From cd8ff7e9eb651a2ab78bd17a7d8a6cc6d9cce9c4 Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Tue, 13 Jun 2017 14:09:46 -0700
Subject: Check for destroyed annotations in CPDFSDK_WidgetHandler::OnLoad().

BUG=chromium:732039

Change-Id: I0bc6b24cb41f093eae7bd0a96bcdd441ec8322d7
Reviewed-on: https://pdfium-review.googlesource.com/6531
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
---
 fpdfsdk/cpdfsdk_widgethandler.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fpdfsdk/cpdfsdk_widgethandler.cpp b/fpdfsdk/cpdfsdk_widgethandler.cpp
index 1e63f5ecc6..c34f766793 100644
--- a/fpdfsdk/cpdfsdk_widgethandler.cpp
+++ b/fpdfsdk/cpdfsdk_widgethandler.cpp
@@ -229,7 +229,11 @@ void CPDFSDK_WidgetHandler::OnLoad(CPDFSDK_Annot* pAnnot) {
   int nFieldType = pWidget->GetFieldType();
   if (nFieldType == FIELDTYPE_TEXTFIELD || nFieldType == FIELDTYPE_COMBOBOX) {
     bool bFormatted = false;
+    CPDFSDK_Annot::ObservedPtr pObserved(pWidget);
     CFX_WideString sValue = pWidget->OnFormat(bFormatted);
+    if (!pObserved)
+      return;
+
     if (bFormatted && nFieldType == FIELDTYPE_COMBOBOX)
       pWidget->ResetAppearance(&sValue, false);
   }
-- 
cgit v1.2.3