Fix CPDFSDK_FormFillEnvironment destruction order

fpdfsdk/cpdfsdk_formfillenvironment.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 
 #include <memory>
 
@@ skipping 23 matching lines @@
     UnderlyingDocumentType* pDoc,
     FPDF_FORMFILLINFO* pFFinfo)
     : m_pInfo(pFFinfo),
       m_pUnderlyingDoc(pDoc),
       m_pSysHandler(new CFX_SystemHandler(this)),
       m_bChangeMask(false),
       m_bBeingDestroyed(false) {}
 
 CPDFSDK_FormFillEnvironment::~CPDFSDK_FormFillEnvironment() {
   m_bBeingDestroyed = true;
-
   ClearAllFocusedAnnots();
 
-  // |m_pAnnotHandlerMgr| will try to access |m_pFormFiller|
-  // when it cleans up. So, we must make sure it is cleaned up before
-  // |m_pFormFiller|.
+  // |m_PageMap| will try to access |m_pInterForm| when it cleans itself up.
+  // Make sure it is deleted before |m_pInterForm|.
+  m_PageMap.clear();
+
+  // |m_pAnnotHandlerMgr| will try to access |m_pFormFiller| when it cleans
+  // itself up. Make sure it is deleted before |m_pFormFiller|.
   m_pAnnotHandlerMgr.reset();
 
   // Must destroy the |m_pFormFiller| before the environment (|this|)
   // because any created form widgets hold a pointer to the environment.
   // Those widgets may call things like KillTimer() as they are shutdown.
   m_pFormFiller.reset();
 
   if (m_pInfo && m_pInfo->Release)
     m_pInfo->Release(m_pInfo);
 }
@@ skipping 496 matching lines @@
 }
 
 void CPDFSDK_FormFillEnvironment::PageEvent(int iPageCount,
                                             uint32_t dwEventType) const {
   if (m_pInfo && m_pInfo->FFI_PageEvent)
     m_pInfo->FFI_PageEvent(m_pInfo, iPageCount, dwEventType);
 }
 #endif  // PDF_ENABLE_XFA
 
 void CPDFSDK_FormFillEnvironment::ClearAllFocusedAnnots() {
-  for (auto& it : m_pageMap) {
+  for (auto& it : m_PageMap) {
     if (it.second->IsValidSDKAnnot(GetFocusAnnot()))
       KillFocusAnnot(0);
   }
 }
 
 CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetPageView(
     UnderlyingPageType* pUnderlyingPage,
     bool renew) {
-  auto it = m_pageMap.find(pUnderlyingPage);
-  if (it != m_pageMap.end())
+  auto it = m_PageMap.find(pUnderlyingPage);
+  if (it != m_PageMap.end())
     return it->second.get();
 
   if (!renew)
     return nullptr;
 
   CPDFSDK_PageView* pPageView = new CPDFSDK_PageView(this, pUnderlyingPage);
-  m_pageMap[pUnderlyingPage].reset(pPageView);
+  m_PageMap[pUnderlyingPage].reset(pPageView);
   // Delay to load all the annotations, to avoid endless loop.
   pPageView->LoadFXAnnots();
   return pPageView;
 }
 
 CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetCurrentView() {
   UnderlyingPageType* pPage =
       UnderlyingFromFPDFPage(GetCurrentPage(m_pUnderlyingDoc));
   return pPage ? GetPageView(pPage, true) : nullptr;
 }
 
 CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetPageView(int nIndex) {
   UnderlyingPageType* pTempPage =
       UnderlyingFromFPDFPage(GetPage(m_pUnderlyingDoc, nIndex));
   if (!pTempPage)
     return nullptr;
 
-  auto it = m_pageMap.find(pTempPage);
-  return it != m_pageMap.end() ? it->second.get() : nullptr;
+  auto it = m_PageMap.find(pTempPage);
+  return it != m_PageMap.end() ? it->second.get() : nullptr;
 }
 
 void CPDFSDK_FormFillEnvironment::ProcJavascriptFun() {
   CPDF_Document* pPDFDoc = GetPDFDocument();
   CPDF_DocJSActions docJS(pPDFDoc);
   int iCount = docJS.CountJSActions();
   if (iCount < 1)
     return;
   for (int i = 0; i < iCount; i++) {
     CFX_ByteString csJSName;
@@ skipping 27 matching lines @@
     CPDF_Action action(pDict);
     if (GetActionHander())
       GetActionHander()->DoAction_DocOpen(action, this);
     return true;
   }
   return false;
 }
 
 void CPDFSDK_FormFillEnvironment::RemovePageView(
     UnderlyingPageType* pUnderlyingPage) {
-  auto it = m_pageMap.find(pUnderlyingPage);
-  if (it == m_pageMap.end())
+  auto it = m_PageMap.find(pUnderlyingPage);
+  if (it == m_PageMap.end())
     return;
 
   CPDFSDK_PageView* pPageView = it->second.get();
   if (pPageView->IsLocked() || pPageView->IsBeingDestroyed())
     return;
 
   // Mark the page view so we do not come into |RemovePageView| a second
   // time while we're in the process of removing.
   pPageView->SetBeingDestroyed();
 
   // This must happen before we remove |pPageView| from the map because
   // |KillFocusAnnot| can call into the |GetPage| method which will
   // look for this page view in the map, if it doesn't find it a new one will
   // be created. We then have two page views pointing to the same page and
   // bad things happen.
   if (pPageView->IsValidSDKAnnot(GetFocusAnnot()))
     KillFocusAnnot(0);
 
   // Remove the page from the map to make sure we don't accidentally attempt
   // to use the |pPageView| while we're cleaning it up.
-  m_pageMap.erase(it);
+  m_PageMap.erase(it);
 }
 
 UnderlyingPageType* CPDFSDK_FormFillEnvironment::GetPage(int nIndex) {
   return UnderlyingFromFPDFPage(GetPage(m_pUnderlyingDoc, nIndex));
 }
 
 CPDFSDK_InterForm* CPDFSDK_FormFillEnvironment::GetInterForm() {
   if (!m_pInterForm)
     m_pInterForm = pdfium::MakeUnique<CPDFSDK_InterForm>(this);
   return m_pInterForm.get();
 }
 
 void CPDFSDK_FormFillEnvironment::UpdateAllViews(CPDFSDK_PageView* pSender,
                                                  CPDFSDK_Annot* pAnnot) {
-  for (const auto& it : m_pageMap) {
+  for (const auto& it : m_PageMap) {
     CPDFSDK_PageView* pPageView = it.second.get();
     if (pPageView != pSender)
       pPageView->UpdateView(pAnnot);
   }
 }
 
 bool CPDFSDK_FormFillEnvironment::SetFocusAnnot(
     CPDFSDK_Annot::ObservedPtr* pAnnot) {
   if (m_bBeingDestroyed)
     return false;
@@ skipping 53 matching lines @@
     } else {
       m_pFocusAnnot.Reset(pFocusAnnot.Get());
     }
   }
   return false;
 }
 
 bool CPDFSDK_FormFillEnvironment::GetPermissions(int nFlag) {
   return !!(GetPDFDocument()->GetUserPermissions() & nFlag);
 }