Watch destruction of widgets around OnAAction() method.

We implemented the CFX_Observable mechanism for detecting
stale objects some time ago; now just use it in more places.

Change method signatures to required an ObservedPtr to
indicate that the callers are aware that the value may be
destroyed out from underneath them.

BUG=649659

Review-Url: https://codereview.chromium.org/2368403002

5 files changed, 168 insertions, 192 deletions

diff --git a/fpdfsdk/formfiller/cffl_checkbox.cpp b/fpdfsdk/formfiller/cffl_checkbox.cpp
index 01f1a2a08c..334adb68ed 100644
--- a/fpdfsdk/formfiller/cffl_checkbox.cpp
+++ b/fpdfsdk/formfiller/cffl_checkbox.cpp
@@ -47,15 +47,17 @@ FX_BOOL CFFL_CheckBox::OnChar(CPDFSDK_Annot* pAnnot,
 
       FX_BOOL bReset = FALSE;
       FX_BOOL bExit = FALSE;
-      m_pEnv->GetInteractiveFormFiller()->OnButtonUp(m_pWidget, pPageView,
+      CPDFSDK_Annot::ObservedPtr pObserved(m_pWidget);
+      m_pEnv->GetInteractiveFormFiller()->OnButtonUp(&pObserved, pPageView,
                                                      bReset, bExit, nFlags);
-      if (bReset)
+      if (!pObserved) {
+        m_pWidget = nullptr;
         return TRUE;
-      if (bExit)
+      }
+      if (bReset || bExit)
         return TRUE;
 
       CFFL_FormFiller::OnChar(pAnnot, nChar, nFlags);
-
       if (CPWL_CheckBox* pWnd = (CPWL_CheckBox*)GetPDFWindow(pPageView, TRUE))
         pWnd->SetCheck(!pWnd->IsChecked());
 
diff --git a/fpdfsdk/formfiller/cffl_formfiller.cpp b/fpdfsdk/formfiller/cffl_formfiller.cpp
index 7aeda57c2e..827b9b09ca 100644
--- a/fpdfsdk/formfiller/cffl_formfiller.cpp
+++ b/fpdfsdk/formfiller/cffl_formfiller.cpp
@@ -527,22 +527,21 @@ FX_BOOL CFFL_FormFiller::CommitData(CPDFSDK_PageView* pPageView,
     FX_BOOL bExit = FALSE;
     CFFL_InteractiveFormFiller* pFormFiller =
         m_pEnv->GetInteractiveFormFiller();
-    pFormFiller->OnKeyStrokeCommit(m_pWidget, pPageView, bRC, bExit, nFlag);
-    if (bExit)
+    CPDFSDK_Annot::ObservedPtr pObserved(m_pWidget);
+    pFormFiller->OnKeyStrokeCommit(&pObserved, pPageView, bRC, bExit, nFlag);
+    if (!pObserved || bExit)
       return TRUE;
     if (!bRC) {
       ResetPDFWindow(pPageView, FALSE);
       return TRUE;
     }
-
-    pFormFiller->OnValidate(m_pWidget, pPageView, bRC, bExit, nFlag);
-    if (bExit)
+    pFormFiller->OnValidate(&pObserved, pPageView, bRC, bExit, nFlag);
+    if (!pObserved || bExit)
       return TRUE;
     if (!bRC) {
       ResetPDFWindow(pPageView, FALSE);
       return TRUE;
     }
-
     SaveData(pPageView);
     pFormFiller->OnCalculate(m_pWidget, pPageView, bExit, nFlag);
     if (bExit)
diff --git a/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp b/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
index 3d1a716580..dbe31f7857 100644
--- a/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
+++ b/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
@@ -122,20 +122,18 @@ void CFFL_InteractiveFormFiller::OnDelete(CPDFSDK_Annot* pAnnot) {
   UnRegisterFormFiller(pAnnot);
 }
 
-void CFFL_InteractiveFormFiller::OnMouseEnter(CPDFSDK_PageView* pPageView,
-                                              CPDFSDK_Annot* pAnnot,
-                                              uint32_t nFlag) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
+void CFFL_InteractiveFormFiller::OnMouseEnter(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
   if (!m_bNotifying) {
-    CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::CursorEnter).GetDict()) {
       m_bNotifying = TRUE;
 
       int nValueAge = pWidget->GetValueAge();
-
       pWidget->ClearAppModified();
-
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
@@ -143,6 +141,8 @@ void CFFL_InteractiveFormFiller::OnMouseEnter(CPDFSDK_PageView* pPageView,
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
       pWidget->OnAAction(CPDF_AAction::CursorEnter, fa, pPageView);
       m_bNotifying = FALSE;
+      if (!(*pAnnot))
+        return;
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE)) {
@@ -152,33 +152,31 @@ void CFFL_InteractiveFormFiller::OnMouseEnter(CPDFSDK_PageView* pPageView,
       }
     }
   }
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, TRUE)) {
-    pFormFiller->OnMouseEnter(pPageView, pAnnot);
-  }
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), TRUE))
+    pFormFiller->OnMouseEnter(pPageView, pAnnot->Get());
 }
 
 void CFFL_InteractiveFormFiller::OnMouseExit(CPDFSDK_PageView* pPageView,
-                                             CPDFSDK_Annot* pAnnot,
+                                             CPDFSDK_Annot::ObservedPtr* pAnnot,
                                              uint32_t nFlag) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
   if (!m_bNotifying) {
-    CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::CursorExit).GetDict()) {
       m_bNotifying = TRUE;
       pWidget->GetAppearanceAge();
+
       int nValueAge = pWidget->GetValueAge();
       pWidget->ClearAppModified();
-
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
-
       pWidget->OnAAction(CPDF_AAction::CursorExit, fa, pPageView);
       m_bNotifying = FALSE;
+      if (!(*pAnnot))
+        return;
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE)) {
@@ -188,27 +186,25 @@ void CFFL_InteractiveFormFiller::OnMouseExit(CPDFSDK_PageView* pPageView,
       }
     }
   }
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    pFormFiller->OnMouseExit(pPageView, pAnnot);
-  }
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE))
+    pFormFiller->OnMouseExit(pPageView, pAnnot->Get());
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDown(CPDFSDK_PageView* pPageView,
-                                                  CPDFSDK_Annot* pAnnot,
-                                                  uint32_t nFlags,
-                                                  const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
+FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDown(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
   if (!m_bNotifying) {
-    CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
-    if (Annot_HitTest(pPageView, pAnnot, point) &&
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
+    if (Annot_HitTest(pPageView, pAnnot->Get(), point) &&
         pWidget->GetAAction(CPDF_AAction::ButtonDown).GetDict()) {
       m_bNotifying = TRUE;
       pWidget->GetAppearanceAge();
+
       int nValueAge = pWidget->GetValueAge();
       pWidget->ClearAppModified();
-
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
@@ -216,8 +212,10 @@ FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDown(CPDFSDK_PageView* pPageView,
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlags);
       pWidget->OnAAction(CPDF_AAction::ButtonDown, fa, pPageView);
       m_bNotifying = FALSE;
+      if (!(*pAnnot))
+        return TRUE;
 
-      if (!IsValidAnnot(pPageView, pAnnot))
+      if (!IsValidAnnot(pPageView, pAnnot->Get()))
         return TRUE;
 
       if (pWidget->IsAppModified()) {
@@ -228,27 +226,27 @@ FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDown(CPDFSDK_PageView* pPageView,
       }
     }
   }
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnLButtonDown(pPageView, pAnnot, nFlags, point);
-  }
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE))
+    return pFormFiller->OnLButtonDown(pPageView, pAnnot->Get(), nFlags, point);
 
   return FALSE;
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnLButtonUp(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-  CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+FX_BOOL CFFL_InteractiveFormFiller::OnLButtonUp(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
   CPDFSDK_Document* pDocument = m_pEnv->GetSDKDocument();
 
   switch (pWidget->GetFieldType()) {
     case FIELDTYPE_PUSHBUTTON:
     case FIELDTYPE_CHECKBOX:
     case FIELDTYPE_RADIOBUTTON:
-      if (GetViewBBox(pPageView, pAnnot).Contains((int)point.x, (int)point.y))
+      if (GetViewBBox(pPageView, pAnnot->Get())
+              .Contains((int)point.x, (int)point.y))
         pDocument->SetFocusAnnot(pAnnot);
       break;
     default:
@@ -257,59 +255,52 @@ FX_BOOL CFFL_InteractiveFormFiller::OnLButtonUp(CPDFSDK_PageView* pPageView,
   }
 
   FX_BOOL bRet = FALSE;
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE))
+    bRet = pFormFiller->OnLButtonUp(pPageView, pAnnot->Get(), nFlags, point);
 
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    bRet = pFormFiller->OnLButtonUp(pPageView, pAnnot, nFlags, point);
-  }
-
-  if (pDocument->GetFocusAnnot() == pAnnot) {
+  if (pDocument->GetFocusAnnot() == pAnnot->Get()) {
     FX_BOOL bExit = FALSE;
     FX_BOOL bReset = FALSE;
-    OnButtonUp(pWidget, pPageView, bReset, bExit, nFlags);
-    if (bExit)
+    OnButtonUp(pAnnot, pPageView, bReset, bExit, nFlags);
+    if (!pAnnot || bExit)
       return TRUE;
 #ifdef PDF_ENABLE_XFA
     OnClick(pWidget, pPageView, bReset, bExit, nFlags);
-    if (bExit)
+    if (!pAnnot || bExit)
       return TRUE;
 #endif  // PDF_ENABLE_XFA
   }
   return bRet;
 }
 
-void CFFL_InteractiveFormFiller::OnButtonUp(CPDFSDK_Widget* pWidget,
+void CFFL_InteractiveFormFiller::OnButtonUp(CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             CPDFSDK_PageView* pPageView,
                                             FX_BOOL& bReset,
                                             FX_BOOL& bExit,
                                             uint32_t nFlag) {
-  ASSERT(pWidget);
-
   if (!m_bNotifying) {
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::ButtonUp).GetDict()) {
       m_bNotifying = TRUE;
+
       int nAge = pWidget->GetAppearanceAge();
       int nValueAge = pWidget->GetValueAge();
-
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
-
       pWidget->OnAAction(CPDF_AAction::ButtonUp, fa, pPageView);
       m_bNotifying = FALSE;
-
-      if (!IsValidAnnot(pPageView, pWidget)) {
+      if (!(*pAnnot) || !IsValidAnnot(pPageView, pWidget)) {
         bExit = TRUE;
         return;
       }
-
       if (nAge != pWidget->GetAppearanceAge()) {
         if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE)) {
           pFormFiller->ResetPDFWindow(pPageView,
                                       nValueAge == pWidget->GetValueAge());
         }
-
         bReset = TRUE;
       }
     }
@@ -318,70 +309,59 @@ void CFFL_InteractiveFormFiller::OnButtonUp(CPDFSDK_Widget* pWidget,
 
 FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDblClk(
     CPDFSDK_PageView* pPageView,
-    CPDFSDK_Annot* pAnnot,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
     uint32_t nFlags,
     const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnLButtonDblClk(pPageView, pAnnot, nFlags, point);
-  }
-
-  return FALSE;
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE);
+  return pFormFiller &&
+         pFormFiller->OnLButtonDblClk(pPageView, pAnnot->Get(), nFlags, point);
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnMouseMove(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  // change cursor
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, TRUE)) {
-    return pFormFiller->OnMouseMove(pPageView, pAnnot, nFlags, point);
-  }
-
-  return FALSE;
+FX_BOOL CFFL_InteractiveFormFiller::OnMouseMove(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), TRUE);
+  return pFormFiller &&
+         pFormFiller->OnMouseMove(pPageView, pAnnot->Get(), nFlags, point);
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnMouseWheel(CPDFSDK_PageView* pPageView,
-                                                 CPDFSDK_Annot* pAnnot,
-                                                 uint32_t nFlags,
-                                                 short zDelta,
-                                                 const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnMouseWheel(pPageView, pAnnot, nFlags, zDelta, point);
-  }
-
-  return FALSE;
+FX_BOOL CFFL_InteractiveFormFiller::OnMouseWheel(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    short zDelta,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE);
+  return pFormFiller &&
+         pFormFiller->OnMouseWheel(pPageView, pAnnot->Get(), nFlags, zDelta,
+                                   point);
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnRButtonDown(CPDFSDK_PageView* pPageView,
-                                                  CPDFSDK_Annot* pAnnot,
-                                                  uint32_t nFlags,
-                                                  const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnRButtonDown(pPageView, pAnnot, nFlags, point);
-  }
-
-  return FALSE;
+FX_BOOL CFFL_InteractiveFormFiller::OnRButtonDown(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE);
+  return pFormFiller &&
+         pFormFiller->OnRButtonDown(pPageView, pAnnot->Get(), nFlags, point);
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnRButtonUp(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnRButtonUp(pPageView, pAnnot, nFlags, point);
-  }
-
-  return FALSE;
+FX_BOOL CFFL_InteractiveFormFiller::OnRButtonUp(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE);
+  return pFormFiller &&
+         pFormFiller->OnRButtonUp(pPageView, pAnnot->Get(), nFlags, point);
 }
 
 FX_BOOL CFFL_InteractiveFormFiller::OnKeyDown(CPDFSDK_Annot* pAnnot,
@@ -409,15 +389,15 @@ FX_BOOL CFFL_InteractiveFormFiller::OnChar(CPDFSDK_Annot* pAnnot,
   return FALSE;
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnSetFocus(CPDFSDK_Annot* pAnnot,
-                                               uint32_t nFlag) {
-  if (!pAnnot)
+FX_BOOL CFFL_InteractiveFormFiller::OnSetFocus(
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  if (!(*pAnnot))
     return FALSE;
 
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
   if (!m_bNotifying) {
-    CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::GetFocus).GetDict()) {
       m_bNotifying = TRUE;
       pWidget->GetAppearanceAge();
@@ -425,19 +405,21 @@ FX_BOOL CFFL_InteractiveFormFiller::OnSetFocus(CPDFSDK_Annot* pAnnot,
       int nValueAge = pWidget->GetValueAge();
       pWidget->ClearAppModified();
 
-      CPDFSDK_PageView* pPageView = pAnnot->GetPageView();
+      CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, TRUE);
+      if (!pFormFiller)
+        return FALSE;
+
+      CPDFSDK_PageView* pPageView = (*pAnnot)->GetPageView();
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
-
-      CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, TRUE);
-      if (!pFormFiller)
-        return FALSE;
       pFormFiller->GetActionData(pPageView, CPDF_AAction::GetFocus, fa);
       pWidget->OnAAction(CPDF_AAction::GetFocus, fa, pPageView);
       m_bNotifying = FALSE;
+      if (!(*pAnnot))
+        return FALSE;
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFiller = GetFormFiller(pWidget, FALSE)) {
@@ -448,23 +430,23 @@ FX_BOOL CFFL_InteractiveFormFiller::OnSetFocus(CPDFSDK_Annot* pAnnot,
     }
   }
 
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, TRUE))
-    pFormFiller->SetFocusForAnnot(pAnnot, nFlag);
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), TRUE))
+    pFormFiller->SetFocusForAnnot(pAnnot->Get(), nFlag);
 
   return TRUE;
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnKillFocus(CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlag) {
-  if (!pAnnot)
+FX_BOOL CFFL_InteractiveFormFiller::OnKillFocus(
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  if (!(*pAnnot))
     return FALSE;
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    pFormFiller->KillFocusForAnnot(pAnnot, nFlag);
 
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE)) {
+    pFormFiller->KillFocusForAnnot(pAnnot->Get(), nFlag);
     if (!m_bNotifying) {
-      CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+      CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
       if (pWidget->GetAAction(CPDF_AAction::LoseFocus).GetDict()) {
         m_bNotifying = TRUE;
         pWidget->ClearAppModified();
@@ -475,15 +457,14 @@ FX_BOOL CFFL_InteractiveFormFiller::OnKillFocus(CPDFSDK_Annot* pAnnot,
         PDFSDK_FieldAction fa;
         fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
         fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
-
         pFormFiller->GetActionData(pPageView, CPDF_AAction::LoseFocus, fa);
-
         pWidget->OnAAction(CPDF_AAction::LoseFocus, fa, pPageView);
         m_bNotifying = FALSE;
+        if (!(*pAnnot))
+          return FALSE;
       }
     }
   }
-
   return TRUE;
 }
 
@@ -640,18 +621,19 @@ void CFFL_InteractiveFormFiller::QueryWherePopup(void* pPrivateData,
   fPopupRet = fFactHeight;
 }
 
-void CFFL_InteractiveFormFiller::OnKeyStrokeCommit(CPDFSDK_Widget* pWidget,
-                                                   CPDFSDK_PageView* pPageView,
-                                                   FX_BOOL& bRC,
-                                                   FX_BOOL& bExit,
-                                                   uint32_t nFlag) {
+void CFFL_InteractiveFormFiller::OnKeyStrokeCommit(
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    CPDFSDK_PageView* pPageView,
+    FX_BOOL& bRC,
+    FX_BOOL& bExit,
+    uint32_t nFlag) {
   if (!m_bNotifying) {
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::KeyStroke).GetDict()) {
+      ASSERT(pPageView);
       m_bNotifying = TRUE;
       pWidget->ClearAppModified();
 
-      ASSERT(pPageView);
-
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
@@ -662,8 +644,9 @@ void CFFL_InteractiveFormFiller::OnKeyStrokeCommit(CPDFSDK_Widget* pWidget,
       CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE);
       pFormFiller->GetActionData(pPageView, CPDF_AAction::KeyStroke, fa);
       pFormFiller->SaveState(pPageView);
-
       pWidget->OnAAction(CPDF_AAction::KeyStroke, fa, pPageView);
+      if (!(*pAnnot))
+        return;
 
       bRC = fa.bRC;
       m_bNotifying = FALSE;
@@ -671,18 +654,18 @@ void CFFL_InteractiveFormFiller::OnKeyStrokeCommit(CPDFSDK_Widget* pWidget,
   }
 }
 
-void CFFL_InteractiveFormFiller::OnValidate(CPDFSDK_Widget* pWidget,
+void CFFL_InteractiveFormFiller::OnValidate(CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             CPDFSDK_PageView* pPageView,
                                             FX_BOOL& bRC,
                                             FX_BOOL& bExit,
                                             uint32_t nFlag) {
   if (!m_bNotifying) {
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::Validate).GetDict()) {
+      ASSERT(pPageView);
       m_bNotifying = TRUE;
       pWidget->ClearAppModified();
 
-      ASSERT(pPageView);
-
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
@@ -692,8 +675,9 @@ void CFFL_InteractiveFormFiller::OnValidate(CPDFSDK_Widget* pWidget,
       CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE);
       pFormFiller->GetActionData(pPageView, CPDF_AAction::Validate, fa);
       pFormFiller->SaveState(pPageView);
-
       pWidget->OnAAction(CPDF_AAction::Validate, fa, pPageView);
+      if (!(*pAnnot))
+        return;
 
       bRC = fa.bRC;
       m_bNotifying = FALSE;
@@ -820,10 +804,8 @@ void CFFL_InteractiveFormFiller::OnPopupPreOpen(void* pPrivateData,
   FX_BOOL bTempReset = FALSE;
   FX_BOOL bTempExit = FALSE;
   OnPreOpen(pData->pWidget, pData->pPageView, bTempReset, bTempExit, nFlag);
-
-  if (bTempReset || bTempExit) {
+  if (bTempReset || bTempExit)
     bExit = TRUE;
-  }
 }
 
 void CFFL_InteractiveFormFiller::OnPopupPostOpen(void* pPrivateData,
@@ -836,10 +818,8 @@ void CFFL_InteractiveFormFiller::OnPopupPostOpen(void* pPrivateData,
   FX_BOOL bTempReset = FALSE;
   FX_BOOL bTempExit = FALSE;
   OnPostOpen(pData->pWidget, pData->pPageView, bTempReset, bTempExit, nFlag);
-
-  if (bTempReset || bTempExit) {
+  if (bTempReset || bTempExit)
     bExit = TRUE;
-  }
 }
 
 void CFFL_InteractiveFormFiller::OnPreOpen(CPDFSDK_Widget* pWidget,
@@ -915,10 +895,7 @@ void CFFL_InteractiveFormFiller::OnPostOpen(CPDFSDK_Widget* pWidget,
 
 FX_BOOL CFFL_InteractiveFormFiller::IsValidAnnot(CPDFSDK_PageView* pPageView,
                                                  CPDFSDK_Annot* pAnnot) {
-  if (pPageView)
-    return pPageView->IsValidAnnot(pAnnot->GetPDFAnnot());
-
-  return FALSE;
+  return pPageView && pPageView->IsValidAnnot(pAnnot->GetPDFAnnot());
 }
 
 void CFFL_InteractiveFormFiller::OnBeforeKeyStroke(
@@ -971,9 +948,10 @@ void CFFL_InteractiveFormFiller::OnBeforeKeyStroke(
       pFormFiller->GetActionData(pData->pPageView, CPDF_AAction::KeyStroke, fa);
       pFormFiller->SaveState(pData->pPageView);
 
+      CPDFSDK_Annot::ObservedPtr pObserved(pData->pWidget);
       if (pData->pWidget->OnAAction(CPDF_AAction::KeyStroke, fa,
                                     pData->pPageView)) {
-        if (!IsValidAnnot(pData->pPageView, pData->pWidget)) {
+        if (!pObserved || !IsValidAnnot(pData->pPageView, pData->pWidget)) {
           bExit = TRUE;
           m_bNotifying = FALSE;
           return;
diff --git a/fpdfsdk/formfiller/cffl_interactiveformfiller.h b/fpdfsdk/formfiller/cffl_interactiveformfiller.h
index dc2cb4174e..eec2a34ebf 100644
--- a/fpdfsdk/formfiller/cffl_interactiveformfiller.h
+++ b/fpdfsdk/formfiller/cffl_interactiveformfiller.h
@@ -10,12 +10,12 @@
 #include <map>
 #include <memory>
 
+#include "fpdfsdk/include/cpdfsdk_annot.h"
 #include "fpdfsdk/include/fsdk_define.h"
 #include "fpdfsdk/pdfwindow/PWL_Edit.h"
 
 class CFFL_FormFiller;
 class CPDFSDK_Environment;
-class CPDFSDK_Annot;
 class CPDFSDK_PageView;
 class CPDFSDK_Widget;
 
@@ -38,47 +38,46 @@ class CFFL_InteractiveFormFiller : public IPWL_Filler_Notify {
   void OnDelete(CPDFSDK_Annot* pAnnot);
 
   void OnMouseEnter(CPDFSDK_PageView* pPageView,
-                    CPDFSDK_Annot* pAnnot,
+                    CPDFSDK_Annot::ObservedPtr* pAnnot,
                     uint32_t nFlag);
   void OnMouseExit(CPDFSDK_PageView* pPageView,
-                   CPDFSDK_Annot* pAnnot,
+                   CPDFSDK_Annot::ObservedPtr* pAnnot,
                    uint32_t nFlag);
-
   FX_BOOL OnLButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point);
   FX_BOOL OnLButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point);
   FX_BOOL OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                          CPDFSDK_Annot* pAnnot,
+                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                           uint32_t nFlags,
                           const CFX_FloatPoint& point);
   FX_BOOL OnMouseMove(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point);
   FX_BOOL OnMouseWheel(CPDFSDK_PageView* pPageView,
-                       CPDFSDK_Annot* pAnnot,
+                       CPDFSDK_Annot::ObservedPtr* pAnnot,
                        uint32_t nFlags,
                        short zDelta,
                        const CFX_FloatPoint& point);
   FX_BOOL OnRButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point);
   FX_BOOL OnRButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point);
 
   FX_BOOL OnKeyDown(CPDFSDK_Annot* pAnnot, uint32_t nKeyCode, uint32_t nFlags);
   FX_BOOL OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags);
 
-  FX_BOOL OnSetFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag);
-  FX_BOOL OnKillFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag);
+  FX_BOOL OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot, uint32_t nFlag);
+  FX_BOOL OnKillFocus(CPDFSDK_Annot::ObservedPtr* pAnnot, uint32_t nFlag);
 
   CFFL_FormFiller* GetFormFiller(CPDFSDK_Annot* pAnnot, FX_BOOL bRegister);
   void RemoveFormFiller(CPDFSDK_Annot* pAnnot);
@@ -89,12 +88,12 @@ class CFFL_InteractiveFormFiller : public IPWL_Filler_Notify {
   static FX_BOOL IsValidAnnot(CPDFSDK_PageView* pPageView,
                               CPDFSDK_Annot* pAnnot);
 
-  void OnKeyStrokeCommit(CPDFSDK_Widget* pWidget,
+  void OnKeyStrokeCommit(CPDFSDK_Annot::ObservedPtr* pWidget,
                          CPDFSDK_PageView* pPageView,
                          FX_BOOL& bRC,
                          FX_BOOL& bExit,
                          uint32_t nFlag);
-  void OnValidate(CPDFSDK_Widget* pWidget,
+  void OnValidate(CPDFSDK_Annot::ObservedPtr* pWidget,
                   CPDFSDK_PageView* pPageView,
                   FX_BOOL& bRC,
                   FX_BOOL& bExit,
@@ -108,7 +107,7 @@ class CFFL_InteractiveFormFiller : public IPWL_Filler_Notify {
                 CPDFSDK_PageView* pPageView,
                 FX_BOOL& bExit,
                 uint32_t nFlag);
-  void OnButtonUp(CPDFSDK_Widget* pWidget,
+  void OnButtonUp(CPDFSDK_Annot::ObservedPtr* pWidget,
                   CPDFSDK_PageView* pPageView,
                   FX_BOOL& bReset,
                   FX_BOOL& bExit,
diff --git a/fpdfsdk/formfiller/cffl_radiobutton.cpp b/fpdfsdk/formfiller/cffl_radiobutton.cpp
index 17573fd625..6f30a9b97f 100644
--- a/fpdfsdk/formfiller/cffl_radiobutton.cpp
+++ b/fpdfsdk/formfiller/cffl_radiobutton.cpp
@@ -51,15 +51,13 @@ FX_BOOL CFFL_RadioButton::OnChar(CPDFSDK_Annot* pAnnot,
 
       FX_BOOL bReset = FALSE;
       FX_BOOL bExit = FALSE;
-      m_pEnv->GetInteractiveFormFiller()->OnButtonUp(m_pWidget, pPageView,
+      CPDFSDK_Annot::ObservedPtr pObserved(m_pWidget);
+      m_pEnv->GetInteractiveFormFiller()->OnButtonUp(&pObserved, pPageView,
                                                      bReset, bExit, nFlags);
-      if (bReset)
-        return TRUE;
-      if (bExit)
+      if (!pObserved || bReset || bExit)
         return TRUE;
 
       CFFL_FormFiller::OnChar(pAnnot, nChar, nFlags);
-
       if (CPWL_RadioButton* pWnd =
               (CPWL_RadioButton*)GetPDFWindow(pPageView, TRUE))
         pWnd->SetCheck(TRUE);