Watch destruction of widgets around OnAAction() method.

We implemented the CFX_Observable mechanism for detecting
stale objects some time ago; now just use it in more places.

Change method signatures to required an ObservedPtr to
indicate that the callers are aware that the value may be
destroyed out from underneath them.

BUG=649659

Review-Url: https://codereview.chromium.org/2368403002

20 files changed, 559 insertions, 545 deletions

diff --git a/fpdfsdk/cpdfsdk_annothandlermgr.cpp b/fpdfsdk/cpdfsdk_annothandlermgr.cpp
index 87fc8056c6..75542d360e 100644
--- a/fpdfsdk/cpdfsdk_annothandlermgr.cpp
+++ b/fpdfsdk/cpdfsdk_annothandlermgr.cpp
@@ -104,84 +104,89 @@ void CPDFSDK_AnnotHandlerMgr::Annot_OnDraw(CPDFSDK_PageView* pPageView,
 
 FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnLButtonDown(
     CPDFSDK_PageView* pPageView,
-    CPDFSDK_Annot* pAnnot,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
     uint32_t nFlags,
     const CFX_FloatPoint& point) {
-  ASSERT(pAnnot);
-  return GetAnnotHandler(pAnnot)->OnLButtonDown(pPageView, pAnnot, nFlags,
-                                                point);
+  ASSERT(*pAnnot);
+  return GetAnnotHandler(pAnnot->Get())
+      ->OnLButtonDown(pPageView, pAnnot, nFlags, point);
 }
 
 FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnLButtonUp(
     CPDFSDK_PageView* pPageView,
-    CPDFSDK_Annot* pAnnot,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
     uint32_t nFlags,
     const CFX_FloatPoint& point) {
-  ASSERT(pAnnot);
-  return GetAnnotHandler(pAnnot)->OnLButtonUp(pPageView, pAnnot, nFlags, point);
+  ASSERT(*pAnnot);
+  return GetAnnotHandler(pAnnot->Get())
+      ->OnLButtonUp(pPageView, pAnnot, nFlags, point);
 }
 
 FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnLButtonDblClk(
     CPDFSDK_PageView* pPageView,
-    CPDFSDK_Annot* pAnnot,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
     uint32_t nFlags,
     const CFX_FloatPoint& point) {
-  ASSERT(pAnnot);
-  return GetAnnotHandler(pAnnot)->OnLButtonDblClk(pPageView, pAnnot, nFlags,
-                                                  point);
+  ASSERT(*pAnnot);
+  return GetAnnotHandler(pAnnot->Get())
+      ->OnLButtonDblClk(pPageView, pAnnot, nFlags, point);
 }
 
 FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnMouseMove(
     CPDFSDK_PageView* pPageView,
-    CPDFSDK_Annot* pAnnot,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
     uint32_t nFlags,
     const CFX_FloatPoint& point) {
-  ASSERT(pAnnot);
-  return GetAnnotHandler(pAnnot)->OnMouseMove(pPageView, pAnnot, nFlags, point);
+  ASSERT(*pAnnot);
+  return GetAnnotHandler(pAnnot->Get())
+      ->OnMouseMove(pPageView, pAnnot, nFlags, point);
 }
 
 FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnMouseWheel(
     CPDFSDK_PageView* pPageView,
-    CPDFSDK_Annot* pAnnot,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
     uint32_t nFlags,
     short zDelta,
     const CFX_FloatPoint& point) {
-  ASSERT(pAnnot);
-  return GetAnnotHandler(pAnnot)->OnMouseWheel(pPageView, pAnnot, nFlags,
-                                               zDelta, point);
+  ASSERT(*pAnnot);
+  return GetAnnotHandler(pAnnot->Get())
+      ->OnMouseWheel(pPageView, pAnnot, nFlags, zDelta, point);
 }
 
 FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnRButtonDown(
     CPDFSDK_PageView* pPageView,
-    CPDFSDK_Annot* pAnnot,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
     uint32_t nFlags,
     const CFX_FloatPoint& point) {
-  ASSERT(pAnnot);
-  return GetAnnotHandler(pAnnot)->OnRButtonDown(pPageView, pAnnot, nFlags,
-                                                point);
+  ASSERT(*pAnnot);
+  return GetAnnotHandler(pAnnot->Get())
+      ->OnRButtonDown(pPageView, pAnnot, nFlags, point);
 }
 
 FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnRButtonUp(
     CPDFSDK_PageView* pPageView,
-    CPDFSDK_Annot* pAnnot,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
     uint32_t nFlags,
     const CFX_FloatPoint& point) {
-  ASSERT(pAnnot);
-  return GetAnnotHandler(pAnnot)->OnRButtonUp(pPageView, pAnnot, nFlags, point);
+  ASSERT(*pAnnot);
+  return GetAnnotHandler(pAnnot->Get())
+      ->OnRButtonUp(pPageView, pAnnot, nFlags, point);
 }
 
-void CPDFSDK_AnnotHandlerMgr::Annot_OnMouseEnter(CPDFSDK_PageView* pPageView,
-                                                 CPDFSDK_Annot* pAnnot,
-                                                 uint32_t nFlag) {
-  ASSERT(pAnnot);
-  GetAnnotHandler(pAnnot)->OnMouseEnter(pPageView, pAnnot, nFlag);
+void CPDFSDK_AnnotHandlerMgr::Annot_OnMouseEnter(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  ASSERT(*pAnnot);
+  GetAnnotHandler(pAnnot->Get())->OnMouseEnter(pPageView, pAnnot, nFlag);
 }
 
-void CPDFSDK_AnnotHandlerMgr::Annot_OnMouseExit(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlag) {
-  ASSERT(pAnnot);
-  GetAnnotHandler(pAnnot)->OnMouseExit(pPageView, pAnnot, nFlag);
+void CPDFSDK_AnnotHandlerMgr::Annot_OnMouseExit(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  ASSERT(*pAnnot);
+  GetAnnotHandler(pAnnot->Get())->OnMouseExit(pPageView, pAnnot, nFlag);
 }
 
 FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnChar(CPDFSDK_Annot* pAnnot,
@@ -199,12 +204,10 @@ FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnKeyDown(CPDFSDK_Annot* pAnnot,
   CPDFSDK_PageView* pPage = pAnnot->GetPageView();
   CPDFSDK_Annot* pFocusAnnot = pPage->GetFocusAnnot();
   if (pFocusAnnot && (nKeyCode == FWL_VKEY_Tab)) {
-    CPDFSDK_Annot* pNext =
-        GetNextAnnot(pFocusAnnot, !m_pEnv->IsSHIFTKeyDown(nFlag));
-
-    if (pNext && pNext != pFocusAnnot) {
-      CPDFSDK_Document* pDocument = pPage->GetSDKDocument();
-      pDocument->SetFocusAnnot(pNext);
+    CPDFSDK_Annot::ObservedPtr pNext(
+        GetNextAnnot(pFocusAnnot, !m_pEnv->IsSHIFTKeyDown(nFlag)));
+    if (pNext && pNext.Get() != pFocusAnnot) {
+      pPage->GetSDKDocument()->SetFocusAnnot(&pNext);
       return TRUE;
     }
   }
@@ -218,30 +221,30 @@ FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnKeyUp(CPDFSDK_Annot* pAnnot,
   return FALSE;
 }
 
-FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnSetFocus(CPDFSDK_Annot* pAnnot,
-                                                  uint32_t nFlag) {
-  ASSERT(pAnnot);
-
-  if (!GetAnnotHandler(pAnnot)->OnSetFocus(pAnnot, nFlag))
+FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnSetFocus(
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  ASSERT(*pAnnot);
+  if (!GetAnnotHandler(pAnnot->Get())->OnSetFocus(pAnnot, nFlag))
     return FALSE;
 
-  CPDFSDK_PageView* pPage = pAnnot->GetPageView();
-  pPage->GetSDKDocument();
+  (*pAnnot)->GetPageView()->GetSDKDocument();
   return TRUE;
 }
 
-FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnKillFocus(CPDFSDK_Annot* pAnnot,
-                                                   uint32_t nFlag) {
-  ASSERT(pAnnot);
-  return GetAnnotHandler(pAnnot)->OnKillFocus(pAnnot, nFlag);
+FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnKillFocus(
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  ASSERT(*pAnnot);
+  return GetAnnotHandler(pAnnot->Get())->OnKillFocus(pAnnot, nFlag);
 }
 
 #ifdef PDF_ENABLE_XFA
 FX_BOOL CPDFSDK_AnnotHandlerMgr::Annot_OnChangeFocus(
-    CPDFSDK_Annot* pSetAnnot,
-    CPDFSDK_Annot* pKillAnnot) {
-  FX_BOOL bXFA = (pSetAnnot && pSetAnnot->GetXFAWidget()) ||
-                 (pKillAnnot && pKillAnnot->GetXFAWidget());
+    CPDFSDK_Annot::ObservedPtr* pSetAnnot,
+    CPDFSDK_Annot::ObservedPtr* pKillAnnot) {
+  FX_BOOL bXFA = (*pSetAnnot && (*pSetAnnot)->GetXFAWidget()) ||
+                 (*pKillAnnot && (*pKillAnnot)->GetXFAWidget());
 
   if (bXFA) {
     if (IPDFSDK_AnnotHandler* pXFAAnnotHandler =
diff --git a/fpdfsdk/cpdfsdk_baannothandler.cpp b/fpdfsdk/cpdfsdk_baannothandler.cpp
index 1422c75f49..8131d6f19b 100644
--- a/fpdfsdk/cpdfsdk_baannothandler.cpp
+++ b/fpdfsdk/cpdfsdk_baannothandler.cpp
@@ -79,75 +79,79 @@ void CPDFSDK_BAAnnotHandler::OnDelete(CPDFSDK_Annot* pAnnot) {}
 void CPDFSDK_BAAnnotHandler::OnRelease(CPDFSDK_Annot* pAnnot) {}
 
 void CPDFSDK_BAAnnotHandler::OnMouseEnter(CPDFSDK_PageView* pPageView,
-                                          CPDFSDK_Annot* pAnnot,
+                                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                                           uint32_t nFlag) {
-  CPDFSDK_BAAnnot* pBAAnnot = static_cast<CPDFSDK_BAAnnot*>(pAnnot);
+  CPDFSDK_BAAnnot* pBAAnnot = static_cast<CPDFSDK_BAAnnot*>(pAnnot->Get());
   pBAAnnot->SetOpenState(true);
   UpdateAnnotRects(pPageView, pBAAnnot);
 }
 
 void CPDFSDK_BAAnnotHandler::OnMouseExit(CPDFSDK_PageView* pPageView,
-                                         CPDFSDK_Annot* pAnnot,
+                                         CPDFSDK_Annot::ObservedPtr* pAnnot,
                                          uint32_t nFlag) {
-  CPDFSDK_BAAnnot* pBAAnnot = static_cast<CPDFSDK_BAAnnot*>(pAnnot);
+  CPDFSDK_BAAnnot* pBAAnnot = static_cast<CPDFSDK_BAAnnot*>(pAnnot->Get());
   pBAAnnot->SetOpenState(false);
   UpdateAnnotRects(pPageView, pBAAnnot);
 }
 
-FX_BOOL CPDFSDK_BAAnnotHandler::OnLButtonDown(CPDFSDK_PageView* pPageView,
-                                              CPDFSDK_Annot* pAnnot,
-                                              uint32_t nFlags,
-                                              const CFX_FloatPoint& point) {
+FX_BOOL CPDFSDK_BAAnnotHandler::OnLButtonDown(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
   return FALSE;
 }
 
 FX_BOOL CPDFSDK_BAAnnotHandler::OnLButtonUp(CPDFSDK_PageView* pPageView,
-                                            CPDFSDK_Annot* pAnnot,
+                                            CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             uint32_t nFlags,
                                             const CFX_FloatPoint& point) {
   return FALSE;
 }
 
-FX_BOOL CPDFSDK_BAAnnotHandler::OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
+FX_BOOL CPDFSDK_BAAnnotHandler::OnLButtonDblClk(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
   return FALSE;
 }
 
 FX_BOOL CPDFSDK_BAAnnotHandler::OnMouseMove(CPDFSDK_PageView* pPageView,
-                                            CPDFSDK_Annot* pAnnot,
+                                            CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             uint32_t nFlags,
                                             const CFX_FloatPoint& point) {
   return FALSE;
 }
 
 FX_BOOL CPDFSDK_BAAnnotHandler::OnMouseWheel(CPDFSDK_PageView* pPageView,
-                                             CPDFSDK_Annot* pAnnot,
+                                             CPDFSDK_Annot::ObservedPtr* pAnnot,
                                              uint32_t nFlags,
                                              short zDelta,
                                              const CFX_FloatPoint& point) {
   return FALSE;
 }
 
-FX_BOOL CPDFSDK_BAAnnotHandler::OnRButtonDown(CPDFSDK_PageView* pPageView,
-                                              CPDFSDK_Annot* pAnnot,
-                                              uint32_t nFlags,
-                                              const CFX_FloatPoint& point) {
+FX_BOOL CPDFSDK_BAAnnotHandler::OnRButtonDown(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
   return FALSE;
 }
 
 FX_BOOL CPDFSDK_BAAnnotHandler::OnRButtonUp(CPDFSDK_PageView* pPageView,
-                                            CPDFSDK_Annot* pAnnot,
+                                            CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             uint32_t nFlags,
                                             const CFX_FloatPoint& point) {
   return FALSE;
 }
 
-FX_BOOL CPDFSDK_BAAnnotHandler::OnRButtonDblClk(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
+FX_BOOL CPDFSDK_BAAnnotHandler::OnRButtonDblClk(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
   return FALSE;
 }
 
@@ -177,19 +181,20 @@ void CPDFSDK_BAAnnotHandler::OnCreate(CPDFSDK_Annot* pAnnot) {}
 
 void CPDFSDK_BAAnnotHandler::OnLoad(CPDFSDK_Annot* pAnnot) {}
 
-FX_BOOL CPDFSDK_BAAnnotHandler::OnSetFocus(CPDFSDK_Annot* pAnnot,
+FX_BOOL CPDFSDK_BAAnnotHandler::OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
                                            uint32_t nFlag) {
   return FALSE;
 }
 
-FX_BOOL CPDFSDK_BAAnnotHandler::OnKillFocus(CPDFSDK_Annot* pAnnot,
+FX_BOOL CPDFSDK_BAAnnotHandler::OnKillFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             uint32_t nFlag) {
   return FALSE;
 }
 
 #ifdef PDF_ENABLE_XFA
-FX_BOOL CPDFSDK_BAAnnotHandler::OnXFAChangedFocus(CPDFSDK_Annot* pOldAnnot,
-                                                  CPDFSDK_Annot* pNewAnnot) {
+FX_BOOL CPDFSDK_BAAnnotHandler::OnXFAChangedFocus(
+    CPDFSDK_Annot::ObservedPtr* pOldAnnot,
+    CPDFSDK_Annot::ObservedPtr* pNewAnnot) {
   return TRUE;
 }
 #endif  // PDF_ENABLE_XFA
diff --git a/fpdfsdk/cpdfsdk_document.cpp b/fpdfsdk/cpdfsdk_document.cpp
index d4de6d0510..01e4d88ac1 100644
--- a/fpdfsdk/cpdfsdk_document.cpp
+++ b/fpdfsdk/cpdfsdk_document.cpp
@@ -31,7 +31,6 @@ CPDFSDK_Document* CPDFSDK_Document::FromFPDFFormHandle(
 CPDFSDK_Document::CPDFSDK_Document(UnderlyingDocumentType* pDoc,
                                    CPDFSDK_Environment* pEnv)
     : m_pDoc(pDoc),
-      m_pFocusAnnot(nullptr),
       m_pEnv(pEnv),
       m_bChangeMask(FALSE),
       m_bBeingDestroyed(FALSE) {}
@@ -174,14 +173,15 @@ void CPDFSDK_Document::UpdateAllViews(CPDFSDK_PageView* pSender,
 }
 
 CPDFSDK_Annot* CPDFSDK_Document::GetFocusAnnot() {
-  return m_pFocusAnnot;
+  return m_pFocusAnnot.Get();
 }
 
-FX_BOOL CPDFSDK_Document::SetFocusAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag) {
+FX_BOOL CPDFSDK_Document::SetFocusAnnot(CPDFSDK_Annot::ObservedPtr* pAnnot,
+                                        uint32_t nFlag) {
   if (m_bBeingDestroyed)
     return FALSE;
 
-  if (m_pFocusAnnot == pAnnot)
+  if (m_pFocusAnnot == *pAnnot)
     return TRUE;
 
   if (m_pFocusAnnot) {
@@ -189,24 +189,24 @@ FX_BOOL CPDFSDK_Document::SetFocusAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag) {
       return FALSE;
   }
 
-  if (!pAnnot)
+  if (!*pAnnot)
     return FALSE;
 
 #ifdef PDF_ENABLE_XFA
-  CPDFSDK_Annot* pLastFocusAnnot = m_pFocusAnnot;
+  CPDFSDK_Annot::ObservedPtr pLastFocusAnnot(m_pFocusAnnot.Get());
 #endif  // PDF_ENABLE_XFA
-  CPDFSDK_PageView* pPageView = pAnnot->GetPageView();
+  CPDFSDK_PageView* pPageView = (*pAnnot)->GetPageView();
   if (pPageView && pPageView->IsValid()) {
     CPDFSDK_AnnotHandlerMgr* pAnnotHandler = m_pEnv->GetAnnotHandlerMgr();
     if (!m_pFocusAnnot) {
 #ifdef PDF_ENABLE_XFA
-      if (!pAnnotHandler->Annot_OnChangeFocus(pAnnot, pLastFocusAnnot))
+      if (!pAnnotHandler->Annot_OnChangeFocus(pAnnot, &pLastFocusAnnot))
         return FALSE;
 #endif  // PDF_ENABLE_XFA
       if (!pAnnotHandler->Annot_OnSetFocus(pAnnot, nFlag))
         return FALSE;
       if (!m_pFocusAnnot) {
-        m_pFocusAnnot = pAnnot;
+        m_pFocusAnnot.Reset(pAnnot->Get());
         return TRUE;
       }
     }
@@ -217,28 +217,29 @@ FX_BOOL CPDFSDK_Document::SetFocusAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag) {
 FX_BOOL CPDFSDK_Document::KillFocusAnnot(uint32_t nFlag) {
   if (m_pFocusAnnot) {
     CPDFSDK_AnnotHandlerMgr* pAnnotHandler = m_pEnv->GetAnnotHandlerMgr();
-    CPDFSDK_Annot* pFocusAnnot = m_pFocusAnnot;
-    m_pFocusAnnot = nullptr;
+    CPDFSDK_Annot::ObservedPtr pFocusAnnot(m_pFocusAnnot.Get());
+    m_pFocusAnnot.Reset();
 
 #ifdef PDF_ENABLE_XFA
-    if (!pAnnotHandler->Annot_OnChangeFocus(nullptr, pFocusAnnot))
+    CPDFSDK_Annot::ObservedPtr pNull;
+    if (!pAnnotHandler->Annot_OnChangeFocus(&pNull, &pFocusAnnot))
       return FALSE;
 #endif  // PDF_ENABLE_XFA
 
-    if (pAnnotHandler->Annot_OnKillFocus(pFocusAnnot, nFlag)) {
+    if (pAnnotHandler->Annot_OnKillFocus(&pFocusAnnot, nFlag)) {
       if (pFocusAnnot->GetAnnotSubtype() == CPDF_Annot::Subtype::WIDGET) {
-        CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pFocusAnnot;
+        CPDFSDK_Widget* pWidget =
+            static_cast<CPDFSDK_Widget*>(pFocusAnnot.Get());
         int nFieldType = pWidget->GetFieldType();
         if (FIELDTYPE_TEXTFIELD == nFieldType ||
             FIELDTYPE_COMBOBOX == nFieldType) {
           m_pEnv->OnSetFieldInputFocus(nullptr, 0, FALSE);
         }
       }
-
       if (!m_pFocusAnnot)
         return TRUE;
     } else {
-      m_pFocusAnnot = pFocusAnnot;
+      m_pFocusAnnot.Reset(pFocusAnnot.Get());
     }
   }
   return FALSE;
diff --git a/fpdfsdk/cpdfsdk_pageview.cpp b/fpdfsdk/cpdfsdk_pageview.cpp
index 5989e29f64..900ea48670 100644
--- a/fpdfsdk/cpdfsdk_pageview.cpp
+++ b/fpdfsdk/cpdfsdk_pageview.cpp
@@ -29,7 +29,6 @@ CPDFSDK_PageView::CPDFSDK_PageView(CPDFSDK_Document* pSDKDoc,
                                    UnderlyingPageType* page)
     : m_page(page),
       m_pSDKDoc(pSDKDoc),
-      m_CaptureWidget(nullptr),
 #ifndef PDF_ENABLE_XFA
       m_bOwnsPage(false),
 #endif  // PDF_ENABLE_XFA
@@ -259,8 +258,8 @@ FX_BOOL CPDFSDK_PageView::DeleteAnnot(CPDFSDK_Annot* pAnnot) {
   auto it = std::find(m_fxAnnotArray.begin(), m_fxAnnotArray.end(), pAnnot);
   if (it != m_fxAnnotArray.end())
     m_fxAnnotArray.erase(it);
-  if (m_CaptureWidget == pAnnot)
-    m_CaptureWidget = nullptr;
+  if (m_pCaptureWidget.Get() == pAnnot)
+    m_pCaptureWidget.Reset();
 
   return TRUE;
 #else   // PDF_ENABLE_XFA
@@ -318,37 +317,40 @@ CPDFSDK_Annot* CPDFSDK_PageView::GetAnnotByXFAWidget(CXFA_FFWidget* hWidget) {
 
 FX_BOOL CPDFSDK_PageView::OnLButtonDown(const CFX_FloatPoint& point,
                                         uint32_t nFlag) {
-  CPDFSDK_Environment* pEnv = m_pSDKDoc->GetEnv();
-  ASSERT(pEnv);
-  CPDFSDK_Annot* pFXAnnot = GetFXWidgetAtPoint(point.x, point.y);
-  if (!pFXAnnot) {
+  CPDFSDK_Annot::ObservedPtr pAnnot(GetFXWidgetAtPoint(point.x, point.y));
+  if (!pAnnot) {
     KillFocusAnnot(nFlag);
     return FALSE;
   }
 
+  CPDFSDK_Environment* pEnv = m_pSDKDoc->GetEnv();
   CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
-  FX_BOOL bRet =
-      pAnnotHandlerMgr->Annot_OnLButtonDown(this, pFXAnnot, nFlag, point);
-  if (bRet)
-    SetFocusAnnot(pFXAnnot);
-  return bRet;
+  if (!pAnnotHandlerMgr->Annot_OnLButtonDown(this, &pAnnot, nFlag, point))
+    return FALSE;
+
+  if (!pAnnot)
+    return FALSE;
+
+  SetFocusAnnot(&pAnnot);
+  return TRUE;
 }
 
 #ifdef PDF_ENABLE_XFA
 FX_BOOL CPDFSDK_PageView::OnRButtonDown(const CFX_FloatPoint& point,
                                         uint32_t nFlag) {
+  CPDFSDK_Annot::ObservedPtr pAnnot(GetFXWidgetAtPoint(point.x, point.y));
+  if (!pAnnot)
+    return FALSE;
+
   CPDFSDK_Environment* pEnv = m_pSDKDoc->GetEnv();
-  ASSERT(pEnv);
   CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
-  ASSERT(pAnnotHandlerMgr);
-
-  CPDFSDK_Annot* pFXAnnot = GetFXWidgetAtPoint(point.x, point.y);
-
-  if (!pFXAnnot)
+  FX_BOOL ok =
+      pAnnotHandlerMgr->Annot_OnRButtonDown(this, &pAnnot, nFlag, point);
+  if (!pAnnot)
     return FALSE;
 
-  if (pAnnotHandlerMgr->Annot_OnRButtonDown(this, pFXAnnot, nFlag, point))
-    SetFocusAnnot(pFXAnnot);
+  if (ok)
+    SetFocusAnnot(&pAnnot);
 
   return TRUE;
 }
@@ -356,16 +358,13 @@ FX_BOOL CPDFSDK_PageView::OnRButtonDown(const CFX_FloatPoint& point,
 FX_BOOL CPDFSDK_PageView::OnRButtonUp(const CFX_FloatPoint& point,
                                       uint32_t nFlag) {
   CPDFSDK_Environment* pEnv = m_pSDKDoc->GetEnv();
-  ASSERT(pEnv);
   CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
-
-  CPDFSDK_Annot* pFXAnnot = GetFXWidgetAtPoint(point.x, point.y);
-
+  CPDFSDK_Annot::ObservedPtr pFXAnnot(GetFXWidgetAtPoint(point.x, point.y));
   if (!pFXAnnot)
     return FALSE;
 
-  if (pAnnotHandlerMgr->Annot_OnRButtonUp(this, pFXAnnot, nFlag, point))
-    SetFocusAnnot(pFXAnnot);
+  if (pAnnotHandlerMgr->Annot_OnRButtonUp(this, &pFXAnnot, nFlag, point))
+    SetFocusAnnot(&pFXAnnot);
 
   return TRUE;
 }
@@ -374,46 +373,45 @@ FX_BOOL CPDFSDK_PageView::OnRButtonUp(const CFX_FloatPoint& point,
 FX_BOOL CPDFSDK_PageView::OnLButtonUp(const CFX_FloatPoint& point,
                                       uint32_t nFlag) {
   CPDFSDK_Environment* pEnv = m_pSDKDoc->GetEnv();
-  ASSERT(pEnv);
   CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
-  CPDFSDK_Annot* pFXAnnot = GetFXWidgetAtPoint(point.x, point.y);
-  CPDFSDK_Annot* pFocusAnnot = GetFocusAnnot();
-  FX_BOOL bRet = FALSE;
+  CPDFSDK_Annot::ObservedPtr pFXAnnot(GetFXWidgetAtPoint(point.x, point.y));
+  CPDFSDK_Annot::ObservedPtr pFocusAnnot(GetFocusAnnot());
   if (pFocusAnnot && pFocusAnnot != pFXAnnot) {
     // Last focus Annot gets a chance to handle the event.
-    bRet = pAnnotHandlerMgr->Annot_OnLButtonUp(this, pFocusAnnot, nFlag, point);
+    if (pAnnotHandlerMgr->Annot_OnLButtonUp(this, &pFocusAnnot, nFlag, point))
+      return TRUE;
   }
-  if (pFXAnnot && !bRet)
-    bRet = pAnnotHandlerMgr->Annot_OnLButtonUp(this, pFXAnnot, nFlag, point);
-  return bRet;
+  return pFXAnnot &&
+         pAnnotHandlerMgr->Annot_OnLButtonUp(this, &pFXAnnot, nFlag, point);
 }
 
 FX_BOOL CPDFSDK_PageView::OnMouseMove(const CFX_FloatPoint& point, int nFlag) {
   CPDFSDK_Environment* pEnv = m_pSDKDoc->GetEnv();
   CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
-  if (CPDFSDK_Annot* pFXAnnot = GetFXAnnotAtPoint(point.x, point.y)) {
-    if (m_CaptureWidget && m_CaptureWidget != pFXAnnot) {
+  CPDFSDK_Annot::ObservedPtr pFXAnnot(GetFXAnnotAtPoint(point.x, point.y));
+  if (pFXAnnot) {
+    if (m_pCaptureWidget && m_pCaptureWidget != pFXAnnot) {
       m_bExitWidget = TRUE;
       m_bEnterWidget = FALSE;
-      pAnnotHandlerMgr->Annot_OnMouseExit(this, m_CaptureWidget, nFlag);
+      pAnnotHandlerMgr->Annot_OnMouseExit(this, &m_pCaptureWidget, nFlag);
     }
-    m_CaptureWidget = pFXAnnot;
+    m_pCaptureWidget.Reset(pFXAnnot.Get());
     m_bOnWidget = TRUE;
     if (!m_bEnterWidget) {
       m_bEnterWidget = TRUE;
       m_bExitWidget = FALSE;
-      pAnnotHandlerMgr->Annot_OnMouseEnter(this, pFXAnnot, nFlag);
+      pAnnotHandlerMgr->Annot_OnMouseEnter(this, &pFXAnnot, nFlag);
     }
-    pAnnotHandlerMgr->Annot_OnMouseMove(this, pFXAnnot, nFlag, point);
+    pAnnotHandlerMgr->Annot_OnMouseMove(this, &pFXAnnot, nFlag, point);
     return TRUE;
   }
   if (m_bOnWidget) {
     m_bOnWidget = FALSE;
     m_bExitWidget = TRUE;
     m_bEnterWidget = FALSE;
-    if (m_CaptureWidget) {
-      pAnnotHandlerMgr->Annot_OnMouseExit(this, m_CaptureWidget, nFlag);
-      m_CaptureWidget = nullptr;
+    if (m_pCaptureWidget) {
+      pAnnotHandlerMgr->Annot_OnMouseExit(this, &m_pCaptureWidget, nFlag);
+      m_pCaptureWidget.Reset();
     }
   }
   return FALSE;
@@ -423,13 +421,14 @@ FX_BOOL CPDFSDK_PageView::OnMouseWheel(double deltaX,
                                        double deltaY,
                                        const CFX_FloatPoint& point,
                                        int nFlag) {
-  if (CPDFSDK_Annot* pAnnot = GetFXWidgetAtPoint(point.x, point.y)) {
-    CPDFSDK_Environment* pEnv = m_pSDKDoc->GetEnv();
-    CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
-    return pAnnotHandlerMgr->Annot_OnMouseWheel(this, pAnnot, nFlag,
-                                                (int)deltaY, point);
-  }
-  return FALSE;
+  CPDFSDK_Annot::ObservedPtr pAnnot(GetFXWidgetAtPoint(point.x, point.y));
+  if (!pAnnot)
+    return FALSE;
+
+  CPDFSDK_Environment* pEnv = m_pSDKDoc->GetEnv();
+  CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
+  return pAnnotHandlerMgr->Annot_OnMouseWheel(this, &pAnnot, nFlag, (int)deltaY,
+                                              point);
 }
 
 FX_BOOL CPDFSDK_PageView::OnChar(int nChar, uint32_t nFlag) {
@@ -511,9 +510,11 @@ void CPDFSDK_PageView::LoadFXAnnots() {
 
 void CPDFSDK_PageView::ClearFXAnnots() {
   SetLock(TRUE);
-  if (m_pSDKDoc && GetFocusAnnot())
-    m_pSDKDoc->SetFocusAnnot(nullptr);
-  m_CaptureWidget = nullptr;
+  if (m_pSDKDoc && GetFocusAnnot()) {
+    CPDFSDK_Annot::ObservedPtr pNull;
+    m_pSDKDoc->SetFocusAnnot(&pNull);
+  }
+  m_pCaptureWidget.Reset();
   for (CPDFSDK_Annot* pAnnot : m_fxAnnotArray)
     m_pSDKDoc->GetEnv()->GetAnnotHandlerMgr()->ReleaseAnnot(pAnnot);
   m_fxAnnotArray.clear();
diff --git a/fpdfsdk/cpdfsdk_widgethandler.cpp b/fpdfsdk/cpdfsdk_widgethandler.cpp
index 3998cb4f8a..e4e093f818 100644
--- a/fpdfsdk/cpdfsdk_widgethandler.cpp
+++ b/fpdfsdk/cpdfsdk_widgethandler.cpp
@@ -110,65 +110,66 @@ void CPDFSDK_WidgetHandler::OnDelete(CPDFSDK_Annot* pAnnot) {}
 void CPDFSDK_WidgetHandler::OnRelease(CPDFSDK_Annot* pAnnot) {}
 
 void CPDFSDK_WidgetHandler::OnMouseEnter(CPDFSDK_PageView* pPageView,
-                                         CPDFSDK_Annot* pAnnot,
+                                         CPDFSDK_Annot::ObservedPtr* pAnnot,
                                          uint32_t nFlag) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     m_pFormFiller->OnMouseEnter(pPageView, pAnnot, nFlag);
 }
 
 void CPDFSDK_WidgetHandler::OnMouseExit(CPDFSDK_PageView* pPageView,
-                                        CPDFSDK_Annot* pAnnot,
+                                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                                         uint32_t nFlag) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     m_pFormFiller->OnMouseExit(pPageView, pAnnot, nFlag);
 }
 
 FX_BOOL CPDFSDK_WidgetHandler::OnLButtonDown(CPDFSDK_PageView* pPageView,
-                                             CPDFSDK_Annot* pAnnot,
+                                             CPDFSDK_Annot::ObservedPtr* pAnnot,
                                              uint32_t nFlags,
                                              const CFX_FloatPoint& point) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     return m_pFormFiller->OnLButtonDown(pPageView, pAnnot, nFlags, point);
 
   return FALSE;
 }
 
 FX_BOOL CPDFSDK_WidgetHandler::OnLButtonUp(CPDFSDK_PageView* pPageView,
-                                           CPDFSDK_Annot* pAnnot,
+                                           CPDFSDK_Annot::ObservedPtr* pAnnot,
                                            uint32_t nFlags,
                                            const CFX_FloatPoint& point) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     return m_pFormFiller->OnLButtonUp(pPageView, pAnnot, nFlags, point);
 
   return FALSE;
 }
 
-FX_BOOL CPDFSDK_WidgetHandler::OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                                               CPDFSDK_Annot* pAnnot,
-                                               uint32_t nFlags,
-                                               const CFX_FloatPoint& point) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+FX_BOOL CPDFSDK_WidgetHandler::OnLButtonDblClk(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     return m_pFormFiller->OnLButtonDblClk(pPageView, pAnnot, nFlags, point);
 
   return FALSE;
 }
 
 FX_BOOL CPDFSDK_WidgetHandler::OnMouseMove(CPDFSDK_PageView* pPageView,
-                                           CPDFSDK_Annot* pAnnot,
+                                           CPDFSDK_Annot::ObservedPtr* pAnnot,
                                            uint32_t nFlags,
                                            const CFX_FloatPoint& point) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     return m_pFormFiller->OnMouseMove(pPageView, pAnnot, nFlags, point);
 
   return FALSE;
 }
 
 FX_BOOL CPDFSDK_WidgetHandler::OnMouseWheel(CPDFSDK_PageView* pPageView,
-                                            CPDFSDK_Annot* pAnnot,
+                                            CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             uint32_t nFlags,
                                             short zDelta,
                                             const CFX_FloatPoint& point) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     return m_pFormFiller->OnMouseWheel(pPageView, pAnnot, nFlags, zDelta,
                                        point);
 
@@ -176,29 +177,30 @@ FX_BOOL CPDFSDK_WidgetHandler::OnMouseWheel(CPDFSDK_PageView* pPageView,
 }
 
 FX_BOOL CPDFSDK_WidgetHandler::OnRButtonDown(CPDFSDK_PageView* pPageView,
-                                             CPDFSDK_Annot* pAnnot,
+                                             CPDFSDK_Annot::ObservedPtr* pAnnot,
                                              uint32_t nFlags,
                                              const CFX_FloatPoint& point) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     return m_pFormFiller->OnRButtonDown(pPageView, pAnnot, nFlags, point);
 
   return FALSE;
 }
 
 FX_BOOL CPDFSDK_WidgetHandler::OnRButtonUp(CPDFSDK_PageView* pPageView,
-                                           CPDFSDK_Annot* pAnnot,
+                                           CPDFSDK_Annot::ObservedPtr* pAnnot,
                                            uint32_t nFlags,
                                            const CFX_FloatPoint& point) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     return m_pFormFiller->OnRButtonUp(pPageView, pAnnot, nFlags, point);
 
   return FALSE;
 }
 
-FX_BOOL CPDFSDK_WidgetHandler::OnRButtonDblClk(CPDFSDK_PageView* pPageView,
-                                               CPDFSDK_Annot* pAnnot,
-                                               uint32_t nFlags,
-                                               const CFX_FloatPoint& point) {
+FX_BOOL CPDFSDK_WidgetHandler::OnRButtonDblClk(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
   return FALSE;
 }
 
@@ -260,25 +262,26 @@ void CPDFSDK_WidgetHandler::OnLoad(CPDFSDK_Annot* pAnnot) {
     m_pFormFiller->OnLoad(pAnnot);
 }
 
-FX_BOOL CPDFSDK_WidgetHandler::OnSetFocus(CPDFSDK_Annot* pAnnot,
+FX_BOOL CPDFSDK_WidgetHandler::OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
                                           uint32_t nFlag) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     return m_pFormFiller->OnSetFocus(pAnnot, nFlag);
 
   return TRUE;
 }
 
-FX_BOOL CPDFSDK_WidgetHandler::OnKillFocus(CPDFSDK_Annot* pAnnot,
+FX_BOOL CPDFSDK_WidgetHandler::OnKillFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
                                            uint32_t nFlag) {
-  if (!pAnnot->IsSignatureWidget() && m_pFormFiller)
+  if (!(*pAnnot)->IsSignatureWidget() && m_pFormFiller)
     return m_pFormFiller->OnKillFocus(pAnnot, nFlag);
 
   return TRUE;
 }
 
 #ifdef PDF_ENABLE_XFA
-FX_BOOL CPDFSDK_WidgetHandler::OnXFAChangedFocus(CPDFSDK_Annot* pOldAnnot,
-                                                 CPDFSDK_Annot* pNewAnnot) {
+FX_BOOL CPDFSDK_WidgetHandler::OnXFAChangedFocus(
+    CPDFSDK_Annot::ObservedPtr* pOldAnnot,
+    CPDFSDK_Annot::ObservedPtr* pNewAnnot) {
   return TRUE;
 }
 #endif  // PDF_ENABLE_XFA
diff --git a/fpdfsdk/cpdfsdk_xfawidgethandler.cpp b/fpdfsdk/cpdfsdk_xfawidgethandler.cpp
index fc39473b04..381699155e 100644
--- a/fpdfsdk/cpdfsdk_xfawidgethandler.cpp
+++ b/fpdfsdk/cpdfsdk_xfawidgethandler.cpp
@@ -138,118 +138,126 @@ FX_BOOL CPDFSDK_XFAWidgetHandler::HitTest(CPDFSDK_PageView* pPageView,
 }
 
 void CPDFSDK_XFAWidgetHandler::OnMouseEnter(CPDFSDK_PageView* pPageView,
-                                            CPDFSDK_Annot* pAnnot,
+                                            CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             uint32_t nFlag) {
-  if (!pPageView || !pAnnot)
+  if (!pPageView || !(*pAnnot))
     return;
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  pWidgetHandler->OnMouseEnter(pAnnot->GetXFAWidget());
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
+  pWidgetHandler->OnMouseEnter((*pAnnot)->GetXFAWidget());
 }
 
 void CPDFSDK_XFAWidgetHandler::OnMouseExit(CPDFSDK_PageView* pPageView,
-                                           CPDFSDK_Annot* pAnnot,
+                                           CPDFSDK_Annot::ObservedPtr* pAnnot,
                                            uint32_t nFlag) {
-  if (!pPageView || !pAnnot)
+  if (!pPageView || !(*pAnnot))
     return;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  pWidgetHandler->OnMouseExit(pAnnot->GetXFAWidget());
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
+  pWidgetHandler->OnMouseExit((*pAnnot)->GetXFAWidget());
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnLButtonDown(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
-  if (!pPageView || !pAnnot)
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnLButtonDown(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  if (!pPageView || !(*pAnnot))
     return FALSE;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnLButtonDown(pAnnot->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
+  return pWidgetHandler->OnLButtonDown((*pAnnot)->GetXFAWidget(),
                                        GetFWLFlags(nFlags), point.x, point.y);
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnLButtonUp(CPDFSDK_PageView* pPageView,
-                                              CPDFSDK_Annot* pAnnot,
-                                              uint32_t nFlags,
-                                              const CFX_FloatPoint& point) {
-  if (!pPageView || !pAnnot)
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnLButtonUp(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  if (!pPageView || !(*pAnnot))
     return FALSE;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnLButtonUp(pAnnot->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
+  return pWidgetHandler->OnLButtonUp((*pAnnot)->GetXFAWidget(),
                                      GetFWLFlags(nFlags), point.x, point.y);
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                                                  CPDFSDK_Annot* pAnnot,
-                                                  uint32_t nFlags,
-                                                  const CFX_FloatPoint& point) {
-  if (!pPageView || !pAnnot)
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnLButtonDblClk(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  if (!pPageView || !(*pAnnot))
     return FALSE;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnLButtonDblClk(pAnnot->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
+  return pWidgetHandler->OnLButtonDblClk((*pAnnot)->GetXFAWidget(),
                                          GetFWLFlags(nFlags), point.x, point.y);
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnMouseMove(CPDFSDK_PageView* pPageView,
-                                              CPDFSDK_Annot* pAnnot,
-                                              uint32_t nFlags,
-                                              const CFX_FloatPoint& point) {
-  if (!pPageView || !pAnnot)
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnMouseMove(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  if (!pPageView || !(*pAnnot))
     return FALSE;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnMouseMove(pAnnot->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
+  return pWidgetHandler->OnMouseMove((*pAnnot)->GetXFAWidget(),
                                      GetFWLFlags(nFlags), point.x, point.y);
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnMouseWheel(CPDFSDK_PageView* pPageView,
-                                               CPDFSDK_Annot* pAnnot,
-                                               uint32_t nFlags,
-                                               short zDelta,
-                                               const CFX_FloatPoint& point) {
-  if (!pPageView || !pAnnot)
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnMouseWheel(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    short zDelta,
+    const CFX_FloatPoint& point) {
+  if (!pPageView || !(*pAnnot))
     return FALSE;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
   return pWidgetHandler->OnMouseWheel(
-      pAnnot->GetXFAWidget(), GetFWLFlags(nFlags), zDelta, point.x, point.y);
+      (*pAnnot)->GetXFAWidget(), GetFWLFlags(nFlags), zDelta, point.x, point.y);
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnRButtonDown(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
-  if (!pPageView || !pAnnot)
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnRButtonDown(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  if (!pPageView || !(*pAnnot))
     return FALSE;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnRButtonDown(pAnnot->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
+  return pWidgetHandler->OnRButtonDown((*pAnnot)->GetXFAWidget(),
                                        GetFWLFlags(nFlags), point.x, point.y);
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnRButtonUp(CPDFSDK_PageView* pPageView,
-                                              CPDFSDK_Annot* pAnnot,
-                                              uint32_t nFlags,
-                                              const CFX_FloatPoint& point) {
-  if (!pPageView || !pAnnot)
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnRButtonUp(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  if (!pPageView || !(*pAnnot))
     return FALSE;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnRButtonUp(pAnnot->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
+  return pWidgetHandler->OnRButtonUp((*pAnnot)->GetXFAWidget(),
                                      GetFWLFlags(nFlags), point.x, point.y);
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnRButtonDblClk(CPDFSDK_PageView* pPageView,
-                                                  CPDFSDK_Annot* pAnnot,
-                                                  uint32_t nFlags,
-                                                  const CFX_FloatPoint& point) {
-  if (!pPageView || !pAnnot)
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnRButtonDblClk(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  if (!pPageView || !(*pAnnot))
     return FALSE;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnRButtonDblClk(pAnnot->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
+  return pWidgetHandler->OnRButtonDblClk((*pAnnot)->GetXFAWidget(),
                                          GetFWLFlags(nFlags), point.x, point.y);
 }
 
@@ -290,40 +298,42 @@ void CPDFSDK_XFAWidgetHandler::OnDeSelected(CPDFSDK_Annot* pAnnot) {}
 
 void CPDFSDK_XFAWidgetHandler::OnSelected(CPDFSDK_Annot* pAnnot) {}
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnSetFocus(CPDFSDK_Annot* pAnnot,
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
                                              uint32_t nFlag) {
   return TRUE;
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnKillFocus(CPDFSDK_Annot* pAnnot,
-                                              uint32_t nFlag) {
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnKillFocus(
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
   return TRUE;
 }
 
-FX_BOOL CPDFSDK_XFAWidgetHandler::OnXFAChangedFocus(CPDFSDK_Annot* pOldAnnot,
-                                                    CPDFSDK_Annot* pNewAnnot) {
+FX_BOOL CPDFSDK_XFAWidgetHandler::OnXFAChangedFocus(
+    CPDFSDK_Annot::ObservedPtr* pOldAnnot,
+    CPDFSDK_Annot::ObservedPtr* pNewAnnot) {
   CXFA_FFWidgetHandler* pWidgetHandler = nullptr;
+  if (*pOldAnnot)
+    pWidgetHandler = GetXFAWidgetHandler(pOldAnnot->Get());
+  else if (*pNewAnnot)
+    pWidgetHandler = GetXFAWidgetHandler(pNewAnnot->Get());
 
-  if (pOldAnnot)
-    pWidgetHandler = GetXFAWidgetHandler(pOldAnnot);
-  else if (pNewAnnot)
-    pWidgetHandler = GetXFAWidgetHandler(pNewAnnot);
-
-  if (pWidgetHandler) {
-    FX_BOOL bRet = TRUE;
-    CXFA_FFWidget* hWidget = pNewAnnot ? pNewAnnot->GetXFAWidget() : nullptr;
-    if (hWidget) {
-      CXFA_FFPageView* pXFAPageView = hWidget->GetPageView();
-      if (pXFAPageView) {
-        bRet = pXFAPageView->GetDocView()->SetFocus(hWidget);
-        if (pXFAPageView->GetDocView()->GetFocusWidget() == hWidget)
-          bRet = TRUE;
-      }
-    }
-    return bRet;
-  }
+  if (!pWidgetHandler)
+    return TRUE;
 
-  return TRUE;
+  CXFA_FFWidget* hWidget = *pNewAnnot ? (*pNewAnnot)->GetXFAWidget() : nullptr;
+  if (!hWidget)
+    return TRUE;
+
+  CXFA_FFPageView* pXFAPageView = hWidget->GetPageView();
+  if (!pXFAPageView)
+    return TRUE;
+
+  FX_BOOL bRet = pXFAPageView->GetDocView()->SetFocus(hWidget);
+  if (pXFAPageView->GetDocView()->GetFocusWidget() == hWidget)
+    bRet = TRUE;
+
+  return bRet;
 }
 
 CXFA_FFWidgetHandler* CPDFSDK_XFAWidgetHandler::GetXFAWidgetHandler(
diff --git a/fpdfsdk/formfiller/cffl_checkbox.cpp b/fpdfsdk/formfiller/cffl_checkbox.cpp
index 01f1a2a08c..334adb68ed 100644
--- a/fpdfsdk/formfiller/cffl_checkbox.cpp
+++ b/fpdfsdk/formfiller/cffl_checkbox.cpp
@@ -47,15 +47,17 @@ FX_BOOL CFFL_CheckBox::OnChar(CPDFSDK_Annot* pAnnot,
 
       FX_BOOL bReset = FALSE;
       FX_BOOL bExit = FALSE;
-      m_pEnv->GetInteractiveFormFiller()->OnButtonUp(m_pWidget, pPageView,
+      CPDFSDK_Annot::ObservedPtr pObserved(m_pWidget);
+      m_pEnv->GetInteractiveFormFiller()->OnButtonUp(&pObserved, pPageView,
                                                      bReset, bExit, nFlags);
-      if (bReset)
+      if (!pObserved) {
+        m_pWidget = nullptr;
         return TRUE;
-      if (bExit)
+      }
+      if (bReset || bExit)
         return TRUE;
 
       CFFL_FormFiller::OnChar(pAnnot, nChar, nFlags);
-
       if (CPWL_CheckBox* pWnd = (CPWL_CheckBox*)GetPDFWindow(pPageView, TRUE))
         pWnd->SetCheck(!pWnd->IsChecked());
 
diff --git a/fpdfsdk/formfiller/cffl_formfiller.cpp b/fpdfsdk/formfiller/cffl_formfiller.cpp
index 7aeda57c2e..827b9b09ca 100644
--- a/fpdfsdk/formfiller/cffl_formfiller.cpp
+++ b/fpdfsdk/formfiller/cffl_formfiller.cpp
@@ -527,22 +527,21 @@ FX_BOOL CFFL_FormFiller::CommitData(CPDFSDK_PageView* pPageView,
     FX_BOOL bExit = FALSE;
     CFFL_InteractiveFormFiller* pFormFiller =
         m_pEnv->GetInteractiveFormFiller();
-    pFormFiller->OnKeyStrokeCommit(m_pWidget, pPageView, bRC, bExit, nFlag);
-    if (bExit)
+    CPDFSDK_Annot::ObservedPtr pObserved(m_pWidget);
+    pFormFiller->OnKeyStrokeCommit(&pObserved, pPageView, bRC, bExit, nFlag);
+    if (!pObserved || bExit)
       return TRUE;
     if (!bRC) {
       ResetPDFWindow(pPageView, FALSE);
       return TRUE;
     }
-
-    pFormFiller->OnValidate(m_pWidget, pPageView, bRC, bExit, nFlag);
-    if (bExit)
+    pFormFiller->OnValidate(&pObserved, pPageView, bRC, bExit, nFlag);
+    if (!pObserved || bExit)
       return TRUE;
     if (!bRC) {
       ResetPDFWindow(pPageView, FALSE);
       return TRUE;
     }
-
     SaveData(pPageView);
     pFormFiller->OnCalculate(m_pWidget, pPageView, bExit, nFlag);
     if (bExit)
diff --git a/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp b/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
index 3d1a716580..dbe31f7857 100644
--- a/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
+++ b/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
@@ -122,20 +122,18 @@ void CFFL_InteractiveFormFiller::OnDelete(CPDFSDK_Annot* pAnnot) {
   UnRegisterFormFiller(pAnnot);
 }
 
-void CFFL_InteractiveFormFiller::OnMouseEnter(CPDFSDK_PageView* pPageView,
-                                              CPDFSDK_Annot* pAnnot,
-                                              uint32_t nFlag) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
+void CFFL_InteractiveFormFiller::OnMouseEnter(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
   if (!m_bNotifying) {
-    CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::CursorEnter).GetDict()) {
       m_bNotifying = TRUE;
 
       int nValueAge = pWidget->GetValueAge();
-
       pWidget->ClearAppModified();
-
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
@@ -143,6 +141,8 @@ void CFFL_InteractiveFormFiller::OnMouseEnter(CPDFSDK_PageView* pPageView,
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
       pWidget->OnAAction(CPDF_AAction::CursorEnter, fa, pPageView);
       m_bNotifying = FALSE;
+      if (!(*pAnnot))
+        return;
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE)) {
@@ -152,33 +152,31 @@ void CFFL_InteractiveFormFiller::OnMouseEnter(CPDFSDK_PageView* pPageView,
       }
     }
   }
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, TRUE)) {
-    pFormFiller->OnMouseEnter(pPageView, pAnnot);
-  }
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), TRUE))
+    pFormFiller->OnMouseEnter(pPageView, pAnnot->Get());
 }
 
 void CFFL_InteractiveFormFiller::OnMouseExit(CPDFSDK_PageView* pPageView,
-                                             CPDFSDK_Annot* pAnnot,
+                                             CPDFSDK_Annot::ObservedPtr* pAnnot,
                                              uint32_t nFlag) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
   if (!m_bNotifying) {
-    CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::CursorExit).GetDict()) {
       m_bNotifying = TRUE;
       pWidget->GetAppearanceAge();
+
       int nValueAge = pWidget->GetValueAge();
       pWidget->ClearAppModified();
-
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
-
       pWidget->OnAAction(CPDF_AAction::CursorExit, fa, pPageView);
       m_bNotifying = FALSE;
+      if (!(*pAnnot))
+        return;
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE)) {
@@ -188,27 +186,25 @@ void CFFL_InteractiveFormFiller::OnMouseExit(CPDFSDK_PageView* pPageView,
       }
     }
   }
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    pFormFiller->OnMouseExit(pPageView, pAnnot);
-  }
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE))
+    pFormFiller->OnMouseExit(pPageView, pAnnot->Get());
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDown(CPDFSDK_PageView* pPageView,
-                                                  CPDFSDK_Annot* pAnnot,
-                                                  uint32_t nFlags,
-                                                  const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
+FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDown(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
   if (!m_bNotifying) {
-    CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
-    if (Annot_HitTest(pPageView, pAnnot, point) &&
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
+    if (Annot_HitTest(pPageView, pAnnot->Get(), point) &&
         pWidget->GetAAction(CPDF_AAction::ButtonDown).GetDict()) {
       m_bNotifying = TRUE;
       pWidget->GetAppearanceAge();
+
       int nValueAge = pWidget->GetValueAge();
       pWidget->ClearAppModified();
-
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
@@ -216,8 +212,10 @@ FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDown(CPDFSDK_PageView* pPageView,
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlags);
       pWidget->OnAAction(CPDF_AAction::ButtonDown, fa, pPageView);
       m_bNotifying = FALSE;
+      if (!(*pAnnot))
+        return TRUE;
 
-      if (!IsValidAnnot(pPageView, pAnnot))
+      if (!IsValidAnnot(pPageView, pAnnot->Get()))
         return TRUE;
 
       if (pWidget->IsAppModified()) {
@@ -228,27 +226,27 @@ FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDown(CPDFSDK_PageView* pPageView,
       }
     }
   }
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnLButtonDown(pPageView, pAnnot, nFlags, point);
-  }
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE))
+    return pFormFiller->OnLButtonDown(pPageView, pAnnot->Get(), nFlags, point);
 
   return FALSE;
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnLButtonUp(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-  CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+FX_BOOL CFFL_InteractiveFormFiller::OnLButtonUp(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
   CPDFSDK_Document* pDocument = m_pEnv->GetSDKDocument();
 
   switch (pWidget->GetFieldType()) {
     case FIELDTYPE_PUSHBUTTON:
     case FIELDTYPE_CHECKBOX:
     case FIELDTYPE_RADIOBUTTON:
-      if (GetViewBBox(pPageView, pAnnot).Contains((int)point.x, (int)point.y))
+      if (GetViewBBox(pPageView, pAnnot->Get())
+              .Contains((int)point.x, (int)point.y))
         pDocument->SetFocusAnnot(pAnnot);
       break;
     default:
@@ -257,59 +255,52 @@ FX_BOOL CFFL_InteractiveFormFiller::OnLButtonUp(CPDFSDK_PageView* pPageView,
   }
 
   FX_BOOL bRet = FALSE;
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE))
+    bRet = pFormFiller->OnLButtonUp(pPageView, pAnnot->Get(), nFlags, point);
 
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    bRet = pFormFiller->OnLButtonUp(pPageView, pAnnot, nFlags, point);
-  }
-
-  if (pDocument->GetFocusAnnot() == pAnnot) {
+  if (pDocument->GetFocusAnnot() == pAnnot->Get()) {
     FX_BOOL bExit = FALSE;
     FX_BOOL bReset = FALSE;
-    OnButtonUp(pWidget, pPageView, bReset, bExit, nFlags);
-    if (bExit)
+    OnButtonUp(pAnnot, pPageView, bReset, bExit, nFlags);
+    if (!pAnnot || bExit)
       return TRUE;
 #ifdef PDF_ENABLE_XFA
     OnClick(pWidget, pPageView, bReset, bExit, nFlags);
-    if (bExit)
+    if (!pAnnot || bExit)
       return TRUE;
 #endif  // PDF_ENABLE_XFA
   }
   return bRet;
 }
 
-void CFFL_InteractiveFormFiller::OnButtonUp(CPDFSDK_Widget* pWidget,
+void CFFL_InteractiveFormFiller::OnButtonUp(CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             CPDFSDK_PageView* pPageView,
                                             FX_BOOL& bReset,
                                             FX_BOOL& bExit,
                                             uint32_t nFlag) {
-  ASSERT(pWidget);
-
   if (!m_bNotifying) {
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::ButtonUp).GetDict()) {
       m_bNotifying = TRUE;
+
       int nAge = pWidget->GetAppearanceAge();
       int nValueAge = pWidget->GetValueAge();
-
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
-
       pWidget->OnAAction(CPDF_AAction::ButtonUp, fa, pPageView);
       m_bNotifying = FALSE;
-
-      if (!IsValidAnnot(pPageView, pWidget)) {
+      if (!(*pAnnot) || !IsValidAnnot(pPageView, pWidget)) {
         bExit = TRUE;
         return;
       }
-
       if (nAge != pWidget->GetAppearanceAge()) {
         if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE)) {
           pFormFiller->ResetPDFWindow(pPageView,
                                       nValueAge == pWidget->GetValueAge());
         }
-
         bReset = TRUE;
       }
     }
@@ -318,70 +309,59 @@ void CFFL_InteractiveFormFiller::OnButtonUp(CPDFSDK_Widget* pWidget,
 
 FX_BOOL CFFL_InteractiveFormFiller::OnLButtonDblClk(
     CPDFSDK_PageView* pPageView,
-    CPDFSDK_Annot* pAnnot,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
     uint32_t nFlags,
     const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnLButtonDblClk(pPageView, pAnnot, nFlags, point);
-  }
-
-  return FALSE;
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE);
+  return pFormFiller &&
+         pFormFiller->OnLButtonDblClk(pPageView, pAnnot->Get(), nFlags, point);
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnMouseMove(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  // change cursor
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, TRUE)) {
-    return pFormFiller->OnMouseMove(pPageView, pAnnot, nFlags, point);
-  }
-
-  return FALSE;
+FX_BOOL CFFL_InteractiveFormFiller::OnMouseMove(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), TRUE);
+  return pFormFiller &&
+         pFormFiller->OnMouseMove(pPageView, pAnnot->Get(), nFlags, point);
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnMouseWheel(CPDFSDK_PageView* pPageView,
-                                                 CPDFSDK_Annot* pAnnot,
-                                                 uint32_t nFlags,
-                                                 short zDelta,
-                                                 const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnMouseWheel(pPageView, pAnnot, nFlags, zDelta, point);
-  }
-
-  return FALSE;
+FX_BOOL CFFL_InteractiveFormFiller::OnMouseWheel(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    short zDelta,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE);
+  return pFormFiller &&
+         pFormFiller->OnMouseWheel(pPageView, pAnnot->Get(), nFlags, zDelta,
+                                   point);
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnRButtonDown(CPDFSDK_PageView* pPageView,
-                                                  CPDFSDK_Annot* pAnnot,
-                                                  uint32_t nFlags,
-                                                  const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnRButtonDown(pPageView, pAnnot, nFlags, point);
-  }
-
-  return FALSE;
+FX_BOOL CFFL_InteractiveFormFiller::OnRButtonDown(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE);
+  return pFormFiller &&
+         pFormFiller->OnRButtonDown(pPageView, pAnnot->Get(), nFlags, point);
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnRButtonUp(CPDFSDK_PageView* pPageView,
-                                                CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlags,
-                                                const CFX_FloatPoint& point) {
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    return pFormFiller->OnRButtonUp(pPageView, pAnnot, nFlags, point);
-  }
-
-  return FALSE;
+FX_BOOL CFFL_InteractiveFormFiller::OnRButtonUp(
+    CPDFSDK_PageView* pPageView,
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlags,
+    const CFX_FloatPoint& point) {
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE);
+  return pFormFiller &&
+         pFormFiller->OnRButtonUp(pPageView, pAnnot->Get(), nFlags, point);
 }
 
 FX_BOOL CFFL_InteractiveFormFiller::OnKeyDown(CPDFSDK_Annot* pAnnot,
@@ -409,15 +389,15 @@ FX_BOOL CFFL_InteractiveFormFiller::OnChar(CPDFSDK_Annot* pAnnot,
   return FALSE;
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnSetFocus(CPDFSDK_Annot* pAnnot,
-                                               uint32_t nFlag) {
-  if (!pAnnot)
+FX_BOOL CFFL_InteractiveFormFiller::OnSetFocus(
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  if (!(*pAnnot))
     return FALSE;
 
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
   if (!m_bNotifying) {
-    CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::GetFocus).GetDict()) {
       m_bNotifying = TRUE;
       pWidget->GetAppearanceAge();
@@ -425,19 +405,21 @@ FX_BOOL CFFL_InteractiveFormFiller::OnSetFocus(CPDFSDK_Annot* pAnnot,
       int nValueAge = pWidget->GetValueAge();
       pWidget->ClearAppModified();
 
-      CPDFSDK_PageView* pPageView = pAnnot->GetPageView();
+      CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, TRUE);
+      if (!pFormFiller)
+        return FALSE;
+
+      CPDFSDK_PageView* pPageView = (*pAnnot)->GetPageView();
       ASSERT(pPageView);
 
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
-
-      CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, TRUE);
-      if (!pFormFiller)
-        return FALSE;
       pFormFiller->GetActionData(pPageView, CPDF_AAction::GetFocus, fa);
       pWidget->OnAAction(CPDF_AAction::GetFocus, fa, pPageView);
       m_bNotifying = FALSE;
+      if (!(*pAnnot))
+        return FALSE;
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFiller = GetFormFiller(pWidget, FALSE)) {
@@ -448,23 +430,23 @@ FX_BOOL CFFL_InteractiveFormFiller::OnSetFocus(CPDFSDK_Annot* pAnnot,
     }
   }
 
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, TRUE))
-    pFormFiller->SetFocusForAnnot(pAnnot, nFlag);
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), TRUE))
+    pFormFiller->SetFocusForAnnot(pAnnot->Get(), nFlag);
 
   return TRUE;
 }
 
-FX_BOOL CFFL_InteractiveFormFiller::OnKillFocus(CPDFSDK_Annot* pAnnot,
-                                                uint32_t nFlag) {
-  if (!pAnnot)
+FX_BOOL CFFL_InteractiveFormFiller::OnKillFocus(
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    uint32_t nFlag) {
+  if (!(*pAnnot))
     return FALSE;
-  ASSERT(pAnnot->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
-
-  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot, FALSE)) {
-    pFormFiller->KillFocusForAnnot(pAnnot, nFlag);
 
+  ASSERT((*pAnnot)->GetPDFAnnot()->GetSubtype() == CPDF_Annot::Subtype::WIDGET);
+  if (CFFL_FormFiller* pFormFiller = GetFormFiller(pAnnot->Get(), FALSE)) {
+    pFormFiller->KillFocusForAnnot(pAnnot->Get(), nFlag);
     if (!m_bNotifying) {
-      CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pAnnot;
+      CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
       if (pWidget->GetAAction(CPDF_AAction::LoseFocus).GetDict()) {
         m_bNotifying = TRUE;
         pWidget->ClearAppModified();
@@ -475,15 +457,14 @@ FX_BOOL CFFL_InteractiveFormFiller::OnKillFocus(CPDFSDK_Annot* pAnnot,
         PDFSDK_FieldAction fa;
         fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
         fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
-
         pFormFiller->GetActionData(pPageView, CPDF_AAction::LoseFocus, fa);
-
         pWidget->OnAAction(CPDF_AAction::LoseFocus, fa, pPageView);
         m_bNotifying = FALSE;
+        if (!(*pAnnot))
+          return FALSE;
       }
     }
   }
-
   return TRUE;
 }
 
@@ -640,18 +621,19 @@ void CFFL_InteractiveFormFiller::QueryWherePopup(void* pPrivateData,
   fPopupRet = fFactHeight;
 }
 
-void CFFL_InteractiveFormFiller::OnKeyStrokeCommit(CPDFSDK_Widget* pWidget,
-                                                   CPDFSDK_PageView* pPageView,
-                                                   FX_BOOL& bRC,
-                                                   FX_BOOL& bExit,
-                                                   uint32_t nFlag) {
+void CFFL_InteractiveFormFiller::OnKeyStrokeCommit(
+    CPDFSDK_Annot::ObservedPtr* pAnnot,
+    CPDFSDK_PageView* pPageView,
+    FX_BOOL& bRC,
+    FX_BOOL& bExit,
+    uint32_t nFlag) {
   if (!m_bNotifying) {
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::KeyStroke).GetDict()) {
+      ASSERT(pPageView);
       m_bNotifying = TRUE;
       pWidget->ClearAppModified();
 
-      ASSERT(pPageView);
-
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
@@ -662,8 +644,9 @@ void CFFL_InteractiveFormFiller::OnKeyStrokeCommit(CPDFSDK_Widget* pWidget,
       CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE);
       pFormFiller->GetActionData(pPageView, CPDF_AAction::KeyStroke, fa);
       pFormFiller->SaveState(pPageView);
-
       pWidget->OnAAction(CPDF_AAction::KeyStroke, fa, pPageView);
+      if (!(*pAnnot))
+        return;
 
       bRC = fa.bRC;
       m_bNotifying = FALSE;
@@ -671,18 +654,18 @@ void CFFL_InteractiveFormFiller::OnKeyStrokeCommit(CPDFSDK_Widget* pWidget,
   }
 }
 
-void CFFL_InteractiveFormFiller::OnValidate(CPDFSDK_Widget* pWidget,
+void CFFL_InteractiveFormFiller::OnValidate(CPDFSDK_Annot::ObservedPtr* pAnnot,
                                             CPDFSDK_PageView* pPageView,
                                             FX_BOOL& bRC,
                                             FX_BOOL& bExit,
                                             uint32_t nFlag) {
   if (!m_bNotifying) {
+    CPDFSDK_Widget* pWidget = static_cast<CPDFSDK_Widget*>(pAnnot->Get());
     if (pWidget->GetAAction(CPDF_AAction::Validate).GetDict()) {
+      ASSERT(pPageView);
       m_bNotifying = TRUE;
       pWidget->ClearAppModified();
 
-      ASSERT(pPageView);
-
       PDFSDK_FieldAction fa;
       fa.bModifier = m_pEnv->IsCTRLKeyDown(nFlag);
       fa.bShift = m_pEnv->IsSHIFTKeyDown(nFlag);
@@ -692,8 +675,9 @@ void CFFL_InteractiveFormFiller::OnValidate(CPDFSDK_Widget* pWidget,
       CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget, FALSE);
       pFormFiller->GetActionData(pPageView, CPDF_AAction::Validate, fa);
       pFormFiller->SaveState(pPageView);
-
       pWidget->OnAAction(CPDF_AAction::Validate, fa, pPageView);
+      if (!(*pAnnot))
+        return;
 
       bRC = fa.bRC;
       m_bNotifying = FALSE;
@@ -820,10 +804,8 @@ void CFFL_InteractiveFormFiller::OnPopupPreOpen(void* pPrivateData,
   FX_BOOL bTempReset = FALSE;
   FX_BOOL bTempExit = FALSE;
   OnPreOpen(pData->pWidget, pData->pPageView, bTempReset, bTempExit, nFlag);
-
-  if (bTempReset || bTempExit) {
+  if (bTempReset || bTempExit)
     bExit = TRUE;
-  }
 }
 
 void CFFL_InteractiveFormFiller::OnPopupPostOpen(void* pPrivateData,
@@ -836,10 +818,8 @@ void CFFL_InteractiveFormFiller::OnPopupPostOpen(void* pPrivateData,
   FX_BOOL bTempReset = FALSE;
   FX_BOOL bTempExit = FALSE;
   OnPostOpen(pData->pWidget, pData->pPageView, bTempReset, bTempExit, nFlag);
-
-  if (bTempReset || bTempExit) {
+  if (bTempReset || bTempExit)
     bExit = TRUE;
-  }
 }
 
 void CFFL_InteractiveFormFiller::OnPreOpen(CPDFSDK_Widget* pWidget,
@@ -915,10 +895,7 @@ void CFFL_InteractiveFormFiller::OnPostOpen(CPDFSDK_Widget* pWidget,
 
 FX_BOOL CFFL_InteractiveFormFiller::IsValidAnnot(CPDFSDK_PageView* pPageView,
                                                  CPDFSDK_Annot* pAnnot) {
-  if (pPageView)
-    return pPageView->IsValidAnnot(pAnnot->GetPDFAnnot());
-
-  return FALSE;
+  return pPageView && pPageView->IsValidAnnot(pAnnot->GetPDFAnnot());
 }
 
 void CFFL_InteractiveFormFiller::OnBeforeKeyStroke(
@@ -971,9 +948,10 @@ void CFFL_InteractiveFormFiller::OnBeforeKeyStroke(
       pFormFiller->GetActionData(pData->pPageView, CPDF_AAction::KeyStroke, fa);
       pFormFiller->SaveState(pData->pPageView);
 
+      CPDFSDK_Annot::ObservedPtr pObserved(pData->pWidget);
       if (pData->pWidget->OnAAction(CPDF_AAction::KeyStroke, fa,
                                     pData->pPageView)) {
-        if (!IsValidAnnot(pData->pPageView, pData->pWidget)) {
+        if (!pObserved || !IsValidAnnot(pData->pPageView, pData->pWidget)) {
           bExit = TRUE;
           m_bNotifying = FALSE;
           return;
diff --git a/fpdfsdk/formfiller/cffl_interactiveformfiller.h b/fpdfsdk/formfiller/cffl_interactiveformfiller.h
index dc2cb4174e..eec2a34ebf 100644
--- a/fpdfsdk/formfiller/cffl_interactiveformfiller.h
+++ b/fpdfsdk/formfiller/cffl_interactiveformfiller.h
@@ -10,12 +10,12 @@
 #include <map>
 #include <memory>
 
+#include "fpdfsdk/include/cpdfsdk_annot.h"
 #include "fpdfsdk/include/fsdk_define.h"
 #include "fpdfsdk/pdfwindow/PWL_Edit.h"
 
 class CFFL_FormFiller;
 class CPDFSDK_Environment;
-class CPDFSDK_Annot;
 class CPDFSDK_PageView;
 class CPDFSDK_Widget;
 
@@ -38,47 +38,46 @@ class CFFL_InteractiveFormFiller : public IPWL_Filler_Notify {
   void OnDelete(CPDFSDK_Annot* pAnnot);
 
   void OnMouseEnter(CPDFSDK_PageView* pPageView,
-                    CPDFSDK_Annot* pAnnot,
+                    CPDFSDK_Annot::ObservedPtr* pAnnot,
                     uint32_t nFlag);
   void OnMouseExit(CPDFSDK_PageView* pPageView,
-                   CPDFSDK_Annot* pAnnot,
+                   CPDFSDK_Annot::ObservedPtr* pAnnot,
                    uint32_t nFlag);
-
   FX_BOOL OnLButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point);
   FX_BOOL OnLButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point);
   FX_BOOL OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                          CPDFSDK_Annot* pAnnot,
+                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                           uint32_t nFlags,
                           const CFX_FloatPoint& point);
   FX_BOOL OnMouseMove(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point);
   FX_BOOL OnMouseWheel(CPDFSDK_PageView* pPageView,
-                       CPDFSDK_Annot* pAnnot,
+                       CPDFSDK_Annot::ObservedPtr* pAnnot,
                        uint32_t nFlags,
                        short zDelta,
                        const CFX_FloatPoint& point);
   FX_BOOL OnRButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point);
   FX_BOOL OnRButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point);
 
   FX_BOOL OnKeyDown(CPDFSDK_Annot* pAnnot, uint32_t nKeyCode, uint32_t nFlags);
   FX_BOOL OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags);
 
-  FX_BOOL OnSetFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag);
-  FX_BOOL OnKillFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag);
+  FX_BOOL OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot, uint32_t nFlag);
+  FX_BOOL OnKillFocus(CPDFSDK_Annot::ObservedPtr* pAnnot, uint32_t nFlag);
 
   CFFL_FormFiller* GetFormFiller(CPDFSDK_Annot* pAnnot, FX_BOOL bRegister);
   void RemoveFormFiller(CPDFSDK_Annot* pAnnot);
@@ -89,12 +88,12 @@ class CFFL_InteractiveFormFiller : public IPWL_Filler_Notify {
   static FX_BOOL IsValidAnnot(CPDFSDK_PageView* pPageView,
                               CPDFSDK_Annot* pAnnot);
 
-  void OnKeyStrokeCommit(CPDFSDK_Widget* pWidget,
+  void OnKeyStrokeCommit(CPDFSDK_Annot::ObservedPtr* pWidget,
                          CPDFSDK_PageView* pPageView,
                          FX_BOOL& bRC,
                          FX_BOOL& bExit,
                          uint32_t nFlag);
-  void OnValidate(CPDFSDK_Widget* pWidget,
+  void OnValidate(CPDFSDK_Annot::ObservedPtr* pWidget,
                   CPDFSDK_PageView* pPageView,
                   FX_BOOL& bRC,
                   FX_BOOL& bExit,
@@ -108,7 +107,7 @@ class CFFL_InteractiveFormFiller : public IPWL_Filler_Notify {
                 CPDFSDK_PageView* pPageView,
                 FX_BOOL& bExit,
                 uint32_t nFlag);
-  void OnButtonUp(CPDFSDK_Widget* pWidget,
+  void OnButtonUp(CPDFSDK_Annot::ObservedPtr* pWidget,
                   CPDFSDK_PageView* pPageView,
                   FX_BOOL& bReset,
                   FX_BOOL& bExit,
diff --git a/fpdfsdk/formfiller/cffl_radiobutton.cpp b/fpdfsdk/formfiller/cffl_radiobutton.cpp
index 17573fd625..6f30a9b97f 100644
--- a/fpdfsdk/formfiller/cffl_radiobutton.cpp
+++ b/fpdfsdk/formfiller/cffl_radiobutton.cpp
@@ -51,15 +51,13 @@ FX_BOOL CFFL_RadioButton::OnChar(CPDFSDK_Annot* pAnnot,
 
       FX_BOOL bReset = FALSE;
       FX_BOOL bExit = FALSE;
-      m_pEnv->GetInteractiveFormFiller()->OnButtonUp(m_pWidget, pPageView,
+      CPDFSDK_Annot::ObservedPtr pObserved(m_pWidget);
+      m_pEnv->GetInteractiveFormFiller()->OnButtonUp(&pObserved, pPageView,
                                                      bReset, bExit, nFlags);
-      if (bReset)
-        return TRUE;
-      if (bExit)
+      if (!pObserved || bReset || bExit)
         return TRUE;
 
       CFFL_FormFiller::OnChar(pAnnot, nChar, nFlags);
-
       if (CPWL_RadioButton* pWnd =
               (CPWL_RadioButton*)GetPDFWindow(pPageView, TRUE))
         pWnd->SetCheck(TRUE);
diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp b/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp
index 106d997e44..a44172e191 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp
@@ -538,7 +538,8 @@ void CPDFXFA_DocEnvironment::SetFocusWidget(CXFA_FFDoc* hDoc,
     return;
 
   if (!hWidget) {
-    m_pDocument->GetSDKDoc()->SetFocusAnnot(nullptr);
+    CPDFSDK_Annot::ObservedPtr pNull;
+    m_pDocument->GetSDKDoc()->SetFocusAnnot(&pNull);
     return;
   }
 
@@ -548,9 +549,9 @@ void CPDFXFA_DocEnvironment::SetFocusWidget(CXFA_FFDoc* hDoc,
     if (!pPageView)
       continue;
 
-    CPDFSDK_Annot* pAnnot = pPageView->GetAnnotByXFAWidget(hWidget);
+    CPDFSDK_Annot::ObservedPtr pAnnot(pPageView->GetAnnotByXFAWidget(hWidget));
     if (pAnnot) {
-      m_pDocument->GetSDKDoc()->SetFocusAnnot(pAnnot);
+      m_pDocument->GetSDKDoc()->SetFocusAnnot(&pAnnot);
       break;
     }
   }
diff --git a/fpdfsdk/include/cpdfsdk_annothandlermgr.h b/fpdfsdk/include/cpdfsdk_annothandlermgr.h
index 9e0035cc4c..d66914aafb 100644
--- a/fpdfsdk/include/cpdfsdk_annothandlermgr.h
+++ b/fpdfsdk/include/cpdfsdk_annothandlermgr.h
@@ -13,11 +13,11 @@
 #include "core/fpdfdoc/include/cpdf_annot.h"
 #include "core/fxcrt/include/fx_basic.h"
 #include "core/fxcrt/include/fx_coordinates.h"
+#include "fpdfsdk/include/cpdfsdk_annot.h"
 
 class CFX_Matrix;
 class CFX_RenderDevice;
 class CPDFSDK_Environment;
-class CPDFSDK_Annot;
 class CPDFSDK_BAAnnotHandler;
 class CPDFSDK_WidgetHandler;
 class CPDFSDK_PageView;
@@ -50,50 +50,50 @@ class CPDFSDK_AnnotHandlerMgr {
                     bool bDrawAnnots);
 
   void Annot_OnMouseEnter(CPDFSDK_PageView* pPageView,
-                          CPDFSDK_Annot* pAnnot,
+                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                           uint32_t nFlags);
   void Annot_OnMouseExit(CPDFSDK_PageView* pPageView,
-                         CPDFSDK_Annot* pAnnot,
+                         CPDFSDK_Annot::ObservedPtr* pAnnot,
                          uint32_t nFlags);
   FX_BOOL Annot_OnLButtonDown(CPDFSDK_PageView* pPageView,
-                              CPDFSDK_Annot* pAnnot,
+                              CPDFSDK_Annot::ObservedPtr* pAnnot,
                               uint32_t nFlags,
                               const CFX_FloatPoint& point);
   FX_BOOL Annot_OnLButtonUp(CPDFSDK_PageView* pPageView,
-                            CPDFSDK_Annot* pAnnot,
+                            CPDFSDK_Annot::ObservedPtr* pAnnot,
                             uint32_t nFlags,
                             const CFX_FloatPoint& point);
   FX_BOOL Annot_OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                                CPDFSDK_Annot* pAnnot,
+                                CPDFSDK_Annot::ObservedPtr* pAnnot,
                                 uint32_t nFlags,
                                 const CFX_FloatPoint& point);
   FX_BOOL Annot_OnMouseMove(CPDFSDK_PageView* pPageView,
-                            CPDFSDK_Annot* pAnnot,
+                            CPDFSDK_Annot::ObservedPtr* pAnnot,
                             uint32_t nFlags,
                             const CFX_FloatPoint& point);
   FX_BOOL Annot_OnMouseWheel(CPDFSDK_PageView* pPageView,
-                             CPDFSDK_Annot* pAnnot,
+                             CPDFSDK_Annot::ObservedPtr* pAnnot,
                              uint32_t nFlags,
                              short zDelta,
                              const CFX_FloatPoint& point);
   FX_BOOL Annot_OnRButtonDown(CPDFSDK_PageView* pPageView,
-                              CPDFSDK_Annot* pAnnot,
+                              CPDFSDK_Annot::ObservedPtr* pAnnot,
                               uint32_t nFlags,
                               const CFX_FloatPoint& point);
   FX_BOOL Annot_OnRButtonUp(CPDFSDK_PageView* pPageView,
-                            CPDFSDK_Annot* pAnnot,
+                            CPDFSDK_Annot::ObservedPtr* pAnnot,
                             uint32_t nFlags,
                             const CFX_FloatPoint& point);
   FX_BOOL Annot_OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags);
   FX_BOOL Annot_OnKeyDown(CPDFSDK_Annot* pAnnot, int nKeyCode, int nFlag);
   FX_BOOL Annot_OnKeyUp(CPDFSDK_Annot* pAnnot, int nKeyCode, int nFlag);
 
-  FX_BOOL Annot_OnSetFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag);
-  FX_BOOL Annot_OnKillFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag);
+  FX_BOOL Annot_OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot, uint32_t nFlag);
+  FX_BOOL Annot_OnKillFocus(CPDFSDK_Annot::ObservedPtr* pAnnot, uint32_t nFlag);
 
 #ifdef PDF_ENABLE_XFA
-  FX_BOOL Annot_OnChangeFocus(CPDFSDK_Annot* pSetAnnot,
-                              CPDFSDK_Annot* pKillAnnot);
+  FX_BOOL Annot_OnChangeFocus(CPDFSDK_Annot::ObservedPtr* pSetAnnot,
+                              CPDFSDK_Annot::ObservedPtr* pKillAnnot);
 #endif  // PDF_ENABLE_XFA
 
   CFX_FloatRect Annot_OnGetViewBBox(CPDFSDK_PageView* pPageView,
diff --git a/fpdfsdk/include/cpdfsdk_baannothandler.h b/fpdfsdk/include/cpdfsdk_baannothandler.h
index 112f8125f1..ae884526a0 100644
--- a/fpdfsdk/include/cpdfsdk_baannothandler.h
+++ b/fpdfsdk/include/cpdfsdk_baannothandler.h
@@ -50,43 +50,44 @@ class CPDFSDK_BAAnnotHandler : public IPDFSDK_AnnotHandler {
   void OnLoad(CPDFSDK_Annot* pAnnot) override;
   void OnDelete(CPDFSDK_Annot* pAnnot) override;
   void OnRelease(CPDFSDK_Annot* pAnnot) override;
+
   void OnMouseEnter(CPDFSDK_PageView* pPageView,
-                    CPDFSDK_Annot* pAnnot,
+                    CPDFSDK_Annot::ObservedPtr* pAnnot,
                     uint32_t nFlag) override;
   void OnMouseExit(CPDFSDK_PageView* pPageView,
-                   CPDFSDK_Annot* pAnnot,
+                   CPDFSDK_Annot::ObservedPtr* pAnnot,
                    uint32_t nFlag) override;
   FX_BOOL OnLButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point) override;
   FX_BOOL OnLButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point) override;
   FX_BOOL OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                          CPDFSDK_Annot* pAnnot,
+                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                           uint32_t nFlags,
                           const CFX_FloatPoint& point) override;
   FX_BOOL OnMouseMove(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point) override;
   FX_BOOL OnMouseWheel(CPDFSDK_PageView* pPageView,
-                       CPDFSDK_Annot* pAnnot,
+                       CPDFSDK_Annot::ObservedPtr* pAnnot,
                        uint32_t nFlags,
                        short zDelta,
                        const CFX_FloatPoint& point) override;
   FX_BOOL OnRButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point) override;
   FX_BOOL OnRButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point) override;
   FX_BOOL OnRButtonDblClk(CPDFSDK_PageView* pPageView,
-                          CPDFSDK_Annot* pAnnot,
+                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                           uint32_t nFlags,
                           const CFX_FloatPoint& point) override;
   FX_BOOL OnChar(CPDFSDK_Annot* pAnnot,
@@ -96,11 +97,13 @@ class CPDFSDK_BAAnnotHandler : public IPDFSDK_AnnotHandler {
   FX_BOOL OnKeyUp(CPDFSDK_Annot* pAnnot, int nKeyCode, int nFlag) override;
   void OnDeSelected(CPDFSDK_Annot* pAnnot) override;
   void OnSelected(CPDFSDK_Annot* pAnnot) override;
-  FX_BOOL OnSetFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag) override;
-  FX_BOOL OnKillFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag) override;
+  FX_BOOL OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
+                     uint32_t nFlag) override;
+  FX_BOOL OnKillFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
+                      uint32_t nFlag) override;
 #ifdef PDF_ENABLE_XFA
-  FX_BOOL OnXFAChangedFocus(CPDFSDK_Annot* pOldAnnot,
-                            CPDFSDK_Annot* pNewAnnot) override;
+  FX_BOOL OnXFAChangedFocus(CPDFSDK_Annot::ObservedPtr* pOldAnnot,
+                            CPDFSDK_Annot::ObservedPtr* pNewAnnot) override;
 #endif  // PDF_ENABLE_XFA
 };
 
diff --git a/fpdfsdk/include/cpdfsdk_document.h b/fpdfsdk/include/cpdfsdk_document.h
index 5a83b74296..9fce00f684 100644
--- a/fpdfsdk/include/cpdfsdk_document.h
+++ b/fpdfsdk/include/cpdfsdk_document.h
@@ -12,12 +12,12 @@
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_document.h"
 #include "core/fxcrt/include/cfx_observable.h"
+#include "fpdfsdk/include/cpdfsdk_annot.h"
 #include "fpdfsdk/include/fsdk_define.h"
 #include "public/fpdf_formfill.h"
 
 class CPDF_OCContext;
 class CPDFSDK_Environment;
-class CPDFSDK_Annot;
 class CPDFSDK_InterForm;
 class CPDFSDK_PageView;
 class IJS_Runtime;
@@ -68,7 +68,7 @@ class CPDFSDK_Document : public CFX_Observable<CPDFSDK_Document> {
 
   IJS_Runtime* GetJsRuntime();
 
-  FX_BOOL SetFocusAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag = 0);
+  FX_BOOL SetFocusAnnot(CPDFSDK_Annot::ObservedPtr* pAnnot, uint32_t nFlag = 0);
   FX_BOOL KillFocusAnnot(uint32_t nFlag = 0);
 
   FX_BOOL ExtractPages(const std::vector<uint16_t>& arrExtraPages,
@@ -98,7 +98,7 @@ class CPDFSDK_Document : public CFX_Observable<CPDFSDK_Document> {
   std::map<UnderlyingPageType*, CPDFSDK_PageView*> m_pageMap;
   UnderlyingDocumentType* m_pDoc;
   std::unique_ptr<CPDFSDK_InterForm> m_pInterForm;
-  CPDFSDK_Annot* m_pFocusAnnot;
+  CPDFSDK_Annot::ObservedPtr m_pFocusAnnot;
   CPDFSDK_Environment* m_pEnv;
   std::unique_ptr<CPDF_OCContext> m_pOccontent;
   FX_BOOL m_bChangeMask;
diff --git a/fpdfsdk/include/cpdfsdk_pageview.h b/fpdfsdk/include/cpdfsdk_pageview.h
index d22b6b48a0..2a54dffc30 100644
--- a/fpdfsdk/include/cpdfsdk_pageview.h
+++ b/fpdfsdk/include/cpdfsdk_pageview.h
@@ -12,6 +12,7 @@
 
 #include "core/fpdfapi/fpdf_page/include/cpdf_page.h"
 #include "core/fxcrt/include/fx_system.h"
+#include "fpdfsdk/include/cpdfsdk_annot.h"
 #include "fpdfsdk/include/cpdfsdk_document.h"
 
 class CFX_RenderDevice;
@@ -39,7 +40,8 @@ class CPDFSDK_PageView final : public CPDF_Page::View {
   const CPDF_Annot* GetPDFWidgetAtPoint(FX_FLOAT pageX, FX_FLOAT pageY);
   CPDFSDK_Annot* GetFXWidgetAtPoint(FX_FLOAT pageX, FX_FLOAT pageY);
   CPDFSDK_Annot* GetFocusAnnot();
-  void SetFocusAnnot(CPDFSDK_Annot* pSDKAnnot, uint32_t nFlag = 0) {
+  void SetFocusAnnot(CPDFSDK_Annot::ObservedPtr* pSDKAnnot,
+                     uint32_t nFlag = 0) {
     m_pSDKDoc->SetFocusAnnot(pSDKAnnot, nFlag);
   }
   FX_BOOL KillFocusAnnot(uint32_t nFlag = 0) {
@@ -108,7 +110,7 @@ class CPDFSDK_PageView final : public CPDF_Page::View {
   std::unique_ptr<CPDF_AnnotList> m_pAnnotList;
   std::vector<CPDFSDK_Annot*> m_fxAnnotArray;
   CPDFSDK_Document* const m_pSDKDoc;
-  CPDFSDK_Annot* m_CaptureWidget;
+  CPDFSDK_Annot::ObservedPtr m_pCaptureWidget;
 #ifndef PDF_ENABLE_XFA
   bool m_bOwnsPage;
 #endif  // PDF_ENABLE_XFA
diff --git a/fpdfsdk/include/cpdfsdk_widgethandler.h b/fpdfsdk/include/cpdfsdk_widgethandler.h
index 19f977eb95..b18f623b3f 100644
--- a/fpdfsdk/include/cpdfsdk_widgethandler.h
+++ b/fpdfsdk/include/cpdfsdk_widgethandler.h
@@ -50,43 +50,44 @@ class CPDFSDK_WidgetHandler : public IPDFSDK_AnnotHandler {
   void OnLoad(CPDFSDK_Annot* pAnnot) override;
   void OnDelete(CPDFSDK_Annot* pAnnot) override;
   void OnRelease(CPDFSDK_Annot* pAnnot) override;
+
   void OnMouseEnter(CPDFSDK_PageView* pPageView,
-                    CPDFSDK_Annot* pAnnot,
+                    CPDFSDK_Annot::ObservedPtr* pAnnot,
                     uint32_t nFlag) override;
   void OnMouseExit(CPDFSDK_PageView* pPageView,
-                   CPDFSDK_Annot* pAnnot,
+                   CPDFSDK_Annot::ObservedPtr* pAnnot,
                    uint32_t nFlag) override;
   FX_BOOL OnLButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point) override;
   FX_BOOL OnLButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point) override;
   FX_BOOL OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                          CPDFSDK_Annot* pAnnot,
+                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                           uint32_t nFlags,
                           const CFX_FloatPoint& point) override;
   FX_BOOL OnMouseMove(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point) override;
   FX_BOOL OnMouseWheel(CPDFSDK_PageView* pPageView,
-                       CPDFSDK_Annot* pAnnot,
+                       CPDFSDK_Annot::ObservedPtr* pAnnot,
                        uint32_t nFlags,
                        short zDelta,
                        const CFX_FloatPoint& point) override;
   FX_BOOL OnRButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point) override;
   FX_BOOL OnRButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point) override;
   FX_BOOL OnRButtonDblClk(CPDFSDK_PageView* pPageView,
-                          CPDFSDK_Annot* pAnnot,
+                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                           uint32_t nFlags,
                           const CFX_FloatPoint& point) override;
   FX_BOOL OnChar(CPDFSDK_Annot* pAnnot,
@@ -96,11 +97,13 @@ class CPDFSDK_WidgetHandler : public IPDFSDK_AnnotHandler {
   FX_BOOL OnKeyUp(CPDFSDK_Annot* pAnnot, int nKeyCode, int nFlag) override;
   void OnDeSelected(CPDFSDK_Annot* pAnnot) override {}
   void OnSelected(CPDFSDK_Annot* pAnnot) override {}
-  FX_BOOL OnSetFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag) override;
-  FX_BOOL OnKillFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag) override;
+  FX_BOOL OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
+                     uint32_t nFlag) override;
+  FX_BOOL OnKillFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
+                      uint32_t nFlag) override;
 #ifdef PDF_ENABLE_XFA
-  FX_BOOL OnXFAChangedFocus(CPDFSDK_Annot* pOldAnnot,
-                            CPDFSDK_Annot* pNewAnnot) override;
+  FX_BOOL OnXFAChangedFocus(CPDFSDK_Annot::ObservedPtr* pOldAnnot,
+                            CPDFSDK_Annot::ObservedPtr* pNewAnnot) override;
 #endif  // PDF_ENABLE_XFA
 
   void SetFormFiller(CFFL_InteractiveFormFiller* pFiller) {
diff --git a/fpdfsdk/include/cpdfsdk_xfawidgethandler.h b/fpdfsdk/include/cpdfsdk_xfawidgethandler.h
index c18a36f8b6..2bf977951c 100644
--- a/fpdfsdk/include/cpdfsdk_xfawidgethandler.h
+++ b/fpdfsdk/include/cpdfsdk_xfawidgethandler.h
@@ -46,42 +46,42 @@ class CPDFSDK_XFAWidgetHandler : public IPDFSDK_AnnotHandler {
   void OnDelete(CPDFSDK_Annot* pAnnot) override;
   void OnRelease(CPDFSDK_Annot* pAnnot) override;
   void OnMouseEnter(CPDFSDK_PageView* pPageView,
-                    CPDFSDK_Annot* pAnnot,
+                    CPDFSDK_Annot::ObservedPtr* pAnnot,
                     uint32_t nFlag) override;
   void OnMouseExit(CPDFSDK_PageView* pPageView,
-                   CPDFSDK_Annot* pAnnot,
+                   CPDFSDK_Annot::ObservedPtr* pAnnot,
                    uint32_t nFlag) override;
   FX_BOOL OnLButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point) override;
   FX_BOOL OnLButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point) override;
   FX_BOOL OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                          CPDFSDK_Annot* pAnnot,
+                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                           uint32_t nFlags,
                           const CFX_FloatPoint& point) override;
   FX_BOOL OnMouseMove(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point) override;
   FX_BOOL OnMouseWheel(CPDFSDK_PageView* pPageView,
-                       CPDFSDK_Annot* pAnnot,
+                       CPDFSDK_Annot::ObservedPtr* pAnnot,
                        uint32_t nFlags,
                        short zDelta,
                        const CFX_FloatPoint& point) override;
   FX_BOOL OnRButtonDown(CPDFSDK_PageView* pPageView,
-                        CPDFSDK_Annot* pAnnot,
+                        CPDFSDK_Annot::ObservedPtr* pAnnot,
                         uint32_t nFlags,
                         const CFX_FloatPoint& point) override;
   FX_BOOL OnRButtonUp(CPDFSDK_PageView* pPageView,
-                      CPDFSDK_Annot* pAnnot,
+                      CPDFSDK_Annot::ObservedPtr* pAnnot,
                       uint32_t nFlags,
                       const CFX_FloatPoint& point) override;
   FX_BOOL OnRButtonDblClk(CPDFSDK_PageView* pPageView,
-                          CPDFSDK_Annot* pAnnot,
+                          CPDFSDK_Annot::ObservedPtr* pAnnot,
                           uint32_t nFlags,
                           const CFX_FloatPoint& point) override;
   FX_BOOL OnChar(CPDFSDK_Annot* pAnnot,
@@ -91,10 +91,12 @@ class CPDFSDK_XFAWidgetHandler : public IPDFSDK_AnnotHandler {
   FX_BOOL OnKeyUp(CPDFSDK_Annot* pAnnot, int nKeyCode, int nFlag) override;
   void OnDeSelected(CPDFSDK_Annot* pAnnot) override;
   void OnSelected(CPDFSDK_Annot* pAnnot) override;
-  FX_BOOL OnSetFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag) override;
-  FX_BOOL OnKillFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag) override;
-  FX_BOOL OnXFAChangedFocus(CPDFSDK_Annot* pOldAnnot,
-                            CPDFSDK_Annot* pNewAnnot) override;
+  FX_BOOL OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
+                     uint32_t nFlag) override;
+  FX_BOOL OnKillFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
+                      uint32_t nFlag) override;
+  FX_BOOL OnXFAChangedFocus(CPDFSDK_Annot::ObservedPtr* pOldAnnot,
+                            CPDFSDK_Annot::ObservedPtr* pNewAnnot) override;
 
  private:
   CXFA_FFWidgetHandler* GetXFAWidgetHandler(CPDFSDK_Annot* pAnnot);
diff --git a/fpdfsdk/include/ipdfsdk_annothandler.h b/fpdfsdk/include/ipdfsdk_annothandler.h
index d2f9010b76..f1db6983c0 100644
--- a/fpdfsdk/include/ipdfsdk_annothandler.h
+++ b/fpdfsdk/include/ipdfsdk_annothandler.h
@@ -9,11 +9,11 @@
 
 #include "core/fxcrt/include/fx_basic.h"
 #include "core/fxcrt/include/fx_coordinates.h"
+#include "fpdfsdk/include/cpdfsdk_annot.h"
 
 class CFX_Matrix;
 class CFX_RenderDevice;
 class CPDF_Annot;
-class CPDFSDK_Annot;
 class CPDFSDK_PageView;
 
 #ifdef PDF_ENABLE_XFA
@@ -49,43 +49,44 @@ class IPDFSDK_AnnotHandler {
   virtual void OnLoad(CPDFSDK_Annot* pAnnot) = 0;
   virtual void OnDelete(CPDFSDK_Annot* pAnnot) = 0;
   virtual void OnRelease(CPDFSDK_Annot* pAnnot) = 0;
+
   virtual void OnMouseEnter(CPDFSDK_PageView* pPageView,
-                            CPDFSDK_Annot* pAnnot,
+                            CPDFSDK_Annot::ObservedPtr* pAnnot,
                             uint32_t nFlag) = 0;
   virtual void OnMouseExit(CPDFSDK_PageView* pPageView,
-                           CPDFSDK_Annot* pAnnot,
+                           CPDFSDK_Annot::ObservedPtr* pAnnot,
                            uint32_t nFlag) = 0;
   virtual FX_BOOL OnLButtonDown(CPDFSDK_PageView* pPageView,
-                                CPDFSDK_Annot* pAnnot,
+                                CPDFSDK_Annot::ObservedPtr* pAnnot,
                                 uint32_t nFlags,
                                 const CFX_FloatPoint& point) = 0;
   virtual FX_BOOL OnLButtonUp(CPDFSDK_PageView* pPageView,
-                              CPDFSDK_Annot* pAnnot,
+                              CPDFSDK_Annot::ObservedPtr* pAnnot,
                               uint32_t nFlags,
                               const CFX_FloatPoint& point) = 0;
   virtual FX_BOOL OnLButtonDblClk(CPDFSDK_PageView* pPageView,
-                                  CPDFSDK_Annot* pAnnot,
+                                  CPDFSDK_Annot::ObservedPtr* pAnnot,
                                   uint32_t nFlags,
                                   const CFX_FloatPoint& point) = 0;
   virtual FX_BOOL OnMouseMove(CPDFSDK_PageView* pPageView,
-                              CPDFSDK_Annot* pAnnot,
+                              CPDFSDK_Annot::ObservedPtr* pAnnot,
                               uint32_t nFlags,
                               const CFX_FloatPoint& point) = 0;
   virtual FX_BOOL OnMouseWheel(CPDFSDK_PageView* pPageView,
-                               CPDFSDK_Annot* pAnnot,
+                               CPDFSDK_Annot::ObservedPtr* pAnnot,
                                uint32_t nFlags,
                                short zDelta,
                                const CFX_FloatPoint& point) = 0;
   virtual FX_BOOL OnRButtonDown(CPDFSDK_PageView* pPageView,
-                                CPDFSDK_Annot* pAnnot,
+                                CPDFSDK_Annot::ObservedPtr* pAnnot,
                                 uint32_t nFlags,
                                 const CFX_FloatPoint& point) = 0;
   virtual FX_BOOL OnRButtonUp(CPDFSDK_PageView* pPageView,
-                              CPDFSDK_Annot* pAnnot,
+                              CPDFSDK_Annot::ObservedPtr* pAnnot,
                               uint32_t nFlags,
                               const CFX_FloatPoint& point) = 0;
   virtual FX_BOOL OnRButtonDblClk(CPDFSDK_PageView* pPageView,
-                                  CPDFSDK_Annot* pAnnot,
+                                  CPDFSDK_Annot::ObservedPtr* pAnnot,
                                   uint32_t nFlags,
                                   const CFX_FloatPoint& point) = 0;
   virtual FX_BOOL OnChar(CPDFSDK_Annot* pAnnot,
@@ -95,11 +96,13 @@ class IPDFSDK_AnnotHandler {
   virtual FX_BOOL OnKeyUp(CPDFSDK_Annot* pAnnot, int nKeyCode, int nFlag) = 0;
   virtual void OnDeSelected(CPDFSDK_Annot* pAnnot) = 0;
   virtual void OnSelected(CPDFSDK_Annot* pAnnot) = 0;
-  virtual FX_BOOL OnSetFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag) = 0;
-  virtual FX_BOOL OnKillFocus(CPDFSDK_Annot* pAnnot, uint32_t nFlag) = 0;
+  virtual FX_BOOL OnSetFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
+                             uint32_t nFlag) = 0;
+  virtual FX_BOOL OnKillFocus(CPDFSDK_Annot::ObservedPtr* pAnnot,
+                              uint32_t nFlag) = 0;
 #ifdef PDF_ENABLE_XFA
-  virtual FX_BOOL OnXFAChangedFocus(CPDFSDK_Annot* pOldAnnot,
-                                    CPDFSDK_Annot* pNewAnnot) = 0;
+  virtual FX_BOOL OnXFAChangedFocus(CPDFSDK_Annot::ObservedPtr* pOldAnnot,
+                                    CPDFSDK_Annot::ObservedPtr* pNewAnnot) = 0;
 #endif  // PDF_ENABLE_XFA
 };
 
diff --git a/fpdfsdk/javascript/Field.cpp b/fpdfsdk/javascript/Field.cpp
index 3abf0ecc7e..0534f47749 100644
--- a/fpdfsdk/javascript/Field.cpp
+++ b/fpdfsdk/javascript/Field.cpp
@@ -3222,7 +3222,8 @@ FX_BOOL Field::setFocus(IJS_Context* cc,
   }
 
   if (pWidget) {
-    m_pDocument->SetFocusAnnot(pWidget);
+    CPDFSDK_Annot::ObservedPtr pObserved(pWidget);
+    m_pDocument->SetFocusAnnot(&pObserved);
   }
 
   return TRUE;