Watch destruction of widgets around OnAAction() method

fpdfsdk/cpdfsdk_document.cpp

Index: fpdfsdk/cpdfsdk_document.cpp
diff --git a/fpdfsdk/cpdfsdk_document.cpp b/fpdfsdk/cpdfsdk_document.cpp
index d4de6d0510151e90a087015933613a011c6fca00..c5bc85805d6040004e1d9c2965b23266d1bd993e 100644
--- a/fpdfsdk/cpdfsdk_document.cpp
+++ b/fpdfsdk/cpdfsdk_document.cpp
@@ -31,7 +31,6 @@ CPDFSDK_Document* CPDFSDK_Document::FromFPDFFormHandle(
 CPDFSDK_Document::CPDFSDK_Document(UnderlyingDocumentType* pDoc,
                                    CPDFSDK_Environment* pEnv)
     : m_pDoc(pDoc),
-      m_pFocusAnnot(nullptr),
       m_pEnv(pEnv),
       m_bChangeMask(FALSE),
       m_bBeingDestroyed(FALSE) {}
@@ -174,10 +173,11 @@ void CPDFSDK_Document::UpdateAllViews(CPDFSDK_PageView* pSender,
 }
 
 CPDFSDK_Annot* CPDFSDK_Document::GetFocusAnnot() {
-  return m_pFocusAnnot;
+  return m_pFocusAnnot.Get();
 }
 
-FX_BOOL CPDFSDK_Document::SetFocusAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag) {
+FX_BOOL CPDFSDK_Document::SetFocusAnnot(CPDFSDK_Annot::ObservedPtr& pAnnot,
+                                        uint32_t nFlag) {
   if (m_bBeingDestroyed)
     return FALSE;
 
@@ -193,7 +193,7 @@ FX_BOOL CPDFSDK_Document::SetFocusAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag) {
     return FALSE;
 
 #ifdef PDF_ENABLE_XFA
-  CPDFSDK_Annot* pLastFocusAnnot = m_pFocusAnnot;
+  CPDFSDK_Annot::ObservedPtr pLastFocusAnnot(m_pFocusAnnot.Get());
 #endif  // PDF_ENABLE_XFA
   CPDFSDK_PageView* pPageView = pAnnot->GetPageView();
   if (pPageView && pPageView->IsValid()) {
@@ -206,7 +206,7 @@ FX_BOOL CPDFSDK_Document::SetFocusAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag) {
       if (!pAnnotHandler->Annot_OnSetFocus(pAnnot, nFlag))
         return FALSE;
       if (!m_pFocusAnnot) {
-        m_pFocusAnnot = pAnnot;
+        m_pFocusAnnot.Reset(pAnnot.Get());
         return TRUE;
       }
     }
@@ -217,28 +217,29 @@ FX_BOOL CPDFSDK_Document::SetFocusAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag) {
 FX_BOOL CPDFSDK_Document::KillFocusAnnot(uint32_t nFlag) {
   if (m_pFocusAnnot) {
     CPDFSDK_AnnotHandlerMgr* pAnnotHandler = m_pEnv->GetAnnotHandlerMgr();
-    CPDFSDK_Annot* pFocusAnnot = m_pFocusAnnot;
-    m_pFocusAnnot = nullptr;
+    CPDFSDK_Annot::ObservedPtr pFocusAnnot(m_pFocusAnnot.Get());
+    m_pFocusAnnot.Reset();
 
 #ifdef PDF_ENABLE_XFA
-    if (!pAnnotHandler->Annot_OnChangeFocus(nullptr, pFocusAnnot))
+    CPDFSDK_Annot::ObservedPtr pNull;
+    if (!pAnnotHandler->Annot_OnChangeFocus(pNull, pFocusAnnot))
       return FALSE;
 #endif  // PDF_ENABLE_XFA
 
     if (pAnnotHandler->Annot_OnKillFocus(pFocusAnnot, nFlag)) {
       if (pFocusAnnot->GetAnnotSubtype() == CPDF_Annot::Subtype::WIDGET) {
-        CPDFSDK_Widget* pWidget = (CPDFSDK_Widget*)pFocusAnnot;
+        CPDFSDK_Widget* pWidget =
+            static_cast<CPDFSDK_Widget*>(pFocusAnnot.Get());
         int nFieldType = pWidget->GetFieldType();
         if (FIELDTYPE_TEXTFIELD == nFieldType ||
             FIELDTYPE_COMBOBOX == nFieldType) {
           m_pEnv->OnSetFieldInputFocus(nullptr, 0, FALSE);
         }
       }
-
       if (!m_pFocusAnnot)
         return TRUE;
     } else {
-      m_pFocusAnnot = pFocusAnnot;
+      m_pFocusAnnot.Reset(pFocusAnnot.Get());
     }
   }
   return FALSE;