Refcount all the IFX_ stream classes all the time.

We can remove a lot of "bOwnsStream" logic in the process.
Always pass these by const reference, in case the called method
wants to hang on to the stream (one exception is where we stick
a raw pointer into a void* slot in a context from another layer).

Review-Url: https://codereview.chromium.org/2451493002

11 files changed, 108 insertions, 102 deletions

diff --git a/fpdfsdk/cpdfsdk_formfillenvironment.cpp b/fpdfsdk/cpdfsdk_formfillenvironment.cpp
index ee7758c281..b91c97842f 100644
--- a/fpdfsdk/cpdfsdk_formfillenvironment.cpp
+++ b/fpdfsdk/cpdfsdk_formfillenvironment.cpp
@@ -462,8 +462,8 @@ FPDF_FILEHANDLER* CPDFSDK_FormFillEnvironment::OpenFile(int fileType,
   return nullptr;
 }
 
-IFX_SeekableReadStream* CPDFSDK_FormFillEnvironment::DownloadFromURL(
-    const FX_WCHAR* url) {
+CFX_RetainPtr<IFX_SeekableReadStream>
+CPDFSDK_FormFillEnvironment::DownloadFromURL(const FX_WCHAR* url) {
   if (!m_pInfo || !m_pInfo->FFI_DownloadFromURL)
     return nullptr;
 
@@ -472,7 +472,6 @@ IFX_SeekableReadStream* CPDFSDK_FormFillEnvironment::DownloadFromURL(
       (FPDF_WIDESTRING)bstrURL.GetBuffer(bstrURL.GetLength());
 
   FPDF_LPFILEHANDLER fileHandler = m_pInfo->FFI_DownloadFromURL(m_pInfo, wsURL);
-
   return MakeSeekableStream(fileHandler);
 }
 
diff --git a/fpdfsdk/cpdfsdk_formfillenvironment.h b/fpdfsdk/cpdfsdk_formfillenvironment.h
index b4e11ca763..8c2a8a33c8 100644
--- a/fpdfsdk/cpdfsdk_formfillenvironment.h
+++ b/fpdfsdk/cpdfsdk_formfillenvironment.h
@@ -149,7 +149,7 @@ class CPDFSDK_FormFillEnvironment
   FPDF_FILEHANDLER* OpenFile(int fileType,
                              FPDF_WIDESTRING wsURL,
                              const char* mode);
-  IFX_SeekableReadStream* DownloadFromURL(const FX_WCHAR* url);
+  CFX_RetainPtr<IFX_SeekableReadStream> DownloadFromURL(const FX_WCHAR* url);
   CFX_WideString PostRequestURL(const FX_WCHAR* wsURL,
                                 const FX_WCHAR* wsData,
                                 const FX_WCHAR* wsContentType,
diff --git a/fpdfsdk/fpdf_dataavail.cpp b/fpdfsdk/fpdf_dataavail.cpp
index a3accba766..b1bc1e3bc0 100644
--- a/fpdfsdk/fpdf_dataavail.cpp
+++ b/fpdfsdk/fpdf_dataavail.cpp
@@ -11,6 +11,7 @@
 
 #include "core/fpdfapi/parser/cpdf_data_avail.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
+#include "core/fxcrt/cfx_retain_ptr.h"
 #include "fpdfsdk/fsdk_define.h"
 #include "public/fpdf_formfill.h"
 #include "third_party/base/ptr_util.h"
@@ -43,7 +44,7 @@ namespace {
 
 class CFPDF_FileAvailWrap : public CPDF_DataAvail::FileAvail {
  public:
-  CFPDF_FileAvailWrap() { m_pfileAvail = nullptr; }
+  CFPDF_FileAvailWrap() : m_pfileAvail(nullptr) {}
   ~CFPDF_FileAvailWrap() override {}
 
   void Set(FX_FILEAVAIL* pfileAvail) { m_pfileAvail = pfileAvail; }
@@ -59,7 +60,9 @@ class CFPDF_FileAvailWrap : public CPDF_DataAvail::FileAvail {
 
 class CFPDF_FileAccessWrap : public IFX_SeekableReadStream {
  public:
-  CFPDF_FileAccessWrap() { m_pFileAccess = nullptr; }
+  static CFX_RetainPtr<CFPDF_FileAccessWrap> Create() {
+    return CFX_RetainPtr<CFPDF_FileAccessWrap>(new CFPDF_FileAccessWrap());
+  }
   ~CFPDF_FileAccessWrap() override {}
 
   void Set(FPDF_FILEACCESS* pFile) { m_pFileAccess = pFile; }
@@ -72,9 +75,9 @@ class CFPDF_FileAccessWrap : public IFX_SeekableReadStream {
                                        (uint8_t*)buffer, size);
   }
 
-  void Release() override {}
-
  private:
+  CFPDF_FileAccessWrap() : m_pFileAccess(nullptr) {}
+
   FPDF_FILEACCESS* m_pFileAccess;
 };
 
@@ -97,12 +100,14 @@ class CFPDF_DownloadHintsWrap : public CPDF_DataAvail::DownloadHints {
 
 class CFPDF_DataAvail {
  public:
-  CFPDF_DataAvail() {}
+  CFPDF_DataAvail()
+      : m_FileAvail(new CFPDF_FileAvailWrap),
+        m_FileRead(CFPDF_FileAccessWrap::Create()) {}
   ~CFPDF_DataAvail() {}
 
   std::unique_ptr<CPDF_DataAvail> m_pDataAvail;
-  CFPDF_FileAvailWrap m_FileAvail;
-  CFPDF_FileAccessWrap m_FileRead;
+  std::unique_ptr<CFPDF_FileAvailWrap> m_FileAvail;
+  CFX_RetainPtr<CFPDF_FileAccessWrap> m_FileRead;
 };
 
 CFPDF_DataAvail* CFPDFDataAvailFromFPDFAvail(FPDF_AVAIL avail) {
@@ -114,10 +119,10 @@ CFPDF_DataAvail* CFPDFDataAvailFromFPDFAvail(FPDF_AVAIL avail) {
 DLLEXPORT FPDF_AVAIL STDCALL FPDFAvail_Create(FX_FILEAVAIL* file_avail,
                                               FPDF_FILEACCESS* file) {
   CFPDF_DataAvail* pAvail = new CFPDF_DataAvail;
-  pAvail->m_FileAvail.Set(file_avail);
-  pAvail->m_FileRead.Set(file);
+  pAvail->m_FileAvail->Set(file_avail);
+  pAvail->m_FileRead->Set(file);
   pAvail->m_pDataAvail = pdfium::MakeUnique<CPDF_DataAvail>(
-      &pAvail->m_FileAvail, &pAvail->m_FileRead, true);
+      pAvail->m_FileAvail.get(), pAvail->m_FileRead, true);
   return pAvail;
 }
 
diff --git a/fpdfsdk/fpdfeditimg.cpp b/fpdfsdk/fpdfeditimg.cpp
index 2c869ac624..531a9abc8c 100644
--- a/fpdfsdk/fpdfeditimg.cpp
+++ b/fpdfsdk/fpdfeditimg.cpp
@@ -32,7 +32,8 @@ FPDFImageObj_LoadJpegFile(FPDF_PAGE* pages,
   if (!image_object || !fileAccess || !pages)
     return false;
 
-  IFX_SeekableReadStream* pFile = MakeSeekableReadStream(fileAccess);
+  CFX_RetainPtr<IFX_SeekableReadStream> pFile =
+      MakeSeekableReadStream(fileAccess);
   CPDF_ImageObject* pImgObj = reinterpret_cast<CPDF_ImageObject*>(image_object);
   for (int index = 0; index < nCount; index++) {
     CPDF_Page* pPage = CPDFPageFromFPDFPage(pages[index]);
diff --git a/fpdfsdk/fpdfsave.cpp b/fpdfsdk/fpdfsave.cpp
index c65ff88f3d..0cfcd4af57 100644
--- a/fpdfsdk/fpdfsave.cpp
+++ b/fpdfsdk/fpdfsave.cpp
@@ -39,21 +39,23 @@
 
 class CFX_IFileWrite final : public IFX_WriteStream {
  public:
-  CFX_IFileWrite();
+  static CFX_RetainPtr<CFX_IFileWrite> Create();
   bool Init(FPDF_FILEWRITE* pFileWriteStruct);
   bool WriteBlock(const void* pData, size_t size) override;
-  void Release() override;
 
  protected:
+  CFX_IFileWrite();
   ~CFX_IFileWrite() override {}
 
   FPDF_FILEWRITE* m_pFileWriteStruct;
 };
 
-CFX_IFileWrite::CFX_IFileWrite() {
-  m_pFileWriteStruct = nullptr;
+CFX_RetainPtr<CFX_IFileWrite> CFX_IFileWrite::Create() {
+  return CFX_RetainPtr<CFX_IFileWrite>(new CFX_IFileWrite());
 }
 
+CFX_IFileWrite::CFX_IFileWrite() : m_pFileWriteStruct(nullptr) {}
+
 bool CFX_IFileWrite::Init(FPDF_FILEWRITE* pFileWriteStruct) {
   if (!pFileWriteStruct)
     return false;
@@ -70,15 +72,12 @@ bool CFX_IFileWrite::WriteBlock(const void* pData, size_t size) {
   return true;
 }
 
-void CFX_IFileWrite::Release() {
-  delete this;
-}
-
 namespace {
 
 #ifdef PDF_ENABLE_XFA
-bool SaveXFADocumentData(CPDFXFA_Context* pContext,
-                         std::vector<ScopedFileStream>* fileList) {
+bool SaveXFADocumentData(
+    CPDFXFA_Context* pContext,
+    std::vector<CFX_RetainPtr<IFX_SeekableStream>>* fileList) {
   if (!pContext)
     return false;
 
@@ -136,8 +135,9 @@ bool SaveXFADocumentData(CPDFXFA_Context* pContext,
     streamAcc.LoadAllData(pTemplateStream);
     uint8_t* pData = (uint8_t*)streamAcc.GetData();
     uint32_t dwSize2 = streamAcc.GetSize();
-    ScopedFileStream pTemplate(IFX_MemoryStream::Create(pData, dwSize2));
-    pChecksum->UpdateChecksum(pTemplate.get());
+    CFX_RetainPtr<IFX_SeekableStream> pTemplate =
+        IFX_MemoryStream::Create(pData, dwSize2);
+    pChecksum->UpdateChecksum(pTemplate);
   }
   CPDF_Stream* pFormStream = nullptr;
   CPDF_Stream* pDataSetsStream = nullptr;
@@ -169,23 +169,23 @@ bool SaveXFADocumentData(CPDFXFA_Context* pContext,
   }
   // L"datasets"
   {
-    ScopedFileStream pDsfileWrite(IFX_MemoryStream::Create());
-    if (pXFADocView->GetDoc()->SavePackage(XFA_HASHCODE_Datasets,
-                                           pDsfileWrite.get(), nullptr) &&
+    CFX_RetainPtr<IFX_SeekableStream> pDsfileWrite = IFX_MemoryStream::Create();
+    if (pXFADocView->GetDoc()->SavePackage(XFA_HASHCODE_Datasets, pDsfileWrite,
+                                           nullptr) &&
         pDsfileWrite->GetSize() > 0) {
       // Datasets
-      pChecksum->UpdateChecksum(pDsfileWrite.get());
+      pChecksum->UpdateChecksum(pDsfileWrite);
       pChecksum->FinishChecksum();
       auto pDataDict = pdfium::MakeUnique<CPDF_Dictionary>(
           pPDFDocument->GetByteStringPool());
       if (iDataSetsIndex != -1) {
         if (pDataSetsStream) {
-          pDataSetsStream->InitStreamFromFile(pDsfileWrite.get(),
+          pDataSetsStream->InitStreamFromFile(pDsfileWrite,
                                               std::move(pDataDict));
         }
       } else {
         CPDF_Stream* pData = pPDFDocument->NewIndirect<CPDF_Stream>();
-        pData->InitStreamFromFile(pDsfileWrite.get(), std::move(pDataDict));
+        pData->InitStreamFromFile(pDsfileWrite, std::move(pDataDict));
         iLast = pArray->GetCount() - 2;
         pArray->InsertNewAt<CPDF_String>(iLast, "datasets", false);
         pArray->InsertNewAt<CPDF_Reference>(iLast + 1, pPDFDocument,
@@ -196,20 +196,18 @@ bool SaveXFADocumentData(CPDFXFA_Context* pContext,
   }
   // L"form"
   {
-    ScopedFileStream pfileWrite(IFX_MemoryStream::Create());
-    if (pXFADocView->GetDoc()->SavePackage(XFA_HASHCODE_Form, pfileWrite.get(),
+    CFX_RetainPtr<IFX_SeekableStream> pfileWrite = IFX_MemoryStream::Create();
+    if (pXFADocView->GetDoc()->SavePackage(XFA_HASHCODE_Form, pfileWrite,
                                            pChecksum.get()) &&
         pfileWrite->GetSize() > 0) {
       auto pDataDict = pdfium::MakeUnique<CPDF_Dictionary>(
           pPDFDocument->GetByteStringPool());
       if (iFormIndex != -1) {
-        if (pFormStream) {
-          pFormStream->InitStreamFromFile(pfileWrite.get(),
-                                          std::move(pDataDict));
-        }
+        if (pFormStream)
+          pFormStream->InitStreamFromFile(pfileWrite, std::move(pDataDict));
       } else {
         CPDF_Stream* pData = pPDFDocument->NewIndirect<CPDF_Stream>();
-        pData->InitStreamFromFile(pfileWrite.get(), std::move(pDataDict));
+        pData->InitStreamFromFile(pfileWrite, std::move(pDataDict));
         iLast = pArray->GetCount() - 2;
         pArray->InsertNewAt<CPDF_String>(iLast, "form", false);
         pArray->InsertNewAt<CPDF_Reference>(iLast + 1, pPDFDocument,
@@ -246,8 +244,9 @@ bool SendPostSaveToXFADoc(CPDFXFA_Context* pContext) {
   return true;
 }
 
-bool SendPreSaveToXFADoc(CPDFXFA_Context* pContext,
-                         std::vector<ScopedFileStream>* fileList) {
+bool SendPreSaveToXFADoc(
+    CPDFXFA_Context* pContext,
+    std::vector<CFX_RetainPtr<IFX_SeekableStream>>* fileList) {
   if (pContext->GetDocType() != DOCTYPE_DYNAMIC_XFA &&
       pContext->GetDocType() != DOCTYPE_STATIC_XFA)
     return true;
@@ -280,7 +279,7 @@ bool FPDF_Doc_Save(FPDF_DOCUMENT document,
 
 #ifdef PDF_ENABLE_XFA
   CPDFXFA_Context* pContext = static_cast<CPDFXFA_Context*>(document);
-  std::vector<ScopedFileStream> fileList;
+  std::vector<CFX_RetainPtr<IFX_SeekableStream>> fileList;
   SendPreSaveToXFADoc(pContext, &fileList);
 #endif  // PDF_ENABLE_XFA
 
@@ -295,13 +294,12 @@ bool FPDF_Doc_Save(FPDF_DOCUMENT document,
     FileMaker.RemoveSecurity();
   }
 
-  CFX_IFileWrite* pStreamWrite = new CFX_IFileWrite;
+  CFX_RetainPtr<CFX_IFileWrite> pStreamWrite = CFX_IFileWrite::Create();
   pStreamWrite->Init(pFileWrite);
   bool bRet = FileMaker.Create(pStreamWrite, flags);
 #ifdef PDF_ENABLE_XFA
   SendPostSaveToXFADoc(pContext);
 #endif  // PDF_ENABLE_XFA
-  pStreamWrite->Release();
   return bRet;
 }
 
diff --git a/fpdfsdk/fpdfview.cpp b/fpdfsdk/fpdfview.cpp
index fb87c838d4..b49be38716 100644
--- a/fpdfsdk/fpdfview.cpp
+++ b/fpdfsdk/fpdfview.cpp
@@ -119,15 +119,17 @@ void RenderPageImpl(CPDF_PageRenderContext* pContext,
 
 class CPDF_CustomAccess final : public IFX_SeekableReadStream {
  public:
-  explicit CPDF_CustomAccess(FPDF_FILEACCESS* pFileAccess);
-  ~CPDF_CustomAccess() override {}
+  static CFX_RetainPtr<CPDF_CustomAccess> Create(FPDF_FILEACCESS* pFileAccess) {
+    return CFX_RetainPtr<CPDF_CustomAccess>(new CPDF_CustomAccess(pFileAccess));
+  }
 
   // IFX_SeekableReadStream
   FX_FILESIZE GetSize() override;
-  void Release() override;
   bool ReadBlock(void* buffer, FX_FILESIZE offset, size_t size) override;
 
  private:
+  explicit CPDF_CustomAccess(FPDF_FILEACCESS* pFileAccess);
+
   FPDF_FILEACCESS m_FileAccess;
 };
 
@@ -138,10 +140,6 @@ FX_FILESIZE CPDF_CustomAccess::GetSize() {
   return m_FileAccess.m_FileLen;
 }
 
-void CPDF_CustomAccess::Release() {
-  delete this;
-}
-
 bool CPDF_CustomAccess::ReadBlock(void* buffer,
                                   FX_FILESIZE offset,
                                   size_t size) {
@@ -161,12 +159,12 @@ bool CPDF_CustomAccess::ReadBlock(void* buffer,
 #ifdef PDF_ENABLE_XFA
 class CFPDF_FileStream : public IFX_SeekableStream {
  public:
-  explicit CFPDF_FileStream(FPDF_FILEHANDLER* pFS);
-  ~CFPDF_FileStream() override {}
+  static CFX_RetainPtr<CFPDF_FileStream> Create(FPDF_FILEHANDLER* pFS) {
+    return CFX_RetainPtr<CFPDF_FileStream>(new CFPDF_FileStream(pFS));
+  }
+  ~CFPDF_FileStream() override;
 
   // IFX_SeekableStream:
-  IFX_SeekableStream* Retain() override;
-  void Release() override;
   FX_FILESIZE GetSize() override;
   bool IsEOF() override;
   FX_FILESIZE GetPosition() override;
@@ -178,6 +176,8 @@ class CFPDF_FileStream : public IFX_SeekableStream {
   void SetPosition(FX_FILESIZE pos) { m_nCurPos = pos; }
 
  protected:
+  explicit CFPDF_FileStream(FPDF_FILEHANDLER* pFS);
+
   FPDF_FILEHANDLER* m_pFS;
   FX_FILESIZE m_nCurPos;
 };
@@ -187,14 +187,9 @@ CFPDF_FileStream::CFPDF_FileStream(FPDF_FILEHANDLER* pFS) {
   m_nCurPos = 0;
 }
 
-IFX_SeekableStream* CFPDF_FileStream::Retain() {
-  return this;
-}
-
-void CFPDF_FileStream::Release() {
+CFPDF_FileStream::~CFPDF_FileStream() {
   if (m_pFS && m_pFS->Release)
     m_pFS->Release(m_pFS->clientData);
-  delete this;
 }
 
 FX_FILESIZE CFPDF_FileStream::GetSize() {
@@ -310,13 +305,15 @@ CFX_DIBitmap* CFXBitmapFromFPDFBitmap(FPDF_BITMAP bitmap) {
   return static_cast<CFX_DIBitmap*>(bitmap);
 }
 
-IFX_SeekableReadStream* MakeSeekableReadStream(FPDF_FILEACCESS* pFileAccess) {
-  return new CPDF_CustomAccess(pFileAccess);
+CFX_RetainPtr<IFX_SeekableReadStream> MakeSeekableReadStream(
+    FPDF_FILEACCESS* pFileAccess) {
+  return CPDF_CustomAccess::Create(pFileAccess);
 }
 
 #ifdef PDF_ENABLE_XFA
-IFX_SeekableStream* MakeSeekableStream(FPDF_FILEHANDLER* pFilehandler) {
-  return new CFPDF_FileStream(pFilehandler);
+CFX_RetainPtr<IFX_SeekableStream> MakeSeekableStream(
+    FPDF_FILEHANDLER* pFilehandler) {
+  return CFPDF_FileStream::Create(pFilehandler);
 }
 #endif  // PDF_ENABLE_XFA
 
@@ -447,7 +444,7 @@ DLLEXPORT FPDF_DOCUMENT STDCALL FPDF_LoadDocument(FPDF_STRING file_path,
                                                   FPDF_BYTESTRING password) {
   // NOTE: the creation of the file needs to be by the embedder on the
   // other side of this API.
-  IFX_SeekableReadStream* pFileAccess =
+  CFX_RetainPtr<IFX_SeekableReadStream> pFileAccess =
       IFX_SeekableReadStream::CreateFromFilename((const FX_CHAR*)file_path);
   if (!pFileAccess)
     return nullptr;
@@ -500,25 +497,26 @@ DLLEXPORT FPDF_BOOL STDCALL FPDF_LoadXFA(FPDF_DOCUMENT document) {
 
 class CMemFile final : public IFX_SeekableReadStream {
  public:
-  CMemFile(uint8_t* pBuf, FX_FILESIZE size) : m_pBuf(pBuf), m_size(size) {}
+  static CFX_RetainPtr<CMemFile> Create(uint8_t* pBuf, FX_FILESIZE size) {
+    return CFX_RetainPtr<CMemFile>(new CMemFile(pBuf, size));
+  }
 
-  void Release() override { delete this; }
   FX_FILESIZE GetSize() override { return m_size; }
   bool ReadBlock(void* buffer, FX_FILESIZE offset, size_t size) override {
-    if (offset < 0) {
+    if (offset < 0)
       return false;
-    }
+
     FX_SAFE_FILESIZE newPos = pdfium::base::checked_cast<FX_FILESIZE>(size);
     newPos += offset;
-    if (!newPos.IsValid() || newPos.ValueOrDie() > m_size) {
+    if (!newPos.IsValid() || newPos.ValueOrDie() > m_size)
       return false;
-    }
+
     FXSYS_memcpy(buffer, m_pBuf + offset, size);
     return true;
   }
 
  private:
-  ~CMemFile() override {}
+  CMemFile(uint8_t* pBuf, FX_FILESIZE size) : m_pBuf(pBuf), m_size(size) {}
 
   uint8_t* const m_pBuf;
   const FX_FILESIZE m_size;
@@ -527,12 +525,11 @@ class CMemFile final : public IFX_SeekableReadStream {
 DLLEXPORT FPDF_DOCUMENT STDCALL FPDF_LoadMemDocument(const void* data_buf,
                                                      int size,
                                                      FPDF_BYTESTRING password) {
-  CMemFile* pMemFile = new CMemFile((uint8_t*)data_buf, size);
-  std::unique_ptr<CPDF_Parser> pParser(new CPDF_Parser);
+  CFX_RetainPtr<CMemFile> pMemFile = CMemFile::Create((uint8_t*)data_buf, size);
+  auto pParser = pdfium::MakeUnique<CPDF_Parser>();
   pParser->SetPassword(password);
 
-  std::unique_ptr<CPDF_Document> pDocument(
-      new CPDF_Document(std::move(pParser)));
+  auto pDocument = pdfium::MakeUnique<CPDF_Document>(std::move(pParser));
   CPDF_Parser::Error error =
       pDocument->GetParser()->StartParse(pMemFile, pDocument.get());
   if (error != CPDF_Parser::SUCCESS) {
@@ -546,12 +543,12 @@ DLLEXPORT FPDF_DOCUMENT STDCALL FPDF_LoadMemDocument(const void* data_buf,
 DLLEXPORT FPDF_DOCUMENT STDCALL
 FPDF_LoadCustomDocument(FPDF_FILEACCESS* pFileAccess,
                         FPDF_BYTESTRING password) {
-  CPDF_CustomAccess* pFile = new CPDF_CustomAccess(pFileAccess);
-  std::unique_ptr<CPDF_Parser> pParser(new CPDF_Parser);
+  CFX_RetainPtr<CPDF_CustomAccess> pFile =
+      CPDF_CustomAccess::Create(pFileAccess);
+  auto pParser = pdfium::MakeUnique<CPDF_Parser>();
   pParser->SetPassword(password);
 
-  std::unique_ptr<CPDF_Document> pDocument(
-      new CPDF_Document(std::move(pParser)));
+  auto pDocument = pdfium::MakeUnique<CPDF_Document>(std::move(pParser));
   CPDF_Parser::Error error =
       pDocument->GetParser()->StartParse(pFile, pDocument.get());
   if (error != CPDF_Parser::SUCCESS) {
diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp b/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
index 7945786070..1995882388 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
@@ -328,7 +328,7 @@ CFX_WideString CPDFXFA_Context::Response(const CFX_WideString& wsQuestion,
   return wsAnswer;
 }
 
-IFX_SeekableReadStream* CPDFXFA_Context::DownloadURL(
+CFX_RetainPtr<IFX_SeekableReadStream> CPDFXFA_Context::DownloadURL(
     const CFX_WideString& wsURL) {
   return m_pFormFillEnv ? m_pFormFillEnv->DownloadFromURL(wsURL.c_str())
                         : nullptr;
diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_context.h b/fpdfsdk/fpdfxfa/cpdfxfa_context.h
index 2cd2b439d3..8b9daea26f 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_context.h
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_context.h
@@ -67,7 +67,8 @@ class CPDFXFA_Context : public IXFA_AppProvider {
                           const CFX_WideString& wsTitle,
                           const CFX_WideString& wsDefaultAnswer,
                           bool bMark) override;
-  IFX_SeekableReadStream* DownloadURL(const CFX_WideString& wsURL) override;
+  CFX_RetainPtr<IFX_SeekableReadStream> DownloadURL(
+      const CFX_WideString& wsURL) override;
   bool PostRequestURL(const CFX_WideString& wsURL,
                       const CFX_WideString& wsData,
                       const CFX_WideString& wsContentType,
diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp b/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp
index 6e199e2ff1..2b3368bc60 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp
@@ -11,6 +11,7 @@
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_stream_acc.h"
 #include "core/fpdfapi/parser/cpdf_string.h"
+#include "core/fxcrt/cfx_retain_ptr.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_interform.h"
 #include "fpdfsdk/cpdfsdk_pageview.h"
@@ -437,15 +438,15 @@ void CPDFXFA_DocEnvironment::ExportData(CXFA_FFDoc* hDoc,
   if (!pFileHandler)
     return;
 
-  std::unique_ptr<IFX_SeekableStream, ReleaseDeleter<IFX_SeekableStream>>
-      fileWrite(MakeSeekableStream(pFileHandler));
+  CFX_RetainPtr<IFX_SeekableStream> fileWrite =
+      MakeSeekableStream(pFileHandler);
   CFX_ByteString content;
   if (fileType == FXFA_SAVEAS_XML) {
     content = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n";
     fileWrite->WriteBlock(content.c_str(), fileWrite->GetSize(),
                           content.GetLength());
-    m_pContext->GetXFADocView()->GetDoc()->SavePackage(
-        XFA_HASHCODE_Data, fileWrite.get(), nullptr);
+    m_pContext->GetXFADocView()->GetDoc()->SavePackage(XFA_HASHCODE_Data,
+                                                       fileWrite, nullptr);
   } else if (fileType == FXFA_SAVEAS_XDP) {
     if (!m_pContext->GetPDFDoc())
       return;
@@ -475,13 +476,13 @@ void CPDFXFA_DocEnvironment::ExportData(CXFA_FFDoc* hDoc,
       if (!pStream)
         continue;
       if (pPrePDFObj->GetString() == "form") {
-        m_pContext->GetXFADocView()->GetDoc()->SavePackage(
-            XFA_HASHCODE_Form, fileWrite.get(), nullptr);
+        m_pContext->GetXFADocView()->GetDoc()->SavePackage(XFA_HASHCODE_Form,
+                                                           fileWrite, nullptr);
         continue;
       }
       if (pPrePDFObj->GetString() == "datasets") {
         m_pContext->GetXFADocView()->GetDoc()->SavePackage(
-            XFA_HASHCODE_Datasets, fileWrite.get(), nullptr);
+            XFA_HASHCODE_Datasets, fileWrite, nullptr);
         continue;
       }
       if (i == size - 1) {
@@ -699,7 +700,7 @@ bool CPDFXFA_DocEnvironment::SubmitData(CXFA_FFDoc* hDoc, CXFA_Submit submit) {
   return ret;
 }
 
-IFX_SeekableReadStream* CPDFXFA_DocEnvironment::OpenLinkedFile(
+CFX_RetainPtr<IFX_SeekableReadStream> CPDFXFA_DocEnvironment::OpenLinkedFile(
     CXFA_FFDoc* hDoc,
     const CFX_WideString& wsLink) {
   CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
@@ -729,13 +730,13 @@ bool CPDFXFA_DocEnvironment::ExportSubmitFile(FPDF_FILEHANDLER* pFileHandler,
   if (!pFormFillEnv)
     return false;
 
-  std::unique_ptr<IFX_SeekableStream, ReleaseDeleter<IFX_SeekableStream>>
-      fileStream(MakeSeekableStream(pFileHandler));
+  CFX_RetainPtr<IFX_SeekableStream> fileStream =
+      MakeSeekableStream(pFileHandler);
 
   if (fileType == FXFA_SAVEAS_XML) {
     const char kContent[] = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n";
     fileStream->WriteBlock(kContent, 0, strlen(kContent));
-    m_pContext->GetXFADoc()->SavePackage(XFA_HASHCODE_Data, fileStream.get(),
+    m_pContext->GetXFADoc()->SavePackage(XFA_HASHCODE_Data, fileStream,
                                          nullptr);
     return true;
   }
@@ -797,11 +798,11 @@ bool CPDFXFA_DocEnvironment::ExportSubmitFile(FPDF_FILEHANDLER* pFileHandler,
     if (pPrePDFObj->GetString() == "form" && !(flag & FXFA_FORM))
       continue;
     if (pPrePDFObj->GetString() == "form") {
-      m_pContext->GetXFADoc()->SavePackage(XFA_HASHCODE_Form, fileStream.get(),
+      m_pContext->GetXFADoc()->SavePackage(XFA_HASHCODE_Form, fileStream,
                                            nullptr);
     } else if (pPrePDFObj->GetString() == "datasets") {
-      m_pContext->GetXFADoc()->SavePackage(XFA_HASHCODE_Datasets,
-                                           fileStream.get(), nullptr);
+      m_pContext->GetXFADoc()->SavePackage(XFA_HASHCODE_Datasets, fileStream,
+                                           nullptr);
     } else {
       // PDF,creator.
     }
diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h b/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h
index a7d41a88c8..d7cb169616 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h
@@ -7,6 +7,7 @@
 #ifndef FPDFSDK_FPDFXFA_CPDFXFA_DOCENVIRONMENT_H_
 #define FPDFSDK_FPDFXFA_CPDFXFA_DOCENVIRONMENT_H_
 
+#include "core/fxcrt/cfx_retain_ptr.h"
 #include "public/fpdfview.h"
 #include "xfa/fxfa/fxfa.h"
 
@@ -85,8 +86,9 @@ class CPDFXFA_DocEnvironment : public IXFA_DocEnvironment {
                          const CFX_ByteStringC& szPropName,
                          CFXJSE_Value* pValue) override;
 
-  IFX_SeekableReadStream* OpenLinkedFile(CXFA_FFDoc* hDoc,
-                                         const CFX_WideString& wsLink) override;
+  CFX_RetainPtr<IFX_SeekableReadStream> OpenLinkedFile(
+      CXFA_FFDoc* hDoc,
+      const CFX_WideString& wsLink) override;
 
  private:
   bool OnBeforeNotifySubmit();
diff --git a/fpdfsdk/fsdk_define.h b/fpdfsdk/fsdk_define.h
index a3f5a30836..9a115966db 100644
--- a/fpdfsdk/fsdk_define.h
+++ b/fpdfsdk/fsdk_define.h
@@ -27,12 +27,14 @@ class IFSDK_PAUSE_Adapter;
 
 // Layering prevents fxcrt from knowing about FPDF_FILEACCESS, so this can't
 // be a static method of IFX_SeekableReadStream.
-IFX_SeekableReadStream* MakeSeekableReadStream(FPDF_FILEACCESS* pFileAccess);
+CFX_RetainPtr<IFX_SeekableReadStream> MakeSeekableReadStream(
+    FPDF_FILEACCESS* pFileAccess);
 
 #ifdef PDF_ENABLE_XFA
 // Layering prevents fxcrt from knowing about FPDF_FILEHANDLER, so this can't
 // be a static method of IFX_SeekableStream.
-IFX_SeekableStream* MakeSeekableStream(FPDF_FILEHANDLER* pFileHandler);
+CFX_RetainPtr<IFX_SeekableStream> MakeSeekableStream(
+    FPDF_FILEHANDLER* pFileHandler);
 #endif  // PDF_ENABLE_XFA
 
 // Object types for public FPDF_ types; these correspond to next layer down