From fa5db8d5509374c3014314771dd7f3621375402f Mon Sep 17 00:00:00 2001
From: Tom Sepez <[email protected]>
Date: Fri, 15 May 2026 18:48:52 -0700
Subject: [PATCH] Fix variants of prior CJS_Field::set_display() issue.

Test for existence of form_field_env_ following JS re-entrancy.

Bug: 513536416
Change-Id: Icbcc26ccefaea9d332a9e8da8a130d9823830a35
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/147790
Commit-Queue: Lei Zhang <[email protected]>
Reviewed-by: Lei Zhang <[email protected]>
---

diff --git a/fxjs/cjs_field.cpp b/fxjs/cjs_field.cpp
index 1d2acf3..c020254 100644
--- a/fxjs/cjs_field.cpp
+++ b/fxjs/cjs_field.cpp
@@ -777,12 +777,16 @@
 
 CJS_Result CJS_Field::set_border_style(CJS_Runtime* pRuntime,
                                        v8::Local<v8::Value> vp) {
-  DCHECK(form_fill_env_);
   if (!can_set_) {
     return CJS_Result::Failure(JSMessage::kReadOnlyError);
   }
-
   ByteString byte_str = pRuntime->ToByteStringReentrant(vp);
+
+  // Check if still exists following JS re-entrancy.
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
+  }
+
   if (delay_) {
     AddDelay_String(FP_BORDERSTYLE, byte_str);
   } else {
@@ -1130,6 +1134,11 @@
     }
   }
 
+  // Check if still exists following JS re-entrancy.
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
+  }
+
   if (delay_) {
     AddDelay_WordArray(FP_CURRENTVALUEINDICES, array);
   } else {
@@ -1272,9 +1281,12 @@
     return CJS_Result::Failure(JSMessage::kReadOnlyError);
   }
   int value = pRuntime->ToInt32Reentrant(vp);
+
+  // Check if still exists following JS re-entrancy.
   if (!form_fill_env_) {
     return CJS_Result::Failure(JSMessage::kBadObjectError);
   }
+
   if (delay_) {
     AddDelay_Int(FP_DISPLAY, value);
   } else {
@@ -1461,12 +1473,17 @@
   if (!can_set_) {
     return CJS_Result::Failure(JSMessage::kReadOnlyError);
   }
+  const bool value = pRuntime->ToBooleanReentrant(vp);
+
+  // Check if still exists following JS re-entrancy.
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
+  }
 
   if (delay_) {
-    AddDelay_Bool(FP_HIDDEN, pRuntime->ToBooleanReentrant(vp));
+    AddDelay_Bool(FP_HIDDEN, value);
   } else {
-    SetHidden(form_fill_env_.Get(), field_name_, form_control_index_,
-              pRuntime->ToBooleanReentrant(vp));
+    SetHidden(form_fill_env_.Get(), field_name_, form_control_index_, value);
   }
   return CJS_Result::Success();
 }
@@ -1542,12 +1559,17 @@
   if (!can_set_) {
     return CJS_Result::Failure(JSMessage::kReadOnlyError);
   }
+  const int value = pRuntime->ToInt32Reentrant(vp);
+
+  // Check if still exists following JS re-entrancy.
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
+  }
 
   if (delay_) {
-    AddDelay_Int(FP_LINEWIDTH, pRuntime->ToInt32Reentrant(vp));
+    AddDelay_Int(FP_LINEWIDTH, value);
   } else {
-    SetLineWidth(form_fill_env_.Get(), field_name_, form_control_index_,
-                 pRuntime->ToInt32Reentrant(vp));
+    SetLineWidth(form_fill_env_.Get(), field_name_, form_control_index_, value);
   }
   return CJS_Result::Success();
 }
@@ -1712,10 +1734,15 @@
   if (FieldArray.empty()) {
     return CJS_Result::Failure(JSMessage::kBadObjectError);
   }
-
   if (!can_set_) {
     return CJS_Result::Failure(JSMessage::kReadOnlyError);
   }
+  const bool value = pRuntime->ToBooleanReentrant(vp);
+
+  // Check if still exists following JS re-entrancy.
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
+  }
 
   for (CPDF_FormField* pFormField : FieldArray) {
     if (form_control_index_ < 0) {
@@ -1724,23 +1751,20 @@
         if (CPDFSDK_Widget* pWidget =
                 pForm->GetWidget(pFormField->GetControl(i))) {
           uint32_t dwFlags = pWidget->GetFlags();
-          if (pRuntime->ToBooleanReentrant(vp)) {
+          if (value) {
             dwFlags |= pdfium::annotation_flags::kPrint;
           } else {
             dwFlags &= ~pdfium::annotation_flags::kPrint;
           }
-
           if (dwFlags != pWidget->GetFlags()) {
             pWidget->SetFlags(dwFlags);
             bSet = true;
           }
         }
       }
-
       if (bSet) {
         UpdateFormField(form_fill_env_.Get(), pFormField, false);
       }
-
       continue;
     }
 
@@ -1752,12 +1776,11 @@
             pFormField->GetControl(form_control_index_)) {
       if (CPDFSDK_Widget* pWidget = pForm->GetWidget(pFormControl)) {
         uint32_t dwFlags = pWidget->GetFlags();
-        if (pRuntime->ToBooleanReentrant(vp)) {
+        if (value) {
           dwFlags |= pdfium::annotation_flags::kPrint;
         } else {
           dwFlags &= ~pdfium::annotation_flags::kPrint;
         }
-
         if (dwFlags != pWidget->GetFlags()) {
           pWidget->SetFlags(dwFlags);
           UpdateFormControl(form_fill_env_.Get(),
@@ -1877,6 +1900,11 @@
   float f3 = static_cast<float>(pRuntime->ToInt32Reentrant(
       pRuntime->GetArrayElementReentrant(rcArray, 3)));
 
+  // Check if still exists following JS re-entrancy.
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
+  }
+
   CFX_FloatRect crRect(f0, f1, f2, f3);
   if (delay_) {
     AddDelay_Rect(FP_RECT, crRect);
@@ -2321,6 +2349,11 @@
     strArray.push_back(pRuntime->ToWideStringReentrant(vp));
   }
 
+  // Check if still exists following JS re-entrancy.
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
+  }
+
   if (delay_) {
     AddDelay_WideStringArray(FP_VALUE, strArray);
   } else {
@@ -2499,6 +2532,11 @@
     bCheckit = pRuntime->ToBooleanReentrant(params[1]);
   }
 
+  // Check if still exists following JS re-entrancy.
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
+  }
+
   CPDF_FormField* pFormField = GetFirstFormField();
   if (!pFormField) {
     return CJS_Result::Failure(JSMessage::kBadObjectError);