Use UnownedPtr to CXFA_Node from outside the treechromium/3477

Comment raw pointers subject to nondeterministic tree destruction
order as such to avoid re-attempting to convert to the unowned
mechanism.

Change-Id: Ia9fe3c8a2729dc1e2b1de4a8c62ae3d2c3d7ec0a
Reviewed-on: https://pdfium-review.googlesource.com/36635
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

1 files changed, 10 insertions, 9 deletions

diff --git a/xfa/fxfa/parser/cxfa_node.h b/xfa/fxfa/parser/cxfa_node.h
index db01983a1a..99930c6686 100644
--- a/xfa/fxfa/parser/cxfa_node.h
+++ b/xfa/fxfa/parser/cxfa_node.h
@@ -494,21 +494,22 @@ class CXFA_Node : public CXFA_Object {
   const AttributeData* const m_Attributes;
   const uint32_t m_ValidPackets;
 
-  // These nodes are responsible for building the CXFA_Node tree. We don't use
-  // unowned ptrs here because the cleanup process will remove the nodes in an
-  // order that doesn't necessarily match up to the tree structure.
-  CXFA_Node* parent_;
-  CXFA_Node* next_sibling_;
-  CXFA_Node* prev_sibling_;
-  CXFA_Node* first_child_;
-  CXFA_Node* last_child_;
+  // These members are responsible for building the CXFA_Node tree. Node
+  // pointers within the tree (or in objects owned by nodes in the tree)
+  // can't be UnownedPtr<> because the cleanup process will remove the nodes
+  // in an order that doesn't necessarily match up to the tree structure.
+  CXFA_Node* parent_;        // Raw, intra-tree node pointer.
+  CXFA_Node* next_sibling_;  // Raw, intra-tree node pointer.
+  CXFA_Node* prev_sibling_;  // Raw, intra-tree node pointer.
+  CXFA_Node* first_child_;   // Raw, intra-tree node pointer.
+  CXFA_Node* last_child_;    // Raw, intra-tree node pointer.
 
   UnownedPtr<CFX_XMLNode> xml_node_;
   const XFA_PacketType m_ePacket;
   uint8_t m_ExecuteRecursionDepth = 0;
   uint16_t m_uNodeFlags;
   uint32_t m_dwNameHash;
-  CXFA_Node* m_pAuxNode;
+  CXFA_Node* m_pAuxNode;  // Raw, node tree cleanup order.
   std::vector<UnownedPtr<CXFA_Node>> binding_nodes_;
   bool m_bIsNull = true;
   bool m_bPreNull = true;