Fixup CPDFSDK_PageView and CPDF_Page interactions.

fpdfsdk/fsdk_mgr.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "fpdfsdk/include/fsdk_mgr.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 281 matching lines @@
   return pPage ? GetPageView(pPage, true) : nullptr;
 }
 
 CPDFSDK_PageView* CPDFSDK_Document::GetPageView(int nIndex) {
   UnderlyingPageType* pTempPage =
       UnderlyingFromFPDFPage(m_pEnv->FFI_GetPage(m_pDoc, nIndex));
   if (!pTempPage)
     return nullptr;
 
   auto it = m_pageMap.find(pTempPage);
-  return it->second;
+  return it != m_pageMap.end() ? it->second : nullptr;
 }
 
 void CPDFSDK_Document::ProcJavascriptFun() {
   CPDF_Document* pPDFDoc = GetPDFDocument();
   CPDF_DocJSActions docJS(pPDFDoc);
   int iCount = docJS.CountJSActions();
   if (iCount < 1)
     return;
   for (int i = 0; i < iCount; i++) {
     CFX_ByteString csJSName;
@@ skipping 162 matching lines @@
 CFX_WideString CPDFSDK_Document::GetPath() {
   return m_pEnv->JS_docGetFilePath();
 }
 
 CPDFSDK_PageView::CPDFSDK_PageView(CPDFSDK_Document* pSDKDoc,
                                    UnderlyingPageType* page)
     : m_page(page),
       m_pSDKDoc(pSDKDoc),
       m_CaptureWidget(nullptr),
 #ifndef PDF_ENABLE_XFA
-      m_bTakeOverPage(FALSE),
+      m_bOwnsPage(false),
 #endif  // PDF_ENABLE_XFA
       m_bEnterWidget(FALSE),
       m_bExitWidget(FALSE),
       m_bOnWidget(FALSE),
       m_bValid(FALSE),
       m_bLocked(FALSE) {
   CPDFSDK_InterForm* pInterForm = pSDKDoc->GetInterForm();
   if (pInterForm) {
     CPDF_InterForm* pPDFInterForm = pInterForm->GetInterForm();
 #ifdef PDF_ENABLE_XFA
     if (page->GetPDFPage())
       pPDFInterForm->FixPageFields(page->GetPDFPage());
 #else   // PDF_ENABLE_XFA
     pPDFInterForm->FixPageFields(page);
 #endif  // PDF_ENABLE_XFA
   }
 #ifndef PDF_ENABLE_XFA
   m_page->SetView(this);
 #endif  // PDF_ENABLE_XFA
 }
 
 CPDFSDK_PageView::~CPDFSDK_PageView() {
+#ifndef PDF_ENABLE_XFA
+  // The call to |ReleaseAnnot| can cause the page pointed to by |m_page| to
+  // be freed, which will cause issues if we try to cleanup the pageview pointer
+  // in |m_page|. So, reset the pageview pointer before doing anything else.
+  m_page->SetView(nullptr);
+#endif  // PDF_ENABLE_XFA
+
   CPDFDoc_Environment* pEnv = m_pSDKDoc->GetEnv();
   CPDFSDK_AnnotHandlerMgr* pAnnotHandlerMgr = pEnv->GetAnnotHandlerMgr();
   for (CPDFSDK_Annot* pAnnot : m_fxAnnotArray)
     pAnnotHandlerMgr->ReleaseAnnot(pAnnot);
 
   m_fxAnnotArray.clear();
   m_pAnnotList.reset();
+
 #ifndef PDF_ENABLE_XFA
-  m_page->SetView(nullptr);
-  if (m_bTakeOverPage) {
+  if (m_bOwnsPage)
     delete m_page;
-  }
 #endif  // PDF_ENABLE_XFA
 }
 
 void CPDFSDK_PageView::PageView_OnDraw(CFX_RenderDevice* pDevice,
                                        CFX_Matrix* pUser2Device,
 #ifdef PDF_ENABLE_XFA
                                        CPDF_RenderOptions* pOptions,
                                        const FX_RECT& pClip) {
 #else
                                        CPDF_RenderOptions* pOptions) {
@@ skipping 492 matching lines @@
       return pAnnot;
   }
   return nullptr;
 }
 
 int CPDFSDK_PageView::GetPageIndexForStaticPDF() const {
   CPDF_Dictionary* pDict = GetPDFPage()->m_pFormDict;
   CPDF_Document* pDoc = m_pSDKDoc->GetPDFDocument();
   return (pDoc && pDict) ? pDoc->GetPageIndex(pDict->GetObjNum()) : -1;
 }