Fix heap-use-after-free in CXFA_FFWidget::GetDataAcc()

xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp

Index: xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
diff --git a/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp b/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
index 8e0a9444c5dcef2f37fe8a7edb53d6466267a05a..855483bbae68f226d42fd9002c5a62b5f977c2fd 100644
--- a/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
+++ b/xfa/src/fxfa/src/parser/xfa_layout_appadapter.cpp
@@ -52,6 +52,7 @@ void XFA_ReleaseLayoutItem(CXFA_LayoutItem* pLayoutItem) {
     XFA_ReleaseLayoutItem(pNode);
     pNode = pNext;
   }
+  pNotify->OnLayoutEvent(pDocLayout, pLayoutItem, XFA_LAYOUTEVENT_ItemRemoving);

[jun_fang, 2016/02/06 03:49:27]

The information about destroy of pLayoutItem should be passed to layout before
deleting pLayoutItem. 

   if (pLayoutItem->m_pFormNode->GetClassID() == XFA_ELEMENT_PageArea) {
     pNotify->OnPageEvent(static_cast<CXFA_ContainerLayoutItem*>(pLayoutItem),
                          XFA_PAGEEVENT_PageRemoved);