Fix heap-use-after-free in CXFA_FFWidget::GetDataAcc()

xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/src/foxitlib.h"
 #include "xfa/src/fxfa/src/common/xfa_utils.h"
 #include "xfa/src/fxfa/src/common/xfa_object.h"
 #include "xfa/src/fxfa/src/common/xfa_document.h"
@@ skipping 34 matching lines @@
   IXFA_DocLayout* pDocLayout =
       pLayoutItem->m_pFormNode->GetDocument()->GetDocLayout();
   while (pNode) {
     CXFA_LayoutItem* pNext = pNode->m_pNextSibling;
     pNode->m_pParent = nullptr;
     pNotify->OnLayoutEvent(pDocLayout, static_cast<CXFA_LayoutItem*>(pNode),
                            XFA_LAYOUTEVENT_ItemRemoving);
     XFA_ReleaseLayoutItem(pNode);
     pNode = pNext;
   }
+  pNotify->OnLayoutEvent(pDocLayout, pLayoutItem, XFA_LAYOUTEVENT_ItemRemoving);

[jun_fang, 2016/02/06 03:49:27]

The information about destroy of pLayoutItem should be passed to layout before
deleting pLayoutItem. 

   if (pLayoutItem->m_pFormNode->GetClassID() == XFA_ELEMENT_PageArea) {
     pNotify->OnPageEvent(static_cast<CXFA_ContainerLayoutItem*>(pLayoutItem),
                          XFA_PAGEEVENT_PageRemoved);
   }
   delete pLayoutItem;
 }