From 30f739c81db8d6fb4cb68347eae6b2a785cd6414 Mon Sep 17 00:00:00 2001
From: Dan Sinclair <dsinclair@chromium.org>
Date: Thu, 17 May 2018 18:30:32 +0000
Subject: Make CXFA_LayoutProcessor an UnownedPtr in CXFA_FFDocView

The LayoutProcessor is owned by the CXFA_Document. Make the ownership
explicit with an UnownedPtr.

Change-Id: I100af9e2e029e0a5db4ee365e11977016ffdcd70
Reviewed-on: https://pdfium-review.googlesource.com/32670
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
---
 fpdfsdk/fpdfxfa/cpdfxfa_context.cpp | 10 +++++++++-
 xfa/fxfa/cxfa_ffdocview.h           |  4 +++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp b/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
index ed58d24b1f..84fcb37d16 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
@@ -73,8 +73,16 @@ void CPDFXFA_Context::SetFormFillEnv(
   // The layout data can have pointers back into the script context. That
   // context will be different if the form fill environment closes, so, force
   // the layout data to clear.
-  if (m_pXFADoc && m_pXFADoc->GetXFADoc())
+  if (m_pXFADoc && m_pXFADoc->GetXFADoc()) {
+    // The CPDF_XFADocView has a pointer to the CXFA_LayoutProcessor which is
+    // owned by the CXFA_Document. The Layout Processor will be freed with the
+    // ClearLayoutData() call. Make sure the doc view has already released the
+    // pointer.
+    if (m_pXFADocView)
+      m_pXFADocView->ResetLayoutProcessor();
+
     m_pXFADoc->GetXFADoc()->ClearLayoutData();
+  }
 
   m_pFormFillEnv.Reset(pFormFillEnv);
 }
diff --git a/xfa/fxfa/cxfa_ffdocview.h b/xfa/fxfa/cxfa_ffdocview.h
index 2b8358264c..efa504ecd3 100644
--- a/xfa/fxfa/cxfa_ffdocview.h
+++ b/xfa/fxfa/cxfa_ffdocview.h
@@ -97,6 +97,8 @@ class CXFA_FFDocView {
   bool m_bInLayoutStatus = false;
   std::vector<WideString> m_arrNullTestMsg;
 
+  void ResetLayoutProcessor() { m_pXFADocLayout.Release(); }
+
  private:
   bool RunEventLayoutReady();
   void RunBindItems();
@@ -115,7 +117,7 @@ class CXFA_FFDocView {
 
   UnownedPtr<CXFA_FFDoc> const m_pDoc;
   std::unique_ptr<CXFA_FFWidgetHandler> m_pWidgetHandler;
-  CXFA_LayoutProcessor* m_pXFADocLayout = nullptr;  // Not owned.
+  UnownedPtr<CXFA_LayoutProcessor> m_pXFADocLayout;
   UnownedPtr<CXFA_Node> m_pFocusNode;
   UnownedPtr<CXFA_FFWidget> m_pFocusWidget;
   std::vector<CXFA_Node*> m_ValidateNodes;
-- 
cgit v1.2.3