Invalidate IPWL_FocusHandler and IPWL_Provider on destruction.

BUG=572871
TBR=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1564773003 .

(cherry picked from commit dcac57bc8b64fdc870d79d11a498ae7021cf8ae7)

Review URL: https://codereview.chromium.org/1569663002 .

6 files changed, 23 insertions, 2 deletions

diff --git a/fpdfsdk/include/pdfwindow/PWL_Wnd.h b/fpdfsdk/include/pdfwindow/PWL_Wnd.h
index 91baafa03d..0ea48b570d 100644
--- a/fpdfsdk/include/pdfwindow/PWL_Wnd.h
+++ b/fpdfsdk/include/pdfwindow/PWL_Wnd.h
@@ -288,6 +288,8 @@ class CPWL_Wnd : public CPWL_TimerHandler {
 
   void Create(const PWL_CREATEPARAM& cp);
   virtual CFX_ByteString GetClassName() const;
+  void InvalidateFocusHandler(IPWL_FocusHandler* handler);
+  void InvalidateProvider(IPWL_Provider* provider);
   void Destroy();
   void Move(const CPDF_Rect& rcNew, FX_BOOL bReset, FX_BOOL bRefresh);
   virtual void InvalidateRect(CPDF_Rect* pRect = NULL);
diff --git a/fpdfsdk/src/formfiller/FFL_ComboBox.cpp b/fpdfsdk/src/formfiller/FFL_ComboBox.cpp
index 49d76bb265..5e88a5d133 100644
--- a/fpdfsdk/src/formfiller/FFL_ComboBox.cpp
+++ b/fpdfsdk/src/formfiller/FFL_ComboBox.cpp
@@ -21,6 +21,8 @@ CFFL_ComboBox::CFFL_ComboBox(CPDFDoc_Environment* pApp, CPDFSDK_Annot* pAnnot)
 }
 
 CFFL_ComboBox::~CFFL_ComboBox() {
+  for (const auto& it : m_Maps)
+    it.second->InvalidateFocusHandler(this);
   delete m_pFontMap;
 }
 
diff --git a/fpdfsdk/src/formfiller/FFL_FormFiller.cpp b/fpdfsdk/src/formfiller/FFL_FormFiller.cpp
index 2e73b491c9..ce73f7d4cb 100644
--- a/fpdfsdk/src/formfiller/FFL_FormFiller.cpp
+++ b/fpdfsdk/src/formfiller/FFL_FormFiller.cpp
@@ -24,9 +24,10 @@ CFFL_FormFiller::CFFL_FormFiller(CPDFDoc_Environment* pApp,
 }
 
 CFFL_FormFiller::~CFFL_FormFiller() {
-  for (auto& it : m_Maps) {
+  for (const auto& it : m_Maps) {
     CPWL_Wnd* pWnd = it.second;
     CFFL_PrivateData* pData = (CFFL_PrivateData*)pWnd->GetAttachedData();
+    pWnd->InvalidateProvider(this);
     pWnd->Destroy();
     delete pWnd;
     delete pData;
diff --git a/fpdfsdk/src/formfiller/FFL_TextField.cpp b/fpdfsdk/src/formfiller/FFL_TextField.cpp
index 8d39b82dd5..ca4e07be4d 100644
--- a/fpdfsdk/src/formfiller/FFL_TextField.cpp
+++ b/fpdfsdk/src/formfiller/FFL_TextField.cpp
@@ -16,6 +16,8 @@ CFFL_TextField::CFFL_TextField(CPDFDoc_Environment* pApp, CPDFSDK_Annot* pAnnot)
 }
 
 CFFL_TextField::~CFFL_TextField() {
+  for (const auto& it : m_Maps)
+    it.second->InvalidateFocusHandler(this);
   delete m_pFontMap;
 }
 
diff --git a/fpdfsdk/src/fpdfview_embeddertest.cpp b/fpdfsdk/src/fpdfview_embeddertest.cpp
index 0f4666836f..6eb5fb95cd 100644
--- a/fpdfsdk/src/fpdfview_embeddertest.cpp
+++ b/fpdfsdk/src/fpdfview_embeddertest.cpp
@@ -196,10 +196,14 @@ TEST_F(FPDFViewEmbeddertest, Crasher_452455) {
 }
 
 TEST_F(FPDFViewEmbeddertest, Crasher_454695) {
-  // Document is damanged and can't be opened.
+  // Document is damaged and can't be opened.
   EXPECT_FALSE(OpenDocument("bug_454695.pdf"));
 }
 
+TEST_F(FPDFViewEmbeddertest, Crasher_572871) {
+  EXPECT_TRUE(OpenDocument("bug_572871.pdf"));
+}
+
 // The following tests pass if the document opens without infinite looping.
 TEST_F(FPDFViewEmbeddertest, Hang_298) {
   EXPECT_FALSE(OpenDocument("bug_298.pdf"));
diff --git a/fpdfsdk/src/pdfwindow/PWL_Wnd.cpp b/fpdfsdk/src/pdfwindow/PWL_Wnd.cpp
index 9c4e21713b..5bedad127a 100644
--- a/fpdfsdk/src/pdfwindow/PWL_Wnd.cpp
+++ b/fpdfsdk/src/pdfwindow/PWL_Wnd.cpp
@@ -237,6 +237,16 @@ void CPWL_Wnd::OnCreated() {}
 
 void CPWL_Wnd::OnDestroy() {}
 
+void CPWL_Wnd::InvalidateFocusHandler(IPWL_FocusHandler* handler) {
+  if (m_sPrivateParam.pFocusHandler == handler)
+    m_sPrivateParam.pFocusHandler = nullptr;
+}
+
+void CPWL_Wnd::InvalidateProvider(IPWL_Provider* provider) {
+  if (m_sPrivateParam.pProvider == provider)
+    m_sPrivateParam.pProvider = nullptr;
+}
+
 void CPWL_Wnd::Destroy() {
   KillFocus();