XFA: Change the destruction order inside CPDFXFA_Document to avoid UAFs.

fpdfsdk/include/fpdfxfa/fpdfxfa_doc.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef FPDFXFA_DOC_H_
 #define FPDFXFA_DOC_H_
 
 #include "../../../xfa/include/fxfa/fxfa.h"
@@ skipping 19 matching lines @@
   IXFA_Doc* GetXFADoc() { return m_pXFADoc; }
   IXFA_DocView* GetXFADocView() { return m_pXFADocView; }
 
   int GetPageCount();
   CPDFXFA_Page* GetPage(int page_index);
   CPDFXFA_Page* GetPage(IXFA_PageView* pPage);
   void RemovePage(CPDFXFA_Page* page);
   int GetDocType() { return m_iDocType; }
 
   CPDFSDK_Document* GetSDKDocument(CPDFDoc_Environment* pFormFillEnv);
-  void ReleaseSDKDoc();
 
   void FXRect2PDFRect(const CFX_RectF& fxRectF, CPDF_Rect& pdfRect);
 
   virtual void SetChangeMark(IXFA_Doc* hDoc);
   virtual FX_BOOL GetChangeMark(IXFA_Doc* hDoc);
   // used in dynamic xfa, dwFlags refer to XFA_INVALIDATE_XXX macros.
   virtual void InvalidateRect(IXFA_PageView* pPageView,
                               const CFX_RectF& rt,
                               FX_DWORD dwFlags = 0);
   // used in static xfa, dwFlags refer to XFA_INVALIDATE_XXX macros.
@@ skipping 169 matching lines @@
   CPDF_Document* m_pPDFDoc;
   CPDFSDK_Document* m_pSDKDoc;
   IXFA_Doc* m_pXFADoc;
   IXFA_DocView* m_pXFADocView;
   CPDFXFA_App* m_pApp;
   IJS_Context* m_pJSContext;
   CFX_ArrayTemplate<CPDFXFA_Page*> m_XFAPageList;
 };
 
 #endif  // FPDFXFA_DOC_H_