[Backport] CVE-2018-18336

Fix CPLW_Wnd ownership model in CFFL_FormFiller.

CFFL_FormFiller::DestroyPDFWindow() might get re-entered, so
do not leave any dangling references in maps. Use unique_ptr
to be more sure that we have it right.

Bug: chromium:898531
Reviewed-on: https://pdfium-review.googlesource.com/c/44542
Change-Id: I01f2986c6082760b3d73f5326dab9d6f0017a5ea
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

14 files changed, 84 insertions, 78 deletions

diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.cpp
index ffa3a032cf5..c50ab6a7244 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.cpp
@@ -6,11 +6,14 @@
 
 #include "fpdfsdk/formfiller/cffl_checkbox.h"
 
+#include <utility>
+
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_widget.h"
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
 #include "fpdfsdk/pdfwindow/PWL_SpecialButton.h"
 #include "public/fpdf_fwlevent.h"
+#include "third_party/base/ptr_util.h"
 
 CFFL_CheckBox::CFFL_CheckBox(CPDFSDK_FormFillEnvironment* pApp,
                              CPDFSDK_Widget* pWidget)
@@ -18,12 +21,12 @@ CFFL_CheckBox::CFFL_CheckBox(CPDFSDK_FormFillEnvironment* pApp,
 
 CFFL_CheckBox::~CFFL_CheckBox() {}
 
-CPWL_Wnd* CFFL_CheckBox::NewPDFWindow(const PWL_CREATEPARAM& cp,
-                                      CPDFSDK_PageView* pPageView) {
-  CPWL_CheckBox* pWnd = new CPWL_CheckBox();
+std::unique_ptr<CPWL_Wnd> CFFL_CheckBox::NewPDFWindow(const PWL_CREATEPARAM& cp,
+                                                      CPDFSDK_PageView* pPageView) {
+  auto pWnd = pdfium::MakeUnique<CPWL_CheckBox>();
   pWnd->Create(cp);
   pWnd->SetCheck(m_pWidget->IsChecked());
-  return pWnd;
+  return std::move(pWnd);
 }
 
 bool CFFL_CheckBox::OnKeyDown(CPDFSDK_Annot* pAnnot,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.h
index 65dba29f2e0..6c570b40876 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.h
@@ -7,6 +7,8 @@
 #ifndef FPDFSDK_FORMFILLER_CFFL_CHECKBOX_H_
 #define FPDFSDK_FORMFILLER_CFFL_CHECKBOX_H_
 
+#include <memory>
+
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
 
 class CFFL_CheckBox : public CFFL_Button {
@@ -15,8 +17,8 @@ class CFFL_CheckBox : public CFFL_Button {
   ~CFFL_CheckBox() override;
 
   // CFFL_Button
-  CPWL_Wnd* NewPDFWindow(const PWL_CREATEPARAM& cp,
-                         CPDFSDK_PageView* pPageView) override;
+  std::unique_ptr<CPWL_Wnd> NewPDFWindow(const PWL_CREATEPARAM& cp,
+                                         CPDFSDK_PageView* pPageView) override;
   bool OnKeyDown(CPDFSDK_Annot* pAnnot,
                  uint32_t nKeyCode,
                  uint32_t nFlags) override;
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.cpp
index 92897b63c6a..77eed053bad 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.cpp
@@ -49,9 +49,9 @@ PWL_CREATEPARAM CFFL_ComboBox::GetCreateParam() {
   return cp;
 }
 
-CPWL_Wnd* CFFL_ComboBox::NewPDFWindow(const PWL_CREATEPARAM& cp,
-                                      CPDFSDK_PageView* pPageView) {
-  CPWL_ComboBox* pWnd = new CPWL_ComboBox();
+std::unique_ptr<CPWL_Wnd> CFFL_ComboBox::NewPDFWindow(
+    const PWL_CREATEPARAM& cp, CPDFSDK_PageView* pPageView) {
+  auto pWnd = pdfium::MakeUnique<CPWL_ComboBox>();
   pWnd->AttachFFLData(this);
   pWnd->Create(cp);
 
@@ -66,13 +66,12 @@ CPWL_Wnd* CFFL_ComboBox::NewPDFWindow(const PWL_CREATEPARAM& cp,
   else
     swText = m_pWidget->GetOptionLabel(nCurSel);
 
-  for (int32_t i = 0, sz = m_pWidget->CountOptions(); i < sz; i++) {
+  for (int32_t i = 0, sz = m_pWidget->CountOptions(); i < sz; i++)
     pWnd->AddString(m_pWidget->GetOptionLabel(i));
-  }
 
   pWnd->SetSelect(nCurSel);
   pWnd->SetText(swText);
-  return pWnd;
+  return std::move(pWnd);
 }
 
 bool CFFL_ComboBox::OnChar(CPDFSDK_Annot* pAnnot,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.h
index aab10b90e14..61f231acc86 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.h
@@ -7,6 +7,8 @@
 #ifndef FPDFSDK_FORMFILLER_CFFL_COMBOBOX_H_
 #define FPDFSDK_FORMFILLER_CFFL_COMBOBOX_H_
 
+#include <memory>
+
 #include "core/fxcrt/fx_string.h"
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
 
@@ -26,8 +28,8 @@ class CFFL_ComboBox : public CFFL_FormFiller, public IPWL_FocusHandler {
 
   // CFFL_FormFiller:
   PWL_CREATEPARAM GetCreateParam() override;
-  CPWL_Wnd* NewPDFWindow(const PWL_CREATEPARAM& cp,
-                         CPDFSDK_PageView* pPageView) override;
+  std::unique_ptr<CPWL_Wnd> NewPDFWindow(
+      const PWL_CREATEPARAM& cp, CPDFSDK_PageView* pPageView) override;
   bool OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags) override;
   bool IsDataChanged(CPDFSDK_PageView* pPageView) override;
   void SaveData(CPDFSDK_PageView* pPageView) override;
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.cpp
index 281057a6ac6..53d9a4c1eb0 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.cpp
@@ -32,15 +32,17 @@ CFFL_FormFiller::~CFFL_FormFiller() {
 }
 
 void CFFL_FormFiller::DestroyWindows() {
-  for (const auto& it : m_Maps) {
-    CPWL_Wnd* pWnd = it.second;
-    CFFL_PrivateData* pData = (CFFL_PrivateData*)pWnd->GetAttachedData();
-    pWnd->InvalidateProvider(this);
-    pWnd->Destroy();
-    delete pWnd;
-    delete pData;
+  while (!m_Maps.empty()) {
+    std::unique_ptr<CFFL_PrivateData> pData;
+    {
+      auto it = m_Maps.begin();
+      std::unique_ptr<CPWL_Wnd> pWnd = std::move(it->second);
+      pData.reset(static_cast<CFFL_PrivateData*>(pWnd->GetAttachedData()));
+      m_Maps.erase(it);
+      pWnd->InvalidateProvider(this);
+      pWnd->Destroy();
+    }
   }
-  m_Maps.clear();
 }
 
 void CFFL_FormFiller::SetWindowRect(CPDFSDK_PageView* pPageView,
@@ -344,36 +346,34 @@ PWL_CREATEPARAM CFFL_FormFiller::GetCreateParam() {
 CPWL_Wnd* CFFL_FormFiller::GetPDFWindow(CPDFSDK_PageView* pPageView,
                                         bool bNew) {
   ASSERT(pPageView);
-
   auto it = m_Maps.find(pPageView);
-  const bool found = it != m_Maps.end();
-  CPWL_Wnd* pWnd = found ? it->second : nullptr;
-  if (!bNew)
-    return pWnd;
+  if (it == m_Maps.end()) {
+    if (!bNew)
+      return nullptr;
 
-  if (found) {
-    CFFL_PrivateData* pPrivateData = (CFFL_PrivateData*)pWnd->GetAttachedData();
-    if (pPrivateData->nWidgetAge != m_pWidget->GetAppearanceAge()) {
-      return ResetPDFWindow(
-          pPageView, m_pWidget->GetValueAge() == pPrivateData->nValueAge);
-    }
-  } else {
     PWL_CREATEPARAM cp = GetCreateParam();
     cp.pAttachedWidget.Reset(m_pWidget);
 
-    CFFL_PrivateData* pPrivateData = new CFFL_PrivateData;
+    auto pPrivateData = pdfium::MakeUnique<CFFL_PrivateData>();
     pPrivateData->pWidget = m_pWidget;
     pPrivateData->pPageView = pPageView;
     pPrivateData->nWidgetAge = m_pWidget->GetAppearanceAge();
     pPrivateData->nValueAge = 0;
 
-    cp.pAttachedData = pPrivateData;
-
-    pWnd = NewPDFWindow(cp, pPageView);
-    m_Maps[pPageView] = pWnd;
+    cp.pAttachedData = pPrivateData.release();
+    m_Maps[pPageView] = NewPDFWindow(cp, pPageView);
+    return m_Maps[pPageView].get();
   }
+  CPWL_Wnd* pWnd = it->second.get();
+  if (!bNew)
+    return pWnd;
+
+  auto* pPrivateData = static_cast<CFFL_PrivateData*>(pWnd->GetAttachedData());
+  if (pPrivateData->nWidgetAge == m_pWidget->GetAppearanceAge())
+    return pWnd;
 
-  return pWnd;
+  return ResetPDFWindow(
+      pPageView, m_pWidget->GetValueAge() == pPrivateData->nValueAge);
 }
 
 void CFFL_FormFiller::DestroyPDFWindow(CPDFSDK_PageView* pPageView) {
@@ -381,13 +381,13 @@ void CFFL_FormFiller::DestroyPDFWindow(CPDFSDK_PageView* pPageView) {
   if (it == m_Maps.end())
     return;
 
-  CPWL_Wnd* pWnd = it->second;
-  CFFL_PrivateData* pData = (CFFL_PrivateData*)pWnd->GetAttachedData();
-  pWnd->Destroy();
-  delete pWnd;
-  delete pData;
-
-  m_Maps.erase(it);
+  std::unique_ptr<CFFL_PrivateData> pData;
+  {
+    std::unique_ptr<CPWL_Wnd> pWnd = std::move(it->second);
+    m_Maps.erase(it);
+    pData.reset(static_cast<CFFL_PrivateData*>(pWnd->GetAttachedData()));
+    pWnd->Destroy();
+  }
 }
 
 CFX_Matrix CFFL_FormFiller::GetWindowMatrix(void* pAttachedData) {
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.h
index cf1aaf72056..50432ca27f6 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.h
@@ -8,6 +8,7 @@
 #define FPDFSDK_FORMFILLER_CFFL_FORMFILLER_H_
 
 #include <map>
+#include <memory>
 
 #include "fpdfsdk/formfiller/cba_fontmap.h"
 #include "fpdfsdk/formfiller/cffl_interactiveformfiller.h"
@@ -101,7 +102,6 @@ class CFFL_FormFiller : public IPWL_Provider, public CPWL_TimerHandler {
                                    bool bRestoreValue);
 
   CFX_Matrix GetCurMatrix();
-
   CFX_FloatRect FFLtoPWL(const CFX_FloatRect& rect);
   CFX_FloatRect PWLtoFFL(const CFX_FloatRect& rect);
   CFX_FloatPoint FFLtoPWL(const CFX_FloatPoint& point);
@@ -129,8 +129,8 @@ class CFFL_FormFiller : public IPWL_Provider, public CPWL_TimerHandler {
   void EscapeFiller(CPDFSDK_PageView* pPageView, bool bDestroyPDFWindow);
 
   virtual PWL_CREATEPARAM GetCreateParam();
-  virtual CPWL_Wnd* NewPDFWindow(const PWL_CREATEPARAM& cp,
-                                 CPDFSDK_PageView* pPageView) = 0;
+  virtual std::unique_ptr<CPWL_Wnd> NewPDFWindow(
+      const PWL_CREATEPARAM& cp, CPDFSDK_PageView* pPageView) = 0;
   virtual CFX_FloatRect GetFocusBox(CPDFSDK_PageView* pPageView);
 
   bool IsValid() const;
@@ -146,8 +146,6 @@ class CFFL_FormFiller : public IPWL_Provider, public CPWL_TimerHandler {
   CPDFSDK_Annot* GetSDKAnnot() { return m_pAnnot; }
 
  protected:
-  using CFFL_PageView2PDFWindow = std::map<CPDFSDK_PageView*, CPWL_Wnd*>;
-
   // If the inheriting widget has its own fontmap and a PWL_Edit widget that
   // access that fontmap then you have to call DestroyWindows before destroying
   // the font map in order to not get a use-after-free.
@@ -161,7 +159,7 @@ class CFFL_FormFiller : public IPWL_Provider, public CPWL_TimerHandler {
   CPDFSDK_Annot* m_pAnnot;
 
   bool m_bValid;
-  CFFL_PageView2PDFWindow m_Maps;
+  std::map<CPDFSDK_PageView*, std::unique_ptr<CPWL_Wnd>> m_Maps;
   CFX_FloatPoint m_ptOldPos;
 };
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.cpp
index 51ec69400eb..b4124aa15fe 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.cpp
@@ -46,9 +46,9 @@ PWL_CREATEPARAM CFFL_ListBox::GetCreateParam() {
   return cp;
 }
 
-CPWL_Wnd* CFFL_ListBox::NewPDFWindow(const PWL_CREATEPARAM& cp,
-                                     CPDFSDK_PageView* pPageView) {
-  CPWL_ListBox* pWnd = new CPWL_ListBox();
+std::unique_ptr<CPWL_Wnd> CFFL_ListBox::NewPDFWindow(
+    const PWL_CREATEPARAM& cp, CPDFSDK_PageView* pPageView) {
+  auto pWnd = pdfium::MakeUnique<CPWL_ListBox>();
   pWnd->AttachFFLData(this);
   pWnd->Create(cp);
   pWnd->SetFillerNotify(m_pFormFillEnv->GetInteractiveFormFiller());
@@ -80,8 +80,7 @@ CPWL_Wnd* CFFL_ListBox::NewPDFWindow(const PWL_CREATEPARAM& cp,
   }
 
   pWnd->SetTopVisibleIndex(m_pWidget->GetTopVisibleIndex());
-
-  return pWnd;
+  return std::move(pWnd);
 }
 
 bool CFFL_ListBox::OnChar(CPDFSDK_Annot* pAnnot,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.h
index e97ede0deb1..b8a2ee42420 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.h
@@ -21,7 +21,7 @@ class CFFL_ListBox : public CFFL_FormFiller {
 
   // CFFL_FormFiller
   PWL_CREATEPARAM GetCreateParam() override;
-  CPWL_Wnd* NewPDFWindow(const PWL_CREATEPARAM& cp,
+  std::unique_ptr<CPWL_Wnd> NewPDFWindow(const PWL_CREATEPARAM& cp,
                          CPDFSDK_PageView* pPageView) override;
   bool OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags) override;
   bool IsDataChanged(CPDFSDK_PageView* pPageView) override;
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.cpp
index 9b4121af9d1..7c180b55a70 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.cpp
@@ -6,6 +6,8 @@
 
 #include "fpdfsdk/formfiller/cffl_pushbutton.h"
 
+#include <utility>
+
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
 #include "fpdfsdk/pdfwindow/PWL_SpecialButton.h"
 
@@ -15,12 +17,11 @@ CFFL_PushButton::CFFL_PushButton(CPDFSDK_FormFillEnvironment* pApp,
 
 CFFL_PushButton::~CFFL_PushButton() {}
 
-CPWL_Wnd* CFFL_PushButton::NewPDFWindow(const PWL_CREATEPARAM& cp,
-                                        CPDFSDK_PageView* pPageView) {
-  CPWL_PushButton* pWnd = new CPWL_PushButton();
+std::unique_ptr<CPWL_Wnd> CFFL_PushButton::NewPDFWindow(
+    const PWL_CREATEPARAM& cp, CPDFSDK_PageView* pPageView) {
+  auto pWnd = pdfium::MakeUnique<CPWL_PushButton>();
   pWnd->Create(cp);
-
-  return pWnd;
+  return std::move(pWnd);
 }
 
 bool CFFL_PushButton::OnChar(CPDFSDK_Annot* pAnnot,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.h
index 1d50595c875..d0713756d0c 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.h
@@ -15,7 +15,7 @@ class CFFL_PushButton : public CFFL_Button {
   ~CFFL_PushButton() override;
 
   // CFFL_Button
-  CPWL_Wnd* NewPDFWindow(const PWL_CREATEPARAM& cp,
+  std::unique_ptr<CPWL_Wnd> NewPDFWindow(const PWL_CREATEPARAM& cp,
                          CPDFSDK_PageView* pPageView) override;
   bool OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags) override;
   void OnDraw(CPDFSDK_PageView* pPageView,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.cpp
index 70d4c0dee6e..c62eddacd03 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.cpp
@@ -6,6 +6,8 @@
 
 #include "fpdfsdk/formfiller/cffl_radiobutton.h"
 
+#include <utility>
+
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_widget.h"
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
@@ -18,14 +20,13 @@ CFFL_RadioButton::CFFL_RadioButton(CPDFSDK_FormFillEnvironment* pApp,
 
 CFFL_RadioButton::~CFFL_RadioButton() {}
 
-CPWL_Wnd* CFFL_RadioButton::NewPDFWindow(const PWL_CREATEPARAM& cp,
-                                         CPDFSDK_PageView* pPageView) {
-  CPWL_RadioButton* pWnd = new CPWL_RadioButton();
+std::unique_ptr<CPWL_Wnd> CFFL_RadioButton::NewPDFWindow(
+    const PWL_CREATEPARAM& cp, CPDFSDK_PageView* pPageView) {
+  auto pWnd = pdfium::MakeUnique<CPWL_RadioButton>();
   pWnd->Create(cp);
 
   pWnd->SetCheck(m_pWidget->IsChecked());
-
-  return pWnd;
+  return std::move(pWnd);
 }
 
 bool CFFL_RadioButton::OnKeyDown(CPDFSDK_Annot* pAnnot,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.h
index 49a658f84eb..780b3fc7414 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.h
@@ -7,6 +7,8 @@
 #ifndef FPDFSDK_FORMFILLER_CFFL_RADIOBUTTON_H_
 #define FPDFSDK_FORMFILLER_CFFL_RADIOBUTTON_H_
 
+#include <memory>
+
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
 
 class CFFL_RadioButton : public CFFL_Button {
@@ -15,7 +17,7 @@ class CFFL_RadioButton : public CFFL_Button {
   ~CFFL_RadioButton() override;
 
   // CFFL_Button
-  CPWL_Wnd* NewPDFWindow(const PWL_CREATEPARAM& cp,
+  std::unique_ptr<CPWL_Wnd> NewPDFWindow(const PWL_CREATEPARAM& cp,
                          CPDFSDK_PageView* pPageView) override;
   bool OnKeyDown(CPDFSDK_Annot* pAnnot,
                  uint32_t nKeyCode,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.cpp
index 44dd52a2248..64979d054ff 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.cpp
@@ -82,9 +82,9 @@ PWL_CREATEPARAM CFFL_TextField::GetCreateParam() {
   return cp;
 }
 
-CPWL_Wnd* CFFL_TextField::NewPDFWindow(const PWL_CREATEPARAM& cp,
-                                       CPDFSDK_PageView* pPageView) {
-  CPWL_Edit* pWnd = new CPWL_Edit();
+std::unique_ptr<CPWL_Wnd> CFFL_TextField::NewPDFWindow(
+    const PWL_CREATEPARAM& cp, CPDFSDK_PageView* pPageView) {
+  auto pWnd = pdfium::MakeUnique<CPWL_Edit>();
   pWnd->AttachFFLData(this);
   pWnd->Create(cp);
   pWnd->SetFillerNotify(m_pFormFillEnv->GetInteractiveFormFiller());
@@ -100,9 +100,8 @@ CPWL_Wnd* CFFL_TextField::NewPDFWindow(const PWL_CREATEPARAM& cp,
       pWnd->SetLimitChar(nMaxLen);
     }
   }
-
   pWnd->SetText(swValue);
-  return pWnd;
+  return std::move(pWnd);
 }
 
 bool CFFL_TextField::OnChar(CPDFSDK_Annot* pAnnot,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.h
index 29579f72a5f..2b3d4e7abf8 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.h
@@ -32,8 +32,8 @@ class CFFL_TextField : public CFFL_FormFiller, public IPWL_FocusHandler {
 
   // CFFL_FormFiller:
   PWL_CREATEPARAM GetCreateParam() override;
-  CPWL_Wnd* NewPDFWindow(const PWL_CREATEPARAM& cp,
-                         CPDFSDK_PageView* pPageView) override;
+  std::unique_ptr<CPWL_Wnd> NewPDFWindow(
+      const PWL_CREATEPARAM& cp, CPDFSDK_PageView* pPageView) override;
   bool OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags) override;
   bool IsDataChanged(CPDFSDK_PageView* pPageView) override;
   void SaveData(CPDFSDK_PageView* pPageView) override;