_PointF& pt);
   CFX_FloatRect FFLtoWnd(CPDFSDK_PageView* pPageView,
                          const CFX_FloatRect& rect);
@@ -133,9 +135,6 @@ class CFFL_FormFiller : public CPWL_Wnd::ProviderIface,
   void DestroyPDFWindow(CPDFSDK_PageView* pPageView);
   void EscapeFiller(CPDFSDK_PageView* pPageView, bool bDestroyPDFWindow);
 
-  virtual CPWL_Wnd::CreateParams GetCreateParam();
-  virtual CPWL_Wnd* NewPDFWindow(const CPWL_Wnd::CreateParams& cp) = 0;
-  virtual CFX_FloatRect GetFocusBox(CPDFSDK_PageView* pPageView);
 
   bool IsValid() const;
   CFX_FloatRect GetPDFWindowRect() const;
@@ -146,8 +145,6 @@ class CFFL_FormFiller : public CPWL_Wnd::ProviderIface,
   CPDFSDK_Annot* GetSDKAnnot() const { return m_pWidget.Get(); }
 
  protected:
-  using CFFL_PageView2PDFWindow = std::map<CPDFSDK_PageView*, CPWL_Wnd*>;
-
   // If the inheriting widget has its own fontmap and a PWL_Edit widget that
   // access that fontmap then you have to call DestroyWindows before destroying
   // the font map in order to not get a use-after-free.
@@ -158,10 +155,10 @@ class CFFL_FormFiller : public CPWL_Wnd::ProviderIface,
 
   void InvalidateRect(const FX_RECT& rect);
 
+  bool m_bValid = false;
   UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
   UnownedPtr<CPDFSDK_Widget> m_pWidget;
-  bool m_bValid;
-  CFFL_PageView2PDFWindow m_Maps;
+  std::map<CPDFSDK_PageView*, std::unique_ptr<CPWL_Wnd>> m_Maps;
 };
 
 #endif  // FPDFSDK_FORMFILLER_CFFL_FORMFILLER_H_