BASELINE: Update Chromium to 78.0.3904.130

Change-Id: If185e0c0061b3437531c97c9c8c78f239352a68b Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
author: Allan Sandfeld Jensen <allan.jensen@qt.io> 2020-01-20 13:40:20 +0100
committer: Allan Sandfeld Jensen <allan.jensen@qt.io> 2020-01-22 12:41:23 +0000
commit: 7961cea6d1041e3e454dae6a1da660b453efd238 (patch)
tree: c0eeb4a9ff9ba32986289c1653d9608e53ccb444 /chromium/third_party/pdfium
parent: b7034d0803538058e5c9d904ef03cf5eab34f6ef (diff)
download: qtwebengine-chromium-7961cea6d1041e3e454dae6a1da660b453efd238.tar.gz
429 files changed, 5883 insertions, 5259 deletions
diff --git a/chromium/third_party/pdfium/AUTHORS b/chromium/third_party/pdfium/AUTHORS
index 8fe2b46c2fa..3c972371313 100644
--- a/chromium/third_party/pdfium/AUTHORS
+++ b/chromium/third_party/pdfium/AUTHORS
@@ -20,6 +20,7 @@ Felix Kauselmann <licorn@gmail.com>
 Finnur Thorarinsson <finnur@chromium.org>
 GiWan Go <gogil@stealien.com>
 Henrique Nakashima <hnakashima@chromium.org>
+Huy Ngo <huyna89@gmail.com>
 Jiang Jiang <jiangj@opera.com>
 Jochen Eisinger <jochen@chromium.org>
 John Abd-El-Malek <jam@chromium.org>
@@ -32,6 +33,7 @@ Luật Nguyễn <manhluat93.php@gmail.com>
 Matt Giuca <mgiuca@chromium.org>
 Michael Doppler <m.doppler@gmail.com>
 Miklos Vajna <vmiklos@vmiklos.hu>
+Minh Trần <myoki.crystal@gmail.com>
 Nico Weber <thakis@chromium.org>
 Nicolás Peña <npm@chromium.org>
 Peter Kasting <pkasting@chromium.org>
diff --git a/chromium/third_party/pdfium/BUILD.gn b/chromium/third_party/pdfium/BUILD.gn
index 91a2ccbaf69..3ce1e086348 100644
--- a/chromium/third_party/pdfium/BUILD.gn
+++ b/chromium/third_party/pdfium/BUILD.gn
@@ -120,6 +120,7 @@ jumbo_source_set("pdfium_public_headers_impl") {
     "public/fpdf_flatten.h",
     "public/fpdf_formfill.h",
     "public/fpdf_fwlevent.h",
+    "public/fpdf_javascript.h",
     "public/fpdf_ppo.h",
     "public/fpdf_progressive.h",
     "public/fpdf_save.h",
@@ -149,7 +150,6 @@ jumbo_component("pdfium") {
 
   deps = [
     "constants",
-    "core/fpdfapi",
     "core/fpdfapi/page",
     "core/fpdfapi/parser",
     "core/fpdfdoc",
diff --git a/chromium/third_party/pdfium/DEPS b/chromium/third_party/pdfium/DEPS
index 54964bccaa7..205022f8ad3 100644
--- a/chromium/third_party/pdfium/DEPS
+++ b/chromium/third_party/pdfium/DEPS
@@ -14,29 +14,26 @@ vars = {
 
   'android_ndk_revision': '4e2cea441bfd43f0863d14f57b1e1844260b9884',
   'binutils_revision': '92bfa0a5dcee9dc01173e39e5bff226b09af0254',
-  'build_revision': '95a2cff8feeab9d3ea06f7be01e29d8730c7d456',
-  'buildtools_revision': '95c72f350fed4d9bc1929c65d0ca0e5f28615322',
-  'catapult_revision': '123c46068daa0b5660f02168df9b76a2a255ef71',
-  'clang_revision': '7cefad2f8f24c452fc25a43360e97c84745406ef',
+  'build_revision': 'e7232efebc1d3d8f23f8509fd4262a19d05e012f',
+  'buildtools_revision': 'aeda9c123d0d6811bcca4fa6703012f2f682941f',
+  'catapult_revision': '2861f86d3c5a1dc98d49be0c4e91105600896b52',
+  'clang_revision': '8215b086137d5de08cd573955799a24cd40b4f1f',
   'code_coverage_revision': 'b53d904eb74afb18f4ddc27db4f75552b1237514',
-  'depot_tools_revision': '3b07526aec5572513374e26191e83d367a6e1f7b',
-  'freetype_revision': 'b110acba9e6f7e40314f0da5d249cb3cb3beeab8',
-  'gtest_revision': 'd7003576dd133856432e2e07340f45926242cc3a',
-  'icu_revision': 'fd97d4326fac6da84452b2d5fe75ff0949368dab',
-  'instrumented_lib_revision': 'a959e4f0cb643003f2d75d179cede449979e3e77',
+  'depot_tools_revision': '59bb8cce842ce937f07064f64f18a6f9192110de',
+  'freetype_revision': '543a3b939df50e02e52b948f4c9c8ba63bf38059',
+  'gtest_revision': 'a45c24ac1878932e0dc5fbc0d78a699befd386d3',
+  'icu_revision': '682a230923933a7157a41b88c7804b6b7d2abdfa',
+  'instrumented_lib_revision': 'b1c3ca20848c117eb935b02c25d441f03e6fbc5e',
   'jinja2_revision': '45571de473282bd1d8b63a8dfcb1fd268d0635d2',
-  'jpeg_turbo_revision': 'e1669e3707c6448a01c8a0dc3e4b20976a4dacf3',
+  'jpeg_turbo_revision': '81aef9014e059f9bf4838db49ba4fd47fd9d14ce',
   'markupsafe_revision': '8f45f5cfa0009d2a70589bcda0349b8cb2b72783',
   'pdfium_tests_revision': '02dd653ec62649b6f1aa4e4526071cc32d903f54',
   'skia_revision': '8590026dbf0d22291c8c42ed0eddb73d66da446d',
   'tools_memory_revision': 'f7b00daf4df7f6c469f5fbc68d7f40f6bd15d6e6',
   'trace_event_revision': 'cfe8887fa6ac3170e23a68949930e28d4705a16f',
-  'v8_revision': 'b6dda94d79dd9d7e5fe7b07b3a9b2b83c655896d',
+  'v8_revision': '33faa512cb633005dd8e13a91ca4fb12033ba376',
   'yasm_source_revision': '720b70524a4424b15fc57e82263568c8ba0496ad',
-  'zlib_revision': 'abd51836c6dad6c460d236fff70f28cc578a1336',
-
-  # GN CIPD package version.
-  'gn_version': 'git_revision:0790d3043387c762a6bacb1ae0a9ebe883188ab2',
+  'zlib_revision': '2b4888a46ae73eb1261efc924ac13fe2faa6c480',
 }
 
 deps = {
@@ -51,39 +48,6 @@ deps = {
     Var('chromium_git') + "/chromium/src/buildtools.git@" +
         Var('buildtools_revision'),
 
-  'pdfium/buildtools/linux64': {
-    'packages': [
-      {
-        'package': 'gn/gn/linux-amd64',
-        'version': Var('gn_version'),
-      }
-    ],
-    'dep_type': 'cipd',
-    'condition': 'host_os == "linux"',
-  },
-
-  'pdfium/buildtools/mac': {
-    'packages': [
-      {
-        'package': 'gn/gn/mac-amd64',
-        'version': Var('gn_version'),
-      }
-    ],
-    'dep_type': 'cipd',
-    'condition': 'host_os == "mac"',
-  },
-
-  'pdfium/buildtools/win': {
-    'packages': [
-      {
-        'package': 'gn/gn/windows-amd64',
-        'version': Var('gn_version'),
-      }
-    ],
-    'dep_type': 'cipd',
-    'condition': 'host_os == "win"',
-  },
-
   "testing/corpus":
     Var('pdfium_git') + "/pdfium_tests@" + Var('pdfium_tests_revision'),
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/BUILD.gn b/chromium/third_party/pdfium/core/fpdfapi/BUILD.gn
deleted file mode 100644
index 3f947dd0e03..00000000000
--- a/chromium/third_party/pdfium/core/fpdfapi/BUILD.gn
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2018 The PDFium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//build/config/jumbo.gni")
-import("../../pdfium.gni")
-
-jumbo_source_set("fpdfapi") {
-  sources = [
-    "cpdf_modulemgr.cpp",
-    "cpdf_modulemgr.h",
-  ]
-  configs += [ "../../:pdfium_core_config" ]
-  deps = [
-    "../fxcodec",
-    "../fxcrt",
-    "../fxge",
-    "cmaps",
-    "edit",
-    "font",
-    "page",
-    "parser",
-    "render",
-  ]
-  visibility = [ "../../*" ]
-}
diff --git a/chromium/third_party/pdfium/core/fpdfapi/cpdf_modulemgr.cpp b/chromium/third_party/pdfium/core/fpdfapi/cpdf_modulemgr.cpp
deleted file mode 100644
index 3987f698188..00000000000
--- a/chromium/third_party/pdfium/core/fpdfapi/cpdf_modulemgr.cpp
+++ /dev/null
@@ -1,91 +0,0 @@
-// Copyright 2014 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#include "core/fpdfapi/cpdf_modulemgr.h"
-
-#include "core/fpdfapi/cmaps/CNS1/cmaps_cns1.h"
-#include "core/fpdfapi/cmaps/GB1/cmaps_gb1.h"
-#include "core/fpdfapi/cmaps/Japan1/cmaps_japan1.h"
-#include "core/fpdfapi/cmaps/Korea1/cmaps_korea1.h"
-#include "core/fpdfapi/font/cpdf_fontglobals.h"
-#include "core/fpdfapi/page/cpdf_pagemodule.h"
-#include "core/fxcodec/fx_codec.h"
-#include "third_party/base/ptr_util.h"
-
-namespace {
-
-CPDF_ModuleMgr* g_pDefaultMgr = nullptr;
-
-}  // namespace
-
-// static
-void CPDF_ModuleMgr::Create() {
-  ASSERT(!g_pDefaultMgr);
-  g_pDefaultMgr = new CPDF_ModuleMgr;
-  fxcodec::ModuleMgr::Create();
-  CPDF_PageModule::Create();
-  g_pDefaultMgr->LoadEmbeddedMaps();
-}
-
-// static
-void CPDF_ModuleMgr::Destroy() {
-  ASSERT(g_pDefaultMgr);
-  CPDF_PageModule::Destroy();
-  fxcodec::ModuleMgr::Destroy();
-  delete g_pDefaultMgr;
-  g_pDefaultMgr = nullptr;
-}
-
-// static
-CPDF_ModuleMgr* CPDF_ModuleMgr::Get() {
-  ASSERT(g_pDefaultMgr);
-  return g_pDefaultMgr;
-}
-
-CPDF_ModuleMgr::CPDF_ModuleMgr() = default;
-
-CPDF_ModuleMgr::~CPDF_ModuleMgr() = default;
-
-void CPDF_ModuleMgr::LoadEmbeddedMaps() {
-  LoadEmbeddedGB1CMaps();
-  LoadEmbeddedCNS1CMaps();
-  LoadEmbeddedJapan1CMaps();
-  LoadEmbeddedKorea1CMaps();
-}
-
-void CPDF_ModuleMgr::LoadEmbeddedGB1CMaps() {
-  auto* pFontGlobals = CPDF_FontGlobals::GetInstance();
-  pFontGlobals->SetEmbeddedCharset(
-      CIDSET_GB1,
-      pdfium::make_span(g_FXCMAP_GB1_cmaps, g_FXCMAP_GB1_cmaps_size));
-  pFontGlobals->SetEmbeddedToUnicode(CIDSET_GB1, g_FXCMAP_GB1CID2Unicode_5);
-}
-
-void CPDF_ModuleMgr::LoadEmbeddedCNS1CMaps() {
-  auto* pFontGlobals = CPDF_FontGlobals::GetInstance();
-  pFontGlobals->SetEmbeddedCharset(
-      CIDSET_CNS1,
-      pdfium::make_span(g_FXCMAP_CNS1_cmaps, g_FXCMAP_CNS1_cmaps_size));
-  pFontGlobals->SetEmbeddedToUnicode(CIDSET_CNS1, g_FXCMAP_CNS1CID2Unicode_5);
-}
-
-void CPDF_ModuleMgr::LoadEmbeddedJapan1CMaps() {
-  auto* pFontGlobals = CPDF_FontGlobals::GetInstance();
-  pFontGlobals->SetEmbeddedCharset(
-      CIDSET_JAPAN1,
-      pdfium::make_span(g_FXCMAP_Japan1_cmaps, g_FXCMAP_Japan1_cmaps_size));
-  pFontGlobals->SetEmbeddedToUnicode(CIDSET_JAPAN1,
-                                     g_FXCMAP_Japan1CID2Unicode_4);
-}
-
-void CPDF_ModuleMgr::LoadEmbeddedKorea1CMaps() {
-  auto* pFontGlobals = CPDF_FontGlobals::GetInstance();
-  pFontGlobals->SetEmbeddedCharset(
-      CIDSET_KOREA1,
-      pdfium::make_span(g_FXCMAP_Korea1_cmaps, g_FXCMAP_Korea1_cmaps_size));
-  pFontGlobals->SetEmbeddedToUnicode(CIDSET_KOREA1,
-                                     g_FXCMAP_Korea1CID2Unicode_2);
-}
diff --git a/chromium/third_party/pdfium/core/fpdfapi/cpdf_modulemgr.h b/chromium/third_party/pdfium/core/fpdfapi/cpdf_modulemgr.h
deleted file mode 100644
index 7bda93b3039..00000000000
--- a/chromium/third_party/pdfium/core/fpdfapi/cpdf_modulemgr.h
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright 2016 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef CORE_FPDFAPI_CPDF_MODULEMGR_H_
-#define CORE_FPDFAPI_CPDF_MODULEMGR_H_
-
-#include <memory>
-#include <utility>
-
-namespace fpdfapi {
-
-class UnsupportedInfoAdapter {
- public:
-  explicit UnsupportedInfoAdapter(void* info) : m_info(info) {}
-
-  void* info() const { return m_info; }
-
- private:
-  void* const m_info;
-};
-
-}  // namespace fpdfapi
-
-class CPDF_ModuleMgr {
- public:
-  static void Create();
-  static void Destroy();
-  static CPDF_ModuleMgr* Get();
-
-  void SetUnsupportInfoAdapter(
-      std::unique_ptr<fpdfapi::UnsupportedInfoAdapter> pAdapter) {
-    m_pUnsupportInfoAdapter = std::move(pAdapter);
-  }
-  fpdfapi::UnsupportedInfoAdapter* GetUnsupportInfoAdapter() const {
-    return m_pUnsupportInfoAdapter.get();
-  }
-
- private:
-  CPDF_ModuleMgr();
-  ~CPDF_ModuleMgr();
-
-  void InitPageModule();
-  void LoadEmbeddedMaps();
-  void LoadEmbeddedGB1CMaps();
-  void LoadEmbeddedCNS1CMaps();
-  void LoadEmbeddedJapan1CMaps();
-  void LoadEmbeddedKorea1CMaps();
-
-  std::unique_ptr<fpdfapi::UnsupportedInfoAdapter> m_pUnsupportInfoAdapter;
-};
-
-#endif  // CORE_FPDFAPI_CPDF_MODULEMGR_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/edit/BUILD.gn b/chromium/third_party/pdfium/core/fpdfapi/edit/BUILD.gn
index 25dd6630881..f4d70c1d332 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/edit/BUILD.gn
+++ b/chromium/third_party/pdfium/core/fpdfapi/edit/BUILD.gn
@@ -38,7 +38,6 @@ pdfium_unittest_source_set("unittests") {
   ]
   deps = [
     ":edit",
-    "../",
     "../../fxge",
     "../font",
     "../page",
diff --git a/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_creator.cpp b/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_creator.cpp
index 11c0f2d089b..00936a365a5 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_creator.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_creator.cpp
@@ -232,7 +232,7 @@ CPDF_Creator::Stage CPDF_Creator::WriteDoc_Stage1() {
       m_IsIncremental = false;
 
     const CPDF_Dictionary* pDict = m_pDocument->GetRoot();
-    m_pMetadata = pDict ? pDict->GetDirectObjectFor("Metadata") : nullptr;
+    m_pMetadata.Reset(pDict ? pDict->GetDirectObjectFor("Metadata") : nullptr);
     m_iStage = Stage::kWriteHeader10;
   }
   if (m_iStage == Stage::kWriteHeader10) {
@@ -619,7 +619,7 @@ void CPDF_Creator::InitID() {
     ASSERT(m_pParser);
     if (m_pEncryptDict->GetStringFor("Filter") == "Standard") {
       m_pNewEncryptDict = ToDictionary(m_pEncryptDict->Clone());
-      m_pEncryptDict = m_pNewEncryptDict.Get();
+      m_pEncryptDict = m_pNewEncryptDict;
       m_pSecurityHandler = pdfium::MakeRetain<CPDF_SecurityHandler>();
       m_pSecurityHandler->OnCreate(m_pNewEncryptDict.Get(), m_pIDArray.Get(),
                                    m_pParser->GetPassword());
diff --git a/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_creator.h b/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_creator.h
index 9399dba0df5..d85d8cf9885 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_creator.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_creator.h
@@ -74,10 +74,10 @@ class CPDF_Creator {
 
   UnownedPtr<CPDF_Document> const m_pDocument;
   UnownedPtr<const CPDF_Parser> const m_pParser;
-  UnownedPtr<const CPDF_Dictionary> m_pEncryptDict;
+  RetainPtr<const CPDF_Dictionary> m_pEncryptDict;
   RetainPtr<CPDF_Dictionary> m_pNewEncryptDict;
   RetainPtr<CPDF_SecurityHandler> m_pSecurityHandler;
-  UnownedPtr<const CPDF_Object> m_pMetadata;
+  RetainPtr<const CPDF_Object> m_pMetadata;
   uint32_t m_dwLastObjNum;
   std::unique_ptr<IFX_ArchiveStream> m_Archive;
   FX_FILESIZE m_SavedOffset = 0;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp b/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp
index 16676fe5bae..c804c0529af 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp
@@ -494,12 +494,12 @@ void CPDF_PageContentGenerator::ProcessText(std::ostringstream* buf,
                                             CPDF_TextObject* pTextObj) {
   ProcessGraphics(buf, pTextObj);
   *buf << "BT " << pTextObj->GetTextMatrix() << " Tm ";
-  CPDF_Font* pFont = pTextObj->GetFont();
+  RetainPtr<CPDF_Font> pFont(pTextObj->GetFont());
   if (!pFont)
     pFont = CPDF_Font::GetStockFont(m_pDocument.Get(), "Helvetica");
 
   FontData data;
-  CPDF_FontEncoding* pEncoding = nullptr;
+  const CPDF_FontEncoding* pEncoding = nullptr;
   if (pFont->IsType1Font()) {
     data.type = "Type1";
     pEncoding = pFont->AsType1Font()->GetEncoding();
@@ -511,7 +511,7 @@ void CPDF_PageContentGenerator::ProcessText(std::ostringstream* buf,
   } else {
     return;
   }
-  data.baseFont = pFont->GetBaseFont();
+  data.baseFont = pFont->GetBaseFontName();
   auto it = m_pObjHolder->m_FontsMap.find(data);
   ByteString dictName;
   if (it != m_pObjHolder->m_FontsMap.end()) {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_pagecontentgenerator_unittest.cpp b/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_pagecontentgenerator_unittest.cpp
index d997420df4d..b2619f08613 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_pagecontentgenerator_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/edit/cpdf_pagecontentgenerator_unittest.cpp
@@ -7,12 +7,12 @@
 #include <memory>
 #include <utility>
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/page/cpdf_colorspace.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
 #include "core/fpdfapi/page/cpdf_form.h"
 #include "core/fpdfapi/page/cpdf_page.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "core/fpdfapi/page/cpdf_pathobject.h"
 #include "core/fpdfapi/page/cpdf_textobject.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
@@ -28,8 +28,8 @@
 
 class CPDF_PageContentGeneratorTest : public testing::Test {
  protected:
-  void SetUp() override { CPDF_ModuleMgr::Create(); }
-  void TearDown() override { CPDF_ModuleMgr::Destroy(); }
+  void SetUp() override { CPDF_PageModule::Create(); }
+  void TearDown() override { CPDF_PageModule::Destroy(); }
 
   void TestProcessPath(CPDF_PageContentGenerator* pGen,
                        std::ostringstream* buf,
@@ -247,9 +247,11 @@ TEST_F(CPDF_PageContentGeneratorTest, ProcessStandardText) {
   auto pTestPage = pdfium::MakeRetain<CPDF_Page>(pDoc.get(), pPageDict);
   CPDF_PageContentGenerator generator(pTestPage.Get());
   auto pTextObj = pdfium::MakeUnique<CPDF_TextObject>();
-  CPDF_Font* pFont = CPDF_Font::GetStockFont(pDoc.get(), "Times-Roman");
+  RetainPtr<CPDF_Font> pFont =
+      CPDF_Font::GetStockFont(pDoc.get(), "Times-Roman");
   pTextObj->m_TextState.SetFont(pFont);
   pTextObj->m_TextState.SetFontSize(10.0f);
+
   static const std::vector<float> rgb = {0.5f, 0.7f, 0.35f};
   RetainPtr<CPDF_ColorSpace> pCS = CPDF_ColorSpace::GetStockCS(PDFCS_DEVICERGB);
   pTextObj->m_ColorState.SetFillColor(pCS, rgb);
@@ -320,18 +322,19 @@ TEST_F(CPDF_PageContentGeneratorTest, ProcessText) {
     CPDF_Dictionary* pDict = pDoc->NewIndirect<CPDF_Dictionary>();
     pDict->SetNewFor<CPDF_Name>("Type", "Font");
     pDict->SetNewFor<CPDF_Name>("Subtype", "TrueType");
-    CPDF_Font* pFont = CPDF_Font::GetStockFont(pDoc.get(), "Arial");
-    pDict->SetNewFor<CPDF_Name>("BaseFont", pFont->GetBaseFont());
+
+    RetainPtr<CPDF_Font> pFont = CPDF_Font::GetStockFont(pDoc.get(), "Arial");
+    pDict->SetNewFor<CPDF_Name>("BaseFont", pFont->GetBaseFontName());
 
     CPDF_Dictionary* pDesc = pDoc->NewIndirect<CPDF_Dictionary>();
     pDesc->SetNewFor<CPDF_Name>("Type", "FontDescriptor");
-    pDesc->SetNewFor<CPDF_Name>("FontName", pFont->GetBaseFont());
+    pDesc->SetNewFor<CPDF_Name>("FontName", pFont->GetBaseFontName());
     pDict->SetNewFor<CPDF_Reference>("FontDescriptor", pDoc.get(),
                                      pDesc->GetObjNum());
 
-    CPDF_Font* loadedFont =
+    RetainPtr<CPDF_Font> pLoadedFont =
         CPDF_DocPageData::FromDocument(pDoc.get())->GetFont(pDict);
-    pTextObj->m_TextState.SetFont(loadedFont);
+    pTextObj->m_TextState.SetFont(pLoadedFont);
     pTextObj->m_TextState.SetFontSize(15.5f);
     pTextObj->SetText("I am indirect");
     TestProcessText(&generator, &buf, pTextObj.get());
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/BUILD.gn b/chromium/third_party/pdfium/core/fpdfapi/font/BUILD.gn
index a649460b959..673f34293ce 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/BUILD.gn
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/BUILD.gn
@@ -62,7 +62,6 @@ pdfium_unittest_source_set("unittests") {
   ]
   deps = [
     ":font",
-    "../../fpdfapi",
     "../page",
     "../parser",
     "../render",
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cfx_stockfontarray.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cfx_stockfontarray.cpp
index 235f38c82cf..a8d8597aeb0 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cfx_stockfontarray.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cfx_stockfontarray.cpp
@@ -24,17 +24,16 @@ CFX_StockFontArray::~CFX_StockFontArray() {
   }
 }
 
-CPDF_Font* CFX_StockFontArray::GetFont(
+RetainPtr<CPDF_Font> CFX_StockFontArray::GetFont(
     CFX_FontMapper::StandardFont index) const {
-  if (index >= FX_ArraySize(m_StockFonts))
-    return nullptr;
-  return m_StockFonts[index].get();
+  if (index < FX_ArraySize(m_StockFonts))
+    return m_StockFonts[index];
+  NOTREACHED();
+  return nullptr;
 }
 
-CPDF_Font* CFX_StockFontArray::SetFont(CFX_FontMapper::StandardFont index,
-                                       std::unique_ptr<CPDF_Font> pFont) {
-  CPDF_Font* result = pFont.get();
+void CFX_StockFontArray::SetFont(CFX_FontMapper::StandardFont index,
+                                 const RetainPtr<CPDF_Font>& pFont) {
   if (index < FX_ArraySize(m_StockFonts))
-    m_StockFonts[index] = std::move(pFont);
-  return result;
+    m_StockFonts[index] = pFont;
 }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cfx_stockfontarray.h b/chromium/third_party/pdfium/core/fpdfapi/font/cfx_stockfontarray.h
index d5a873921d2..5e5470430a8 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cfx_stockfontarray.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cfx_stockfontarray.h
@@ -9,6 +9,7 @@
 
 #include <memory>
 
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxge/cfx_fontmapper.h"
 
 class CPDF_Font;
@@ -18,13 +19,12 @@ class CFX_StockFontArray {
   CFX_StockFontArray();
   ~CFX_StockFontArray();
 
-  // Takes ownership of |pFont|, returns unowned pointer to it.
-  CPDF_Font* SetFont(CFX_FontMapper::StandardFont index,
-                     std::unique_ptr<CPDF_Font> pFont);
-  CPDF_Font* GetFont(CFX_FontMapper::StandardFont index) const;
+  RetainPtr<CPDF_Font> GetFont(CFX_FontMapper::StandardFont index) const;
+  void SetFont(CFX_FontMapper::StandardFont index,
+               const RetainPtr<CPDF_Font>& pFont);
 
  private:
-  std::unique_ptr<CPDF_Font> m_StockFonts[14];
+  RetainPtr<CPDF_Font> m_StockFonts[14];
 };
 
 #endif  // CORE_FPDFAPI_FONT_CFX_STOCKFONTARRAY_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cid2unicodemap.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cid2unicodemap.cpp
index 612881f0f3c..abb23ac5987 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cid2unicodemap.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cid2unicodemap.cpp
@@ -6,10 +6,12 @@
 
 #include "core/fpdfapi/font/cpdf_cid2unicodemap.h"
 
-#include "core/fpdfapi/font/cpdf_cmapmanager.h"
 #include "core/fpdfapi/font/cpdf_fontglobals.h"
 
-CPDF_CID2UnicodeMap::CPDF_CID2UnicodeMap() = default;
+CPDF_CID2UnicodeMap::CPDF_CID2UnicodeMap(CIDSet charset)
+    : m_Charset(charset),
+      m_pEmbeddedMap(
+          CPDF_FontGlobals::GetInstance()->GetEmbeddedToUnicode(m_Charset)) {}
 
 CPDF_CID2UnicodeMap::~CPDF_CID2UnicodeMap() = default;
 
@@ -17,18 +19,8 @@ bool CPDF_CID2UnicodeMap::IsLoaded() const {
   return !m_pEmbeddedMap.empty();
 }
 
-wchar_t CPDF_CID2UnicodeMap::UnicodeFromCID(uint16_t CID) const {
+wchar_t CPDF_CID2UnicodeMap::UnicodeFromCID(uint16_t cid) const {
   if (m_Charset == CIDSET_UNICODE)
-    return CID;
-
-  if (CID < m_pEmbeddedMap.size())
-    return m_pEmbeddedMap[CID];
-
-  return 0;
-}
-
-void CPDF_CID2UnicodeMap::Load(CPDF_CMapManager* pMgr, CIDSet charset) {
-  m_Charset = charset;
-  m_pEmbeddedMap =
-      CPDF_FontGlobals::GetInstance()->GetEmbeddedToUnicode(charset);
+    return cid;
+  return cid < m_pEmbeddedMap.size() ? m_pEmbeddedMap[cid] : 0;
 }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cid2unicodemap.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cid2unicodemap.h
index 16467f31a77..e556917fd85 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cid2unicodemap.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cid2unicodemap.h
@@ -10,20 +10,17 @@
 #include "core/fpdfapi/font/cpdf_cidfont.h"
 #include "third_party/base/span.h"
 
-class CPDF_CMapManager;
-
 class CPDF_CID2UnicodeMap {
  public:
-  CPDF_CID2UnicodeMap();
+  explicit CPDF_CID2UnicodeMap(CIDSet charset);
   ~CPDF_CID2UnicodeMap();
 
   bool IsLoaded() const;
-  wchar_t UnicodeFromCID(uint16_t CID) const;
-  void Load(CPDF_CMapManager* pMgr, CIDSet charset);
+  wchar_t UnicodeFromCID(uint16_t cid) const;
 
  private:
-  CIDSet m_Charset;
-  pdfium::span<const uint16_t> m_pEmbeddedMap;
+  const CIDSet m_Charset;
+  const pdfium::span<const uint16_t> m_pEmbeddedMap;
 };
 
 #endif  // CORE_FPDFAPI_FONT_CPDF_CID2UNICODEMAP_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont.cpp
index 3aaad30f1bc..6a9e4fcce90 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont.cpp
@@ -337,11 +337,11 @@ bool CPDF_CIDFont::Load() {
   if (!pCIDFontDict)
     return false;
 
-  m_BaseFont = pCIDFontDict->GetStringFor("BaseFont");
-  if ((m_BaseFont.Compare("CourierStd") == 0 ||
-       m_BaseFont.Compare("CourierStd-Bold") == 0 ||
-       m_BaseFont.Compare("CourierStd-BoldOblique") == 0 ||
-       m_BaseFont.Compare("CourierStd-Oblique") == 0) &&
+  m_BaseFontName = pCIDFontDict->GetStringFor("BaseFont");
+  if ((m_BaseFontName.Compare("CourierStd") == 0 ||
+       m_BaseFontName.Compare("CourierStd-Bold") == 0 ||
+       m_BaseFontName.Compare("CourierStd-BoldOblique") == 0 ||
+       m_BaseFontName.Compare("CourierStd-Oblique") == 0) &&
       !IsEmbedded()) {
     m_bAdobeCourierStd = true;
   }
@@ -360,13 +360,10 @@ bool CPDF_CIDFont::Load() {
   if (pEncoding->IsName()) {
     ByteString cmap = pEncoding->GetString();
     m_pCMap = manager->GetPredefinedCMap(cmap);
-    if (!m_pCMap)
-      return false;
   } else if (CPDF_Stream* pStream = pEncoding->AsStream()) {
     auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
     pAcc->LoadAllDataFiltered();
-    m_pCMap = pdfium::MakeRetain<CPDF_CMap>();
-    m_pCMap->LoadEmbedded(pAcc->GetSpan());
+    m_pCMap = pdfium::MakeRetain<CPDF_CMap>(pAcc->GetSpan());
   } else {
     return false;
   }
@@ -756,7 +753,7 @@ bool CPDF_CIDFont::IsUnicodeCompatible() const {
 void CPDF_CIDFont::LoadSubstFont() {
   pdfium::base::CheckedNumeric<int> safeStemV(m_StemV);
   safeStemV *= 5;
-  m_Font.LoadSubst(m_BaseFont, !m_bType1, m_Flags,
+  m_Font.LoadSubst(m_BaseFontName, !m_bType1, m_Flags,
                    safeStemV.ValueOrDefault(FXFONT_FW_NORMAL), m_ItalicAngle,
                    g_CharsetCPs[m_Charset], IsVertWriting());
 }
@@ -818,7 +815,7 @@ float CPDF_CIDFont::CIDTransformToFloat(uint8_t ch) {
 }
 
 void CPDF_CIDFont::LoadGB2312() {
-  m_BaseFont = m_pFontDict->GetStringFor("BaseFont");
+  m_BaseFontName = m_pFontDict->GetStringFor("BaseFont");
   const CPDF_Dictionary* pFontDesc = m_pFontDict->GetDictFor("FontDescriptor");
   if (pFontDesc)
     LoadFontDescriptor(pFontDesc);
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont.h
index e40085909b3..ce00e1dd3f7 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont.h
@@ -34,7 +34,9 @@ class CPDF_StreamAcc;
 
 class CPDF_CIDFont final : public CPDF_Font {
  public:
-  CPDF_CIDFont(CPDF_Document* pDocument, CPDF_Dictionary* pFontDict);
+  template <typename T, typename... Args>
+  friend RetainPtr<T> pdfium::MakeRetain(Args&&... args);
+
   ~CPDF_CIDFont() override;
 
   static float CIDTransformToFloat(uint8_t ch);
@@ -62,6 +64,8 @@ class CPDF_CIDFont final : public CPDF_Font {
   int GetCharSize(uint32_t charcode) const;
 
  private:
+  CPDF_CIDFont(CPDF_Document* pDocument, CPDF_Dictionary* pFontDict);
+
   void LoadGB2312();
   int GetGlyphIndex(uint32_t unicodeb, bool* pVertGlyph);
   int GetVerticalGlyph(int index, bool* pVertGlyph);
@@ -71,7 +75,7 @@ class CPDF_CIDFont final : public CPDF_Font {
   void LoadSubstFont();
   wchar_t GetUnicodeFromCharCode(uint32_t charcode) const;
 
-  RetainPtr<CPDF_CMap> m_pCMap;
+  RetainPtr<const CPDF_CMap> m_pCMap;
   UnownedPtr<const CPDF_CID2UnicodeMap> m_pCID2UnicodeMap;
   RetainPtr<CPDF_StreamAcc> m_pStreamAcc;
   std::unique_ptr<CFX_CTTGSUBTable> m_pTTGSUBTable;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont_unittest.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont_unittest.cpp
index 563ee3097d3..225ea3a1b57 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cidfont_unittest.cpp
@@ -6,8 +6,8 @@
 
 #include <utility>
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
@@ -17,8 +17,8 @@
 
 class CPDF_CIDFontTest : public testing::Test {
  protected:
-  void SetUp() override { CPDF_ModuleMgr::Create(); }
-  void TearDown() override { CPDF_ModuleMgr::Destroy(); }
+  void SetUp() override { CPDF_PageModule::Create(); }
+  void TearDown() override { CPDF_PageModule::Destroy(); }
 };
 
 TEST_F(CPDF_CIDFontTest, BUG_920636) {
@@ -37,8 +37,8 @@ TEST_F(CPDF_CIDFontTest, BUG_920636) {
     font_dict->SetFor("DescendantFonts", std::move(descendant_fonts));
   }
 
-  CPDF_CIDFont font(&doc, font_dict.Get());
-  ASSERT_TRUE(font.Load());
+  auto font = pdfium::MakeRetain<CPDF_CIDFont>(&doc, font_dict.Get());
+  ASSERT_TRUE(font->Load());
 
   // It would be nice if we can test more values here. However, the glyph
   // indices are sometimes machine dependent.
@@ -53,6 +53,6 @@ TEST_F(CPDF_CIDFontTest, BUG_920636) {
 
   for (const auto& test_case : kTestCases) {
     EXPECT_EQ(test_case.glyph,
-              font.GlyphFromCharCode(test_case.charcode, nullptr));
+              font->GlyphFromCharCode(test_case.charcode, nullptr));
   }
 }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmap.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmap.cpp
index 861508446bd..81ee02d3d57 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmap.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmap.cpp
@@ -11,7 +11,6 @@
 #include <vector>
 
 #include "core/fpdfapi/cmaps/cmap_int.h"
-#include "core/fpdfapi/font/cpdf_cmapmanager.h"
 #include "core/fpdfapi/font/cpdf_cmapparser.h"
 #include "core/fpdfapi/font/cpdf_fontglobals.h"
 #include "core/fpdfapi/parser/cpdf_simple_parser.h"
@@ -32,7 +31,7 @@ struct PredefinedCMap {
   ByteRange m_LeadingSegs[2];
 };
 
-const PredefinedCMap g_PredefinedCMaps[] = {
+constexpr PredefinedCMap kPredefinedCMaps[] = {
     {"GB-EUC",
      CIDSET_GB1,
      CIDCODING_GB,
@@ -182,6 +181,27 @@ const PredefinedCMap g_PredefinedCMaps[] = {
     {"UniKS-UTF16", CIDSET_KOREA1, CIDCODING_UTF16, CPDF_CMap::TwoBytes, 0, {}},
 };
 
+const PredefinedCMap* GetPredefinedCMap(const ByteString& bsPredefinedName) {
+  ByteString cmapid = bsPredefinedName;
+  if (cmapid.GetLength() > 2)
+    cmapid = cmapid.Left(cmapid.GetLength() - 2);
+  for (const auto& map : kPredefinedCMaps) {
+    if (cmapid == ByteStringView(map.m_pName))
+      return &map;
+  }
+  return nullptr;
+}
+
+std::vector<bool> LoadLeadingSegments(const PredefinedCMap& map) {
+  std::vector<bool> segments(256);
+  for (uint32_t i = 0; i < map.m_LeadingSegCount; ++i) {
+    const ByteRange& seg = map.m_LeadingSegs[i];
+    for (int b = seg.m_First; b <= seg.m_Last; ++b)
+      segments[b] = true;
+  }
+  return segments;
+}
+
 int CheckFourByteCodeRange(uint8_t* codes,
                            size_t size,
                            const std::vector<CPDF_CMap::CodeRange>& ranges) {
@@ -238,70 +258,44 @@ size_t GetFourByteCharSizeImpl(
 
 }  // namespace
 
-CPDF_CMap::CPDF_CMap()
-    : m_bLoaded(false),
-      m_bVertical(false),
-      m_Charset(CIDSET_UNKNOWN),
-      m_CodingScheme(TwoBytes),
-      m_Coding(CIDCODING_UNKNOWN),
-      m_pEmbedMap(nullptr) {}
-
-CPDF_CMap::~CPDF_CMap() {}
-
-void CPDF_CMap::LoadPredefined(CPDF_CMapManager* pMgr,
-                               const ByteString& bsName) {
-  m_PredefinedCMap = bsName;
-  if (m_PredefinedCMap == "Identity-H" || m_PredefinedCMap == "Identity-V") {
+CPDF_CMap::CPDF_CMap(const ByteString& bsPredefinedName)
+    : m_bVertical(bsPredefinedName.Last() == 'V') {
+  if (bsPredefinedName == "Identity-H" || bsPredefinedName == "Identity-V") {
     m_Coding = CIDCODING_CID;
-    m_bVertical = bsName.Last() == 'V';
     m_bLoaded = true;
     return;
   }
-  ByteString cmapid = m_PredefinedCMap;
-  m_bVertical = cmapid.Last() == 'V';
-  if (cmapid.GetLength() > 2) {
-    cmapid = cmapid.Left(cmapid.GetLength() - 2);
-  }
-  const PredefinedCMap* map = nullptr;
-  for (size_t i = 0; i < FX_ArraySize(g_PredefinedCMaps); ++i) {
-    if (cmapid == ByteStringView(g_PredefinedCMaps[i].m_pName)) {
-      map = &g_PredefinedCMaps[i];
-      break;
-    }
-  }
+
+  const PredefinedCMap* map = GetPredefinedCMap(bsPredefinedName);
   if (!map)
     return;
 
   m_Charset = map->m_Charset;
   m_Coding = map->m_Coding;
   m_CodingScheme = map->m_CodingScheme;
-  if (m_CodingScheme == MixedTwoBytes) {
-    m_MixedTwoByteLeadingBytes = std::vector<bool>(256);
-    for (uint32_t i = 0; i < map->m_LeadingSegCount; ++i) {
-      const ByteRange& seg = map->m_LeadingSegs[i];
-      for (int b = seg.m_First; b <= seg.m_Last; ++b)
-        m_MixedTwoByteLeadingBytes[b] = true;
-    }
-  }
+  if (m_CodingScheme == MixedTwoBytes)
+    m_MixedTwoByteLeadingBytes = LoadLeadingSegments(*map);
   m_pEmbedMap = FindEmbeddedCMap(
-      CPDF_FontGlobals::GetInstance()->GetEmbeddedCharset(m_Charset), bsName);
+      CPDF_FontGlobals::GetInstance()->GetEmbeddedCharset(m_Charset),
+      bsPredefinedName);
   if (!m_pEmbedMap)
     return;
 
   m_bLoaded = true;
 }
 
-void CPDF_CMap::LoadEmbedded(pdfium::span<const uint8_t> data) {
-  m_DirectCharcodeToCIDTable = std::vector<uint16_t>(65536);
+CPDF_CMap::CPDF_CMap(pdfium::span<const uint8_t> spEmbeddedData)
+    : m_DirectCharcodeToCIDTable(65536) {
   CPDF_CMapParser parser(this);
-  CPDF_SimpleParser syntax(data);
+  CPDF_SimpleParser syntax(spEmbeddedData);
   while (1) {
     ByteStringView word = syntax.GetWord();
-    if (word.IsEmpty()) {
+    if (word.IsEmpty())
       break;
-    }
+
     parser.ParseWord(word);
   }
+
   if (m_CodingScheme == MixedFourBytes && parser.HasAdditionalMappings()) {
     m_AdditionalCharcodeToCIDMappings = parser.TakeAdditionalMappings();
     std::sort(
@@ -313,6 +307,8 @@ void CPDF_CMap::LoadEmbedded(pdfium::span<const uint8_t> data) {
   }
 }
 
+CPDF_CMap::~CPDF_CMap() = default;
+
 uint16_t CPDF_CMap::CIDFromCharCode(uint32_t charcode) const {
   if (m_Coding == CIDCODING_CID)
     return static_cast<uint16_t>(charcode);
@@ -479,3 +475,7 @@ int CPDF_CMap::AppendChar(char* str, uint32_t charcode) const {
   }
   return 0;
 }
+
+void CPDF_CMap::SetMixedFourByteLeadingRanges(std::vector<CodeRange> ranges) {
+  m_MixedFourByteLeadingRanges = std::move(ranges);
+}
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmap.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmap.h
index 2c0503a298c..c9dc61f9189 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmap.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmap.h
@@ -13,7 +13,6 @@
 #include "core/fxcrt/retain_ptr.h"
 #include "third_party/base/span.h"
 
-class CPDF_CMapManager;
 struct FXCMAP_CMap;
 
 enum CIDCoding : uint8_t {
@@ -51,9 +50,6 @@ class CPDF_CMap final : public Retainable {
   template <typename T, typename... Args>
   friend RetainPtr<T> pdfium::MakeRetain(Args&&... args);
 
-  void LoadPredefined(CPDF_CMapManager* pMgr, const ByteString& name);
-  void LoadEmbedded(pdfium::span<const uint8_t> data);
-
   bool IsLoaded() const { return m_bLoaded; }
   bool IsVertWriting() const { return m_bVertical; }
 
@@ -66,12 +62,7 @@ class CPDF_CMap final : public Retainable {
 
   void SetVertical(bool vert) { m_bVertical = vert; }
   void SetCodingScheme(CodingScheme scheme) { m_CodingScheme = scheme; }
-  const std::vector<CodeRange>& GetMixedFourByteLeadingRanges() const {
-    return m_MixedFourByteLeadingRanges;
-  }
-  void AppendMixedFourByteLeadingRanges(const CodeRange& range) {
-    m_MixedFourByteLeadingRanges.push_back(range);
-  }
+  void SetMixedFourByteLeadingRanges(std::vector<CodeRange> ranges);
 
   int GetCoding() const { return m_Coding; }
   const FXCMAP_CMap* GetEmbedMap() const { return m_pEmbedMap.Get(); }
@@ -86,15 +77,15 @@ class CPDF_CMap final : public Retainable {
   }
 
  private:
-  CPDF_CMap();
+  explicit CPDF_CMap(const ByteString& bsPredefinedName);
+  explicit CPDF_CMap(pdfium::span<const uint8_t> spEmbeddedData);
   ~CPDF_CMap() override;
 
-  ByteString m_PredefinedCMap;
-  bool m_bLoaded;
-  bool m_bVertical;
-  CIDSet m_Charset;
-  CodingScheme m_CodingScheme;
-  int m_Coding;
+  bool m_bLoaded = false;
+  bool m_bVertical = false;
+  CIDSet m_Charset = CIDSET_UNKNOWN;
+  CodingScheme m_CodingScheme = TwoBytes;
+  int m_Coding = CIDCODING_UNKNOWN;
   std::vector<bool> m_MixedTwoByteLeadingBytes;
   std::vector<CodeRange> m_MixedFourByteLeadingRanges;
   std::vector<uint16_t> m_DirectCharcodeToCIDTable;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapmanager.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapmanager.cpp
index bbf77f59b1f..653af0c7134 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapmanager.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapmanager.cpp
@@ -12,42 +12,37 @@
 #include "core/fpdfapi/font/cpdf_cmap.h"
 #include "third_party/base/ptr_util.h"
 
-CPDF_CMapManager::CPDF_CMapManager() {}
+namespace {
 
-CPDF_CMapManager::~CPDF_CMapManager() {}
+RetainPtr<const CPDF_CMap> LoadPredefinedCMap(ByteString name) {
+  if (!name.IsEmpty() && name[0] == '/')
+    name = name.Right(name.GetLength() - 1);
+  return pdfium::MakeRetain<CPDF_CMap>(name);
+}
+
+}  // namespace
 
-RetainPtr<CPDF_CMap> CPDF_CMapManager::GetPredefinedCMap(
+CPDF_CMapManager::CPDF_CMapManager() = default;
+
+CPDF_CMapManager::~CPDF_CMapManager() = default;
+
+RetainPtr<const CPDF_CMap> CPDF_CMapManager::GetPredefinedCMap(
     const ByteString& name) {
   auto it = m_CMaps.find(name);
   if (it != m_CMaps.end())
     return it->second;
 
-  RetainPtr<CPDF_CMap> pCMap = LoadPredefinedCMap(name);
+  RetainPtr<const CPDF_CMap> pCMap = LoadPredefinedCMap(name);
   if (!name.IsEmpty())
     m_CMaps[name] = pCMap;
 
   return pCMap;
 }
 
-RetainPtr<CPDF_CMap> CPDF_CMapManager::LoadPredefinedCMap(ByteString name) {
-  if (!name.IsEmpty() && name[0] == '/')
-    name = name.Right(name.GetLength() - 1);
-
-  auto pCMap = pdfium::MakeRetain<CPDF_CMap>();
-  pCMap->LoadPredefined(this, name);
-  return pCMap;
-}
-
 CPDF_CID2UnicodeMap* CPDF_CMapManager::GetCID2UnicodeMap(CIDSet charset) {
-  if (!m_CID2UnicodeMaps[charset])
-    m_CID2UnicodeMaps[charset] = LoadCID2UnicodeMap(charset);
-
+  if (!m_CID2UnicodeMaps[charset]) {
+    m_CID2UnicodeMaps[charset] =
+        pdfium::MakeUnique<CPDF_CID2UnicodeMap>(charset);
+  }
   return m_CID2UnicodeMaps[charset].get();
 }
-
-std::unique_ptr<CPDF_CID2UnicodeMap> CPDF_CMapManager::LoadCID2UnicodeMap(
-    CIDSet charset) {
-  auto pMap = pdfium::MakeUnique<CPDF_CID2UnicodeMap>();
-  pMap->Load(this, charset);
-  return pMap;
-}
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapmanager.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapmanager.h
index af61e3fb7e6..bc8d4e947d5 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapmanager.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapmanager.h
@@ -19,15 +19,12 @@ class CPDF_CMapManager {
   CPDF_CMapManager();
   ~CPDF_CMapManager();
 
-  RetainPtr<CPDF_CMap> GetPredefinedCMap(const ByteString& name);
+  RetainPtr<const CPDF_CMap> GetPredefinedCMap(const ByteString& name);
   CPDF_CID2UnicodeMap* GetCID2UnicodeMap(CIDSet charset);
 
  private:
-  RetainPtr<CPDF_CMap> LoadPredefinedCMap(ByteString name);
-  std::unique_ptr<CPDF_CID2UnicodeMap> LoadCID2UnicodeMap(CIDSet charset);
-
-  std::map<ByteString, RetainPtr<CPDF_CMap>> m_CMaps;
-  std::unique_ptr<CPDF_CID2UnicodeMap> m_CID2UnicodeMaps[6];
+  std::map<ByteString, RetainPtr<const CPDF_CMap>> m_CMaps;
+  std::unique_ptr<CPDF_CID2UnicodeMap> m_CID2UnicodeMaps[CIDSET_NUM_SETS];
 };
 
 #endif  // CORE_FPDFAPI_FONT_CPDF_CMAPMANAGER_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser.cpp
index a16d008e3a6..1ef8a7cc5af 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser.cpp
@@ -18,17 +18,6 @@
 
 namespace {
 
-const char* const g_CharsetNames[CIDSET_NUM_SETS] = {nullptr,  "GB1",    "CNS1",
-                                                     "Japan1", "Korea1", "UCS"};
-
-CIDSet CIDSetFromSizeT(size_t index) {
-  if (index >= CIDSET_NUM_SETS) {
-    NOTREACHED();
-    return CIDSET_UNKNOWN;
-  }
-  return static_cast<CIDSet>(index);
-}
-
 ByteStringView CMap_GetString(ByteStringView word) {
   if (word.GetLength() <= 2)
     return ByteStringView();
@@ -37,107 +26,119 @@ ByteStringView CMap_GetString(ByteStringView word) {
 
 }  // namespace
 
-CPDF_CMapParser::CPDF_CMapParser(CPDF_CMap* pCMap)
-    : m_pCMap(pCMap), m_Status(0), m_CodeSeq(0) {}
+CPDF_CMapParser::CPDF_CMapParser(CPDF_CMap* pCMap) : m_pCMap(pCMap) {}
 
-CPDF_CMapParser::~CPDF_CMapParser() {}
+CPDF_CMapParser::~CPDF_CMapParser() {
+  m_pCMap->SetMixedFourByteLeadingRanges(std::move(m_Ranges));
+}
 
 void CPDF_CMapParser::ParseWord(ByteStringView word) {
-  if (word.IsEmpty()) {
-    return;
-  }
+  ASSERT(!word.IsEmpty());
+
   if (word == "begincidchar") {
-    m_Status = 1;
+    m_Status = kProcessingCidChar;
     m_CodeSeq = 0;
   } else if (word == "begincidrange") {
-    m_Status = 2;
+    m_Status = kProcessingCidRange;
     m_CodeSeq = 0;
   } else if (word == "endcidrange" || word == "endcidchar") {
-    m_Status = 0;
+    m_Status = kStart;
   } else if (word == "/WMode") {
-    m_Status = 6;
+    m_Status = kProcessingWMode;
   } else if (word == "/Registry") {
-    m_Status = 3;
+    m_Status = kProcessingRegistry;
   } else if (word == "/Ordering") {
-    m_Status = 4;
+    m_Status = kProcessingOrdering;
   } else if (word == "/Supplement") {
-    m_Status = 5;
+    m_Status = kProcessingSupplement;
   } else if (word == "begincodespacerange") {
-    m_Status = 7;
+    m_Status = kProcessingCodeSpaceRange;
     m_CodeSeq = 0;
   } else if (word == "usecmap") {
-  } else if (m_Status == 1 || m_Status == 2) {
-    m_CodePoints[m_CodeSeq] = GetCode(word);
-    m_CodeSeq++;
-    uint32_t StartCode, EndCode;
-    uint16_t StartCID;
-    if (m_Status == 1) {
-      if (m_CodeSeq < 2) {
-        return;
-      }
-      EndCode = StartCode = m_CodePoints[0];
-      StartCID = (uint16_t)m_CodePoints[1];
-    } else {
-      if (m_CodeSeq < 3) {
-        return;
-      }
-      StartCode = m_CodePoints[0];
-      EndCode = m_CodePoints[1];
-      StartCID = (uint16_t)m_CodePoints[2];
-    }
-    if (EndCode < 0x10000) {
-      for (uint32_t code = StartCode; code <= EndCode; code++) {
-        m_pCMap->SetDirectCharcodeToCIDTable(
-            code, static_cast<uint16_t>(StartCID + code - StartCode));
-      }
-    } else {
-      m_AdditionalCharcodeToCIDMappings.push_back(
-          {StartCode, EndCode, StartCID});
-    }
-    m_CodeSeq = 0;
-  } else if (m_Status == 3) {
-    m_Status = 0;
-  } else if (m_Status == 4) {
+  } else if (m_Status == kProcessingCidChar) {
+    HandleCid(word);
+  } else if (m_Status == kProcessingCidRange) {
+    HandleCid(word);
+  } else if (m_Status == kProcessingRegistry) {
+    m_Status = kStart;
+  } else if (m_Status == kProcessingOrdering) {
     m_pCMap->SetCharset(CharsetFromOrdering(CMap_GetString(word)));
-    m_Status = 0;
-  } else if (m_Status == 5) {
-    m_Status = 0;
-  } else if (m_Status == 6) {
+    m_Status = kStart;
+  } else if (m_Status == kProcessingSupplement) {
+    m_Status = kStart;
+  } else if (m_Status == kProcessingWMode) {
     m_pCMap->SetVertical(GetCode(word) != 0);
-    m_Status = 0;
-  } else if (m_Status == 7) {
-    if (word == "endcodespacerange") {
-      const auto& code_ranges = m_pCMap->GetMixedFourByteLeadingRanges();
-      size_t nSegs = code_ranges.size() + m_PendingRanges.size();
-      if (nSegs == 1) {
-        const auto& first_range =
-            !code_ranges.empty() ? code_ranges[0] : m_PendingRanges[0];
-        m_pCMap->SetCodingScheme((first_range.m_CharSize == 2)
-                                     ? CPDF_CMap::TwoBytes
-                                     : CPDF_CMap::OneByte);
-      } else if (nSegs > 1) {
-        m_pCMap->SetCodingScheme(CPDF_CMap::MixedFourBytes);
-        for (const auto& range : m_PendingRanges)
-          m_pCMap->AppendMixedFourByteLeadingRanges(range);
-        m_PendingRanges.clear();
-      }
-      m_Status = 0;
-    } else {
-      if (word.GetLength() == 0 || word[0] != '<') {
-        return;
-      }
-      if (m_CodeSeq % 2) {
-        CPDF_CMap::CodeRange range;
-        if (GetCodeRange(range, m_LastWord.AsStringView(), word))
-          m_PendingRanges.push_back(range);
-      }
-      m_CodeSeq++;
-    }
+    m_Status = kStart;
+  } else if (m_Status == kProcessingCodeSpaceRange) {
+    HandleCodeSpaceRange(word);
   }
   m_LastWord = word;
 }
 
-uint32_t CPDF_CMapParser::GetCode(ByteStringView word) const {
+void CPDF_CMapParser::HandleCid(ByteStringView word) {
+  ASSERT(m_Status == kProcessingCidChar || m_Status == kProcessingCidRange);
+  bool bChar = m_Status == kProcessingCidChar;
+
+  m_CodePoints[m_CodeSeq] = GetCode(word);
+  m_CodeSeq++;
+  int nRequiredCodePoints = bChar ? 2 : 3;
+  if (m_CodeSeq < nRequiredCodePoints)
+    return;
+
+  uint32_t StartCode = m_CodePoints[0];
+  uint32_t EndCode;
+  uint16_t StartCID;
+  if (bChar) {
+    EndCode = StartCode;
+    StartCID = static_cast<uint16_t>(m_CodePoints[1]);
+  } else {
+    EndCode = m_CodePoints[1];
+    StartCID = static_cast<uint16_t>(m_CodePoints[2]);
+  }
+  if (EndCode < 0x10000) {
+    for (uint32_t code = StartCode; code <= EndCode; code++) {
+      m_pCMap->SetDirectCharcodeToCIDTable(
+          code, static_cast<uint16_t>(StartCID + code - StartCode));
+    }
+  } else {
+    m_AdditionalCharcodeToCIDMappings.push_back({StartCode, EndCode, StartCID});
+  }
+  m_CodeSeq = 0;
+}
+
+void CPDF_CMapParser::HandleCodeSpaceRange(ByteStringView word) {
+  if (word != "endcodespacerange") {
+    if (word.GetLength() == 0 || word[0] != '<')
+      return;
+
+    if (m_CodeSeq % 2) {
+      Optional<CPDF_CMap::CodeRange> range =
+          GetCodeRange(m_LastWord.AsStringView(), word);
+      if (range.has_value())
+        m_PendingRanges.push_back(range.value());
+    }
+    m_CodeSeq++;
+    return;
+  }
+
+  size_t nSegs = m_Ranges.size() + m_PendingRanges.size();
+  if (nSegs == 1) {
+    const auto& first_range =
+        !m_Ranges.empty() ? m_Ranges[0] : m_PendingRanges[0];
+    m_pCMap->SetCodingScheme(first_range.m_CharSize == 2 ? CPDF_CMap::TwoBytes
+                                                         : CPDF_CMap::OneByte);
+  } else if (nSegs > 1) {
+    m_pCMap->SetCodingScheme(CPDF_CMap::MixedFourBytes);
+    m_Ranges.reserve(nSegs);
+    std::move(m_PendingRanges.begin(), m_PendingRanges.end(),
+              std::back_inserter(m_Ranges));
+    m_PendingRanges.clear();
+  }
+  m_Status = kStart;
+}
+
+// static
+uint32_t CPDF_CMapParser::GetCode(ByteStringView word) {
   if (word.IsEmpty())
     return 0;
 
@@ -159,22 +160,24 @@ uint32_t CPDF_CMapParser::GetCode(ByteStringView word) const {
   return num.ValueOrDie();
 }
 
-bool CPDF_CMapParser::GetCodeRange(CPDF_CMap::CodeRange& range,
-                                   ByteStringView first,
-                                   ByteStringView second) const {
+// static
+Optional<CPDF_CMap::CodeRange> CPDF_CMapParser::GetCodeRange(
+    ByteStringView first,
+    ByteStringView second) {
   if (first.GetLength() == 0 || first[0] != '<')
-    return false;
+    return pdfium::nullopt;
 
   size_t i;
   for (i = 1; i < first.GetLength(); ++i) {
-    if (first[i] == '>') {
+    if (first[i] == '>')
       break;
-    }
   }
-  range.m_CharSize = (i - 1) / 2;
-  if (range.m_CharSize > 4)
-    return false;
+  size_t char_size = (i - 1) / 2;
+  if (char_size > 4)
+    return pdfium::nullopt;
 
+  CPDF_CMap::CodeRange range;
+  range.m_CharSize = char_size;
   for (i = 0; i < range.m_CharSize; ++i) {
     uint8_t digit1 = first[i * 2 + 1];
     uint8_t digit2 = first[i * 2 + 2];
@@ -184,19 +187,26 @@ bool CPDF_CMapParser::GetCodeRange(CPDF_CMap::CodeRange& range,
 
   size_t size = second.GetLength();
   for (i = 0; i < range.m_CharSize; ++i) {
-    uint8_t digit1 = (i * 2 + 1 < size) ? second[i * 2 + 1] : '0';
-    uint8_t digit2 = (i * 2 + 2 < size) ? second[i * 2 + 2] : '0';
+    size_t i1 = i * 2 + 1;
+    size_t i2 = i1 + 1;
+    uint8_t digit1 = i1 < size ? second[i1] : '0';
+    uint8_t digit2 = i2 < size ? second[i2] : '0';
     range.m_Upper[i] =
         FXSYS_HexCharToInt(digit1) * 16 + FXSYS_HexCharToInt(digit2);
   }
-  return true;
+  return range;
 }
 
 // static
 CIDSet CPDF_CMapParser::CharsetFromOrdering(ByteStringView ordering) {
-  for (size_t charset = 1; charset < FX_ArraySize(g_CharsetNames); ++charset) {
-    if (ordering == g_CharsetNames[charset])
-      return CIDSetFromSizeT(charset);
+  static const char* const kCharsetNames[CIDSET_NUM_SETS] = {
+      nullptr, "GB1", "CNS1", "Japan1", "Korea1", "UCS"};
+  static_assert(FX_ArraySize(kCharsetNames) == CIDSET_NUM_SETS,
+                "Too many CID sets");
+
+  for (size_t charset = 1; charset < FX_ArraySize(kCharsetNames); ++charset) {
+    if (ordering == kCharsetNames[charset])
+      return static_cast<CIDSet>(charset);
   }
   return CIDSET_UNKNOWN;
 }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser.h
index b62985dd81b..f24a93be2f5 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser.h
@@ -13,6 +13,7 @@
 #include "core/fpdfapi/font/cpdf_cidfont.h"
 #include "core/fpdfapi/font/cpdf_cmap.h"
 #include "core/fxcrt/unowned_ptr.h"
+#include "third_party/base/optional.h"
 
 class CPDF_CMapParser {
  public:
@@ -27,17 +28,34 @@ class CPDF_CMapParser {
     return std::move(m_AdditionalCharcodeToCIDMappings);
   }
 
-  uint32_t GetCode(ByteStringView word) const;
-  bool GetCodeRange(CPDF_CMap::CodeRange& range,
-                    ByteStringView first,
-                    ByteStringView second) const;
-
   static CIDSet CharsetFromOrdering(ByteStringView ordering);
 
  private:
+  friend class cpdf_cmapparser_GetCode_Test;
+  friend class cpdf_cmapparser_GetCodeRange_Test;
+
+  enum Status {
+    kStart,
+    kProcessingCidChar,
+    kProcessingCidRange,
+    kProcessingRegistry,
+    kProcessingOrdering,
+    kProcessingSupplement,
+    kProcessingWMode,
+    kProcessingCodeSpaceRange,
+  };
+
+  void HandleCid(ByteStringView word);
+  void HandleCodeSpaceRange(ByteStringView word);
+
+  static uint32_t GetCode(ByteStringView word);
+  static Optional<CPDF_CMap::CodeRange> GetCodeRange(ByteStringView first,
+                                                     ByteStringView second);
+
+  Status m_Status = kStart;
+  int m_CodeSeq = 0;
   UnownedPtr<CPDF_CMap> const m_pCMap;
-  int m_Status;
-  int m_CodeSeq;
+  std::vector<CPDF_CMap::CodeRange> m_Ranges;
   std::vector<CPDF_CMap::CodeRange> m_PendingRanges;
   std::vector<CPDF_CMap::CIDRange> m_AdditionalCharcodeToCIDMappings;
   ByteString m_LastWord;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser_unittest.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser_unittest.cpp
index 1a36eb79ac2..da654f39dc0 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_cmapparser_unittest.cpp
@@ -8,7 +8,7 @@
 
 namespace {
 
-bool uint_ranges_equal(uint8_t* a, uint8_t* b, size_t count) {
+bool uint_ranges_equal(const uint8_t* a, const uint8_t* b, size_t count) {
   for (size_t i = 0; i < count; ++i) {
     if (a[i] != b[i])
       return false;
@@ -19,55 +19,57 @@ bool uint_ranges_equal(uint8_t* a, uint8_t* b, size_t count) {
 }  // namespace
 
 TEST(cpdf_cmapparser, GetCode) {
-  CPDF_CMapParser parser(nullptr);
+  EXPECT_EQ(0u, CPDF_CMapParser::GetCode(""));
+  EXPECT_EQ(0u, CPDF_CMapParser::GetCode("<"));
+  EXPECT_EQ(194u, CPDF_CMapParser::GetCode("<c2"));
+  EXPECT_EQ(162u, CPDF_CMapParser::GetCode("<A2"));
+  EXPECT_EQ(2802u, CPDF_CMapParser::GetCode("<Af2"));
+  EXPECT_EQ(162u, CPDF_CMapParser::GetCode("<A2z"));
 
-  EXPECT_EQ(0u, parser.GetCode(""));
-  EXPECT_EQ(0u, parser.GetCode("<"));
-  EXPECT_EQ(194u, parser.GetCode("<c2"));
-  EXPECT_EQ(162u, parser.GetCode("<A2"));
-  EXPECT_EQ(2802u, parser.GetCode("<Af2"));
-  EXPECT_EQ(162u, parser.GetCode("<A2z"));
+  EXPECT_EQ(12u, CPDF_CMapParser::GetCode("12"));
+  EXPECT_EQ(12u, CPDF_CMapParser::GetCode("12d"));
+  EXPECT_EQ(128u, CPDF_CMapParser::GetCode("128"));
 
-  EXPECT_EQ(12u, parser.GetCode("12"));
-  EXPECT_EQ(12u, parser.GetCode("12d"));
-  EXPECT_EQ(128u, parser.GetCode("128"));
-
-  EXPECT_EQ(4294967295u, parser.GetCode("<FFFFFFFF"));
+  EXPECT_EQ(4294967295u, CPDF_CMapParser::GetCode("<FFFFFFFF"));
 
   // Overflow a uint32_t.
-  EXPECT_EQ(0u, parser.GetCode("<100000000"));
+  EXPECT_EQ(0u, CPDF_CMapParser::GetCode("<100000000"));
 }
 
 TEST(cpdf_cmapparser, GetCodeRange) {
-  CPDF_CMapParser parser(nullptr);
-  CPDF_CMap::CodeRange range;
+  Optional<CPDF_CMap::CodeRange> range;
 
   // Must start with a <
-  EXPECT_FALSE(parser.GetCodeRange(range, "", ""));
-  EXPECT_FALSE(parser.GetCodeRange(range, "A", ""));
+  range = CPDF_CMapParser::GetCodeRange("", "");
+  EXPECT_FALSE(range.has_value());
+  range = CPDF_CMapParser::GetCodeRange("A", "");
+  EXPECT_FALSE(range.has_value());
 
   // m_CharSize must be <= 4
-  EXPECT_FALSE(parser.GetCodeRange(range, "<aaaaaaaaaa>", ""));
-  EXPECT_EQ(5u, range.m_CharSize);
+  range = CPDF_CMapParser::GetCodeRange("<aaaaaaaaaa>", "");
+  EXPECT_FALSE(range.has_value());
 
-  EXPECT_TRUE(parser.GetCodeRange(range, "<12345678>", "<87654321>"));
-  EXPECT_EQ(4u, range.m_CharSize);
+  range = CPDF_CMapParser::GetCodeRange("<12345678>", "<87654321>");
+  ASSERT_TRUE(range.has_value());
+  ASSERT_EQ(4u, range.value().m_CharSize);
   {
-    uint8_t lower[4] = {18, 52, 86, 120};
-    uint8_t upper[4] = {135, 101, 67, 33};
-    EXPECT_TRUE(uint_ranges_equal(lower, range.m_Lower, range.m_CharSize));
-    EXPECT_TRUE(uint_ranges_equal(upper, range.m_Upper, range.m_CharSize));
+    constexpr uint8_t kLower[4] = {18, 52, 86, 120};
+    constexpr uint8_t kUpper[4] = {135, 101, 67, 33};
+    EXPECT_TRUE(uint_ranges_equal(kLower, range.value().m_Lower, 4));
+    EXPECT_TRUE(uint_ranges_equal(kUpper, range.value().m_Upper, 4));
   }
 
   // Hex characters
-  EXPECT_TRUE(parser.GetCodeRange(range, "<a1>", "<F3>"));
-  EXPECT_EQ(1u, range.m_CharSize);
-  EXPECT_EQ(161, range.m_Lower[0]);
-  EXPECT_EQ(243, range.m_Upper[0]);
+  range = CPDF_CMapParser::GetCodeRange("<a1>", "<F3>");
+  ASSERT_TRUE(range.has_value());
+  ASSERT_EQ(1u, range.value().m_CharSize);
+  EXPECT_EQ(161, range.value().m_Lower[0]);
+  EXPECT_EQ(243, range.value().m_Upper[0]);
 
   // The second string should return 0's if it is shorter
-  EXPECT_TRUE(parser.GetCodeRange(range, "<a1>", ""));
-  EXPECT_EQ(1u, range.m_CharSize);
-  EXPECT_EQ(161, range.m_Lower[0]);
-  EXPECT_EQ(0, range.m_Upper[0]);
+  range = CPDF_CMapParser::GetCodeRange("<a1>", "");
+  ASSERT_TRUE(range.has_value());
+  ASSERT_EQ(1u, range.value().m_CharSize);
+  EXPECT_EQ(161, range.value().m_Lower[0]);
+  EXPECT_EQ(0, range.value().m_Upper[0]);
 }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_font.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_font.cpp
index baac1d35cbd..28e5ffbd65f 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_font.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_font.cpp
@@ -48,7 +48,7 @@ const uint8_t kChineseFontNames[][kChineseFontNameSize] = {
 CPDF_Font::CPDF_Font(CPDF_Document* pDocument, CPDF_Dictionary* pFontDict)
     : m_pDocument(pDocument),
       m_pFontDict(pFontDict),
-      m_BaseFont(pFontDict->GetStringFor("BaseFont")) {}
+      m_BaseFontName(pFontDict->GetStringFor("BaseFont")) {}
 
 CPDF_Font::~CPDF_Font() {
   if (m_pFontFile) {
@@ -122,6 +122,8 @@ int CPDF_Font::GlyphFromCharCodeExt(uint32_t charcode) {
 }
 #endif
 
+void CPDF_Font::WillBeDestroyed() {}
+
 bool CPDF_Font::IsVertWriting() const {
   const CPDF_CIDFont* pCIDFont = AsCIDFont();
   return pCIDFont ? pCIDFont->IsVertWriting() : m_Font.IsVertical();
@@ -271,8 +273,7 @@ void CPDF_Font::LoadUnicodeMap() const {
   if (!pStream)
     return;
 
-  m_pToUnicodeMap = pdfium::MakeUnique<CPDF_ToUnicodeMap>();
-  m_pToUnicodeMap->Load(pStream);
+  m_pToUnicodeMap = pdfium::MakeUnique<CPDF_ToUnicodeMap>(pStream);
 }
 
 uint32_t CPDF_Font::GetStringWidth(ByteStringView pString) {
@@ -284,7 +285,8 @@ uint32_t CPDF_Font::GetStringWidth(ByteStringView pString) {
 }
 
 // static
-CPDF_Font* CPDF_Font::GetStockFont(CPDF_Document* pDoc, ByteStringView name) {
+RetainPtr<CPDF_Font> CPDF_Font::GetStockFont(CPDF_Document* pDoc,
+                                             ByteStringView name) {
   ByteString fontname(name);
   Optional<CFX_FontMapper::StandardFont> font_id =
       CFX_FontMapper::GetStandardFontName(&fontname);
@@ -292,7 +294,7 @@ CPDF_Font* CPDF_Font::GetStockFont(CPDF_Document* pDoc, ByteStringView name) {
     return nullptr;
 
   auto* pFontGlobals = CPDF_FontGlobals::GetInstance();
-  CPDF_Font* pFont = pFontGlobals->Find(pDoc, font_id.value());
+  RetainPtr<CPDF_Font> pFont = pFontGlobals->Find(pDoc, font_id.value());
   if (pFont)
     return pFont;
 
@@ -301,16 +303,17 @@ CPDF_Font* CPDF_Font::GetStockFont(CPDF_Document* pDoc, ByteStringView name) {
   pDict->SetNewFor<CPDF_Name>("Subtype", "Type1");
   pDict->SetNewFor<CPDF_Name>("BaseFont", fontname);
   pDict->SetNewFor<CPDF_Name>("Encoding", "WinAnsiEncoding");
-  return pFontGlobals->Set(pDoc, font_id.value(),
-                           CPDF_Font::Create(nullptr, pDict.Get(), nullptr));
+  pFont = CPDF_Font::Create(nullptr, pDict.Get(), nullptr);
+  pFontGlobals->Set(pDoc, font_id.value(), pFont);
+  return pFont;
 }
 
 // static
-std::unique_ptr<CPDF_Font> CPDF_Font::Create(CPDF_Document* pDoc,
-                                             CPDF_Dictionary* pFontDict,
-                                             FormFactoryIface* pFactory) {
+RetainPtr<CPDF_Font> CPDF_Font::Create(CPDF_Document* pDoc,
+                                       CPDF_Dictionary* pFontDict,
+                                       FormFactoryIface* pFactory) {
   ByteString type = pFontDict->GetStringFor("Subtype");
-  std::unique_ptr<CPDF_Font> pFont;
+  RetainPtr<CPDF_Font> pFont;
   if (type == "TrueType") {
     ByteString tag = pFontDict->GetStringFor("BaseFont").Left(4);
     for (size_t i = 0; i < FX_ArraySize(kChineseFontNames); ++i) {
@@ -318,20 +321,23 @@ std::unique_ptr<CPDF_Font> CPDF_Font::Create(CPDF_Document* pDoc,
         const CPDF_Dictionary* pFontDesc =
             pFontDict->GetDictFor("FontDescriptor");
         if (!pFontDesc || !pFontDesc->KeyExist("FontFile2"))
-          pFont = pdfium::MakeUnique<CPDF_CIDFont>(pDoc, pFontDict);
+          pFont = pdfium::MakeRetain<CPDF_CIDFont>(pDoc, pFontDict);
         break;
       }
     }
     if (!pFont)
-      pFont = pdfium::MakeUnique<CPDF_TrueTypeFont>(pDoc, pFontDict);
+      pFont = pdfium::MakeRetain<CPDF_TrueTypeFont>(pDoc, pFontDict);
   } else if (type == "Type3") {
-    pFont = pdfium::MakeUnique<CPDF_Type3Font>(pDoc, pFontDict, pFactory);
+    pFont = pdfium::MakeRetain<CPDF_Type3Font>(pDoc, pFontDict, pFactory);
   } else if (type == "Type0") {
-    pFont = pdfium::MakeUnique<CPDF_CIDFont>(pDoc, pFontDict);
+    pFont = pdfium::MakeRetain<CPDF_CIDFont>(pDoc, pFontDict);
   } else {
-    pFont = pdfium::MakeUnique<CPDF_Type1Font>(pDoc, pFontDict);
+    pFont = pdfium::MakeRetain<CPDF_Type1Font>(pDoc, pFontDict);
   }
-  return pFont->Load() ? std::move(pFont) : nullptr;
+  if (!pFont->Load())
+    return nullptr;
+
+  return pFont;
 }
 
 uint32_t CPDF_Font::GetNextChar(ByteStringView pString, size_t* pOffset) const {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_font.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_font.h
index 1a1d361ca96..1641bb32cee 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_font.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_font.h
@@ -16,6 +16,8 @@
 #include "core/fpdfapi/parser/cpdf_stream_acc.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/observed_ptr.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "core/fxge/cfx_font.h"
 
@@ -30,7 +32,7 @@ class CPDF_Type3Char;
 class CPDF_Type3Font;
 class CPDF_ToUnicodeMap;
 
-class CPDF_Font {
+class CPDF_Font : public Retainable, public Observable {
  public:
   // Callback mechanism for Type3 fonts to get pixels from forms.
   class FormIface {
@@ -55,15 +57,16 @@ class CPDF_Font {
         CPDF_Stream* pFormStream) = 0;
   };
 
-  // |pFactory| only required for Type3 fonts.
-  static std::unique_ptr<CPDF_Font> Create(CPDF_Document* pDoc,
-                                           CPDF_Dictionary* pFontDict,
-                                           FormFactoryIface* pFactory);
-
-  static CPDF_Font* GetStockFont(CPDF_Document* pDoc, ByteStringView fontname);
   static const uint32_t kInvalidCharCode = static_cast<uint32_t>(-1);
 
-  virtual ~CPDF_Font();
+  // |pFactory| only required for Type3 fonts.
+  static RetainPtr<CPDF_Font> Create(CPDF_Document* pDoc,
+                                     CPDF_Dictionary* pFontDict,
+                                     FormFactoryIface* pFactory);
+  static RetainPtr<CPDF_Font> GetStockFont(CPDF_Document* pDoc,
+                                           ByteStringView fontname);
+
+  ~CPDF_Font() override;
 
   virtual bool IsType1Font() const;
   virtual bool IsTrueTypeFont() const;
@@ -78,6 +81,7 @@ class CPDF_Font {
   virtual const CPDF_CIDFont* AsCIDFont() const;
   virtual CPDF_CIDFont* AsCIDFont();
 
+  virtual void WillBeDestroyed();
   virtual bool IsVertWriting() const;
   virtual bool IsUnicodeCompatible() const;
   virtual uint32_t GetNextChar(ByteStringView pString, size_t* pOffset) const;
@@ -91,7 +95,7 @@ class CPDF_Font {
   virtual uint32_t CharCodeFromUnicode(wchar_t Unicode) const;
   virtual bool HasFontWidths() const;
 
-  ByteString GetBaseFont() const { return m_BaseFont; }
+  ByteString GetBaseFontName() const { return m_BaseFontName; }
   CFX_SubstFont* GetSubstFont() const { return m_Font.GetSubstFont(); }
   bool IsEmbedded() const { return IsType3Font() || m_pFontFile != nullptr; }
   CPDF_Dictionary* GetFontDict() const { return m_pFontDict.Get(); }
@@ -142,7 +146,7 @@ class CPDF_Font {
   std::vector<std::unique_ptr<CFX_Font>> m_FontFallbacks;
   RetainPtr<CPDF_StreamAcc> m_pFontFile;
   RetainPtr<CPDF_Dictionary> m_pFontDict;
-  ByteString m_BaseFont;
+  ByteString m_BaseFontName;
   mutable std::unique_ptr<CPDF_ToUnicodeMap> m_pToUnicodeMap;
   mutable bool m_bToUnicodeLoaded = false;
   int m_Flags = 0;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontencoding.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontencoding.cpp
index f1f7d0639da..a4e687e3c4e 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontencoding.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontencoding.cpp
@@ -1655,10 +1655,6 @@ uint32_t PDF_FindCode(const uint16_t* pCodes, uint16_t unicode) {
 
 }  // namespace
 
-CPDF_FontEncoding::CPDF_FontEncoding() {
-  memset(m_Unicodes, 0, sizeof(m_Unicodes));
-}
-
 int CPDF_FontEncoding::CharCodeFromUnicode(wchar_t unicode) const {
   for (size_t i = 0; i < FX_ArraySize(m_Unicodes); i++) {
     if (m_Unicodes[i] == unicode)
@@ -1669,11 +1665,11 @@ int CPDF_FontEncoding::CharCodeFromUnicode(wchar_t unicode) const {
 
 CPDF_FontEncoding::CPDF_FontEncoding(int PredefinedEncoding) {
   const uint16_t* pSrc = PDF_UnicodesForPredefinedCharSet(PredefinedEncoding);
-  if (!pSrc) {
-    memset(m_Unicodes, 0, sizeof(m_Unicodes));
-  } else {
+  if (pSrc) {
     for (size_t i = 0; i < FX_ArraySize(m_Unicodes); i++)
       m_Unicodes[i] = pSrc[i];
+  } else {
+    memset(m_Unicodes, 0, sizeof(m_Unicodes));
   }
 }
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontencoding.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontencoding.h
index 56904c91330..1bfb0d5c0e3 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontencoding.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontencoding.h
@@ -35,7 +35,6 @@ class CPDF_FontEncoding {
  public:
   static constexpr size_t kEncodingTableSize = 256;
 
-  CPDF_FontEncoding();
   explicit CPDF_FontEncoding(int PredefinedEncoding);
 
   bool IsIdentical(const CPDF_FontEncoding* pAnother) const;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontglobals.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontglobals.cpp
index f4350ebf5b6..10b6c5e66b7 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontglobals.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontglobals.cpp
@@ -6,8 +6,10 @@
 
 #include "core/fpdfapi/font/cpdf_fontglobals.h"
 
-#include <utility>
-
+#include "core/fpdfapi/cmaps/CNS1/cmaps_cns1.h"
+#include "core/fpdfapi/cmaps/GB1/cmaps_gb1.h"
+#include "core/fpdfapi/cmaps/Japan1/cmaps_japan1.h"
+#include "core/fpdfapi/cmaps/Korea1/cmaps_korea1.h"
 #include "core/fpdfapi/font/cfx_stockfontarray.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "third_party/base/ptr_util.h"
@@ -45,22 +47,57 @@ CPDF_FontGlobals::CPDF_FontGlobals() {
 
 CPDF_FontGlobals::~CPDF_FontGlobals() = default;
 
-CPDF_Font* CPDF_FontGlobals::Find(CPDF_Document* pDoc,
-                                  CFX_FontMapper::StandardFont index) {
+void CPDF_FontGlobals::LoadEmbeddedMaps() {
+  LoadEmbeddedGB1CMaps();
+  LoadEmbeddedCNS1CMaps();
+  LoadEmbeddedJapan1CMaps();
+  LoadEmbeddedKorea1CMaps();
+}
+
+RetainPtr<CPDF_Font> CPDF_FontGlobals::Find(
+    CPDF_Document* pDoc,
+    CFX_FontMapper::StandardFont index) {
   auto it = m_StockMap.find(pDoc);
-  if (it == m_StockMap.end())
+  if (it == m_StockMap.end() || !it->second)
     return nullptr;
-  return it->second ? it->second->GetFont(index) : nullptr;
+
+  return it->second->GetFont(index);
 }
 
-CPDF_Font* CPDF_FontGlobals::Set(CPDF_Document* pDoc,
-                                 CFX_FontMapper::StandardFont index,
-                                 std::unique_ptr<CPDF_Font> pFont) {
+void CPDF_FontGlobals::Set(CPDF_Document* pDoc,
+                           CFX_FontMapper::StandardFont index,
+                           const RetainPtr<CPDF_Font>& pFont) {
   if (!pdfium::ContainsKey(m_StockMap, pDoc))
     m_StockMap[pDoc] = pdfium::MakeUnique<CFX_StockFontArray>();
-  return m_StockMap[pDoc]->SetFont(index, std::move(pFont));
+  m_StockMap[pDoc]->SetFont(index, pFont);
 }
 
 void CPDF_FontGlobals::Clear(CPDF_Document* pDoc) {
   m_StockMap.erase(pDoc);
 }
+
+void CPDF_FontGlobals::LoadEmbeddedGB1CMaps() {
+  SetEmbeddedCharset(CIDSET_GB1, pdfium::make_span(g_FXCMAP_GB1_cmaps,
+                                                   g_FXCMAP_GB1_cmaps_size));
+  SetEmbeddedToUnicode(CIDSET_GB1, g_FXCMAP_GB1CID2Unicode_5);
+}
+
+void CPDF_FontGlobals::LoadEmbeddedCNS1CMaps() {
+  SetEmbeddedCharset(CIDSET_CNS1, pdfium::make_span(g_FXCMAP_CNS1_cmaps,
+                                                    g_FXCMAP_CNS1_cmaps_size));
+  SetEmbeddedToUnicode(CIDSET_CNS1, g_FXCMAP_CNS1CID2Unicode_5);
+}
+
+void CPDF_FontGlobals::LoadEmbeddedJapan1CMaps() {
+  SetEmbeddedCharset(
+      CIDSET_JAPAN1,
+      pdfium::make_span(g_FXCMAP_Japan1_cmaps, g_FXCMAP_Japan1_cmaps_size));
+  SetEmbeddedToUnicode(CIDSET_JAPAN1, g_FXCMAP_Japan1CID2Unicode_4);
+}
+
+void CPDF_FontGlobals::LoadEmbeddedKorea1CMaps() {
+  SetEmbeddedCharset(
+      CIDSET_KOREA1,
+      pdfium::make_span(g_FXCMAP_Korea1_cmaps, g_FXCMAP_Korea1_cmaps_size));
+  SetEmbeddedToUnicode(CIDSET_KOREA1, g_FXCMAP_Korea1CID2Unicode_2);
+}
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontglobals.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontglobals.h
index 6ae9064ae0a..8ef9687167c 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontglobals.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_fontglobals.h
@@ -12,6 +12,7 @@
 
 #include "core/fpdfapi/cmaps/cmap_int.h"
 #include "core/fpdfapi/font/cpdf_cmapmanager.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxge/cfx_fontmapper.h"
 #include "third_party/base/span.h"
 
@@ -24,13 +25,15 @@ class CPDF_FontGlobals {
   static void Destroy();
   static CPDF_FontGlobals* GetInstance();
 
-  void Clear(CPDF_Document* pDoc);
-  CPDF_Font* Find(CPDF_Document* pDoc, CFX_FontMapper::StandardFont index);
+  // Caller must load the maps before using font globals.
+  void LoadEmbeddedMaps();
 
-  // Takes ownership of |pFont|, returns unowned pointer to it.
-  CPDF_Font* Set(CPDF_Document* pDoc,
-                 CFX_FontMapper::StandardFont index,
-                 std::unique_ptr<CPDF_Font> pFont);
+  void Clear(CPDF_Document* pDoc);
+  RetainPtr<CPDF_Font> Find(CPDF_Document* pDoc,
+                            CFX_FontMapper::StandardFont index);
+  void Set(CPDF_Document* pDoc,
+           CFX_FontMapper::StandardFont index,
+           const RetainPtr<CPDF_Font>& pFont);
 
   void SetEmbeddedCharset(size_t idx, pdfium::span<const FXCMAP_CMap> map) {
     m_EmbeddedCharsets[idx] = map;
@@ -51,6 +54,11 @@ class CPDF_FontGlobals {
   CPDF_FontGlobals();
   ~CPDF_FontGlobals();
 
+  void LoadEmbeddedGB1CMaps();
+  void LoadEmbeddedCNS1CMaps();
+  void LoadEmbeddedJapan1CMaps();
+  void LoadEmbeddedKorea1CMaps();
+
   CPDF_CMapManager m_CMapManager;
   pdfium::span<const FXCMAP_CMap> m_EmbeddedCharsets[CIDSET_NUM_SETS];
   pdfium::span<const uint16_t> m_EmbeddedToUnicodes[CIDSET_NUM_SETS];
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_simplefont.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_simplefont.cpp
index 06672f23682..546ed2848e8 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_simplefont.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_simplefont.cpp
@@ -101,7 +101,7 @@ void CPDF_SimpleFont::LoadCharMetrics(int charcode) {
 void CPDF_SimpleFont::LoadPDFEncoding(bool bEmbedded, bool bTrueType) {
   const CPDF_Object* pEncoding = m_pFontDict->GetDirectObjectFor("Encoding");
   if (!pEncoding) {
-    if (m_BaseFont == "Symbol") {
+    if (m_BaseFontName == "Symbol") {
       m_BaseEncoding = bTrueType ? PDFFONT_ENCODING_MS_SYMBOL
                                  : PDFFONT_ENCODING_ADOBE_SYMBOL;
     } else if (!bEmbedded && m_BaseEncoding == PDFFONT_ENCODING_BUILTIN) {
@@ -114,7 +114,7 @@ void CPDF_SimpleFont::LoadPDFEncoding(bool bEmbedded, bool bTrueType) {
         m_BaseEncoding == PDFFONT_ENCODING_ZAPFDINGBATS) {
       return;
     }
-    if (FontStyleIsSymbolic(m_Flags) && m_BaseFont == "Symbol") {
+    if (FontStyleIsSymbolic(m_Flags) && m_BaseFontName == "Symbol") {
       if (!bTrueType)
         m_BaseEncoding = PDFFONT_ENCODING_ADOBE_SYMBOL;
       return;
@@ -212,8 +212,8 @@ bool CPDF_SimpleFont::LoadCommon() {
     }
   }
   if (m_pFontFile) {
-    if (m_BaseFont.GetLength() > 8 && m_BaseFont[7] == '+')
-      m_BaseFont = m_BaseFont.Right(m_BaseFont.GetLength() - 8);
+    if (m_BaseFontName.GetLength() > 8 && m_BaseFontName[7] == '+')
+      m_BaseFontName = m_BaseFontName.Right(m_BaseFontName.GetLength() - 8);
   } else {
     LoadSubstFont();
   }
@@ -267,7 +267,7 @@ void CPDF_SimpleFont::LoadSubstFont() {
     safeStemV *= 5;
   else
     safeStemV = safeStemV * 4 + 140;
-  m_Font.LoadSubst(m_BaseFont, IsTrueTypeFont(), m_Flags,
+  m_Font.LoadSubst(m_BaseFontName, IsTrueTypeFont(), m_Flags,
                    safeStemV.ValueOrDefault(FXFONT_FW_NORMAL), m_ItalicAngle, 0,
                    false);
 }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_simplefont.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_simplefont.h
index 290016bc49c..11359c3f5fc 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_simplefont.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_simplefont.h
@@ -16,7 +16,6 @@
 
 class CPDF_SimpleFont : public CPDF_Font {
  public:
-  CPDF_SimpleFont(CPDF_Document* pDocument, CPDF_Dictionary* pFontDict);
   ~CPDF_SimpleFont() override;
 
   // CPDF_Font
@@ -27,11 +26,13 @@ class CPDF_SimpleFont : public CPDF_Font {
   WideString UnicodeFromCharCode(uint32_t charcode) const override;
   uint32_t CharCodeFromUnicode(wchar_t Unicode) const override;
 
-  CPDF_FontEncoding* GetEncoding() { return &m_Encoding; }
+  const CPDF_FontEncoding* GetEncoding() const { return &m_Encoding; }
 
   bool HasFontWidths() const override;
 
  protected:
+  CPDF_SimpleFont(CPDF_Document* pDocument, CPDF_Dictionary* pFontDict);
+
   virtual void LoadGlyphMap() = 0;
 
   bool LoadCommon();
@@ -39,7 +40,7 @@ class CPDF_SimpleFont : public CPDF_Font {
   void LoadCharMetrics(int charcode);
   void LoadPDFEncoding(bool bEmbedded, bool bTrueType);
 
-  CPDF_FontEncoding m_Encoding;
+  CPDF_FontEncoding m_Encoding{PDFFONT_ENCODING_BUILTIN};
   int m_BaseEncoding = PDFFONT_ENCODING_BUILTIN;
   bool m_bUseFontWidth;
   std::vector<ByteString> m_CharNames;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_tounicodemap.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_tounicodemap.cpp
index aca7febf7ac..2c9bb55dbb1 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_tounicodemap.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_tounicodemap.cpp
@@ -16,33 +16,51 @@
 #include "core/fxcrt/fx_safe_types.h"
 #include "third_party/base/numerics/safe_conversions.h"
 
+namespace {
+
+WideString StringDataAdd(WideString str) {
+  WideString ret;
+  wchar_t value = 1;
+  for (size_t i = str.GetLength(); i > 0; --i) {
+    wchar_t ch = str[i - 1] + value;
+    if (ch < str[i - 1]) {
+      ret.InsertAtFront(0);
+    } else {
+      ret.InsertAtFront(ch);
+      value = 0;
+    }
+  }
+  if (value)
+    ret.InsertAtFront(value);
+  return ret;
+}
+
+}  // namespace
+
+CPDF_ToUnicodeMap::CPDF_ToUnicodeMap(const CPDF_Stream* pStream) {
+  Load(pStream);
+}
+
+CPDF_ToUnicodeMap::~CPDF_ToUnicodeMap() = default;
+
 WideString CPDF_ToUnicodeMap::Lookup(uint32_t charcode) const {
   auto it = m_Map.find(charcode);
-  if (it != m_Map.end()) {
-    uint32_t value = it->second;
-    wchar_t unicode = (wchar_t)(value & 0xffff);
-    if (unicode != 0xffff) {
-      return unicode;
-    }
-    const wchar_t* buf = m_MultiCharBuf.GetBuffer();
-    uint32_t buf_len = m_MultiCharBuf.GetLength();
-    if (!buf || buf_len == 0) {
-      return WideString();
-    }
-    uint32_t index = value >> 16;
-    if (index >= buf_len) {
+  if (it == m_Map.end()) {
+    if (!m_pBaseMap)
       return WideString();
-    }
-    uint32_t len = buf[index];
-    if (index + len < index || index + len >= buf_len) {
-      return WideString();
-    }
-    return WideString(buf + index + 1, len);
+    return m_pBaseMap->UnicodeFromCID(static_cast<uint16_t>(charcode));
   }
-  if (m_pBaseMap) {
-    return m_pBaseMap->UnicodeFromCID((uint16_t)charcode);
-  }
-  return WideString();
+
+  uint32_t value = it->second;
+  wchar_t unicode = static_cast<wchar_t>(value & 0xffff);
+  if (unicode != 0xffff)
+    return unicode;
+
+  WideStringView buf = m_MultiCharBuf.AsStringView();
+  size_t index = value >> 16;
+  if (!buf.IsValidIndex(index))
+    return WideString();
+  return WideString(buf.Mid(index + 1, buf[index]));
 }
 
 uint32_t CPDF_ToUnicodeMap::ReverseLookup(wchar_t unicode) const {
@@ -53,77 +71,46 @@ uint32_t CPDF_ToUnicodeMap::ReverseLookup(wchar_t unicode) const {
   return 0;
 }
 
-// Static.
+// static
 uint32_t CPDF_ToUnicodeMap::StringToCode(ByteStringView str) {
-  int len = str.GetLength();
+  size_t len = str.GetLength();
   if (len == 0)
     return 0;
 
   uint32_t result = 0;
   if (str[0] == '<') {
-    for (int i = 1; i < len && std::isxdigit(str[i]); ++i)
+    for (size_t i = 1; i < len && std::isxdigit(str[i]); ++i)
       result = result * 16 + FXSYS_HexCharToInt(str.CharAt(i));
     return result;
   }
 
-  for (int i = 0; i < len && std::isdigit(str[i]); ++i)
+  for (size_t i = 0; i < len && std::isdigit(str[i]); ++i)
     result = result * 10 + FXSYS_DecimalCharToInt(str.CharAt(i));
 
   return result;
 }
 
-static WideString StringDataAdd(WideString str) {
-  WideString ret;
-  int len = str.GetLength();
-  wchar_t value = 1;
-  for (int i = len - 1; i >= 0; --i) {
-    wchar_t ch = str[i] + value;
-    if (ch < str[i]) {
-      ret.InsertAtFront(0);
-    } else {
-      ret.InsertAtFront(ch);
-      value = 0;
-    }
-  }
-  if (value)
-    ret.InsertAtFront(value);
-  return ret;
-}
-
-// Static.
+// static
 WideString CPDF_ToUnicodeMap::StringToWideString(ByteStringView str) {
-  int len = str.GetLength();
-  if (len == 0)
+  size_t len = str.GetLength();
+  if (len == 0 || str[0] != '<')
     return WideString();
 
   WideString result;
-  if (str[0] == '<') {
-    int byte_pos = 0;
-    wchar_t ch = 0;
-    for (int i = 1; i < len && std::isxdigit(str[i]); ++i) {
-      ch = ch * 16 + FXSYS_HexCharToInt(str[i]);
-      byte_pos++;
-      if (byte_pos == 4) {
-        result += ch;
-        byte_pos = 0;
-        ch = 0;
-      }
+  int byte_pos = 0;
+  wchar_t ch = 0;
+  for (size_t i = 1; i < len && std::isxdigit(str[i]); ++i) {
+    ch = ch * 16 + FXSYS_HexCharToInt(str.CharAt(i));
+    byte_pos++;
+    if (byte_pos == 4) {
+      result += ch;
+      byte_pos = 0;
+      ch = 0;
     }
-    return result;
   }
   return result;
 }
 
-CPDF_ToUnicodeMap::CPDF_ToUnicodeMap() : m_pBaseMap(nullptr) {}
-
-CPDF_ToUnicodeMap::~CPDF_ToUnicodeMap() {}
-
-uint32_t CPDF_ToUnicodeMap::GetUnicode() {
-  FX_SAFE_UINT32 uni = m_MultiCharBuf.GetLength();
-  uni = uni * 0x10000 + 0xffff;
-  return uni.ValueOrDefault(0);
-}
-
 void CPDF_ToUnicodeMap::Load(const CPDF_Stream* pStream) {
   CIDSet cid_set = CIDSET_UNKNOWN;
   auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
@@ -131,102 +118,92 @@ void CPDF_ToUnicodeMap::Load(const CPDF_Stream* pStream) {
   CPDF_SimpleParser parser(pAcc->GetSpan());
   while (1) {
     ByteStringView word = parser.GetWord();
-    if (word.IsEmpty()) {
+    if (word.IsEmpty())
       break;
-    }
-    if (word == "beginbfchar") {
-      while (1) {
-        word = parser.GetWord();
-        if (word.IsEmpty() || word == "endbfchar") {
-          break;
-        }
-        uint32_t srccode = StringToCode(word);
-        word = parser.GetWord();
-        WideString destcode = StringToWideString(word);
-        int len = destcode.GetLength();
-        if (len == 0) {
-          continue;
-        }
-        if (len == 1) {
-          m_Map[srccode] = destcode[0];
-        } else {
-          m_Map[srccode] = GetUnicode();
-          m_MultiCharBuf.AppendChar(destcode.GetLength());
-          m_MultiCharBuf << destcode;
-        }
-      }
-    } else if (word == "beginbfrange") {
-      while (1) {
-        ByteString low, high;
-        low = parser.GetWord();
-        if (low.IsEmpty() || low == "endbfrange") {
-          break;
-        }
-        high = parser.GetWord();
-        uint32_t lowcode = StringToCode(low.AsStringView());
-        uint32_t highcode =
-            (lowcode & 0xffffff00) | (StringToCode(high.AsStringView()) & 0xff);
-        if (highcode == (uint32_t)-1) {
-          break;
-        }
-        ByteString start(parser.GetWord());
-        if (start == "[") {
-          for (uint32_t code = lowcode; code <= highcode; code++) {
-            ByteString dest(parser.GetWord());
-            WideString destcode = StringToWideString(dest.AsStringView());
-            int len = destcode.GetLength();
-            if (len == 0) {
-              continue;
-            }
-            if (len == 1) {
-              m_Map[code] = destcode[0];
-            } else {
-              m_Map[code] = GetUnicode();
-              m_MultiCharBuf.AppendChar(destcode.GetLength());
-              m_MultiCharBuf << destcode;
-            }
-          }
-          parser.GetWord();
-        } else {
-          WideString destcode = StringToWideString(start.AsStringView());
-          int len = destcode.GetLength();
-          uint32_t value = 0;
-          if (len == 1) {
-            value = StringToCode(start.AsStringView());
-            for (uint32_t code = lowcode; code <= highcode; code++) {
-              m_Map[code] = value++;
-            }
-          } else {
-            for (uint32_t code = lowcode; code <= highcode; code++) {
-              WideString retcode;
-              if (code == lowcode) {
-                retcode = destcode;
-              } else {
-                retcode = StringDataAdd(destcode);
-              }
-              m_Map[code] = GetUnicode();
-              m_MultiCharBuf.AppendChar(retcode.GetLength());
-              m_MultiCharBuf << retcode;
-              destcode = std::move(retcode);
-            }
-          }
-        }
-      }
-    } else if (word == "/Adobe-Korea1-UCS2") {
+
+    if (word == "beginbfchar")
+      HandleBeginBFChar(&parser);
+    else if (word == "beginbfrange")
+      HandleBeginBFRange(&parser);
+    else if (word == "/Adobe-Korea1-UCS2")
       cid_set = CIDSET_KOREA1;
-    } else if (word == "/Adobe-Japan1-UCS2") {
+    else if (word == "/Adobe-Japan1-UCS2")
       cid_set = CIDSET_JAPAN1;
-    } else if (word == "/Adobe-CNS1-UCS2") {
+    else if (word == "/Adobe-CNS1-UCS2")
       cid_set = CIDSET_CNS1;
-    } else if (word == "/Adobe-GB1-UCS2") {
+    else if (word == "/Adobe-GB1-UCS2")
       cid_set = CIDSET_GB1;
-    }
   }
   if (cid_set) {
-    m_pBaseMap =
-        CPDF_FontGlobals::GetInstance()->GetCMapManager()->GetCID2UnicodeMap(
-            cid_set);
+    auto* manager = CPDF_FontGlobals::GetInstance()->GetCMapManager();
+    m_pBaseMap = manager->GetCID2UnicodeMap(cid_set);
+  }
+}
+
+void CPDF_ToUnicodeMap::HandleBeginBFChar(CPDF_SimpleParser* pParser) {
+  while (1) {
+    ByteStringView word = pParser->GetWord();
+    if (word.IsEmpty() || word == "endbfchar")
+      return;
+
+    SetCode(StringToCode(word), StringToWideString(pParser->GetWord()));
+  }
+}
+
+void CPDF_ToUnicodeMap::HandleBeginBFRange(CPDF_SimpleParser* pParser) {
+  while (1) {
+    ByteStringView low = pParser->GetWord();
+    if (low.IsEmpty() || low == "endbfrange")
+      return;
+
+    ByteStringView high = pParser->GetWord();
+    uint32_t lowcode = StringToCode(low);
+    uint32_t highcode = (lowcode & 0xffffff00) | (StringToCode(high) & 0xff);
+    if (highcode == 0xffffffff)
+      return;
+
+    ByteStringView start = pParser->GetWord();
+    if (start == "[") {
+      for (uint32_t code = lowcode; code <= highcode; code++)
+        SetCode(code, StringToWideString(pParser->GetWord()));
+      pParser->GetWord();
+      continue;
+    }
+
+    WideString destcode = StringToWideString(start);
+    if (destcode.GetLength() == 1) {
+      uint32_t value = StringToCode(start);
+      for (uint32_t code = lowcode; code <= highcode; code++)
+        m_Map[code] = value++;
+    } else {
+      for (uint32_t code = lowcode; code <= highcode; code++) {
+        WideString retcode =
+            code == lowcode ? destcode : StringDataAdd(destcode);
+        m_Map[code] = GetUnicode();
+        m_MultiCharBuf.AppendChar(retcode.GetLength());
+        m_MultiCharBuf << retcode;
+        destcode = std::move(retcode);
+      }
+    }
+  }
+}
+
+uint32_t CPDF_ToUnicodeMap::GetUnicode() const {
+  FX_SAFE_UINT32 uni = m_MultiCharBuf.GetLength();
+  uni = uni * 0x10000 + 0xffff;
+  return uni.ValueOrDefault(0);
+}
+
+void CPDF_ToUnicodeMap::SetCode(uint32_t srccode, WideString destcode) {
+  size_t len = destcode.GetLength();
+  if (len == 0)
+    return;
+
+  if (len == 1) {
+    m_Map[srccode] = destcode[0];
   } else {
-    m_pBaseMap = nullptr;
+    m_Map[srccode] = GetUnicode();
+    m_MultiCharBuf.AppendChar(len);
+    m_MultiCharBuf << destcode;
   }
 }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_tounicodemap.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_tounicodemap.h
index 7be9d19ef35..e3d04ed48c0 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_tounicodemap.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_tounicodemap.h
@@ -13,15 +13,14 @@
 #include "core/fxcrt/unowned_ptr.h"
 
 class CPDF_CID2UnicodeMap;
+class CPDF_SimpleParser;
 class CPDF_Stream;
 
 class CPDF_ToUnicodeMap {
  public:
-  CPDF_ToUnicodeMap();
+  explicit CPDF_ToUnicodeMap(const CPDF_Stream* pStream);
   ~CPDF_ToUnicodeMap();
 
-  void Load(const CPDF_Stream* pStream);
-
   WideString Lookup(uint32_t charcode) const;
   uint32_t ReverseLookup(wchar_t unicode) const;
 
@@ -32,7 +31,11 @@ class CPDF_ToUnicodeMap {
   static uint32_t StringToCode(ByteStringView str);
   static WideString StringToWideString(ByteStringView str);
 
-  uint32_t GetUnicode();
+  void Load(const CPDF_Stream* pStream);
+  void HandleBeginBFChar(CPDF_SimpleParser* pParser);
+  void HandleBeginBFRange(CPDF_SimpleParser* pParser);
+  uint32_t GetUnicode() const;
+  void SetCode(uint32_t srccode, WideString destcode);
 
   std::map<uint32_t, uint32_t> m_Map;
   UnownedPtr<const CPDF_CID2UnicodeMap> m_pBaseMap;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_truetypefont.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_truetypefont.h
index 158a5df85cc..caa16251970 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_truetypefont.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_truetypefont.h
@@ -12,7 +12,9 @@
 
 class CPDF_TrueTypeFont final : public CPDF_SimpleFont {
  public:
-  CPDF_TrueTypeFont(CPDF_Document* pDocument, CPDF_Dictionary* pFontDict);
+  template <typename T, typename... Args>
+  friend RetainPtr<T> pdfium::MakeRetain(Args&&... args);
+
   ~CPDF_TrueTypeFont() override;
 
   // CPDF_Font:
@@ -21,6 +23,8 @@ class CPDF_TrueTypeFont final : public CPDF_SimpleFont {
   CPDF_TrueTypeFont* AsTrueTypeFont() override;
 
  private:
+  CPDF_TrueTypeFont(CPDF_Document* pDocument, CPDF_Dictionary* pFontDict);
+
   // CPDF_Font:
   bool Load() override;
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type1font.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type1font.cpp
index 4660458c93b..04dd7c2d63a 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type1font.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type1font.cpp
@@ -86,7 +86,7 @@ CPDF_Type1Font* CPDF_Type1Font::AsType1Font() {
 }
 
 bool CPDF_Type1Font::Load() {
-  m_Base14Font = CFX_FontMapper::GetStandardFontName(&m_BaseFont);
+  m_Base14Font = CFX_FontMapper::GetStandardFontName(&m_BaseFontName);
   if (!IsBase14Font())
     return LoadCommon();
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type1font.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type1font.h
index eb01ec716a2..79dfe31df70 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type1font.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type1font.h
@@ -14,7 +14,9 @@
 
 class CPDF_Type1Font final : public CPDF_SimpleFont {
  public:
-  CPDF_Type1Font(CPDF_Document* pDocument, CPDF_Dictionary* pFontDict);
+  template <typename T, typename... Args>
+  friend RetainPtr<T> pdfium::MakeRetain(Args&&... args);
+
   ~CPDF_Type1Font() override;
 
   // CPDF_Font:
@@ -28,6 +30,8 @@ class CPDF_Type1Font final : public CPDF_SimpleFont {
   bool IsBase14Font() const { return m_Base14Font.has_value(); }
 
  private:
+  CPDF_Type1Font(CPDF_Document* pDocument, CPDF_Dictionary* pFontDict);
+
   // CPDF_Font:
   bool Load() override;
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3char.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3char.cpp
index 1bf5ebb3a51..7d71e8c44e6 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3char.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3char.cpp
@@ -58,6 +58,11 @@ void CPDF_Type3Char::InitializeFromStreamData(bool bColored,
   m_BBox.top = FXSYS_round(TextUnitToGlyphUnit(pData[5]));
 }
 
+void CPDF_Type3Char::WillBeDestroyed() {
+  // Break cycles.
+  m_pForm.reset();
+}
+
 void CPDF_Type3Char::Transform(CPDF_Font::FormIface* pForm,
                                const CFX_Matrix& matrix) {
   m_Width = m_Width * matrix.GetXUnit() + 0.5f;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3char.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3char.h
index 05ade5f8006..ca8345206fd 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3char.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3char.h
@@ -29,6 +29,7 @@ class CPDF_Type3Char {
   bool LoadBitmapFromSoleImageOfForm();
   void InitializeFromStreamData(bool bColored, const float* pData);
   void Transform(CPDF_Font::FormIface* pForm, const CFX_Matrix& matrix);
+  void WillBeDestroyed();
 
   RetainPtr<CFX_DIBitmap> GetBitmap();
   const RetainPtr<CFX_DIBitmap>& GetBitmap() const;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3font.cpp b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3font.cpp
index 9983f8a3537..7e2e59d5ce3 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3font.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3font.cpp
@@ -45,6 +45,15 @@ CPDF_Type3Font* CPDF_Type3Font::AsType3Font() {
   return this;
 }
 
+void CPDF_Type3Font::WillBeDestroyed() {
+  // Last reference to |this| may be through one of its CPDF_Type3Chars.
+  RetainPtr<CPDF_Font> protector(this);
+  for (const auto& item : m_CacheMap) {
+    if (item.second)
+      item.second->WillBeDestroyed();
+  }
+}
+
 bool CPDF_Type3Font::Load() {
   m_pFontResources.Reset(m_pFontDict->GetDictFor("Resources"));
   const CPDF_Array* pMatrix = m_pFontDict->GetArrayFor("FontMatrix");
diff --git a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3font.h b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3font.h
index 68e0e927850..1ef469bb694 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3font.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/font/cpdf_type3font.h
@@ -22,15 +22,16 @@ class CPDF_Type3Char;
 
 class CPDF_Type3Font final : public CPDF_SimpleFont {
  public:
-  CPDF_Type3Font(CPDF_Document* pDocument,
-                 CPDF_Dictionary* pFontDict,
-                 FormFactoryIface* pFormFactory);
+  template <typename T, typename... Args>
+  friend RetainPtr<T> pdfium::MakeRetain(Args&&... args);
+
   ~CPDF_Type3Font() override;
 
   // CPDF_Font:
   bool IsType3Font() const override;
   const CPDF_Type3Font* AsType3Font() const override;
   CPDF_Type3Font* AsType3Font() override;
+  void WillBeDestroyed() override;
   uint32_t GetCharWidthF(uint32_t charcode) override;
   FX_RECT GetCharBBox(uint32_t charcode) override;
 
@@ -43,6 +44,10 @@ class CPDF_Type3Font final : public CPDF_SimpleFont {
   CFX_Matrix& GetFontMatrix() { return m_FontMatrix; }
 
  private:
+  CPDF_Type3Font(CPDF_Document* pDocument,
+                 CPDF_Dictionary* pFontDict,
+                 FormFactoryIface* pFormFactory);
+
   // CPDF_Font:
   bool Load() override;
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/BUILD.gn b/chromium/third_party/pdfium/core/fpdfapi/page/BUILD.gn
index edb73b89c9e..1ed90949251 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/BUILD.gn
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/BUILD.gn
@@ -10,6 +10,8 @@ jumbo_source_set("page") {
   sources = [
     "cpdf_allstates.cpp",
     "cpdf_allstates.h",
+    "cpdf_annotcontext.cpp",
+    "cpdf_annotcontext.h",
     "cpdf_clippath.cpp",
     "cpdf_clippath.h",
     "cpdf_color.cpp",
@@ -24,11 +26,12 @@ jumbo_source_set("page") {
     "cpdf_contentmarks.h",
     "cpdf_contentparser.cpp",
     "cpdf_contentparser.h",
-    "cpdf_countedobject.h",
     "cpdf_devicecs.cpp",
     "cpdf_devicecs.h",
     "cpdf_dibbase.cpp",
     "cpdf_dibbase.h",
+    "cpdf_dibtransferfunc.cpp",
+    "cpdf_dibtransferfunc.h",
     "cpdf_docpagedata.cpp",
     "cpdf_docpagedata.h",
     "cpdf_expintfunc.cpp",
@@ -91,6 +94,8 @@ jumbo_source_set("page") {
     "cpdf_textstate.h",
     "cpdf_tilingpattern.cpp",
     "cpdf_tilingpattern.h",
+    "cpdf_transferfunc.cpp",
+    "cpdf_transferfunc.h",
     "cpdf_transparency.cpp",
     "cpdf_transparency.h",
     "ipdf_page.h",
@@ -98,7 +103,6 @@ jumbo_source_set("page") {
   configs += [ "../../../:pdfium_core_config" ]
   deps = [
     "../../../constants",
-    "../../fdrm",
     "../../fxcodec",
     "../../fxcrt",
     "../../fxge",
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_allstates.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_allstates.cpp
index 2485a067ca5..a12ce33dd2e 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_allstates.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_allstates.cpp
@@ -10,6 +10,7 @@
 #include <utility>
 #include <vector>
 
+#include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/page/cpdf_pageobjectholder.h"
 #include "core/fpdfapi/page/cpdf_streamcontentparser.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdf_annotcontext.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_annotcontext.cpp
index f363ef21f33..1078e461666 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdf_annotcontext.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_annotcontext.cpp
@@ -4,7 +4,7 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#include "fpdfsdk/cpdf_annotcontext.h"
+#include "core/fpdfapi/page/cpdf_annotcontext.h"
 
 #include "core/fpdfapi/page/cpdf_form.h"
 #include "core/fpdfapi/page/cpdf_page.h"
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdf_annotcontext.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_annotcontext.h
index 0561357815e..ee9f3fc10b8 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdf_annotcontext.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_annotcontext.h
@@ -4,8 +4,8 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#ifndef FPDFSDK_CPDF_ANNOTCONTEXT_H_
-#define FPDFSDK_CPDF_ANNOTCONTEXT_H_
+#ifndef CORE_FPDFAPI_PAGE_CPDF_ANNOTCONTEXT_H_
+#define CORE_FPDFAPI_PAGE_CPDF_ANNOTCONTEXT_H_
 
 #include <memory>
 
@@ -38,4 +38,4 @@ class CPDF_AnnotContext {
   UnownedPtr<CPDF_Page> const m_pPage;
 };
 
-#endif  // FPDFSDK_CPDF_ANNOTCONTEXT_H_
+#endif  // CORE_FPDFAPI_PAGE_CPDF_ANNOTCONTEXT_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_colorspace.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_colorspace.cpp
index 3f88149844a..c20abba509a 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_colorspace.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_colorspace.cpp
@@ -557,7 +557,7 @@ RetainPtr<CPDF_ColorSpace> CPDF_ColorSpace::Load(
     default:
       return nullptr;
   }
-  pCS->m_pArray = pArray;
+  pCS->m_pArray.Reset(pArray);
   pCS->m_nComponents = pCS->v_Load(pDoc, pArray, pVisited);
   if (pCS->m_nComponents == 0)
     return nullptr;
@@ -902,15 +902,7 @@ void CPDF_LabCS::TranslateImageLine(uint8_t* pDestBuf,
 CPDF_ICCBasedCS::CPDF_ICCBasedCS(CPDF_Document* pDoc)
     : CPDF_ColorSpace(pDoc, PDFCS_ICCBASED) {}
 
-CPDF_ICCBasedCS::~CPDF_ICCBasedCS() {
-  if (m_pProfile && m_pDocument) {
-    const CPDF_Stream* pStream = m_pProfile->GetStream();
-    m_pProfile.Reset();  // Give up our reference first.
-    auto* pPageData = CPDF_DocPageData::FromDocument(m_pDocument.Get());
-    if (pPageData)
-      pPageData->MaybePurgeIccProfile(pStream);
-  }
-}
+CPDF_ICCBasedCS::~CPDF_ICCBasedCS() = default;
 
 uint32_t CPDF_ICCBasedCS::v_Load(CPDF_Document* pDoc,
                                  const CPDF_Array* pArray,
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_colorspace.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_colorspace.h
index eb43e543fbb..c8751bd92b4 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_colorspace.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_colorspace.h
@@ -128,7 +128,7 @@ class CPDF_ColorSpace : public Retainable, public Observable {
   void SetComponentsForStockCS(uint32_t nComponents);
 
   UnownedPtr<CPDF_Document> const m_pDocument;
-  UnownedPtr<const CPDF_Array> m_pArray;
+  RetainPtr<const CPDF_Array> m_pArray;
   const int m_Family;
   uint32_t m_dwStdConversion = 0;
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_contentparser.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_contentparser.cpp
index 70b9bd42f19..0caafef8568 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_contentparser.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_contentparser.cpp
@@ -25,7 +25,7 @@
 CPDF_ContentParser::CPDF_ContentParser(CPDF_Page* pPage)
     : m_CurrentStage(Stage::kGetContent), m_pObjectHolder(pPage) {
   ASSERT(pPage);
-  if (!pPage->GetDocument() || !pPage->GetDict()) {
+  if (!pPage->GetDocument()) {
     m_CurrentStage = Stage::kComplete;
     return;
   }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_countedobject.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_countedobject.h
deleted file mode 100644
index cb39616f2bb..00000000000
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_countedobject.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2016 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef CORE_FPDFAPI_PAGE_CPDF_COUNTEDOBJECT_H_
-#define CORE_FPDFAPI_PAGE_CPDF_COUNTEDOBJECT_H_
-
-#include <memory>
-
-#include "core/fxcrt/fx_system.h"
-
-template <class T>
-class CPDF_CountedObject {
- public:
-  explicit CPDF_CountedObject(std::unique_ptr<T> ptr)
-      : m_nCount(1), m_pObj(ptr.release()) {}
-  void reset(std::unique_ptr<T> ptr) {  // CAUTION: tosses prior ref counts.
-    m_nCount = 1;
-    m_pObj = ptr.release();
-  }
-  void clear() {  // Now you're all weak ptrs ...
-    // Guard against accidental re-entry.
-    T* pObj = m_pObj;
-    m_pObj = nullptr;
-    delete pObj;
-  }
-  T* get() const { return m_pObj; }
-  T* AddRef() {
-    ASSERT(m_pObj);
-    ++m_nCount;
-    return m_pObj;
-  }
-  void RemoveRef() {
-    if (m_nCount)
-      --m_nCount;
-  }
-  size_t use_count() const { return m_nCount; }
-
- protected:
-  size_t m_nCount;
-  T* m_pObj;
-};
-
-#endif  // CORE_FPDFAPI_PAGE_CPDF_COUNTEDOBJECT_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibbase.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibbase.cpp
index 2f998f2eebb..e23fe66f73d 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibbase.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibbase.cpp
@@ -102,11 +102,11 @@ bool CPDF_DIBBase::Load(CPDF_Document* pDoc, const CPDF_Stream* pStream) {
     return false;
 
   m_pDocument = pDoc;
-  m_pDict = pStream->GetDict();
+  m_pDict.Reset(pStream->GetDict());
   if (!m_pDict)
     return false;
 
-  m_pStream = pStream;
+  m_pStream.Reset(pStream);
   m_Width = m_pDict->GetIntegerFor("Width");
   m_Height = m_pDict->GetIntegerFor("Height");
   if (m_Width <= 0 || m_Height <= 0 || m_Width > kMaxImageDimension ||
@@ -215,8 +215,8 @@ CPDF_DIBBase::LoadState CPDF_DIBBase::StartLoadDIBBase(
     return LoadState::kFail;
 
   m_pDocument = pDoc;
-  m_pDict = pStream->GetDict();
-  m_pStream = pStream;
+  m_pDict.Reset(pStream->GetDict());
+  m_pStream.Reset(pStream);
   m_bStdCS = bStdCS;
   m_bHasMask = bHasMask;
   m_Width = m_pDict->GetIntegerFor("Width");
@@ -663,9 +663,9 @@ RetainPtr<CFX_DIBitmap> CPDF_DIBBase::LoadJpxBitmap() {
 
 CPDF_DIBBase::LoadState CPDF_DIBBase::StartLoadMask() {
   m_MatteColor = 0XFFFFFFFF;
-  m_pMaskStream = m_pDict->GetStreamFor("SMask");
+  m_pMaskStream.Reset(m_pDict->GetStreamFor("SMask"));
   if (!m_pMaskStream) {
-    m_pMaskStream = ToStream(m_pDict->GetDirectObjectFor("Mask"));
+    m_pMaskStream.Reset(ToStream(m_pDict->GetDirectObjectFor("Mask")));
     return m_pMaskStream ? StartLoadMaskDIB() : LoadState::kSuccess;
   }
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibbase.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibbase.h
index 381a64ec5a3..0e1da42454c 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibbase.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibbase.h
@@ -12,7 +12,6 @@
 
 #include "core/fpdfapi/page/cpdf_clippath.h"
 #include "core/fpdfapi/page/cpdf_colorspace.h"
-#include "core/fpdfapi/page/cpdf_countedobject.h"
 #include "core/fpdfapi/page/cpdf_graphicstates.h"
 #include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
@@ -127,8 +126,8 @@ class CPDF_DIBBase final : public CFX_DIBBase {
   bool TransMask() const;
 
   UnownedPtr<CPDF_Document> m_pDocument;
-  UnownedPtr<const CPDF_Stream> m_pStream;
-  UnownedPtr<const CPDF_Dictionary> m_pDict;
+  RetainPtr<const CPDF_Stream> m_pStream;
+  RetainPtr<const CPDF_Dictionary> m_pDict;
   RetainPtr<CPDF_StreamAcc> m_pStreamAcc;
   RetainPtr<CPDF_ColorSpace> m_pColorSpace;
   uint32_t m_Family = 0;
@@ -155,7 +154,7 @@ class CPDF_DIBBase final : public CFX_DIBBase {
   // Must come after |m_pCachedBitmap|.
   std::unique_ptr<fxcodec::Jbig2Context> m_pJbig2Context;
 
-  UnownedPtr<const CPDF_Stream> m_pMaskStream;
+  RetainPtr<const CPDF_Stream> m_pMaskStream;
   LoadState m_Status = LoadState::kFail;
 };
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_dibtransferfunc.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibtransferfunc.cpp
index 58dbcf06a02..cab90b35244 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_dibtransferfunc.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibtransferfunc.cpp
@@ -4,13 +4,13 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#include "core/fpdfapi/render/cpdf_dibtransferfunc.h"
+#include "core/fpdfapi/page/cpdf_dibtransferfunc.h"
 
 #include <vector>
 
 #include "build/build_config.h"
+#include "core/fpdfapi/page/cpdf_transferfunc.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
-#include "core/fpdfapi/render/cpdf_transferfunc.h"
 #include "third_party/base/compiler_specific.h"
 
 CPDF_DIBTransferFunc::CPDF_DIBTransferFunc(
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_dibtransferfunc.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibtransferfunc.h
index 3ad9023a7c3..35072e20c2d 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_dibtransferfunc.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_dibtransferfunc.h
@@ -4,8 +4,8 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#ifndef CORE_FPDFAPI_RENDER_CPDF_DIBTRANSFERFUNC_H_
-#define CORE_FPDFAPI_RENDER_CPDF_DIBTRANSFERFUNC_H_
+#ifndef CORE_FPDFAPI_PAGE_CPDF_DIBTRANSFERFUNC_H_
+#define CORE_FPDFAPI_PAGE_CPDF_DIBTRANSFERFUNC_H_
 
 #include <vector>
 
@@ -41,4 +41,4 @@ class CPDF_DIBTransferFunc final : public CFX_FilteredDIB {
   const pdfium::span<const uint8_t> m_RampB;
 };
 
-#endif  // CORE_FPDFAPI_RENDER_CPDF_DIBTRANSFERFUNC_H_
+#endif  // CORE_FPDFAPI_PAGE_CPDF_DIBTRANSFERFUNC_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_docpagedata.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_docpagedata.cpp
index 978de5c33c6..bf7b4622fc4 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_docpagedata.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_docpagedata.cpp
@@ -13,7 +13,6 @@
 #include <vector>
 
 #include "build/build_config.h"
-#include "core/fdrm/fx_crypt.h"
 #include "core/fpdfapi/font/cpdf_type1font.h"
 #include "core/fpdfapi/page/cpdf_form.h"
 #include "core/fpdfapi/page/cpdf_iccprofile.h"
@@ -165,98 +164,44 @@ CPDF_DocPageData* CPDF_DocPageData::FromDocument(const CPDF_Document* pDoc) {
 CPDF_DocPageData::CPDF_DocPageData() = default;
 
 CPDF_DocPageData::~CPDF_DocPageData() {
-  Clear(false);
-  Clear(true);
-
-  m_PatternMap.clear();
-
-  for (auto& it : m_FontMap)
-    delete it.second;
-
-  m_FontMap.clear();
+  for (auto& it : m_FontMap) {
+    if (it.second)
+      it.second->WillBeDestroyed();
+  }
 }
 
 void CPDF_DocPageData::ClearStockFont() {
   CPDF_PageModule::GetInstance()->ClearStockFont(GetDocument());
 }
 
-void CPDF_DocPageData::Clear(bool bForceRelease) {
-  m_bForceClear = bForceRelease;
-
-  m_PatternMap.clear();
-
-  for (auto& it : m_FontMap) {
-    CPDF_CountedFont* fontData = it.second;
-    if (!fontData->get())
-      continue;
-    if (bForceRelease || fontData->use_count() < 2) {
-      fontData->clear();
-    }
-  }
-
-  m_ColorSpaceMap.clear();
-
-  for (auto it = m_IccProfileMap.begin(); it != m_IccProfileMap.end();) {
-    auto curr_it = it++;
-    if (bForceRelease || curr_it->second->HasOneRef()) {
-      for (auto hash_it = m_HashProfileMap.begin();
-           hash_it != m_HashProfileMap.end(); ++hash_it) {
-        if (curr_it->first == hash_it->second) {
-          m_HashProfileMap.erase(hash_it);
-          break;
-        }
-      }
-      m_IccProfileMap.erase(curr_it);
-    }
-  }
-
-  for (auto it = m_FontFileMap.begin(); it != m_FontFileMap.end();) {
-    auto curr_it = it++;
-    if (bForceRelease || curr_it->second->HasOneRef())
-      m_FontFileMap.erase(curr_it);
-  }
-
-  m_ImageMap.clear();
-}
-
-CPDF_Font* CPDF_DocPageData::GetFont(CPDF_Dictionary* pFontDict) {
+RetainPtr<CPDF_Font> CPDF_DocPageData::GetFont(CPDF_Dictionary* pFontDict) {
   if (!pFontDict)
     return nullptr;
 
-  CPDF_CountedFont* pFontData = nullptr;
   auto it = m_FontMap.find(pFontDict);
-  if (it != m_FontMap.end()) {
-    pFontData = it->second;
-    if (pFontData->get()) {
-      return pFontData->AddRef();
-    }
-  }
-  std::unique_ptr<CPDF_Font> pFont =
+  if (it != m_FontMap.end() && it->second)
+    return pdfium::WrapRetain(it->second.Get());
+
+  RetainPtr<CPDF_Font> pFont =
       CPDF_Font::Create(GetDocument(), pFontDict, this);
   if (!pFont)
     return nullptr;
 
-  if (pFontData) {
-    pFontData->reset(std::move(pFont));
-  } else {
-    pFontData = new CPDF_CountedFont(std::move(pFont));
-    m_FontMap[pFontDict] = pFontData;
-  }
-  return pFontData->AddRef();
+  m_FontMap[pFontDict].Reset(pFont.Get());
+  return pFont;
 }
 
-CPDF_Font* CPDF_DocPageData::GetStandardFont(
+RetainPtr<CPDF_Font> CPDF_DocPageData::GetStandardFont(
     const ByteString& fontName,
     const CPDF_FontEncoding* pEncoding) {
   if (fontName.IsEmpty())
     return nullptr;
 
   for (auto& it : m_FontMap) {
-    CPDF_CountedFont* fontData = it.second;
-    CPDF_Font* pFont = fontData->get();
+    CPDF_Font* pFont = it.second.Get();
     if (!pFont)
       continue;
-    if (pFont->GetBaseFont() != fontName)
+    if (pFont->GetBaseFontName() != fontName)
       continue;
     if (pFont->IsEmbedded())
       continue;
@@ -269,7 +214,7 @@ CPDF_Font* CPDF_DocPageData::GetStandardFont(
     if (pEncoding && !pT1Font->GetEncoding()->IsIdentical(pEncoding))
       continue;
 
-    return fontData->AddRef();
+    return pdfium::WrapRetain(pFont);
   }
 
   CPDF_Dictionary* pDict = GetDocument()->NewIndirect<CPDF_Dictionary>();
@@ -282,34 +227,12 @@ CPDF_Font* CPDF_DocPageData::GetStandardFont(
   }
 
   // Note: NULL FormFactoryIface OK since known Type1 font from above.
-  std::unique_ptr<CPDF_Font> pFont =
-      CPDF_Font::Create(GetDocument(), pDict, nullptr);
+  RetainPtr<CPDF_Font> pFont = CPDF_Font::Create(GetDocument(), pDict, nullptr);
   if (!pFont)
     return nullptr;
 
-  CPDF_CountedFont* fontData = new CPDF_CountedFont(std::move(pFont));
-  m_FontMap[pDict] = fontData;
-  return fontData->AddRef();
-}
-
-void CPDF_DocPageData::ReleaseFont(const CPDF_Dictionary* pFontDict) {
-  if (!pFontDict)
-    return;
-
-  auto it = m_FontMap.find(pFontDict);
-  if (it == m_FontMap.end())
-    return;
-
-  CPDF_CountedFont* pFontData = it->second;
-  if (!pFontData->get())
-    return;
-
-  pFontData->RemoveRef();
-  if (pFontData->use_count() > 1)
-    return;
-
-  // We have font data only in m_FontMap cache. Clean it.
-  pFontData->clear();
+  m_FontMap[pDict].Reset(pFont.Get());
+  return pFont;
 }
 
 RetainPtr<CPDF_ColorSpace> CPDF_DocPageData::GetColorSpace(
@@ -458,36 +381,26 @@ RetainPtr<CPDF_IccProfile> CPDF_DocPageData::GetIccProfile(
     return nullptr;
 
   auto it = m_IccProfileMap.find(pProfileStream);
-  if (it != m_IccProfileMap.end())
-    return it->second;
+  if (it != m_IccProfileMap.end() && it->second)
+    return pdfium::WrapRetain(it->second.Get());
 
   auto pAccessor = pdfium::MakeRetain<CPDF_StreamAcc>(pProfileStream);
   pAccessor->LoadAllDataFiltered();
 
-  uint8_t digest[20];
-  CRYPT_SHA1Generate(pAccessor->GetData(), pAccessor->GetSize(), digest);
-
-  ByteString bsDigest(digest, 20);
+  ByteString bsDigest = pAccessor->ComputeDigest();
   auto hash_it = m_HashProfileMap.find(bsDigest);
   if (hash_it != m_HashProfileMap.end()) {
-    auto it_copied_stream = m_IccProfileMap.find(hash_it->second);
-    if (it_copied_stream != m_IccProfileMap.end())
-      return it_copied_stream->second;
+    auto it_copied_stream = m_IccProfileMap.find(hash_it->second.Get());
+    if (it_copied_stream != m_IccProfileMap.end() && it_copied_stream->second)
+      return pdfium::WrapRetain(it_copied_stream->second.Get());
   }
   auto pProfile =
       pdfium::MakeRetain<CPDF_IccProfile>(pProfileStream, pAccessor->GetSpan());
-  m_IccProfileMap[pProfileStream] = pProfile;
-  m_HashProfileMap[bsDigest] = pProfileStream;
+  m_IccProfileMap[pProfileStream].Reset(pProfile.Get());
+  m_HashProfileMap[bsDigest].Reset(pProfileStream);
   return pProfile;
 }
 
-void CPDF_DocPageData::MaybePurgeIccProfile(const CPDF_Stream* pProfileStream) {
-  ASSERT(pProfileStream);
-  auto it = m_IccProfileMap.find(pProfileStream);
-  if (it != m_IccProfileMap.end() && it->second->HasOneRef())
-    m_IccProfileMap.erase(it);
-}
-
 RetainPtr<CPDF_StreamAcc> CPDF_DocPageData::GetFontFileStreamAcc(
     const CPDF_Stream* pFontStream) {
   ASSERT(pFontStream);
@@ -530,7 +443,7 @@ std::unique_ptr<CPDF_Font::FormIface> CPDF_DocPageData::CreateForm(
   return pdfium::MakeUnique<CPDF_Form>(pDocument, pPageResources, pFormStream);
 }
 
-CPDF_Font* CPDF_DocPageData::AddStandardFont(
+RetainPtr<CPDF_Font> CPDF_DocPageData::AddStandardFont(
     const char* font,
     const CPDF_FontEncoding* pEncoding) {
   ByteString name(font);
@@ -539,7 +452,8 @@ CPDF_Font* CPDF_DocPageData::AddStandardFont(
   return GetStandardFont(name, pEncoding);
 }
 
-CPDF_Font* CPDF_DocPageData::AddFont(CFX_Font* pFont, int charset) {
+RetainPtr<CPDF_Font> CPDF_DocPageData::AddFont(std::unique_ptr<CFX_Font> pFont,
+                                               int charset) {
   if (!pFont)
     return nullptr;
 
@@ -552,7 +466,7 @@ CPDF_Font* CPDF_DocPageData::AddFont(CFX_Font* pFont, int charset) {
 
   CPDF_Dictionary* pBaseDict = GetDocument()->NewIndirect<CPDF_Dictionary>();
   pBaseDict->SetNewFor<CPDF_Name>("Type", "Font");
-  auto pEncoding = pdfium::MakeUnique<CFX_UnicodeEncoding>(pFont);
+  auto pEncoding = pdfium::MakeUnique<CFX_UnicodeEncoding>(pFont.get());
   CPDF_Dictionary* pFontDict = pBaseDict;
   if (!bCJK) {
     auto pWidths = pdfium::MakeRetain<CPDF_Array>();
@@ -585,8 +499,8 @@ CPDF_Font* CPDF_DocPageData::AddFont(CFX_Font* pFont, int charset) {
   } else {
     pFontDict = ProcessbCJK(
         pBaseDict, charset, basefont,
-        [pFont, &pEncoding](wchar_t start, wchar_t end, CPDF_Array* widthArr) {
-          InsertWidthArray1(pFont, pEncoding.get(), start, end, widthArr);
+        [&pFont, &pEncoding](wchar_t start, wchar_t end, CPDF_Array* widthArr) {
+          InsertWidthArray1(pFont.get(), pEncoding.get(), start, end, widthArr);
         });
   }
   int italicangle =
@@ -623,7 +537,7 @@ CPDF_Font* CPDF_DocPageData::AddFont(CFX_Font* pFont, int charset) {
 }
 
 #if defined(OS_WIN)
-CPDF_Font* CPDF_DocPageData::AddWindowsFont(LOGFONTA* pLogFont) {
+RetainPtr<CPDF_Font> CPDF_DocPageData::AddWindowsFont(LOGFONTA* pLogFont) {
   pLogFont->lfHeight = -1000;
   pLogFont->lfWidth = 0;
   HGDIOBJ hFont = CreateFontIndirectA(pLogFont);
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_docpagedata.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_docpagedata.h
index d774501c28d..bb9059cce1f 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_docpagedata.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_docpagedata.h
@@ -13,10 +13,10 @@
 
 #include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/page/cpdf_colorspace.h"
-#include "core/fpdfapi/page/cpdf_countedobject.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_string.h"
+#include "core/fxcrt/observed_ptr.h"
 #include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 
@@ -50,19 +50,16 @@ class CPDF_DocPageData : public CPDF_Document::PageDataIface,
       CPDF_Dictionary* pPageResources,
       CPDF_Stream* pFormStream) override;
 
-  void Clear(bool bForceRelease);
   bool IsForceClear() const { return m_bForceClear; }
 
-  CPDF_Font* AddFont(CFX_Font* pFont, int charset);
-  CPDF_Font* GetFont(CPDF_Dictionary* pFontDict);
-  CPDF_Font* AddStandardFont(const char* font,
-                             const CPDF_FontEncoding* pEncoding);
-  CPDF_Font* GetStandardFont(const ByteString& fontName,
-                             const CPDF_FontEncoding* pEncoding);
-  void ReleaseFont(const CPDF_Dictionary* pFontDict);
-
+  RetainPtr<CPDF_Font> AddFont(std::unique_ptr<CFX_Font> pFont, int charset);
+  RetainPtr<CPDF_Font> GetFont(CPDF_Dictionary* pFontDict);
+  RetainPtr<CPDF_Font> AddStandardFont(const char* font,
+                                       const CPDF_FontEncoding* pEncoding);
+  RetainPtr<CPDF_Font> GetStandardFont(const ByteString& fontName,
+                                       const CPDF_FontEncoding* pEncoding);
 #if defined(OS_WIN)
-  CPDF_Font* AddWindowsFont(LOGFONTA* pLogFont);
+  RetainPtr<CPDF_Font> AddWindowsFont(LOGFONTA* pLogFont);
 #endif
 
   // Loads a colorspace.
@@ -85,11 +82,8 @@ class CPDF_DocPageData : public CPDF_Document::PageDataIface,
   void MaybePurgeImage(uint32_t dwStreamObjNum);
 
   RetainPtr<CPDF_IccProfile> GetIccProfile(const CPDF_Stream* pProfileStream);
-  void MaybePurgeIccProfile(const CPDF_Stream* pProfileStream);
 
  private:
-  using CPDF_CountedFont = CPDF_CountedObject<CPDF_Font>;
-
   // Loads a colorspace in a context that might be while loading another
   // colorspace, or even in a recursive call from this method itself. |pVisited|
   // is passed recursively to avoid circular calls involving
@@ -107,15 +101,18 @@ class CPDF_DocPageData : public CPDF_Document::PageDataIface,
       int charset,
       ByteString basefont,
       std::function<void(wchar_t, wchar_t, CPDF_Array*)> Insert);
+  void Clear(bool bForceRelease);
 
   bool m_bForceClear = false;
-  std::map<ByteString, const CPDF_Stream*> m_HashProfileMap;
+
+  // Specific destruction order may be required between maps.
+  std::map<ByteString, RetainPtr<const CPDF_Stream>> m_HashProfileMap;
   std::map<const CPDF_Object*, ObservedPtr<CPDF_ColorSpace>> m_ColorSpaceMap;
   std::map<const CPDF_Stream*, RetainPtr<CPDF_StreamAcc>> m_FontFileMap;
-  std::map<const CPDF_Dictionary*, CPDF_CountedFont*> m_FontMap;
-  std::map<const CPDF_Stream*, RetainPtr<CPDF_IccProfile>> m_IccProfileMap;
-  std::map<uint32_t, RetainPtr<CPDF_Image>> m_ImageMap;
+  std::map<const CPDF_Stream*, ObservedPtr<CPDF_IccProfile>> m_IccProfileMap;
   std::map<const CPDF_Object*, ObservedPtr<CPDF_Pattern>> m_PatternMap;
+  std::map<uint32_t, RetainPtr<CPDF_Image>> m_ImageMap;
+  std::map<const CPDF_Dictionary*, ObservedPtr<CPDF_Font>> m_FontMap;
 };
 
 #endif  // CORE_FPDFAPI_PAGE_CPDF_DOCPAGEDATA_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_generalstate.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_generalstate.cpp
index 9a7d9db6e94..6463b57be45 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_generalstate.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_generalstate.cpp
@@ -6,8 +6,8 @@
 
 #include "core/fpdfapi/page/cpdf_generalstate.h"
 
+#include "core/fpdfapi/page/cpdf_transferfunc.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
-#include "core/fpdfapi/render/cpdf_transferfunc.h"
 
 namespace {
 
@@ -157,7 +157,7 @@ const CPDF_Object* CPDF_GeneralState::GetTR() const {
 }
 
 void CPDF_GeneralState::SetTR(CPDF_Object* pObject) {
-  m_Ref.GetPrivateCopy()->m_pTR = pObject;
+  m_Ref.GetPrivateCopy()->m_pTR.Reset(pObject);
 }
 
 RetainPtr<CPDF_TransferFunc> CPDF_GeneralState::GetTransferFunc() const {
@@ -212,15 +212,15 @@ void CPDF_GeneralState::SetOPMode(int mode) {
 }
 
 void CPDF_GeneralState::SetBG(CPDF_Object* pObject) {
-  m_Ref.GetPrivateCopy()->m_pBG = pObject;
+  m_Ref.GetPrivateCopy()->m_pBG.Reset(pObject);
 }
 
 void CPDF_GeneralState::SetUCR(CPDF_Object* pObject) {
-  m_Ref.GetPrivateCopy()->m_pUCR = pObject;
+  m_Ref.GetPrivateCopy()->m_pUCR.Reset(pObject);
 }
 
 void CPDF_GeneralState::SetHT(CPDF_Object* pObject) {
-  m_Ref.GetPrivateCopy()->m_pHT = pObject;
+  m_Ref.GetPrivateCopy()->m_pHT.Reset(pObject);
 }
 
 void CPDF_GeneralState::SetFlatness(float flatness) {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_generalstate.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_generalstate.h
index fb4bb7f32f4..f374380baa4 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_generalstate.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_generalstate.h
@@ -10,8 +10,8 @@
 #include "constants/transparency.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_string.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/shared_copy_on_write.h"
-#include "core/fxcrt/unowned_ptr.h"
 #include "core/fxge/fx_dib.h"
 
 class CPDF_Object;
@@ -91,7 +91,7 @@ class CPDF_GeneralState {
     CFX_Matrix m_SMaskMatrix;
     float m_StrokeAlpha = 1.0f;
     float m_FillAlpha = 1.0f;
-    UnownedPtr<const CPDF_Object> m_pTR;
+    RetainPtr<const CPDF_Object> m_pTR;
     RetainPtr<CPDF_TransferFunc> m_pTransferFunc;
     CFX_Matrix m_Matrix;
     int m_RenderIntent = 0;
@@ -101,9 +101,9 @@ class CPDF_GeneralState {
     bool m_StrokeOP = false;
     bool m_FillOP = false;
     int m_OPMode = 0;
-    UnownedPtr<const CPDF_Object> m_pBG;
-    UnownedPtr<const CPDF_Object> m_pUCR;
-    UnownedPtr<const CPDF_Object> m_pHT;
+    RetainPtr<const CPDF_Object> m_pBG;
+    RetainPtr<const CPDF_Object> m_pUCR;
+    RetainPtr<const CPDF_Object> m_pHT;
     float m_Flatness = 1.0f;
     float m_Smoothness = 0.0f;
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_iccprofile.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_iccprofile.h
index ffac22fbd99..070f8843c09 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_iccprofile.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_iccprofile.h
@@ -9,17 +9,17 @@
 
 #include <memory>
 
+#include "core/fxcrt/observed_ptr.h"
 #include "core/fxcrt/retain_ptr.h"
-#include "core/fxcrt/unowned_ptr.h"
 #include "third_party/base/span.h"
 
 class CPDF_Stream;
 
 namespace fxcodec {
 class CLcmsCmm;
-}
+}  // namespace fxcodec
 
-class CPDF_IccProfile final : public Retainable {
+class CPDF_IccProfile final : public Retainable, public Observable {
  public:
   template <typename T, typename... Args>
   friend RetainPtr<T> pdfium::MakeRetain(Args&&... args);
@@ -36,9 +36,9 @@ class CPDF_IccProfile final : public Retainable {
   ~CPDF_IccProfile() override;
 
   const bool m_bsRGB;
-  UnownedPtr<const CPDF_Stream> const m_pStream;
-  std::unique_ptr<fxcodec::CLcmsCmm> m_Transform;
   uint32_t m_nSrcComponents = 0;
+  RetainPtr<const CPDF_Stream> const m_pStream;
+  std::unique_ptr<fxcodec::CLcmsCmm> m_Transform;
 };
 
 #endif  // CORE_FPDFAPI_PAGE_CPDF_ICCPROFILE_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_image.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_image.cpp
index eb8d76ecafa..00f81b7d171 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_image.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_image.cpp
@@ -61,7 +61,7 @@ CPDF_Image::CPDF_Image(CPDF_Document* pDoc, uint32_t dwStreamObjNum)
 CPDF_Image::~CPDF_Image() = default;
 
 void CPDF_Image::FinishInitialization(CPDF_Dictionary* pStreamDict) {
-  m_pOC = pStreamDict->GetDictFor("OC");
+  m_pOC.Reset(pStreamDict->GetDictFor("OC"));
   m_bIsMask = !pStreamDict->KeyExist("ColorSpace") ||
               pStreamDict->GetIntegerFor("ImageMask");
   m_bInterpolate = !!pStreamDict->GetIntegerFor("Interpolate");
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_image.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_image.h
index 7bcb6483fa6..f8d0d00f587 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_image.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_image.h
@@ -86,7 +86,7 @@ class CPDF_Image final : public Retainable {
   bool m_bInterpolate = false;
   UnownedPtr<CPDF_Document> const m_pDocument;
   RetainPtr<CPDF_Stream> m_pStream;
-  UnownedPtr<const CPDF_Dictionary> m_pOC;
+  RetainPtr<const CPDF_Dictionary> m_pOC;
 };
 
 #endif  // CORE_FPDFAPI_PAGE_CPDF_IMAGE_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_meshstream.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_meshstream.h
index 58805cd533d..939b192389d 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_meshstream.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_meshstream.h
@@ -68,7 +68,7 @@ class CPDF_MeshStream {
 
   const ShadingType m_type;
   const std::vector<std::unique_ptr<CPDF_Function>>& m_funcs;
-  UnownedPtr<const CPDF_Stream> const m_pShadingStream;
+  RetainPtr<const CPDF_Stream> const m_pShadingStream;
   RetainPtr<CPDF_ColorSpace> const m_pCS;
   uint32_t m_nCoordBits;
   uint32_t m_nComponentBits;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pagemodule.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pagemodule.cpp
index 65aba70072b..705d313fcad 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pagemodule.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pagemodule.cpp
@@ -10,6 +10,7 @@
 #include "core/fpdfapi/page/cpdf_colorspace.h"
 #include "core/fpdfapi/page/cpdf_devicecs.h"
 #include "core/fpdfapi/page/cpdf_patterncs.h"
+#include "core/fxcodec/fx_codec.h"
 
 namespace {
 
@@ -20,6 +21,7 @@ CPDF_PageModule* g_PageModule = nullptr;
 // static
 void CPDF_PageModule::Create() {
   ASSERT(!g_PageModule);
+  fxcodec::ModuleMgr::Create();
   g_PageModule = new CPDF_PageModule();
 }
 
@@ -28,6 +30,7 @@ void CPDF_PageModule::Destroy() {
   ASSERT(g_PageModule);
   delete g_PageModule;
   g_PageModule = nullptr;
+  fxcodec::ModuleMgr::Destroy();
 }
 
 // static
@@ -43,6 +46,7 @@ CPDF_PageModule::CPDF_PageModule()
       m_StockPatternCS(pdfium::MakeRetain<CPDF_PatternCS>(nullptr)) {
   m_StockPatternCS->InitializeStockPattern();
   CPDF_FontGlobals::Create();
+  CPDF_FontGlobals::GetInstance()->LoadEmbeddedMaps();
 }
 
 CPDF_PageModule::~CPDF_PageModule() {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.cpp
index c67e408813b..4f22e880856 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.cpp
@@ -40,8 +40,7 @@ CPDF_PageObjectHolder::CPDF_PageObjectHolder(CPDF_Document* pDoc,
       m_pResources(pResources),
       m_pDict(pDict),
       m_pDocument(pDoc) {
-  // TODO(thestig): Check if |m_pDict| is never a nullptr and simplify
-  // callers that checks for that.
+  ASSERT(m_pDict);
 }
 
 CPDF_PageObjectHolder::~CPDF_PageObjectHolder() = default;
@@ -89,9 +88,6 @@ std::set<int32_t> CPDF_PageObjectHolder::TakeDirtyStreams() {
 }
 
 void CPDF_PageObjectHolder::LoadTransInfo() {
-  if (!m_pDict)
-    return;
-
   CPDF_Dictionary* pGroup = m_pDict->GetDictFor("Group");
   if (!pGroup)
     return;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.h
index 332d912fd1e..70a76b8b698 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_pageobjectholder.h
@@ -66,8 +66,6 @@ class CPDF_PageObjectHolder {
 
   CPDF_Document* GetDocument() const { return m_pDocument.Get(); }
 
-  // TODO(thestig): Can this return nullptr? If not, audit callers and simplify
-  // the ones that assume it can.
   CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
   size_t GetPageObjectCount() const { return m_PageObjectList.size(); }
   CPDF_PageObject* GetPageObjectByIndex(size_t index) const;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.cpp
index c4021d87b98..8885760a7dc 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.cpp
@@ -1125,14 +1125,13 @@ void CPDF_StreamContentParser::Handle_MoveTextPoint_SetLeading() {
 
 void CPDF_StreamContentParser::Handle_SetFont() {
   float fs = GetNumber(0);
-  if (fs == 0) {
+  if (fs == 0)
     fs = m_DefFontSize;
-  }
+
   m_pCurStates->m_TextState.SetFontSize(fs);
-  CPDF_Font* pFont = FindFont(GetString(1));
-  if (pFont) {
+  RetainPtr<CPDF_Font> pFont = FindFont(GetString(1));
+  if (pFont)
     m_pCurStates->m_TextState.SetFont(pFont);
-  }
 }
 
 CPDF_Dictionary* CPDF_StreamContentParser::FindResourceHolder(
@@ -1156,14 +1155,15 @@ CPDF_Object* CPDF_StreamContentParser::FindResourceObj(const ByteString& type,
   return pHolder ? pHolder->GetDirectObjectFor(name) : nullptr;
 }
 
-CPDF_Font* CPDF_StreamContentParser::FindFont(const ByteString& name) {
+RetainPtr<CPDF_Font> CPDF_StreamContentParser::FindFont(
+    const ByteString& name) {
   CPDF_Dictionary* pFontDict = ToDictionary(FindResourceObj("Font", name));
   if (!pFontDict) {
     m_bResourceMissing = true;
     return CPDF_Font::GetStockFont(m_pDocument.Get(),
                                    CFX_Font::kDefaultAnsiFontName);
   }
-  CPDF_Font* pFont =
+  RetainPtr<CPDF_Font> pFont =
       CPDF_DocPageData::FromDocument(m_pDocument.Get())->GetFont(pFontDict);
   if (pFont && pFont->IsType3Font()) {
     pFont->AsType3Font()->SetPageResources(m_pResources.Get());
@@ -1219,7 +1219,7 @@ void CPDF_StreamContentParser::AddTextObject(const ByteString* pStrs,
                                              float fInitKerning,
                                              const std::vector<float>& kernings,
                                              size_t nSegs) {
-  CPDF_Font* pFont = m_pCurStates->m_TextState.GetFont();
+  RetainPtr<CPDF_Font> pFont = m_pCurStates->m_TextState.GetFont();
   if (!pFont)
     return;
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.h
index a20dbe1376a..cd47938325e 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_streamcontentparser.h
@@ -58,7 +58,7 @@ class CPDF_StreamContentParser {
   CPDF_AllStates* GetCurStates() const { return m_pCurStates.get(); }
   bool IsColored() const { return m_bColored; }
   const float* GetType3Data() const { return m_Type3Data; }
-  CPDF_Font* FindFont(const ByteString& name);
+  RetainPtr<CPDF_Font> FindFont(const ByteString& name);
 
   static ByteStringView FindKeyAbbreviationForTesting(ByteStringView abbr);
   static ByteStringView FindValueAbbreviationForTesting(ByteStringView abbr);
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textobject.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textobject.cpp
index c554113f22e..feb49e404b6 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textobject.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textobject.cpp
@@ -13,6 +13,8 @@
 #include "core/fpdfapi/font/cpdf_font.h"
 #include "third_party/base/ptr_util.h"
 
+#define ISLATINWORD(u) (u != 0x20 && u <= 0x28FF)
+
 CPDF_TextObjectItem::CPDF_TextObjectItem() : m_CharCode(0) {}
 
 CPDF_TextObjectItem::~CPDF_TextObjectItem() = default;
@@ -40,10 +42,8 @@ void CPDF_TextObject::GetItemInfo(size_t index,
   if (pInfo->m_CharCode == CPDF_Font::kInvalidCharCode)
     return;
 
-  CPDF_Font* pFont = m_TextState.GetFont();
-  if (!pFont->IsCIDFont())
-    return;
-  if (!pFont->AsCIDFont()->IsVertWriting())
+  RetainPtr<CPDF_Font> pFont = m_TextState.GetFont();
+  if (!pFont->IsCIDFont() || !pFont->AsCIDFont()->IsVertWriting())
     return;
 
   uint16_t CID = pFont->AsCIDFont()->CIDFromCharCode(pInfo->m_CharCode);
@@ -101,6 +101,65 @@ void CPDF_TextObject::GetCharInfo(size_t index,
   }
 }
 
+int CPDF_TextObject::CountWords() const {
+  RetainPtr<CPDF_Font> pFont = GetFont();
+  if (!pFont)
+    return 0;
+
+  bool bInLatinWord = false;
+  int nWords = 0;
+  for (size_t i = 0, sz = CountChars(); i < sz; ++i) {
+    uint32_t charcode = CPDF_Font::kInvalidCharCode;
+    float unused_kerning;
+    GetCharInfo(i, &charcode, &unused_kerning);
+
+    WideString swUnicode = pFont->UnicodeFromCharCode(charcode);
+    uint16_t unicode = 0;
+    if (swUnicode.GetLength() > 0)
+      unicode = swUnicode[0];
+
+    bool bIsLatin = ISLATINWORD(unicode);
+    if (bIsLatin && bInLatinWord)
+      continue;
+
+    bInLatinWord = bIsLatin;
+    if (unicode != 0x20)
+      nWords++;
+  }
+
+  return nWords;
+}
+
+WideString CPDF_TextObject::GetWordString(int nWordIndex) const {
+  RetainPtr<CPDF_Font> pFont = GetFont();
+  if (!pFont)
+    return WideString();
+
+  WideString swRet;
+  int nWords = 0;
+  bool bInLatinWord = false;
+  for (size_t i = 0, sz = CountChars(); i < sz; ++i) {
+    uint32_t charcode = CPDF_Font::kInvalidCharCode;
+    float unused_kerning;
+    GetCharInfo(i, &charcode, &unused_kerning);
+
+    WideString swUnicode = pFont->UnicodeFromCharCode(charcode);
+    uint16_t unicode = 0;
+    if (swUnicode.GetLength() > 0)
+      unicode = swUnicode[0];
+
+    bool bIsLatin = ISLATINWORD(unicode);
+    if (!bIsLatin || !bInLatinWord) {
+      bInLatinWord = bIsLatin;
+      if (unicode != 0x20)
+        nWords++;
+    }
+    if (nWords - 1 == nWordIndex)
+      swRet += unicode;
+  }
+  return swRet;
+}
+
 std::unique_ptr<CPDF_TextObject> CPDF_TextObject::Clone() const {
   auto obj = pdfium::MakeUnique<CPDF_TextObject>();
   obj->CopyData(this);
@@ -150,7 +209,7 @@ void CPDF_TextObject::SetSegments(const ByteString* pStrs,
                                   size_t nSegs) {
   m_CharCodes.clear();
   m_CharPos.clear();
-  CPDF_Font* pFont = m_TextState.GetFont();
+  RetainPtr<CPDF_Font> pFont = m_TextState.GetFont();
   int nChars = 0;
   for (size_t i = 0; i < nSegs; ++i)
     nChars += pFont->CountChar(pStrs[i].AsStringView());
@@ -180,7 +239,7 @@ void CPDF_TextObject::SetText(const ByteString& str) {
 
 float CPDF_TextObject::GetCharWidth(uint32_t charcode) const {
   float fontsize = m_TextState.GetFontSize() / 1000;
-  CPDF_Font* pFont = m_TextState.GetFont();
+  RetainPtr<CPDF_Font> pFont = m_TextState.GetFont();
   bool bVertWriting = false;
   CPDF_CIDFont* pCIDFont = pFont->AsCIDFont();
   if (pCIDFont)
@@ -192,7 +251,7 @@ float CPDF_TextObject::GetCharWidth(uint32_t charcode) const {
   return pCIDFont->GetVertWidth(CID) * fontsize;
 }
 
-CPDF_Font* CPDF_TextObject::GetFont() const {
+RetainPtr<CPDF_Font> CPDF_TextObject::GetFont() const {
   return m_TextState.GetFont();
 }
 
@@ -206,7 +265,7 @@ CFX_PointF CPDF_TextObject::CalcPositionData(float horz_scale) {
   float max_x = -10000 * 1.0f;
   float min_y = 10000 * 1.0f;
   float max_y = -10000 * 1.0f;
-  CPDF_Font* pFont = m_TextState.GetFont();
+  RetainPtr<CPDF_Font> pFont = m_TextState.GetFont();
   bool bVertWriting = false;
   CPDF_CIDFont* pCIDFont = pFont->AsCIDFont();
   if (pCIDFont)
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textobject.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textobject.h
index 076dcbb72bd..b0189a94b06 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textobject.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textobject.h
@@ -13,6 +13,7 @@
 #include "core/fpdfapi/page/cpdf_pageobject.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/retain_ptr.h"
 
 class CPDF_TextObjectItem {
  public:
@@ -45,10 +46,13 @@ class CPDF_TextObject final : public CPDF_PageObject {
   void GetCharInfo(size_t index, uint32_t* charcode, float* kerning) const;
   void GetCharInfo(size_t index, CPDF_TextObjectItem* pInfo) const;
   float GetCharWidth(uint32_t charcode) const;
+  int CountWords() const;
+  WideString GetWordString(int nWordIndex) const;
 
   CFX_PointF GetPos() const { return m_Pos; }
   CFX_Matrix GetTextMatrix() const;
-  CPDF_Font* GetFont() const;
+
+  RetainPtr<CPDF_Font> GetFont() const;
   float GetFontSize() const;
 
   void SetText(const ByteString& str);
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textstate.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textstate.cpp
index a72594c6eb4..8b653321a40 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textstate.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textstate.cpp
@@ -18,11 +18,11 @@ void CPDF_TextState::Emplace() {
   m_Ref.Emplace();
 }
 
-CPDF_Font* CPDF_TextState::GetFont() const {
+RetainPtr<CPDF_Font> CPDF_TextState::GetFont() const {
   return m_Ref.GetObject()->m_pFont;
 }
 
-void CPDF_TextState::SetFont(CPDF_Font* pFont) {
+void CPDF_TextState::SetFont(const RetainPtr<CPDF_Font>& pFont) {
   m_Ref.GetPrivateCopy()->SetFont(pFont);
 }
 
@@ -122,16 +122,13 @@ CPDF_TextState::TextData::TextData(const TextData& that)
   }
 }
 
-CPDF_TextState::TextData::~TextData() {
-  ReleaseFont();
-}
+CPDF_TextState::TextData::~TextData() = default;
 
 RetainPtr<CPDF_TextState::TextData> CPDF_TextState::TextData::Clone() const {
   return pdfium::MakeRetain<CPDF_TextState::TextData>(*this);
 }
 
-void CPDF_TextState::TextData::SetFont(CPDF_Font* pFont) {
-  ReleaseFont();
+void CPDF_TextState::TextData::SetFont(const RetainPtr<CPDF_Font>& pFont) {
   m_pDocument = pFont ? pFont->GetDocument() : nullptr;
   m_pFont = pFont;
 }
@@ -152,15 +149,6 @@ float CPDF_TextState::TextData::GetShearAngle() const {
   return GetBaselineAngle() + atan2(m_Matrix[1], m_Matrix[3]);
 }
 
-void CPDF_TextState::TextData::ReleaseFont() {
-  if (!m_pDocument || !m_pFont)
-    return;
-
-  auto* pPageData = CPDF_DocPageData::FromDocument(m_pDocument.Get());
-  if (pPageData && !pPageData->IsForceClear())
-    pPageData->ReleaseFont(m_pFont->GetFontDict());
-}
-
 bool SetTextRenderingModeFromInt(int iMode, TextRenderingMode* mode) {
   if (iMode < 0 || iMode > 7)
     return false;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textstate.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textstate.h
index a466db6e344..53934ec77ef 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textstate.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_textstate.h
@@ -7,6 +7,7 @@
 #ifndef CORE_FPDFAPI_PAGE_CPDF_TEXTSTATE_H_
 #define CORE_FPDFAPI_PAGE_CPDF_TEXTSTATE_H_
 
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/shared_copy_on_write.h"
 #include "core/fxcrt/unowned_ptr.h"
 
@@ -32,8 +33,8 @@ class CPDF_TextState {
 
   void Emplace();
 
-  CPDF_Font* GetFont() const;
-  void SetFont(CPDF_Font* pFont);
+  RetainPtr<CPDF_Font> GetFont() const;
+  void SetFont(const RetainPtr<CPDF_Font>& pFont);
 
   float GetFontSize() const;
   void SetFontSize(float size);
@@ -66,13 +67,13 @@ class CPDF_TextState {
 
     RetainPtr<TextData> Clone() const;
 
-    void SetFont(CPDF_Font* pFont);
+    void SetFont(const RetainPtr<CPDF_Font>& pFont);
     float GetFontSizeV() const;
     float GetFontSizeH() const;
     float GetBaselineAngle() const;
     float GetShearAngle() const;
 
-    CPDF_Font* m_pFont;
+    RetainPtr<CPDF_Font> m_pFont;
     UnownedPtr<CPDF_Document> m_pDocument;
     float m_FontSize;
     float m_CharSpace;
@@ -85,8 +86,6 @@ class CPDF_TextState {
     TextData();
     TextData(const TextData& that);
     ~TextData() override;
-
-    void ReleaseFont();
   };
 
   SharedCopyOnWrite<TextData> m_Ref;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_transferfunc.cpp b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_transferfunc.cpp
index 9f7a029686b..91b08bc8200 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_transferfunc.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_transferfunc.cpp
@@ -4,12 +4,12 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#include "core/fpdfapi/render/cpdf_transferfunc.h"
+#include "core/fpdfapi/page/cpdf_transferfunc.h"
 
 #include <utility>
 
+#include "core/fpdfapi/page/cpdf_dibtransferfunc.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
-#include "core/fpdfapi/render/cpdf_dibtransferfunc.h"
 #include "core/fxge/dib/cfx_dibbase.h"
 
 CPDF_TransferFunc::CPDF_TransferFunc(CPDF_Document* pDoc,
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_transferfunc.h b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_transferfunc.h
index bf143204a9a..b2d997e47a2 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_transferfunc.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/page/cpdf_transferfunc.h
@@ -4,8 +4,8 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#ifndef CORE_FPDFAPI_RENDER_CPDF_TRANSFERFUNC_H_
-#define CORE_FPDFAPI_RENDER_CPDF_TRANSFERFUNC_H_
+#ifndef CORE_FPDFAPI_PAGE_CPDF_TRANSFERFUNC_H_
+#define CORE_FPDFAPI_PAGE_CPDF_TRANSFERFUNC_H_
 
 #include <vector>
 
@@ -52,4 +52,4 @@ class CPDF_TransferFunc final : public Retainable, public Observable {
   const std::vector<uint8_t> m_SamplesB;
 };
 
-#endif  // CORE_FPDFAPI_RENDER_CPDF_TRANSFERFUNC_H_
+#endif  // CORE_FPDFAPI_PAGE_CPDF_TRANSFERFUNC_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/BUILD.gn b/chromium/third_party/pdfium/core/fpdfapi/parser/BUILD.gn
index ffcf9090b94..4c2da7aa440 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/BUILD.gn
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/BUILD.gn
@@ -118,7 +118,6 @@ pdfium_unittest_source_set("unittests") {
   ]
   deps = [
     ":parser",
-    "../",
     "../../../constants",
     "../page",
     "../render",
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_array.h b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_array.h
index aa25e82d0a5..34b7c9a6e9c 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_array.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_array.h
@@ -16,6 +16,7 @@
 #include "core/fpdfapi/parser/cpdf_indirect_object_holder.h"
 #include "core/fpdfapi/parser/cpdf_object.h"
 #include "core/fxcrt/fx_coordinates.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "third_party/base/ptr_util.h"
 
 class CPDF_Array final : public CPDF_Object {
@@ -143,7 +144,7 @@ class CPDF_ArrayLocker {
   }
 
  private:
-  UnownedPtr<const CPDF_Array> const m_pArray;
+  RetainPtr<const CPDF_Array> const m_pArray;
 };
 
 inline CPDF_Array* ToArray(CPDF_Object* obj) {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_dictionary.h b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_dictionary.h
index 10876325cc0..ac1b226f6bc 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_dictionary.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_dictionary.h
@@ -16,6 +16,7 @@
 #include "core/fpdfapi/parser/cpdf_object.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_string.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/string_pool_template.h"
 #include "core/fxcrt/weak_ptr.h"
 #include "third_party/base/logging.h"
@@ -144,7 +145,7 @@ class CPDF_DictionaryLocker {
   }
 
  private:
-  UnownedPtr<const CPDF_Dictionary> const m_pDictionary;
+  RetainPtr<const CPDF_Dictionary> const m_pDictionary;
 };
 
 inline CPDF_Dictionary* ToDictionary(CPDF_Object* obj) {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_document.h b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_document.h
index 7bd94f565e1..dba2a7f6ea6 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_document.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_document.h
@@ -45,6 +45,9 @@ class CPDF_Document : public Observable,
     virtual int GetPageCount() const = 0;
     virtual void DeletePage(int page_index) = 0;
     virtual uint32_t GetUserPermissions() const = 0;
+    virtual bool ContainsExtensionForm() const = 0;
+    virtual bool ContainsExtensionFullForm() const = 0;
+    virtual bool ContainsExtensionForegroundForm() const = 0;
   };
 
   class LinkListIface {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_document_unittest.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_document_unittest.cpp
index 84a16c37ff5..1c52e5149dd 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_document_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_document_unittest.cpp
@@ -7,8 +7,8 @@
 #include <memory>
 #include <utility>
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_boolean.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
@@ -163,8 +163,8 @@ class CPDF_TestDocumentAllowSetParser final : public CPDF_Document {
 
 class cpdf_document_test : public testing::Test {
  public:
-  void SetUp() override { CPDF_ModuleMgr::Create(); }
-  void TearDown() override { CPDF_ModuleMgr::Destroy(); }
+  void SetUp() override { CPDF_PageModule::Create(); }
+  void TearDown() override { CPDF_PageModule::Destroy(); }
 };
 
 TEST_F(cpdf_document_test, GetPages) {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_flateencoder.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_flateencoder.cpp
index 71428b1543b..b6858228250 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_flateencoder.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_flateencoder.cpp
@@ -37,7 +37,7 @@ CPDF_FlateEncoder::CPDF_FlateEncoder(const CPDF_Stream* pStream,
   if (bHasFilter || !bFlateEncode) {
     m_pData = m_pAcc->GetData();
     m_dwSize = m_pAcc->GetSize();
-    m_pDict = pStream->GetDict();
+    m_pDict.Reset(pStream->GetDict());
     ASSERT(!m_pClonedDict);
     return;
   }
@@ -64,7 +64,7 @@ void CPDF_FlateEncoder::CloneDict() {
 
   m_pClonedDict = ToDictionary(m_pDict->Clone());
   ASSERT(m_pClonedDict);
-  m_pDict.Release();
+  m_pDict.Reset();
 }
 
 CPDF_Dictionary* CPDF_FlateEncoder::GetClonedDict() {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_flateencoder.h b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_flateencoder.h
index fdcad2f11bd..c603ee10130 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_flateencoder.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_flateencoder.h
@@ -40,7 +40,7 @@ class CPDF_FlateEncoder {
   MaybeOwned<uint8_t, FxFreeDeleter> m_pData;
 
   // Only one of these two pointers is valid at any time.
-  UnownedPtr<const CPDF_Dictionary> m_pDict;
+  RetainPtr<const CPDF_Dictionary> m_pDict;
   RetainPtr<CPDF_Dictionary> m_pClonedDict;
 };
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_hint_tables_unittest.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_hint_tables_unittest.cpp
index fda209fda19..27592ba232d 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_hint_tables_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_hint_tables_unittest.cpp
@@ -8,7 +8,7 @@
 #include <string>
 #include <utility>
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "core/fpdfapi/parser/cpdf_data_avail.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_linearized_header.h"
@@ -63,10 +63,10 @@ class CPDF_HintTablesTest : public testing::Test {
  public:
   CPDF_HintTablesTest() {
     // Needs for encoding Hint table stream.
-    CPDF_ModuleMgr::Create();
+    CPDF_PageModule::Create();
   }
 
-  ~CPDF_HintTablesTest() override { CPDF_ModuleMgr::Destroy(); }
+  ~CPDF_HintTablesTest() override { CPDF_PageModule::Destroy(); }
 };
 
 TEST_F(CPDF_HintTablesTest, Load) {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_avail.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_avail.cpp
index 9d92c118b15..1dc5125a2de 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_avail.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_avail.cpp
@@ -92,7 +92,7 @@ bool CPDF_ObjectAvail::CheckObjects() {
 
     const CPDF_ReadValidator::Session parse_session(validator_);
     const CPDF_Object* direct = holder_->GetOrParseIndirectObject(obj_num);
-    if (direct == root_.Get())
+    if (direct == root_)
       continue;
 
     if (validator_->has_read_problems() ||
@@ -117,9 +117,9 @@ bool CPDF_ObjectAvail::AppendObjectSubRefs(const CPDF_Object* object,
 
     // Skip if this object if it's an inlined root, the parent object or
     // explicitily excluded.
-    const bool skip = (walker.GetParent() && obj == root_.Get()) ||
+    const bool skip = (walker.GetParent() && obj == root_) ||
                       walker.dictionary_key() == "Parent" ||
-                      (obj != root_.Get() && ExcludeObject(obj));
+                      (obj != root_ && ExcludeObject(obj));
 
     // We need to parse the object before we can do the exclusion check.
     // This is because the exclusion check may check against a referenced
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker.cpp
index dbc775213cd..efd4a5ccdf1 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker.cpp
@@ -149,8 +149,8 @@ const CPDF_Object* CPDF_ObjectWalker::GetNext() {
     if (it->IsFinished()) {
       stack_.pop();
     } else {
-      next_object_ = it->Increment();
-      parent_object_ = it->object();
+      next_object_.Reset(it->Increment());
+      parent_object_.Reset(it->object());
       dict_key_ = parent_object_->IsDictionary()
                       ? static_cast<DictionaryIterator*>(it)->dict_key()
                       : ByteString();
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker.h b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker.h
index 0af683c01ce..d019286f5b1 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker.h
@@ -9,7 +9,7 @@
 #include <stack>
 
 #include "core/fxcrt/fx_string.h"
-#include "core/fxcrt/unowned_ptr.h"
+#include "core/fxcrt/retain_ptr.h"
 
 class CPDF_Object;
 
@@ -32,7 +32,7 @@ class CPDF_ObjectWalker {
     virtual void Start() = 0;
 
    private:
-    UnownedPtr<const CPDF_Object> object_;
+    RetainPtr<const CPDF_Object> object_;
     bool is_started_ = false;
   };
 
@@ -50,8 +50,8 @@ class CPDF_ObjectWalker {
   static std::unique_ptr<SubobjectIterator> MakeIterator(
       const CPDF_Object* object);
 
-  UnownedPtr<const CPDF_Object> next_object_;
-  UnownedPtr<const CPDF_Object> parent_object_;
+  RetainPtr<const CPDF_Object> next_object_;
+  RetainPtr<const CPDF_Object> parent_object_;
   ByteString dict_key_;
   size_t current_depth_ = 0;
   std::stack<std::unique_ptr<SubobjectIterator>> stack_;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker_unittest.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker_unittest.cpp
index 7de4e9a885d..4dde72f6635 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_object_walker_unittest.cpp
@@ -112,7 +112,7 @@ TEST(CPDF_ObjectWalkerTest, SkipWalkIntoCurrentObject) {
   int non_array_objects = 0;
   CPDF_ObjectWalker walker(root_array.Get());
   while (const CPDF_Object* obj = walker.GetNext()) {
-    if (obj != root_array.Get() && obj->IsArray()) {
+    if (obj != root_array && obj->IsArray()) {
       // skip other array except root.
       walker.SkipWalkIntoCurrentObject();
     }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_reference.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_reference.cpp
index 8341ca199c1..d50db340f4f 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_reference.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_reference.cpp
@@ -107,7 +107,7 @@ bool CPDF_Reference::WriteTo(IFX_ArchiveStream* archive,
 
 RetainPtr<CPDF_Object> CPDF_Reference::MakeReference(
     CPDF_IndirectObjectHolder* holder) const {
-  ASSERT(holder == m_pObjList.Get());
+  ASSERT(holder == m_pObjList);
   // Do not allow reference to reference, just create other reference for same
   // object.
   return pdfium::MakeRetain<CPDF_Reference>(holder, GetRefObjNum());
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_security_handler.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_security_handler.cpp
index 4909c56f1d0..2d2795f6e78 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_security_handler.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_security_handler.cpp
@@ -182,7 +182,7 @@ static bool LoadCryptInfo(const CPDF_Dictionary* pEncryptDict,
 }
 
 bool CPDF_SecurityHandler::LoadDict(const CPDF_Dictionary* pEncryptDict) {
-  m_pEncryptDict = pEncryptDict;
+  m_pEncryptDict.Reset(pEncryptDict);
   m_Version = pEncryptDict->GetIntegerFor("V");
   m_Revision = pEncryptDict->GetIntegerFor("R");
   m_Permissions = pEncryptDict->GetIntegerFor("P", -1);
@@ -200,7 +200,7 @@ bool CPDF_SecurityHandler::LoadDict(const CPDF_Dictionary* pEncryptDict) {
 bool CPDF_SecurityHandler::LoadDict(const CPDF_Dictionary* pEncryptDict,
                                     int& cipher,
                                     int& key_len) {
-  m_pEncryptDict = pEncryptDict;
+  m_pEncryptDict.Reset(pEncryptDict);
   m_Version = pEncryptDict->GetIntegerFor("V");
   m_Revision = pEncryptDict->GetIntegerFor("R");
   m_Permissions = pEncryptDict->GetIntegerFor("P", -1);
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_security_handler.h b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_security_handler.h
index cbb8b153f23..8fd661ef400 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_security_handler.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_security_handler.h
@@ -85,7 +85,7 @@ class CPDF_SecurityHandler : public Retainable {
   int m_Cipher;
   int m_KeyLen;
   bool m_bOwnerUnlocked;
-  UnownedPtr<const CPDF_Dictionary> m_pEncryptDict;
+  RetainPtr<const CPDF_Dictionary> m_pEncryptDict;
   std::unique_ptr<CPDF_CryptoHandler> m_pCryptoHandler;
   uint8_t m_EncryptKey[32];
 };
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_stream_acc.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_stream_acc.cpp
index c666ad7ad38..93a2d85a80e 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_stream_acc.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_stream_acc.cpp
@@ -9,6 +9,7 @@
 #include <utility>
 #include <vector>
 
+#include "core/fdrm/fx_crypt.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fpdfapi/parser/fpdf_parser_decode.h"
@@ -70,6 +71,12 @@ uint32_t CPDF_StreamAcc::GetSize() const {
                                                    : 0;
 }
 
+ByteString CPDF_StreamAcc::ComputeDigest() const {
+  uint8_t digest[20];
+  CRYPT_SHA1Generate(GetData(), GetSize(), digest);
+  return ByteString(digest, 20);
+}
+
 std::unique_ptr<uint8_t, FxFreeDeleter> CPDF_StreamAcc::DetachData() {
   if (m_pData.IsOwned()) {
     std::unique_ptr<uint8_t, FxFreeDeleter> p = m_pData.ReleaseAndClear();
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_stream_acc.h b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_stream_acc.h
index 9f571c4ce8b..cc1f632445b 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_stream_acc.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/cpdf_stream_acc.h
@@ -39,6 +39,7 @@ class CPDF_StreamAcc final : public Retainable {
   pdfium::span<uint8_t> GetSpan() const {
     return pdfium::make_span(GetData(), GetSize());
   }
+  ByteString ComputeDigest() const;
   ByteString GetImageDecoder() const { return m_ImageDecoder; }
   const CPDF_Dictionary* GetImageParam() const { return m_pImageParam.Get(); }
   std::unique_ptr<uint8_t, FxFreeDeleter> DetachData();
@@ -48,7 +49,6 @@ class CPDF_StreamAcc final : public Retainable {
   ~CPDF_StreamAcc() override;
 
   void LoadAllData(bool bRawAccess, uint32_t estimated_size, bool bImageAcc);
-
   void ProcessRawData();
   void ProcessFilteredData(uint32_t estimated_size, bool bImageAcc);
 
@@ -58,8 +58,8 @@ class CPDF_StreamAcc final : public Retainable {
   MaybeOwned<uint8_t, FxFreeDeleter> m_pData;
   uint32_t m_dwSize = 0;
   ByteString m_ImageDecoder;
-  UnownedPtr<const CPDF_Dictionary> m_pImageParam;
-  UnownedPtr<const CPDF_Stream> const m_pStream;
+  RetainPtr<const CPDF_Dictionary> m_pImageParam;
+  RetainPtr<const CPDF_Stream> const m_pStream;
 };
 
 #endif  // CORE_FPDFAPI_PARSER_CPDF_STREAM_ACC_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode.cpp
index ed3d08aa41c..707406167c6 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode.cpp
@@ -401,7 +401,7 @@ bool PDF_DataDecode(
     std::unique_ptr<uint8_t, FxFreeDeleter>* dest_buf,
     uint32_t* dest_size,
     ByteString* ImageEncoding,
-    UnownedPtr<const CPDF_Dictionary>* pImageParams) {
+    RetainPtr<const CPDF_Dictionary>* pImageParams) {
   std::unique_ptr<uint8_t, FxFreeDeleter> result;
   // May be changed to point to |result| in the for-loop below. So put it below
   // |result| and let it get destroyed first.
@@ -421,7 +421,7 @@ bool PDF_DataDecode(
         *ImageEncoding = "FlateDecode";
         *dest_buf = std::move(result);
         *dest_size = last_span.size();
-        *pImageParams = pParam;
+        pImageParams->Reset(pParam);
         return true;
       }
       offset = FlateOrLZWDecode(false, last_span, pParam, estimated_size,
@@ -438,7 +438,7 @@ bool PDF_DataDecode(
         *ImageEncoding = "RunLengthDecode";
         *dest_buf = std::move(result);
         *dest_size = last_span.size();
-        *pImageParams = pParam;
+        pImageParams->Reset(pParam);
         return true;
       }
       offset = RunLengthDecode(last_span, &new_buf, &new_size);
@@ -449,7 +449,7 @@ bool PDF_DataDecode(
       else if (decoder == "CCF")
         decoder = "CCITTFaxDecode";
       *ImageEncoding = std::move(decoder);
-      *pImageParams = pParam;
+      pImageParams->Reset(pParam);
       *dest_buf = std::move(result);
       *dest_size = last_span.size();
       return true;
@@ -472,7 +472,7 @@ WideString PDF_DecodeText(pdfium::span<const uint8_t> span) {
   WideString result;
   if (span.size() >= 2 && ((span[0] == 0xfe && span[1] == 0xff) ||
                            (span[0] == 0xff && span[1] == 0xfe))) {
-    uint32_t max_chars = (span.size() - 2) / 2;
+    size_t max_chars = (span.size() - 2) / 2;
     if (!max_chars)
       return result;
 
@@ -481,7 +481,7 @@ WideString PDF_DecodeText(pdfium::span<const uint8_t> span) {
         span[0] == 0xfe ? GetUnicodeFromBigEndianBytes
                         : GetUnicodeFromLittleEndianBytes;
     const uint8_t* unicode_str = &span[2];
-    for (uint32_t i = 0; i < max_chars * 2; i += 2) {
+    for (size_t i = 0; i < max_chars * 2; i += 2) {
       uint16_t unicode = GetUnicodeFromBytes(unicode_str + i);
 
       // 0x001B is a begin/end marker for language metadata region that
@@ -492,7 +492,8 @@ WideString PDF_DecodeText(pdfium::span<const uint8_t> span) {
           unicode = GetUnicodeFromBytes(unicode_str + i);
           if (unicode == 0x001B) {
             i += 2;
-            unicode = GetUnicodeFromBytes(unicode_str + i);
+            if (i < max_chars * 2)
+              unicode = GetUnicodeFromBytes(unicode_str + i);
             break;
           }
         }
@@ -504,7 +505,7 @@ WideString PDF_DecodeText(pdfium::span<const uint8_t> span) {
     }
   } else {
     pdfium::span<wchar_t> dest_buf = result.GetBuffer(span.size());
-    for (uint32_t i = 0; i < span.size(); ++i)
+    for (size_t i = 0; i < span.size(); ++i)
       dest_buf[i] = PDFDocEncoding[span[i]];
     dest_pos = span.size();
   }
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode.h b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode.h
index 6a1a1ce93d1..9782a1fb899 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode.h
@@ -86,6 +86,6 @@ bool PDF_DataDecode(
     std::unique_ptr<uint8_t, FxFreeDeleter>* dest_buf,
     uint32_t* dest_size,
     ByteString* ImageEncoding,
-    UnownedPtr<const CPDF_Dictionary>* pImageParams);
+    RetainPtr<const CPDF_Dictionary>* pImageParams);
 
 #endif  // CORE_FPDFAPI_PARSER_FPDF_PARSER_DECODE_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode_unittest.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode_unittest.cpp
index 171482ebae3..0ddf9ed8081 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_decode_unittest.cpp
@@ -181,6 +181,55 @@ TEST(fpdf_parser_decode, HexDecode) {
   }
 }
 
+TEST(fpdf_parser_decode, DecodeText) {
+  const struct DecodeTestData {
+    const char* input;
+    size_t input_length;
+    const wchar_t* expected_output;
+    size_t expected_length;
+  } kTestData[] = {
+      // Empty src string.
+      {"", 0, L"", 0},
+      // ASCII text.
+      {"the quick\tfox", 13, L"the quick\tfox", 13},
+      // Unicode text.
+      {"\xFE\xFF\x03\x30\x03\x31", 6, L"\x0330\x0331", 2},
+      // More Unicode text.
+      {"\xFE\xFF\x7F\x51\x98\x75\x00\x20\x56\xFE\x72\x47\x00"
+       "\x20\x8D\x44\x8B\xAF\x66\xF4\x59\x1A\x00\x20\x00\xBB",
+       26,
+       L"\x7F51\x9875\x0020\x56FE\x7247\x0020"
+       L"\x8D44\x8BAF\x66F4\x591A\x0020\x00BB",
+       12},
+      // Unicode escape sequence. https://crbug.com/pdfium/182
+      {"\xFE\xFF\x00\x1B\x6A\x61\x00\x1B\x00\x20\x53\x70\x52\x37", 14,
+       L"\x0020\x5370\x5237", 3},
+      {"\xFE\xFF\x00\x1B\x6A\x61\x00\x1B\x00\x20\x53\x70\x52\x37\x29", 15,
+       L"\x0020\x5370\x5237", 3},
+      {"\xFE\xFF\x00\x1B\x6A\x61\x4A\x50\x00\x1B\x00\x20\x53\x70\x52\x37", 16,
+       L"\x0020\x5370\x5237", 3},
+      {"\xFE\xFF\x00\x20\x00\x1B\x6A\x61\x4A\x50\x00\x1B\x52\x37", 14,
+       L"\x0020\x5237", 2},
+      // https://crbug.com/1001159
+      {"\xFE\xFF\x00\x1B\x00\x1B", 6, L"", 0},
+      {"\xFE\xFF\x00\x1B\x00\x1B\x20", 7, L"", 0},
+      {"\xFE\xFF\x00\x1B\x00\x1B\x00\x20", 8, L"\x0020", 1},
+  };
+
+  for (const auto& test_case : kTestData) {
+    WideString output = PDF_DecodeText(
+        pdfium::make_span(reinterpret_cast<const uint8_t*>(test_case.input),
+                          test_case.input_length));
+    ASSERT_EQ(test_case.expected_length, output.GetLength())
+        << "for case " << test_case.input;
+    const wchar_t* str_ptr = output.c_str();
+    for (size_t i = 0; i < test_case.expected_length; ++i) {
+      EXPECT_EQ(test_case.expected_output[i], str_ptr[i])
+          << "for case " << test_case.input << " char " << i;
+    }
+  }
+}
+
 TEST(fpdf_parser_decode, EncodeText) {
   const struct EncodeTestData {
     const wchar_t* input;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility.cpp
index 053ee05722c..af58e8dcb15 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility.cpp
@@ -9,6 +9,7 @@
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_boolean.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
+#include "core/fpdfapi/parser/cpdf_name.h"
 #include "core/fpdfapi/parser/cpdf_number.h"
 #include "core/fpdfapi/parser/cpdf_reference.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
@@ -162,6 +163,31 @@ std::vector<float> ReadArrayElementsToVector(const CPDF_Array* pArray,
   return ret;
 }
 
+bool ValidateDictType(const CPDF_Dictionary* dict, const ByteString& type) {
+  ASSERT(dict);
+  ASSERT(!type.IsEmpty());
+  const CPDF_Name* name_obj = ToName(dict->GetObjectFor("Type"));
+  return name_obj && name_obj->GetString() == type;
+}
+
+bool ValidateDictAllResourcesOfType(const CPDF_Dictionary* dict,
+                                    const ByteString& type) {
+  if (!dict)
+    return false;
+
+  CPDF_DictionaryLocker locker(dict);
+  for (const auto& it : locker) {
+    const CPDF_Dictionary* entry = ToDictionary(it.second.Get()->GetDirect());
+    if (!entry || !ValidateDictType(entry, type))
+      return false;
+  }
+  return true;
+}
+
+bool ValidateFontResourceDict(const CPDF_Dictionary* dict) {
+  return ValidateDictAllResourcesOfType(dict, "Font");
+}
+
 std::ostream& operator<<(std::ostream& buf, const CPDF_Object* pObj) {
   if (!pObj) {
     buf << " null";
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility.h b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility.h
index 29dd246c80d..75f4076afbe 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility.h
@@ -55,6 +55,17 @@ ByteString PDF_NameEncode(const ByteString& orig);
 std::vector<float> ReadArrayElementsToVector(const CPDF_Array* pArray,
                                              size_t nCount);
 
+// Returns true if |dict| has a /Type name entry that matches |type|.
+bool ValidateDictType(const CPDF_Dictionary* dict, const ByteString& type);
+
+// Returns true if |dict| is non-null and all entries in |dict| are dictionaries
+// of |type|.
+bool ValidateDictAllResourcesOfType(const CPDF_Dictionary* dict,
+                                    const ByteString& type);
+
+// Shorthand for ValidateDictAllResourcesOfType(dict, "Font").
+bool ValidateFontResourceDict(const CPDF_Dictionary* dict);
+
 std::ostream& operator<<(std::ostream& buf, const CPDF_Object* pObj);
 
 #endif  // CORE_FPDFAPI_PARSER_FPDF_PARSER_UTILITY_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility_unittest.cpp b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility_unittest.cpp
index e3b4e9debc4..098c3bd39ac 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/parser/fpdf_parser_utility_unittest.cpp
@@ -4,6 +4,14 @@
 
 #include "core/fpdfapi/parser/fpdf_parser_utility.h"
 
+#include "core/fpdfapi/page/cpdf_docpagedata.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
+#include "core/fpdfapi/parser/cpdf_dictionary.h"
+#include "core/fpdfapi/parser/cpdf_document.h"
+#include "core/fpdfapi/parser/cpdf_name.h"
+#include "core/fpdfapi/parser/cpdf_reference.h"
+#include "core/fpdfapi/parser/cpdf_string.h"
+#include "core/fpdfapi/render/cpdf_docrenderdata.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 TEST(fpdf_parser_utility, PDF_NameDecode) {
@@ -24,3 +32,77 @@ TEST(fpdf_parser_utility, PDF_NameEncode) {
   EXPECT_EQ("#C2", PDF_NameEncode("\xc2"));
   EXPECT_EQ("f#C2#A5", PDF_NameEncode("f\xc2\xa5"));
 }
+
+TEST(fpdf_parser_utility, ValidateDictType) {
+  auto dict = pdfium::MakeRetain<CPDF_Dictionary>();
+
+  // No type.
+  EXPECT_FALSE(ValidateDictType(dict.Get(), "foo"));
+  EXPECT_FALSE(ValidateDictType(dict.Get(), "bar"));
+
+  // Add the wrong object type.
+  dict->SetNewFor<CPDF_String>("Type", L"foo");
+  EXPECT_FALSE(ValidateDictType(dict.Get(), "foo"));
+  EXPECT_FALSE(ValidateDictType(dict.Get(), "bar"));
+
+  // Add the correct object type.
+  dict->SetNewFor<CPDF_Name>("Type", "foo");
+  EXPECT_TRUE(ValidateDictType(dict.Get(), "foo"));
+  EXPECT_FALSE(ValidateDictType(dict.Get(), "bar"));
+}
+
+TEST(fpdf_parser_utility, ValidateDictAllResourcesOfType) {
+  CPDF_PageModule::Create();
+
+  {
+    // Direct dictionary.
+    auto dict = pdfium::MakeRetain<CPDF_Dictionary>();
+
+    // Empty dict is ok.
+    EXPECT_TRUE(ValidateDictAllResourcesOfType(dict.Get(), "foo"));
+    EXPECT_TRUE(ValidateDictAllResourcesOfType(dict.Get(), "bar"));
+
+    // nullptr is not.
+    EXPECT_FALSE(ValidateDictAllResourcesOfType(nullptr, "foo"));
+    EXPECT_FALSE(ValidateDictAllResourcesOfType(nullptr, "bar"));
+
+    // Add two correct dictionary entries and one string entry.
+    CPDF_Dictionary* new_dict = dict->SetNewFor<CPDF_Dictionary>("f1");
+    new_dict->SetNewFor<CPDF_Name>("Type", "foo");
+    new_dict = dict->SetNewFor<CPDF_Dictionary>("f2");
+    new_dict->SetNewFor<CPDF_Name>("Type", "foo");
+    dict->SetNewFor<CPDF_String>("f3", L"foo");
+    EXPECT_FALSE(ValidateDictAllResourcesOfType(dict.Get(), "foo"));
+    EXPECT_FALSE(ValidateDictAllResourcesOfType(dict.Get(), "bar"));
+
+    // Change the string entry to a dictionary, but with the wrong /Type.
+    new_dict = dict->SetNewFor<CPDF_Dictionary>("f3");
+    new_dict->SetNewFor<CPDF_Name>("Type", "bar");
+    EXPECT_FALSE(ValidateDictAllResourcesOfType(dict.Get(), "foo"));
+    EXPECT_FALSE(ValidateDictAllResourcesOfType(dict.Get(), "bar"));
+
+    // Change the /Type to match.
+    new_dict->SetNewFor<CPDF_Name>("Type", "foo");
+    EXPECT_TRUE(ValidateDictAllResourcesOfType(dict.Get(), "foo"));
+    EXPECT_FALSE(ValidateDictAllResourcesOfType(dict.Get(), "bar"));
+  }
+
+  {
+    // Indirect dictionary.
+    auto doc = pdfium::MakeUnique<CPDF_Document>(
+        pdfium::MakeUnique<CPDF_DocRenderData>(),
+        pdfium::MakeUnique<CPDF_DocPageData>());
+
+    auto dict = doc->New<CPDF_Dictionary>();
+
+    // Add a correct dictionary entry.
+    CPDF_Dictionary* new_dict = doc->NewIndirect<CPDF_Dictionary>();
+    new_dict->SetNewFor<CPDF_Name>("Type", "foo");
+    dict->SetNewFor<CPDF_Reference>("f1", doc.get(), new_dict->GetObjNum());
+
+    EXPECT_TRUE(ValidateDictAllResourcesOfType(dict.Get(), "foo"));
+    EXPECT_FALSE(ValidateDictAllResourcesOfType(dict.Get(), "bar"));
+  }
+
+  CPDF_PageModule::Destroy();
+}
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/BUILD.gn b/chromium/third_party/pdfium/core/fpdfapi/render/BUILD.gn
index 45f4846d988..8378de657c6 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/BUILD.gn
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/BUILD.gn
@@ -12,8 +12,6 @@ jumbo_source_set("render") {
     "cpdf_charposlist.h",
     "cpdf_devicebuffer.cpp",
     "cpdf_devicebuffer.h",
-    "cpdf_dibtransferfunc.cpp",
-    "cpdf_dibtransferfunc.h",
     "cpdf_docrenderdata.cpp",
     "cpdf_docrenderdata.h",
     "cpdf_imagecacheentry.cpp",
@@ -38,8 +36,6 @@ jumbo_source_set("render") {
     "cpdf_scaledrenderbuffer.h",
     "cpdf_textrenderer.cpp",
     "cpdf_textrenderer.h",
-    "cpdf_transferfunc.cpp",
-    "cpdf_transferfunc.h",
     "cpdf_type3cache.cpp",
     "cpdf_type3cache.h",
     "cpdf_type3glyphmap.cpp",
@@ -55,7 +51,12 @@ jumbo_source_set("render") {
     "../page",
     "../parser",
   ]
-  allow_circular_includes_from = [ "../page" ]
+  if (is_win) {
+    sources += [
+      "cpdf_windowsrenderdevice.cpp",
+      "cpdf_windowsrenderdevice.h",
+    ]
+  }
   visibility = [ "../../../*" ]
 }
 
@@ -65,6 +66,7 @@ pdfium_unittest_source_set("unittests") {
   ]
   deps = [
     ":render",
+    "../page",
     "../parser",
   ]
   pdfium_root_dir = "../../../"
@@ -72,6 +74,7 @@ pdfium_unittest_source_set("unittests") {
 
 pdfium_embeddertest_source_set("embeddertests") {
   sources = [
+    "fpdf_progressive_render_embeddertest.cpp",
     "fpdf_render_pattern_embeddertest.cpp",
   ]
   pdfium_root_dir = "../../../"
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_docrenderdata.cpp b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_docrenderdata.cpp
index cb37c69fcfa..59a136576ca 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_docrenderdata.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_docrenderdata.cpp
@@ -14,9 +14,9 @@
 #include "core/fpdfapi/font/cpdf_type3font.h"
 #include "core/fpdfapi/page/cpdf_dibbase.h"
 #include "core/fpdfapi/page/cpdf_function.h"
+#include "core/fpdfapi/page/cpdf_transferfunc.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
-#include "core/fpdfapi/render/cpdf_transferfunc.h"
 #include "core/fpdfapi/render/cpdf_type3cache.h"
 
 namespace {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_docrenderdata_unittest.cpp b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_docrenderdata_unittest.cpp
index 2f2478551e6..73ee9ae0940 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_docrenderdata_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_docrenderdata_unittest.cpp
@@ -7,11 +7,11 @@
 #include <memory>
 #include <utility>
 
+#include "core/fpdfapi/page/cpdf_transferfunc.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_number.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
-#include "core/fpdfapi/render/cpdf_transferfunc.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/base/ptr_util.h"
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_imageloader.cpp b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_imageloader.cpp
index 222c4bb4f39..23d7522d7e8 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_imageloader.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_imageloader.cpp
@@ -9,10 +9,10 @@
 #include "core/fpdfapi/page/cpdf_dibbase.h"
 #include "core/fpdfapi/page/cpdf_image.h"
 #include "core/fpdfapi/page/cpdf_imageobject.h"
+#include "core/fpdfapi/page/cpdf_transferfunc.h"
 #include "core/fpdfapi/render/cpdf_imagecacheentry.h"
 #include "core/fpdfapi/render/cpdf_pagerendercache.h"
 #include "core/fpdfapi/render/cpdf_renderstatus.h"
-#include "core/fpdfapi/render/cpdf_transferfunc.h"
 #include "core/fxge/dib/cfx_dibitmap.h"
 
 CPDF_ImageLoader::CPDF_ImageLoader() = default;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_imagerenderer.cpp b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_imagerenderer.cpp
index a957f8dd1ec..89e04b49d5b 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_imagerenderer.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_imagerenderer.cpp
@@ -18,6 +18,7 @@
 #include "core/fpdfapi/page/cpdf_pageobject.h"
 #include "core/fpdfapi/page/cpdf_shadingpattern.h"
 #include "core/fpdfapi/page/cpdf_tilingpattern.h"
+#include "core/fpdfapi/page/cpdf_transferfunc.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
@@ -25,7 +26,6 @@
 #include "core/fpdfapi/render/cpdf_pagerendercache.h"
 #include "core/fpdfapi/render/cpdf_rendercontext.h"
 #include "core/fpdfapi/render/cpdf_renderstatus.h"
-#include "core/fpdfapi/render/cpdf_transferfunc.h"
 #include "core/fxcrt/fx_safe_types.h"
 #include "core/fxcrt/maybe_owned.h"
 #include "core/fxge/cfx_defaultrenderdevice.h"
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp
index f18b5520744..b73fdff8931 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp
@@ -37,8 +37,8 @@
 #include "core/fpdfapi/page/cpdf_shadingpattern.h"
 #include "core/fpdfapi/page/cpdf_textobject.h"
 #include "core/fpdfapi/page/cpdf_tilingpattern.h"
+#include "core/fpdfapi/page/cpdf_transferfunc.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
-#include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fpdfapi/parser/fpdf_parser_utility.h"
@@ -51,7 +51,6 @@
 #include "core/fpdfapi/render/cpdf_renderoptions.h"
 #include "core/fpdfapi/render/cpdf_scaledrenderbuffer.h"
 #include "core/fpdfapi/render/cpdf_textrenderer.h"
-#include "core/fpdfapi/render/cpdf_transferfunc.h"
 #include "core/fpdfapi/render/cpdf_type3cache.h"
 #include "core/fxcrt/autorestorer.h"
 #include "core/fxcrt/fx_safe_types.h"
@@ -980,6 +979,22 @@ bool Type3CharMissingStrokeColor(const CPDF_Type3Char* pChar,
                    (pChar->colored() && MissingStrokeColor(pColorState)));
 }
 
+#if defined(_SKIA_SUPPORT_) || defined(_SKIA_SUPPORT_PATHS_)
+class ScopedSkiaDeviceFlush {
+ public:
+  explicit ScopedSkiaDeviceFlush(CFX_RenderDevice* pDevice)
+      : m_pDevice(pDevice) {}
+
+  ScopedSkiaDeviceFlush(const ScopedSkiaDeviceFlush&) = delete;
+  ScopedSkiaDeviceFlush& operator=(const ScopedSkiaDeviceFlush&) = delete;
+
+  ~ScopedSkiaDeviceFlush() { m_pDevice->Flush(/*release=*/false); }
+
+ private:
+  CFX_RenderDevice* const m_pDevice;
+};
+#endif
+
 }  // namespace
 
 CPDF_RenderStatus::CPDF_RenderStatus(CPDF_RenderContext* pContext,
@@ -1177,11 +1192,8 @@ void CPDF_RenderStatus::DrawObjWithBackground(CPDF_PageObject* pObj,
   CFX_Matrix matrix = mtObj2Device * buffer.GetMatrix();
   const CPDF_Dictionary* pFormResource = nullptr;
   const CPDF_FormObject* pFormObj = pObj->AsForm();
-  if (pFormObj) {
-    const CPDF_Dictionary* pFormDict = pFormObj->form()->GetDict();
-    if (pFormDict)
-      pFormResource = pFormDict->GetDictFor("Resources");
-  }
+  if (pFormObj)
+    pFormResource = pFormObj->form()->GetDict()->GetDictFor("Resources");
   CPDF_RenderStatus status(m_pContext.Get(), buffer.GetDevice());
   status.SetOptions(m_Options);
   status.SetDeviceMatrix(buffer.GetMatrix());
@@ -1204,9 +1216,8 @@ bool CPDF_RenderStatus::ProcessForm(const CPDF_FormObject* pFormObj,
     return true;
   }
   CFX_Matrix matrix = pFormObj->form_matrix() * mtObj2Device;
-  const CPDF_Dictionary* pFormDict = pFormObj->form()->GetDict();
   const CPDF_Dictionary* pResources =
-      pFormDict ? pFormDict->GetDictFor("Resources") : nullptr;
+      pFormObj->form()->GetDict()->GetDictFor("Resources");
   CPDF_RenderStatus status(m_pContext.Get(), m_pDevice);
   status.SetOptions(m_Options);
   status.SetStopObject(m_pStopObj.Get());
@@ -1438,9 +1449,7 @@ bool CPDF_RenderStatus::ProcessTransparency(CPDF_PageObject* pPageObj,
     group_alpha = pFormObj->m_GeneralState.GetFillAlpha();
     transparency = pFormObj->form()->GetTransparency();
     bGroupTransparent = transparency.IsIsolated();
-    const CPDF_Dictionary* pFormDict = pFormObj->form()->GetDict();
-    if (pFormDict)
-      pFormResource = pFormDict->GetDictFor("Resources");
+    pFormResource = pFormObj->form()->GetDict()->GetDictFor("Resources");
   }
   bool bTextClip =
       (pPageObj->m_ClipPath.HasRef() &&
@@ -1460,11 +1469,9 @@ bool CPDF_RenderStatus::ProcessTransparency(CPDF_PageObject* pPageObj,
     }
     const CPDF_Dictionary* pPageResources =
         pPage ? pPage->m_pPageResources.Get() : nullptr;
-    const CPDF_Object* pCSObj = pPageObj->AsImage()
-                                    ->GetImage()
-                                    ->GetStream()
-                                    ->GetDict()
-                                    ->GetDirectObjectFor("ColorSpace");
+    auto* pImageStream = pPageObj->AsImage()->GetImage()->GetStream();
+    const CPDF_Object* pCSObj =
+        pImageStream->GetDict()->GetDirectObjectFor("ColorSpace");
     RetainPtr<CPDF_ColorSpace> pColorSpace =
         CPDF_DocPageData::FromDocument(pDocument)->GetColorSpace(
             pCSObj, pPageResources);
@@ -1537,9 +1544,10 @@ bool CPDF_RenderStatus::ProcessTransparency(CPDF_PageObject* pPageObj,
       // TODO(thestig): Should we check the return value here?
       CPDF_TextRenderer::DrawTextPath(
           &text_device, textobj->GetCharCodes(), textobj->GetCharPositions(),
-          textobj->m_TextState.GetFont(), textobj->m_TextState.GetFontSize(),
-          textobj->GetTextMatrix(), &new_matrix,
-          textobj->m_GraphState.GetObject(), 0xffffffff, 0, nullptr, 0);
+          textobj->m_TextState.GetFont().Get(),
+          textobj->m_TextState.GetFontSize(), textobj->GetTextMatrix(),
+          &new_matrix, textobj->m_GraphState.GetObject(), 0xffffffff, 0,
+          nullptr, 0);
     }
   }
   CPDF_RenderStatus bitmap_render(m_pContext.Get(), &bitmap_device);
@@ -1665,7 +1673,7 @@ bool CPDF_RenderStatus::ProcessText(CPDF_TextObject* textobj,
   if (text_render_mode == TextRenderingMode::MODE_INVISIBLE)
     return true;
 
-  CPDF_Font* pFont = textobj->m_TextState.GetFont();
+  RetainPtr<CPDF_Font> pFont = textobj->m_TextState.GetFont();
   if (pFont->IsType3Font())
     return ProcessType3Text(textobj, mtObj2Device);
 
@@ -1725,7 +1733,7 @@ bool CPDF_RenderStatus::ProcessText(CPDF_TextObject* textobj,
 
   float font_size = textobj->m_TextState.GetFontSize();
   if (bPattern) {
-    DrawTextPathWithPattern(textobj, mtObj2Device, pFont, font_size,
+    DrawTextPathWithPattern(textobj, mtObj2Device, pFont.Get(), font_size,
                             &text_matrix, bFill, bStroke);
     return true;
   }
@@ -1751,15 +1759,15 @@ bool CPDF_RenderStatus::ProcessText(CPDF_TextObject* textobj,
     if (m_Options.GetOptions().bNoTextSmooth)
       flag |= FXFILL_NOPATHSMOOTH;
     return CPDF_TextRenderer::DrawTextPath(
-        m_pDevice, textobj->GetCharCodes(), textobj->GetCharPositions(), pFont,
-        font_size, text_matrix, pDeviceMatrix,
+        m_pDevice, textobj->GetCharCodes(), textobj->GetCharPositions(),
+        pFont.Get(), font_size, text_matrix, pDeviceMatrix,
         textobj->m_GraphState.GetObject(), fill_argb, stroke_argb,
         pClippingPath, flag);
   }
   text_matrix.Concat(mtObj2Device);
   return CPDF_TextRenderer::DrawNormalText(
-      m_pDevice, textobj->GetCharCodes(), textobj->GetCharPositions(), pFont,
-      font_size, text_matrix, fill_argb, m_Options);
+      m_pDevice, textobj->GetCharCodes(), textobj->GetCharPositions(),
+      pFont.Get(), font_size, text_matrix, fill_argb, m_Options);
 }
 
 // TODO(npm): Font fallback for type 3 fonts? (Completely separate code!!)
@@ -1823,10 +1831,9 @@ bool CPDF_RenderStatus::ProcessType3Text(CPDF_TextObject* textobj,
       options.GetOptions().bRectAA = true;
       options.GetOptions().bForceDownsample = false;
 
-      const CPDF_Dictionary* pFormResource = nullptr;
-      auto* pForm = static_cast<const CPDF_Form*>(pType3Char->form());
-      if (pForm->GetDict())
-        pFormResource = pForm->GetDict()->GetDictFor("Resources");
+      const auto* pForm = static_cast<const CPDF_Form*>(pType3Char->form());
+      const CPDF_Dictionary* pFormResource =
+          pForm->GetDict()->GetDictFor("Resources");
 
       if (fill_alpha == 255) {
         CPDF_RenderStatus status(m_pContext.Get(), m_pDevice);
@@ -1873,12 +1880,13 @@ bool CPDF_RenderStatus::ProcessType3Text(CPDF_TextObject* textobj,
         CPDF_Document* pDoc = pType3Font->GetDocument();
         RetainPtr<CPDF_Type3Cache> pCache =
             CPDF_DocRenderData::FromDocument(pDoc)->GetCachedType3(pType3Font);
-        refTypeCache.insert(pCache);
 
         const CFX_GlyphBitmap* pBitmap = pCache->LoadGlyph(charcode, &matrix);
         if (!pBitmap)
           continue;
 
+        refTypeCache.insert(std::move(pCache));
+
         CFX_Point origin(FXSYS_round(matrix.e), FXSYS_round(matrix.f));
         if (glyphs.empty()) {
           FX_SAFE_INT32 left = origin.x;
@@ -2135,6 +2143,9 @@ void CPDF_RenderStatus::DrawTilingPattern(CPDF_TilingPattern* pPattern,
     return;
 
   CFX_RenderDevice::StateRestorer restorer(m_pDevice);
+#if defined(_SKIA_SUPPORT_) || defined(_SKIA_SUPPORT_PATHS_)
+  ScopedSkiaDeviceFlush scoped_skia_device_flush(m_pDevice);
+#endif
   if (!ClipPattern(pPageObj, mtObj2Device, bStroke))
     return;
 
@@ -2534,9 +2545,8 @@ RetainPtr<CFX_DIBitmap> CPDF_RenderStatus::LoadSMask(
     bitmap->Clear(0);
   }
 
-  const CPDF_Dictionary* pFormResource = nullptr;
-  if (form.GetDict())
-    pFormResource = form.GetDict()->GetDictFor("Resources");
+  const CPDF_Dictionary* pFormResource =
+      form.GetDict()->GetDictFor("Resources");
   CPDF_RenderOptions options;
   options.SetColorMode(bLuminosity ? CPDF_RenderOptions::kNormal
                                    : CPDF_RenderOptions::kAlpha);
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.h b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.h
index cb07221a053..193a7d313ea 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.h
@@ -13,7 +13,9 @@
 #include "core/fpdfapi/page/cpdf_clippath.h"
 #include "core/fpdfapi/page/cpdf_graphicstates.h"
 #include "core/fpdfapi/page/cpdf_transparency.h"
+#include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/render/cpdf_renderoptions.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "core/fxge/fx_dib.h"
 
@@ -21,7 +23,6 @@ class CFX_DIBitmap;
 class CFX_PathData;
 class CFX_RenderDevice;
 class CPDF_Color;
-class CPDF_Dictionary;
 class CPDF_Font;
 class CPDF_FormObject;
 class CPDF_ImageCacheEntry;
@@ -50,7 +51,9 @@ class CPDF_RenderStatus {
   void SetOptions(const CPDF_RenderOptions& options) { m_Options = options; }
   void SetDeviceMatrix(const CFX_Matrix& matrix) { m_DeviceMatrix = matrix; }
   void SetStopObject(const CPDF_PageObject* pStopObj) { m_pStopObj = pStopObj; }
-  void SetFormResource(const CPDF_Dictionary* pRes) { m_pFormResource = pRes; }
+  void SetFormResource(const CPDF_Dictionary* pRes) {
+    m_pFormResource.Reset(pRes);
+  }
   void SetType3Char(CPDF_Type3Char* pType3Char) { m_pType3Char = pType3Char; }
   void SetFillColor(FX_ARGB color) { m_T3FillColor = color; }
   void SetDropObjects(bool bDropObjects) { m_bDropObjects = bDropObjects; }
@@ -185,7 +188,7 @@ class CPDF_RenderStatus {
                                const CFX_Matrix& mtObj2Device) const;
 
   CPDF_RenderOptions m_Options;
-  UnownedPtr<const CPDF_Dictionary> m_pFormResource;
+  RetainPtr<const CPDF_Dictionary> m_pFormResource;
   RetainPtr<CPDF_Dictionary> m_pPageResource;
   std::vector<CPDF_Type3Font*> m_Type3FontCache;
   UnownedPtr<CPDF_RenderContext> const m_pContext;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_type3cache.cpp b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_type3cache.cpp
index 34114166c1e..078bec79b81 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_type3cache.cpp
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_type3cache.cpp
@@ -85,17 +85,9 @@ int DetectFirstLastScan(const RetainPtr<CFX_DIBitmap>& pBitmap, bool bFirst) {
 
 }  // namespace
 
-CPDF_Type3Cache::CPDF_Type3Cache(CPDF_Type3Font* pFont) : m_pFont(pFont) {
-  // Increments refcount in CPDF_DocPageData.
-  CPDF_Document* pDoc = m_pFont->GetDocument();
-  CPDF_DocPageData::FromDocument(pDoc)->GetFont(m_pFont->GetFontDict());
-}
+CPDF_Type3Cache::CPDF_Type3Cache(CPDF_Type3Font* pFont) : m_pFont(pFont) {}
 
-CPDF_Type3Cache::~CPDF_Type3Cache() {
-  // Decrements refcount in CPDF_DocPageData.
-  CPDF_Document* pDoc = m_pFont->GetDocument();
-  CPDF_DocPageData::FromDocument(pDoc)->ReleaseFont(m_pFont->GetFontDict());
-}
+CPDF_Type3Cache::~CPDF_Type3Cache() = default;
 
 const CFX_GlyphBitmap* CPDF_Type3Cache::LoadGlyph(uint32_t charcode,
                                                   const CFX_Matrix* pMatrix) {
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_type3cache.h b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_type3cache.h
index 1717e8a2999..4371a015d00 100644
--- a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_type3cache.h
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_type3cache.h
@@ -36,7 +36,7 @@ class CPDF_Type3Cache final : public Retainable, public Observable {
                                                uint32_t charcode,
                                                const CFX_Matrix* pMatrix);
 
-  UnownedPtr<CPDF_Type3Font> const m_pFont;
+  RetainPtr<CPDF_Type3Font> const m_pFont;
   std::map<ByteString, std::unique_ptr<CPDF_Type3GlyphMap>> m_SizeMap;
 };
 
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_windowsrenderdevice.cpp b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_windowsrenderdevice.cpp
new file mode 100644
index 00000000000..8e1f212c596
--- /dev/null
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_windowsrenderdevice.cpp
@@ -0,0 +1,26 @@
+// Copyright 2019 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
+
+#include "core/fpdfapi/render/cpdf_windowsrenderdevice.h"
+
+#include "core/fxcodec/basic/basicmodule.h"
+#include "core/fxcodec/fax/faxmodule.h"
+#include "core/fxcodec/flate/flatemodule.h"
+#include "core/fxcodec/jpeg/jpegmodule.h"
+#include "core/fxge/win32/cfx_psrenderer.h"
+
+namespace {
+
+constexpr EncoderIface kEncoderIface = {
+    BasicModule::A85Encode, FaxModule::FaxEncode, FlateModule::Encode,
+    JpegModule::JpegEncode, BasicModule::RunLengthEncode};
+
+}  // namespace
+
+CPDF_WindowsRenderDevice::CPDF_WindowsRenderDevice(HDC hDC)
+    : CFX_WindowsRenderDevice(hDC, &kEncoderIface) {}
+
+CPDF_WindowsRenderDevice::~CPDF_WindowsRenderDevice() = default;
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_windowsrenderdevice.h b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_windowsrenderdevice.h
new file mode 100644
index 00000000000..51d150eb0b3
--- /dev/null
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/cpdf_windowsrenderdevice.h
@@ -0,0 +1,18 @@
+// Copyright 2019 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
+
+#ifndef CORE_FPDFAPI_RENDER_CPDF_WINDOWSRENDERDEVICE_H_
+#define CORE_FPDFAPI_RENDER_CPDF_WINDOWSRENDERDEVICE_H_
+
+#include "core/fxge/cfx_windowsrenderdevice.h"
+
+class CPDF_WindowsRenderDevice final : public CFX_WindowsRenderDevice {
+ public:
+  explicit CPDF_WindowsRenderDevice(HDC hDC);
+  ~CPDF_WindowsRenderDevice() override;
+};
+
+#endif  // CORE_FPDFAPI_RENDER_CPDF_WINDOWSRENDERDEVICE_H_
diff --git a/chromium/third_party/pdfium/core/fpdfapi/render/fpdf_progressive_render_embeddertest.cpp b/chromium/third_party/pdfium/core/fpdfapi/render/fpdf_progressive_render_embeddertest.cpp
new file mode 100644
index 00000000000..3add124b5b6
--- /dev/null
+++ b/chromium/third_party/pdfium/core/fpdfapi/render/fpdf_progressive_render_embeddertest.cpp
@@ -0,0 +1,221 @@
+// Copyright 2019 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <utility>
+
+#include "build/build_config.h"
+#include "core/fxcrt/fx_system.h"
+#include "public/fpdf_progressive.h"
+#include "testing/embedder_test.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+class FPDFProgressiveRenderEmbedderTest : public EmbedderTest {
+ public:
+  // StartRenderPageWithFlags() with no flags.
+  // The call returns true if the rendering is complete.
+  bool StartRenderPage(FPDF_PAGE page, IFSDK_PAUSE* pause);
+
+  // Start rendering of |page| into a bitmap with the ability to pause the
+  // rendering with the specified rendering |flags|.
+  // The call returns true if the rendering is complete.
+  //
+  // See public/fpdfview.h for a list of page rendering flags.
+  bool StartRenderPageWithFlags(FPDF_PAGE page, IFSDK_PAUSE* pause, int flags);
+
+  // Continue rendering of |page| into the bitmap created in
+  // StartRenderPageWithFlags().
+  // The call returns true if the rendering is complete.
+  bool ContinueRenderPage(FPDF_PAGE page, IFSDK_PAUSE* pause);
+
+  // Simplified form of FinishRenderPageWithForms() with no form handle.
+  ScopedFPDFBitmap FinishRenderPage(FPDF_PAGE page);
+
+  // Finish rendering of |page| into the bitmap created in
+  // StartRenderPageWithFlags(). This also renders the forms associated with
+  // the page. The form handle associated with |page| should be passed in via
+  // |handle|. If |handle| is nullptr, then forms on the page will not be
+  // rendered.
+  // This returns the bitmap generated by the progressive render calls.
+  ScopedFPDFBitmap FinishRenderPageWithForms(FPDF_PAGE page,
+                                             FPDF_FORMHANDLE handle);
+
+ private:
+  // Keeps the bitmap used for progressive rendering alive until
+  // FPDF_RenderPage_Close() is called after which the bitmap is returned
+  // to the caller.
+  ScopedFPDFBitmap progressive_render_bitmap_;
+  int progressive_render_flags_ = 0;
+};
+
+bool FPDFProgressiveRenderEmbedderTest::StartRenderPage(FPDF_PAGE page,
+                                                        IFSDK_PAUSE* pause) {
+  return StartRenderPageWithFlags(page, pause, 0);
+}
+
+bool FPDFProgressiveRenderEmbedderTest::StartRenderPageWithFlags(
+    FPDF_PAGE page,
+    IFSDK_PAUSE* pause,
+    int flags) {
+  int width = static_cast<int>(FPDF_GetPageWidth(page));
+  int height = static_cast<int>(FPDF_GetPageHeight(page));
+  progressive_render_flags_ = flags;
+  int alpha = FPDFPage_HasTransparency(page) ? 1 : 0;
+  progressive_render_bitmap_ =
+      ScopedFPDFBitmap(FPDFBitmap_Create(width, height, alpha));
+  FPDF_DWORD fill_color = alpha ? 0x00000000 : 0xFFFFFFFF;
+  FPDFBitmap_FillRect(progressive_render_bitmap_.get(), 0, 0, width, height,
+                      fill_color);
+  int rv = FPDF_RenderPageBitmap_Start(progressive_render_bitmap_.get(), page,
+                                       0, 0, width, height, 0,
+                                       progressive_render_flags_, pause);
+  return rv != FPDF_RENDER_TOBECONTINUED;
+}
+
+bool FPDFProgressiveRenderEmbedderTest::ContinueRenderPage(FPDF_PAGE page,
+                                                           IFSDK_PAUSE* pause) {
+  ASSERT(progressive_render_bitmap_);
+
+  int rv = FPDF_RenderPage_Continue(page, pause);
+  return rv != FPDF_RENDER_TOBECONTINUED;
+}
+
+ScopedFPDFBitmap FPDFProgressiveRenderEmbedderTest::FinishRenderPage(
+    FPDF_PAGE page) {
+  return FinishRenderPageWithForms(page, /*handle=*/nullptr);
+}
+
+ScopedFPDFBitmap FPDFProgressiveRenderEmbedderTest::FinishRenderPageWithForms(
+    FPDF_PAGE page,
+    FPDF_FORMHANDLE handle) {
+  ASSERT(progressive_render_bitmap_);
+
+  int width = static_cast<int>(FPDF_GetPageWidth(page));
+  int height = static_cast<int>(FPDF_GetPageHeight(page));
+  FPDF_FFLDraw(handle, progressive_render_bitmap_.get(), page, 0, 0, width,
+               height, 0, progressive_render_flags_);
+  FPDF_RenderPage_Close(page);
+  return std::move(progressive_render_bitmap_);
+}
+
+class FakePause : public IFSDK_PAUSE {
+ public:
+  explicit FakePause(bool should_pause) : should_pause_(should_pause) {
+    IFSDK_PAUSE::version = 1;
+    IFSDK_PAUSE::user = nullptr;
+    IFSDK_PAUSE::NeedToPauseNow = Pause_NeedToPauseNow;
+  }
+  ~FakePause() = default;
+
+  static FPDF_BOOL Pause_NeedToPauseNow(IFSDK_PAUSE* param) {
+    return static_cast<FakePause*>(param)->should_pause_;
+  }
+
+ private:
+  const bool should_pause_ = false;
+};
+
+TEST_F(FPDFProgressiveRenderEmbedderTest, RenderWithoutPause) {
+#if defined(OS_WIN)
+  static constexpr char kMd5BaseContent[] = "649d6792ea50faf98c013c2d81710595";
+#elif defined(OS_MACOSX)
+  static constexpr char kMd5BaseContent[] = "5f933aac2a74434be1b4d0bdb5334f0b";
+#else
+  static constexpr char kMd5BaseContent[] = "a24edc7740f1d6f76899652dcf825dea";
+#endif
+
+  // Test rendering of page content using progressive render APIs
+  // without pausing the rendering.
+  EXPECT_TRUE(OpenDocument("annotation_stamp_with_ap.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  ASSERT_TRUE(page);
+  FakePause pause(false);
+  EXPECT_TRUE(StartRenderPage(page, &pause));
+  ScopedFPDFBitmap bitmap = FinishRenderPage(page);
+  CompareBitmap(bitmap.get(), 595, 842, kMd5BaseContent);
+  UnloadPage(page);
+}
+
+TEST_F(FPDFProgressiveRenderEmbedderTest, RenderWithPause) {
+#if defined(OS_WIN)
+  static constexpr char kMd5BaseContent[] = "649d6792ea50faf98c013c2d81710595";
+#elif defined(OS_MACOSX)
+  static constexpr char kMd5BaseContent[] = "5f933aac2a74434be1b4d0bdb5334f0b";
+#else
+  static constexpr char kMd5BaseContent[] = "a24edc7740f1d6f76899652dcf825dea";
+#endif
+
+  // Test rendering of page content using progressive render APIs
+  // with pause in rendering.
+  EXPECT_TRUE(OpenDocument("annotation_stamp_with_ap.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  ASSERT_TRUE(page);
+  FakePause pause(true);
+  bool render_done = StartRenderPage(page, &pause);
+  EXPECT_FALSE(render_done);
+
+  while (!render_done) {
+    render_done = ContinueRenderPage(page, &pause);
+  }
+  ScopedFPDFBitmap bitmap = FinishRenderPage(page);
+  CompareBitmap(bitmap.get(), 595, 842, kMd5BaseContent);
+  UnloadPage(page);
+}
+
+TEST_F(FPDFProgressiveRenderEmbedderTest, RenderAnnotWithPause) {
+#if defined(OS_WIN)
+  static constexpr char kMd5ContentWithAnnot[] =
+      "6aa001a77ec05d0f1b0d1d22e28744d4";
+#elif defined(OS_MACOSX)
+  static constexpr char kMd5ContentWithAnnot[] =
+      "c35408717759562d1f8bf33d317483d2";
+#else
+  static constexpr char kMd5ContentWithAnnot[] =
+      "b42cef463483e668eaf4055a65e4f1f5";
+#endif
+
+  // Test rendering of the page with annotations using progressive render APIs
+  // with pause in rendering.
+  EXPECT_TRUE(OpenDocument("annotation_stamp_with_ap.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  ASSERT_TRUE(page);
+  FakePause pause(true);
+  bool render_done = StartRenderPageWithFlags(page, &pause, FPDF_ANNOT);
+  EXPECT_FALSE(render_done);
+
+  while (!render_done) {
+    render_done = ContinueRenderPage(page, &pause);
+  }
+  ScopedFPDFBitmap bitmap = FinishRenderPage(page);
+  CompareBitmap(bitmap.get(), 595, 842, kMd5ContentWithAnnot);
+  UnloadPage(page);
+}
+
+TEST_F(FPDFProgressiveRenderEmbedderTest, RenderFormsWithPause) {
+#if defined(OS_WIN)
+  static constexpr char kMd5ContentWithForms[] =
+      "d3204faa62b607f0bd3893c9c22cabcb";
+#elif defined(OS_MACOSX)
+  static constexpr char kMd5ContentWithForms[] =
+      "5f11dbe575fe197a37c3fb422559f8ff";
+#else
+  static constexpr char kMd5ContentWithForms[] =
+      "b890950d4b9bc163b1a96797f3004b53";
+#endif
+
+  // Test rendering of the page with forms using progressive render APIs
+  // with pause in rendering.
+  EXPECT_TRUE(OpenDocument("text_form.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  ASSERT_TRUE(page);
+  FakePause pause(true);
+  bool render_done = StartRenderPage(page, &pause);
+  EXPECT_FALSE(render_done);
+
+  while (!render_done) {
+    render_done = ContinueRenderPage(page, &pause);
+  }
+  ScopedFPDFBitmap bitmap = FinishRenderPageWithForms(page, form_handle_);
+  CompareBitmap(bitmap.get(), 300, 300, kMd5ContentWithForms);
+  UnloadPage(page);
+}
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/BUILD.gn b/chromium/third_party/pdfium/core/fpdfdoc/BUILD.gn
index ace41a6b357..9cc46ab5129 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/BUILD.gn
+++ b/chromium/third_party/pdfium/core/fpdfdoc/BUILD.gn
@@ -82,13 +82,11 @@ jumbo_source_set("fpdfdoc") {
     "csection.h",
     "ctypeset.cpp",
     "ctypeset.h",
-    "ipdf_formnotify.h",
     "ipvt_fontmap.h",
   ]
   configs += [ "../../:pdfium_core_config" ]
   deps = [
     "../../constants",
-    "../fpdfapi",
     "../fpdfapi/font",
     "../fpdfapi/page",
     "../fpdfapi/parser",
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cba_fontmap.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cba_fontmap.cpp
index b4f737ee3df..e2f935cc88b 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cba_fontmap.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cba_fontmap.cpp
@@ -10,7 +10,6 @@
 #include <utility>
 
 #include "constants/annotation_common.h"
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/font/cpdf_fontencoding.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
@@ -53,20 +52,26 @@ bool FindNativeTrueTypeFont(ByteString sFontFaceName) {
   return false;
 }
 
-CPDF_Font* AddNativeTrueTypeFontToPDF(CPDF_Document* pDoc,
-                                      ByteString sFontFaceName,
-                                      uint8_t nCharset) {
+RetainPtr<CPDF_Font> AddNativeTrueTypeFontToPDF(CPDF_Document* pDoc,
+                                                ByteString sFontFaceName,
+                                                uint8_t nCharset) {
   if (!pDoc)
     return nullptr;
 
   auto pFXFont = pdfium::MakeUnique<CFX_Font>();
   pFXFont->LoadSubst(sFontFaceName, true, 0, 0, 0,
                      FX_GetCodePageFromCharset(nCharset), false);
-  return CPDF_DocPageData::FromDocument(pDoc)->AddFont(pFXFont.get(), nCharset);
+
+  auto* pDocPageData = CPDF_DocPageData::FromDocument(pDoc);
+  return pDocPageData->AddFont(std::move(pFXFont), nCharset);
 }
 
 }  // namespace
 
+CBA_FontMap::Data::Data() = default;
+
+CBA_FontMap::Data::~Data() = default;
+
 CBA_FontMap::CBA_FontMap(CPDF_Document* pDocument, CPDF_Dictionary* pAnnotDict)
     : m_pDocument(pDocument), m_pAnnotDict(pAnnotDict) {
   Initialize();
@@ -76,7 +81,7 @@ CBA_FontMap::~CBA_FontMap() {
   Empty();
 }
 
-CPDF_Font* CBA_FontMap::GetPDFFont(int32_t nFontIndex) {
+RetainPtr<CPDF_Font> CBA_FontMap::GetPDFFont(int32_t nFontIndex) {
   if (pdfium::IndexInBounds(m_Data, nFontIndex))
     return m_Data[nFontIndex]->pFont;
   return nullptr;
@@ -156,7 +161,7 @@ void CBA_FontMap::Reset() {
   m_sDefaultFontName.clear();
 }
 
-void CBA_FontMap::SetDefaultFont(CPDF_Font* pFont,
+void CBA_FontMap::SetDefaultFont(const RetainPtr<CPDF_Font>& pFont,
                                  const ByteString& sFontName) {
   ASSERT(pFont);
 
@@ -166,10 +171,9 @@ void CBA_FontMap::SetDefaultFont(CPDF_Font* pFont,
   m_pDefaultFont = pFont;
   m_sDefaultFontName = sFontName;
 
-  int32_t nCharset = FX_CHARSET_Default;
-  if (const CFX_SubstFont* pSubstFont = m_pDefaultFont->GetSubstFont())
-    nCharset = pSubstFont->m_Charset;
-  AddFontData(m_pDefaultFont.Get(), m_sDefaultFontName, nCharset);
+  const CFX_SubstFont* pSubstFont = m_pDefaultFont->GetSubstFont();
+  int32_t nCharset = pSubstFont ? pSubstFont->m_Charset : FX_CHARSET_Default;
+  AddFontData(m_pDefaultFont, m_sDefaultFontName, nCharset);
 }
 
 void CBA_FontMap::SetAPType(const ByteString& sAPType) {
@@ -196,8 +200,8 @@ void CBA_FontMap::Initialize() {
         else
           nCharset = FX_CHARSET_ANSI;
       }
-      AddFontData(m_pDefaultFont.Get(), m_sDefaultFontName, nCharset);
-      AddFontToAnnotDict(m_pDefaultFont.Get(), m_sDefaultFontName);
+      AddFontData(m_pDefaultFont, m_sDefaultFontName, nCharset);
+      AddFontToAnnotDict(m_pDefaultFont, m_sDefaultFontName);
     }
   }
 
@@ -205,8 +209,8 @@ void CBA_FontMap::Initialize() {
     GetFontIndex(CFX_Font::kDefaultAnsiFontName, FX_CHARSET_ANSI, false);
 }
 
-CPDF_Font* CBA_FontMap::FindFontSameCharset(ByteString* sFontAlias,
-                                            int32_t nCharset) {
+RetainPtr<CPDF_Font> CBA_FontMap::FindFontSameCharset(ByteString* sFontAlias,
+                                                      int32_t nCharset) {
   if (m_pAnnotDict->GetStringFor(pdfium::annotation::kSubtype) != "Widget")
     return nullptr;
 
@@ -225,9 +229,10 @@ CPDF_Font* CBA_FontMap::FindFontSameCharset(ByteString* sFontAlias,
   return FindResFontSameCharset(pDRDict, sFontAlias, nCharset);
 }
 
-CPDF_Font* CBA_FontMap::FindResFontSameCharset(const CPDF_Dictionary* pResDict,
-                                               ByteString* sFontAlias,
-                                               int32_t nCharset) {
+RetainPtr<CPDF_Font> CBA_FontMap::FindResFontSameCharset(
+    const CPDF_Dictionary* pResDict,
+    ByteString* sFontAlias,
+    int32_t nCharset) {
   if (!pResDict)
     return nullptr;
 
@@ -235,7 +240,7 @@ CPDF_Font* CBA_FontMap::FindResFontSameCharset(const CPDF_Dictionary* pResDict,
   if (!pFonts)
     return nullptr;
 
-  CPDF_Font* pFind = nullptr;
+  RetainPtr<CPDF_Font> pFind;
   CPDF_DictionaryLocker locker(pFonts);
   for (const auto& it : locker) {
     const ByteString& csKey = it.first;
@@ -247,7 +252,7 @@ CPDF_Font* CBA_FontMap::FindResFontSameCharset(const CPDF_Dictionary* pResDict,
       continue;
 
     auto* pData = CPDF_DocPageData::FromDocument(m_pDocument.Get());
-    CPDF_Font* pFont = pData->GetFont(pElement);
+    RetainPtr<CPDF_Font> pFont = pData->GetFont(pElement);
     if (!pFont)
       continue;
 
@@ -257,13 +262,13 @@ CPDF_Font* CBA_FontMap::FindResFontSameCharset(const CPDF_Dictionary* pResDict,
 
     if (pSubst->m_Charset == nCharset) {
       *sFontAlias = csKey;
-      pFind = pFont;
+      pFind = std::move(pFont);
     }
   }
   return pFind;
 }
 
-CPDF_Font* CBA_FontMap::GetAnnotDefaultFont(ByteString* sAlias) {
+RetainPtr<CPDF_Font> CBA_FontMap::GetAnnotDefaultFont(ByteString* sAlias) {
   CPDF_Dictionary* pAcroFormDict = nullptr;
   const bool bWidget =
       (m_pAnnotDict->GetStringFor(pdfium::annotation::kSubtype) == "Widget");
@@ -315,7 +320,7 @@ CPDF_Font* CBA_FontMap::GetAnnotDefaultFont(ByteString* sAlias) {
   return CPDF_DocPageData::FromDocument(m_pDocument.Get())->GetFont(pFontDict);
 }
 
-void CBA_FontMap::AddFontToAnnotDict(CPDF_Font* pFont,
+void CBA_FontMap::AddFontToAnnotDict(const RetainPtr<CPDF_Font>& pFont,
                                      const ByteString& sAlias) {
   if (!pFont)
     return;
@@ -378,7 +383,8 @@ int32_t CBA_FontMap::GetFontIndex(const ByteString& sFontName,
     return nFontIndex;
 
   ByteString sAlias;
-  CPDF_Font* pFont = bFind ? FindFontSameCharset(&sAlias, nCharset) : nullptr;
+  RetainPtr<CPDF_Font> pFont =
+      bFind ? FindFontSameCharset(&sAlias, nCharset) : nullptr;
   if (!pFont) {
     ByteString sTemp = sFontName;
     pFont = AddFontToDocument(m_pDocument.Get(), sTemp, nCharset);
@@ -388,7 +394,7 @@ int32_t CBA_FontMap::GetFontIndex(const ByteString& sFontName,
   return AddFontData(pFont, sAlias, nCharset);
 }
 
-int32_t CBA_FontMap::AddFontData(CPDF_Font* pFont,
+int32_t CBA_FontMap::AddFontData(const RetainPtr<CPDF_Font>& pFont,
                                  const ByteString& sFontAlias,
                                  int32_t nCharset) {
   auto pNewData = pdfium::MakeUnique<Data>();
@@ -450,9 +456,9 @@ ByteString CBA_FontMap::GetCachedNativeFontName(int32_t nCharset) {
   return sNew;
 }
 
-CPDF_Font* CBA_FontMap::AddFontToDocument(CPDF_Document* pDoc,
-                                          ByteString& sFontName,
-                                          uint8_t nCharset) {
+RetainPtr<CPDF_Font> CBA_FontMap::AddFontToDocument(CPDF_Document* pDoc,
+                                                    ByteString& sFontName,
+                                                    uint8_t nCharset) {
   if (IsStandardFont(sFontName))
     return AddStandardFont(pDoc, sFontName);
 
@@ -478,29 +484,25 @@ bool CBA_FontMap::IsStandardFont(const ByteString& sFontName) {
     if (sFontName == name)
       return true;
   }
-
   return false;
 }
 
-CPDF_Font* CBA_FontMap::AddStandardFont(CPDF_Document* pDoc,
-                                        ByteString& sFontName) {
+RetainPtr<CPDF_Font> CBA_FontMap::AddStandardFont(CPDF_Document* pDoc,
+                                                  ByteString& sFontName) {
   if (!pDoc)
     return nullptr;
 
-  CPDF_Font* pFont = nullptr;
   auto* pPageData = CPDF_DocPageData::FromDocument(pDoc);
-  if (sFontName == "ZapfDingbats") {
-    pFont = pPageData->AddStandardFont(sFontName.c_str(), nullptr);
-  } else {
-    CPDF_FontEncoding fe(PDFFONT_ENCODING_WINANSI);
-    pFont = pPageData->AddStandardFont(sFontName.c_str(), &fe);
-  }
-  return pFont;
+  if (sFontName == "ZapfDingbats")
+    return pPageData->AddStandardFont(sFontName.c_str(), nullptr);
+
+  static const CPDF_FontEncoding fe(PDFFONT_ENCODING_WINANSI);
+  return pPageData->AddStandardFont(sFontName.c_str(), &fe);
 }
 
-CPDF_Font* CBA_FontMap::AddSystemFont(CPDF_Document* pDoc,
-                                      ByteString& sFontName,
-                                      uint8_t nCharset) {
+RetainPtr<CPDF_Font> CBA_FontMap::AddSystemFont(CPDF_Document* pDoc,
+                                                ByteString& sFontName,
+                                                uint8_t nCharset) {
   if (!pDoc)
     return nullptr;
 
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cba_fontmap.h b/chromium/third_party/pdfium/core/fpdfdoc/cba_fontmap.h
index f4abfbab7f0..ae148098f51 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cba_fontmap.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cba_fontmap.h
@@ -12,6 +12,7 @@
 
 #include "core/fpdfdoc/ipvt_fontmap.h"
 #include "core/fxcrt/fx_codepage.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 
 class CPDF_Dictionary;
@@ -19,11 +20,13 @@ class CPDF_Document;
 
 class CBA_FontMap final : public IPVT_FontMap {
  public:
+  static int32_t GetNativeCharset();
+
   CBA_FontMap(CPDF_Document* pDocument, CPDF_Dictionary* pAnnotDict);
   ~CBA_FontMap() override;
 
   // IPVT_FontMap
-  CPDF_Font* GetPDFFont(int32_t nFontIndex) override;
+  RetainPtr<CPDF_Font> GetPDFFont(int32_t nFontIndex) override;
   ByteString GetPDFFontAlias(int32_t nFontIndex) override;
   int32_t GetWordFontIndex(uint16_t word,
                            int32_t nCharset,
@@ -31,15 +34,17 @@ class CBA_FontMap final : public IPVT_FontMap {
   int32_t CharCodeFromUnicode(int32_t nFontIndex, uint16_t word) override;
   int32_t CharSetFromUnicode(uint16_t word, int32_t nOldCharset) override;
 
-  static int32_t GetNativeCharset();
-
   void Reset();
-  void SetDefaultFont(CPDF_Font* pFont, const ByteString& sFontName);
   void SetAPType(const ByteString& sAPType);
+  void SetDefaultFont(const RetainPtr<CPDF_Font>& pFont,
+                      const ByteString& sFontName);
 
  private:
   struct Data {
-    CPDF_Font* pFont;
+    Data();
+    ~Data();
+
+    RetainPtr<CPDF_Font> pFont;
     int32_t nCharset;
     ByteString sFontName;
   };
@@ -50,13 +55,14 @@ class CBA_FontMap final : public IPVT_FontMap {
   };
 
   void Initialize();
-  CPDF_Font* FindFontSameCharset(ByteString* sFontAlias, int32_t nCharset);
-
-  CPDF_Font* FindResFontSameCharset(const CPDF_Dictionary* pResDict,
-                                    ByteString* sFontAlias,
-                                    int32_t nCharset);
-  CPDF_Font* GetAnnotDefaultFont(ByteString* sAlias);
-  void AddFontToAnnotDict(CPDF_Font* pFont, const ByteString& sAlias);
+  RetainPtr<CPDF_Font> FindFontSameCharset(ByteString* sFontAlias,
+                                           int32_t nCharset);
+  RetainPtr<CPDF_Font> FindResFontSameCharset(const CPDF_Dictionary* pResDict,
+                                              ByteString* sFontAlias,
+                                              int32_t nCharset);
+  RetainPtr<CPDF_Font> GetAnnotDefaultFont(ByteString* sAlias);
+  void AddFontToAnnotDict(const RetainPtr<CPDF_Font>& pFont,
+                          const ByteString& sAlias);
 
   bool KnowWord(int32_t nFontIndex, uint16_t word);
 
@@ -64,7 +70,7 @@ class CBA_FontMap final : public IPVT_FontMap {
   int32_t GetFontIndex(const ByteString& sFontName,
                        int32_t nCharset,
                        bool bFind);
-  int32_t AddFontData(CPDF_Font* pFont,
+  int32_t AddFontData(const RetainPtr<CPDF_Font>& pFont,
                       const ByteString& sFontAlias,
                       int32_t nCharset);
 
@@ -74,20 +80,21 @@ class CBA_FontMap final : public IPVT_FontMap {
   int32_t FindFont(const ByteString& sFontName, int32_t nCharset);
   ByteString GetNativeFontName(int32_t nCharset);
   ByteString GetCachedNativeFontName(int32_t nCharset);
-  CPDF_Font* AddFontToDocument(CPDF_Document* pDoc,
-                               ByteString& sFontName,
-                               uint8_t nCharset);
   bool IsStandardFont(const ByteString& sFontName);
-  CPDF_Font* AddStandardFont(CPDF_Document* pDoc, ByteString& sFontName);
-  CPDF_Font* AddSystemFont(CPDF_Document* pDoc,
-                           ByteString& sFontName,
-                           uint8_t nCharset);
+  RetainPtr<CPDF_Font> AddFontToDocument(CPDF_Document* pDoc,
+                                         ByteString& sFontName,
+                                         uint8_t nCharset);
+  RetainPtr<CPDF_Font> AddStandardFont(CPDF_Document* pDoc,
+                                       ByteString& sFontName);
+  RetainPtr<CPDF_Font> AddSystemFont(CPDF_Document* pDoc,
+                                     ByteString& sFontName,
+                                     uint8_t nCharset);
 
   std::vector<std::unique_ptr<Data>> m_Data;
   std::vector<std::unique_ptr<Native>> m_NativeFont;
   UnownedPtr<CPDF_Document> const m_pDocument;
   RetainPtr<CPDF_Dictionary> const m_pAnnotDict;
-  UnownedPtr<CPDF_Font> m_pDefaultFont;
+  RetainPtr<CPDF_Font> m_pDefaultFont;
   ByteString m_sDefaultFontName;
   ByteString m_sAPType = "N";
 };
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_aaction.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_aaction.cpp
index 905be7c5871..8284913feec 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_aaction.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_aaction.cpp
@@ -41,7 +41,7 @@ static_assert(FX_ArraySize(kAATypes) == CPDF_AAction::kNumberOfActions - 1,
 
 }  // namespace
 
-CPDF_AAction::CPDF_AAction(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+CPDF_AAction::CPDF_AAction(const CPDF_Dictionary* pDict) : m_pDict(pDict) {}
 
 CPDF_AAction::CPDF_AAction(const CPDF_AAction& that) = default;
 
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_aaction.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_aaction.h
index 8b44153fb59..c3c65e8dd10 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_aaction.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_aaction.h
@@ -40,7 +40,7 @@ class CPDF_AAction {
     kNumberOfActions  // Must be last.
   };
 
-  explicit CPDF_AAction(CPDF_Dictionary* pDict);
+  explicit CPDF_AAction(const CPDF_Dictionary* pDict);
   CPDF_AAction(const CPDF_AAction& that);
   ~CPDF_AAction();
 
@@ -51,7 +51,7 @@ class CPDF_AAction {
   static bool IsUserClick(AActionType eType);
 
  private:
-  RetainPtr<CPDF_Dictionary> const m_pDict;
+  RetainPtr<const CPDF_Dictionary> const m_pDict;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_AACTION_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_action.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_action.cpp
index dc4f4854b27..74a7c6f61b8 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_action.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_action.cpp
@@ -10,6 +10,7 @@
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
+#include "core/fpdfapi/parser/cpdf_name.h"
 #include "core/fpdfdoc/cpdf_filespec.h"
 #include "core/fpdfdoc/cpdf_nametree.h"
 
@@ -23,7 +24,7 @@ const char* const g_sATypes[] = {
 
 }  // namespace
 
-CPDF_Action::CPDF_Action(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+CPDF_Action::CPDF_Action(const CPDF_Dictionary* pDict) : m_pDict(pDict) {}
 
 CPDF_Action::CPDF_Action(const CPDF_Action& that) = default;
 
@@ -33,6 +34,14 @@ CPDF_Action::ActionType CPDF_Action::GetType() const {
   if (!m_pDict)
     return Unknown;
 
+  // Validate |m_pDict|. Type is optional, but must be valid if present.
+  const CPDF_Object* pType = m_pDict->GetObjectFor("Type");
+  if (pType) {
+    const CPDF_Name* pName = pType->AsName();
+    if (!pName || pName->GetString() != "Action")
+      return Unknown;
+  }
+
   ByteString csType = m_pDict->GetStringFor("S");
   if (csType.IsEmpty())
     return Unknown;
@@ -49,14 +58,14 @@ CPDF_Dest CPDF_Action::GetDest(CPDF_Document* pDoc) const {
   if (type != GoTo && type != GoToR)
     return CPDF_Dest();
 
-  CPDF_Object* pDest = m_pDict->GetDirectObjectFor("D");
+  const CPDF_Object* pDest = m_pDict->GetDirectObjectFor("D");
   if (!pDest)
     return CPDF_Dest();
   if (pDest->IsString() || pDest->IsName()) {
     CPDF_NameTree name_tree(pDoc, "Dests");
     return CPDF_Dest(name_tree.LookupNamedDest(pDoc, pDest->GetUnicodeText()));
   }
-  if (CPDF_Array* pArray = pDest->AsArray())
+  if (const CPDF_Array* pArray = pDest->AsArray())
     return CPDF_Dest(pArray);
 
   return CPDF_Dest();
@@ -115,13 +124,16 @@ uint32_t CPDF_Action::GetFlags() const {
   return m_pDict->GetIntegerFor("Flags");
 }
 
-WideString CPDF_Action::GetJavaScript() const {
-  if (!m_pDict)
-    return WideString();
+Optional<WideString> CPDF_Action::MaybeGetJavaScript() const {
+  const CPDF_Object* pObject = GetJavaScriptObject();
+  if (!pObject)
+    return pdfium::nullopt;
+  return pObject->GetUnicodeText();
+}
 
-  const CPDF_Object* pJS = m_pDict->GetDirectObjectFor("JS");
-  return (pJS && (pJS->IsString() || pJS->IsStream())) ? pJS->GetUnicodeText()
-                                                       : WideString();
+WideString CPDF_Action::GetJavaScript() const {
+  const CPDF_Object* pObject = GetJavaScriptObject();
+  return pObject ? pObject->GetUnicodeText() : WideString();
 }
 
 size_t CPDF_Action::GetSubActionsCount() const {
@@ -141,12 +153,20 @@ CPDF_Action CPDF_Action::GetSubAction(size_t iIndex) const {
   if (!m_pDict || !m_pDict->KeyExist("Next"))
     return CPDF_Action(nullptr);
 
-  CPDF_Object* pNext = m_pDict->GetDirectObjectFor("Next");
-  if (CPDF_Array* pArray = ToArray(pNext))
+  const CPDF_Object* pNext = m_pDict->GetDirectObjectFor("Next");
+  if (const CPDF_Array* pArray = ToArray(pNext))
     return CPDF_Action(pArray->GetDictAt(iIndex));
-  if (CPDF_Dictionary* pDict = ToDictionary(pNext)) {
+  if (const CPDF_Dictionary* pDict = ToDictionary(pNext)) {
     if (iIndex == 0)
       return CPDF_Action(pDict);
   }
   return CPDF_Action(nullptr);
 }
+
+const CPDF_Object* CPDF_Action::GetJavaScriptObject() const {
+  if (!m_pDict)
+    return nullptr;
+
+  const CPDF_Object* pJS = m_pDict->GetDirectObjectFor("JS");
+  return (pJS && (pJS->IsString() || pJS->IsStream())) ? pJS : nullptr;
+}
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_action.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_action.h
index f55c42a8d43..391f175272f 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_action.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_action.h
@@ -10,9 +10,11 @@
 #include "core/fpdfdoc/cpdf_dest.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/retain_ptr.h"
+#include "third_party/base/optional.h"
 
 class CPDF_Dictionary;
 class CPDF_Document;
+class CPDF_Object;
 
 class CPDF_Action {
  public:
@@ -38,11 +40,10 @@ class CPDF_Action {
     GoTo3DView
   };
 
-  explicit CPDF_Action(CPDF_Dictionary* pDict);
+  explicit CPDF_Action(const CPDF_Dictionary* pDict);
   CPDF_Action(const CPDF_Action& that);
   ~CPDF_Action();
 
-  CPDF_Dictionary* GetDict() { return m_pDict.Get(); }
   const CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
 
   ActionType GetType() const;
@@ -52,12 +53,19 @@ class CPDF_Action {
   bool GetHideStatus() const;
   ByteString GetNamedAction() const;
   uint32_t GetFlags() const;
+
+  // Differentiates between empty JS entry and no JS entry.
+  Optional<WideString> MaybeGetJavaScript() const;
+  // Returns empty string for empty JS entry and no JS entry.
   WideString GetJavaScript() const;
+
   size_t GetSubActionsCount() const;
   CPDF_Action GetSubAction(size_t iIndex) const;
 
  private:
-  RetainPtr<CPDF_Dictionary> const m_pDict;
+  const CPDF_Object* GetJavaScriptObject() const;
+
+  RetainPtr<const CPDF_Dictionary> const m_pDict;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_ACTION_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_annotlist.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_annotlist.cpp
index 2dc0f58f7cd..b1ceb57a09d 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_annotlist.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_annotlist.cpp
@@ -172,9 +172,6 @@ void GenerateAP(CPDF_Document* pDoc, CPDF_Dictionary* pAnnotDict) {
 
 CPDF_AnnotList::CPDF_AnnotList(CPDF_Page* pPage)
     : m_pDocument(pPage->GetDocument()) {
-  if (!pPage->GetDict())
-    return;
-
   CPDF_Array* pAnnots = pPage->GetDict()->GetArrayFor("Annots");
   if (!pAnnots)
     return;
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_apsettings.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_apsettings.h
index d7a6eda08fc..2a163364bbf 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_apsettings.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_apsettings.h
@@ -17,6 +17,15 @@ class CPDF_Dictionary;
 class CPDF_FormControl;
 class CPDF_Stream;
 
+// Corresponds to PDF spec section 12.5.6.19 (Widget annotation TP dictionary).
+#define TEXTPOS_CAPTION 0
+#define TEXTPOS_ICON 1
+#define TEXTPOS_BELOW 2
+#define TEXTPOS_ABOVE 3
+#define TEXTPOS_RIGHT 4
+#define TEXTPOS_LEFT 5
+#define TEXTPOS_OVERLAID 6
+
 class CPDF_ApSettings {
  public:
   explicit CPDF_ApSettings(CPDF_Dictionary* pDict);
@@ -57,6 +66,8 @@ class CPDF_ApSettings {
   CPDF_Stream* GetRolloverIcon() const { return GetIcon("RI"); }
   CPDF_Stream* GetDownIcon() const { return GetIcon("IX"); }
   CPDF_IconFit GetIconFit() const;
+
+  // Returns one of the TEXTPOS_* values above.
   int GetTextPosition() const;
 
   FX_ARGB GetColor(int& iColorType, const ByteString& csEntry) const;
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmark.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmark.cpp
index 3a414ffc865..7f7958b52a7 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmark.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmark.cpp
@@ -19,7 +19,7 @@ CPDF_Bookmark::CPDF_Bookmark() = default;
 
 CPDF_Bookmark::CPDF_Bookmark(const CPDF_Bookmark& that) = default;
 
-CPDF_Bookmark::CPDF_Bookmark(CPDF_Dictionary* pDict) : m_pDict(pDict) {}
+CPDF_Bookmark::CPDF_Bookmark(const CPDF_Dictionary* pDict) : m_pDict(pDict) {}
 
 CPDF_Bookmark::~CPDF_Bookmark() = default;
 
@@ -52,7 +52,7 @@ CPDF_Dest CPDF_Bookmark::GetDest(CPDF_Document* pDocument) const {
   if (!m_pDict)
     return CPDF_Dest();
 
-  CPDF_Object* pDest = m_pDict->GetDirectObjectFor("Dest");
+  const CPDF_Object* pDest = m_pDict->GetDirectObjectFor("Dest");
   if (!pDest)
     return CPDF_Dest();
   if (pDest->IsString() || pDest->IsName()) {
@@ -60,7 +60,7 @@ CPDF_Dest CPDF_Bookmark::GetDest(CPDF_Document* pDocument) const {
     return CPDF_Dest(
         name_tree.LookupNamedDest(pDocument, pDest->GetUnicodeText()));
   }
-  if (CPDF_Array* pArray = pDest->AsArray())
+  if (const CPDF_Array* pArray = pDest->AsArray())
     return CPDF_Dest(pArray);
   return CPDF_Dest();
 }
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmark.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmark.h
index c2de6ffade0..400b869e3ef 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmark.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmark.h
@@ -19,10 +19,9 @@ class CPDF_Bookmark {
  public:
   CPDF_Bookmark();
   CPDF_Bookmark(const CPDF_Bookmark& that);
-  explicit CPDF_Bookmark(CPDF_Dictionary* pDict);
+  explicit CPDF_Bookmark(const CPDF_Dictionary* pDict);
   ~CPDF_Bookmark();
 
-  CPDF_Dictionary* GetDict() { return m_pDict.Get(); }
   const CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
 
   uint32_t GetFontStyle() const;
@@ -31,7 +30,7 @@ class CPDF_Bookmark {
   CPDF_Action GetAction() const;
 
  private:
-  RetainPtr<CPDF_Dictionary> m_pDict;
+  RetainPtr<const CPDF_Dictionary> m_pDict;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_BOOKMARK_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmarktree.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmarktree.cpp
index ce7cfef6f41..5c4fffef68a 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmarktree.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_bookmarktree.cpp
@@ -14,7 +14,7 @@ CPDF_BookmarkTree::CPDF_BookmarkTree(CPDF_Document* pDoc) : m_pDocument(pDoc) {}
 CPDF_BookmarkTree::~CPDF_BookmarkTree() = default;
 
 CPDF_Bookmark CPDF_BookmarkTree::GetFirstChild(CPDF_Bookmark* parent) const {
-  CPDF_Dictionary* pParentDict = parent->GetDict();
+  const CPDF_Dictionary* pParentDict = parent->GetDict();
   if (pParentDict)
     return CPDF_Bookmark(pParentDict->GetDictFor("First"));
 
@@ -28,10 +28,10 @@ CPDF_Bookmark CPDF_BookmarkTree::GetFirstChild(CPDF_Bookmark* parent) const {
 }
 
 CPDF_Bookmark CPDF_BookmarkTree::GetNextSibling(CPDF_Bookmark* bookmark) const {
-  CPDF_Dictionary* pDict = bookmark->GetDict();
+  const CPDF_Dictionary* pDict = bookmark->GetDict();
   if (!pDict)
     return CPDF_Bookmark();
 
-  CPDF_Dictionary* pNext = pDict->GetDictFor("Next");
+  const CPDF_Dictionary* pNext = pDict->GetDictFor("Next");
   return pNext == pDict ? CPDF_Bookmark() : CPDF_Bookmark(pNext);
 }
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_dest.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_dest.cpp
index 511081f05c2..601f85d62e5 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_dest.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_dest.cpp
@@ -32,7 +32,7 @@ static_assert(FX_ArraySize(g_sZoomModes) ==
 
 CPDF_Dest::CPDF_Dest() {}
 
-CPDF_Dest::CPDF_Dest(CPDF_Array* pArray) : m_pArray(pArray) {}
+CPDF_Dest::CPDF_Dest(const CPDF_Array* pArray) : m_pArray(pArray) {}
 
 CPDF_Dest::CPDF_Dest(const CPDF_Dest& that) = default;
 
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_dest.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_dest.h
index c1b1df3c179..2de1263d9cc 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_dest.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_dest.h
@@ -17,11 +17,10 @@ class CPDF_Array;
 class CPDF_Dest {
  public:
   CPDF_Dest();
-  explicit CPDF_Dest(CPDF_Array* pArray);
+  explicit CPDF_Dest(const CPDF_Array* pArray);
   CPDF_Dest(const CPDF_Dest& that);
   ~CPDF_Dest();
 
-  CPDF_Array* GetArray() { return m_pArray.Get(); }
   const CPDF_Array* GetArray() const { return m_pArray.Get(); }
 
   ByteString GetRemoteName() const;
@@ -41,7 +40,7 @@ class CPDF_Dest {
               float* pZoom) const;
 
  private:
-  RetainPtr<CPDF_Array> const m_pArray;
+  RetainPtr<const CPDF_Array> const m_pArray;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_DEST_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_filespec.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_filespec.h
index 3b00cdfe4b4..820b948d30a 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_filespec.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_filespec.h
@@ -8,8 +8,8 @@
 #define CORE_FPDFDOC_CPDF_FILESPEC_H_
 
 #include "core/fxcrt/fx_string.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/string_pool_template.h"
-#include "core/fxcrt/unowned_ptr.h"
 #include "core/fxcrt/weak_ptr.h"
 
 class CPDF_Dictionary;
@@ -40,7 +40,7 @@ class CPDF_FileSpec {
   void SetFileName(const WideString& wsFileName);
 
  private:
-  UnownedPtr<const CPDF_Object> const m_pObj;
+  RetainPtr<const CPDF_Object> const m_pObj;
   RetainPtr<CPDF_Object> const m_pWritableObj;
 };
 
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formcontrol.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formcontrol.cpp
index d7491e54c00..3b7b9b3040f 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formcontrol.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formcontrol.cpp
@@ -8,6 +8,7 @@
 
 #include <algorithm>
 
+#include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
@@ -15,6 +16,7 @@
 #include "core/fpdfapi/parser/cpdf_name.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fpdfapi/parser/fpdf_parser_decode.h"
+#include "core/fpdfapi/parser/fpdf_parser_utility.h"
 #include "core/fpdfdoc/cpdf_interactiveform.h"
 
 namespace {
@@ -201,7 +203,15 @@ CPDF_DefaultAppearance CPDF_FormControl::GetDefaultAppearance() const {
   return CPDF_DefaultAppearance(pObj->GetString());
 }
 
-CPDF_Font* CPDF_FormControl::GetDefaultControlFont() {
+Optional<WideString> CPDF_FormControl::GetDefaultControlFontName() const {
+  RetainPtr<CPDF_Font> pFont = GetDefaultControlFont();
+  if (!pFont)
+    return {};
+
+  return WideString::FromDefANSI(pFont->GetBaseFontName().AsStringView());
+}
+
+RetainPtr<CPDF_Font> CPDF_FormControl::GetDefaultControlFont() const {
   float fFontSize;
   CPDF_DefaultAppearance cDA = GetDefaultAppearance();
   Optional<ByteString> csFontNameTag = cDA.GetFont(&fFontSize);
@@ -211,34 +221,36 @@ CPDF_Font* CPDF_FormControl::GetDefaultControlFont() {
   CPDF_Object* pObj = FPDF_GetFieldAttr(m_pWidgetDict.Get(), "DR");
   if (CPDF_Dictionary* pDict = ToDictionary(pObj)) {
     CPDF_Dictionary* pFonts = pDict->GetDictFor("Font");
-    if (pFonts) {
+    if (ValidateFontResourceDict(pFonts)) {
       CPDF_Dictionary* pElement = pFonts->GetDictFor(*csFontNameTag);
       if (pElement) {
         auto* pData = CPDF_DocPageData::FromDocument(m_pForm->GetDocument());
-        CPDF_Font* pFont = pData->GetFont(pElement);
+        RetainPtr<CPDF_Font> pFont = pData->GetFont(pElement);
         if (pFont)
           return pFont;
       }
     }
   }
-  if (CPDF_Font* pFormFont = m_pForm->GetFormFont(*csFontNameTag))
+  RetainPtr<CPDF_Font> pFormFont = m_pForm->GetFormFont(*csFontNameTag);
+  if (pFormFont)
     return pFormFont;
 
   CPDF_Dictionary* pPageDict = m_pWidgetDict->GetDictFor("P");
-  pObj = FPDF_GetFieldAttr(pPageDict, "Resources");
-  if (CPDF_Dictionary* pDict = ToDictionary(pObj)) {
-    CPDF_Dictionary* pFonts = pDict->GetDictFor("Font");
-    if (pFonts) {
-      CPDF_Dictionary* pElement = pFonts->GetDictFor(*csFontNameTag);
-      if (pElement) {
-        auto* pData = CPDF_DocPageData::FromDocument(m_pForm->GetDocument());
-        CPDF_Font* pFont = pData->GetFont(pElement);
-        if (pFont)
-          return pFont;
-      }
-    }
-  }
-  return nullptr;
+  CPDF_Dictionary* pDict =
+      ToDictionary(FPDF_GetFieldAttr(pPageDict, "Resources"));
+  if (!pDict)
+    return nullptr;
+
+  CPDF_Dictionary* pFonts = pDict->GetDictFor("Font");
+  if (!ValidateFontResourceDict(pFonts))
+    return nullptr;
+
+  CPDF_Dictionary* pElement = pFonts->GetDictFor(*csFontNameTag);
+  if (!pElement)
+    return nullptr;
+
+  auto* pDocPageData = CPDF_DocPageData::FromDocument(m_pForm->GetDocument());
+  return pDocPageData->GetFont(pElement);
 }
 
 int CPDF_FormControl::GetControlAlignment() const {
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formcontrol.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formcontrol.h
index 778e0794de5..d8256344f1a 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formcontrol.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formcontrol.h
@@ -15,18 +15,11 @@
 #include "core/fpdfdoc/cpdf_defaultappearance.h"
 #include "core/fpdfdoc/cpdf_formfield.h"
 #include "core/fpdfdoc/cpdf_iconfit.h"
-#include "core/fpdfdoc/ipdf_formnotify.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_string.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxge/fx_dib.h"
-
-#define TEXTPOS_CAPTION 0
-#define TEXTPOS_ICON 1
-#define TEXTPOS_BELOW 2
-#define TEXTPOS_ABOVE 3
-#define TEXTPOS_RIGHT 4
-#define TEXTPOS_LEFT 5
-#define TEXTPOS_OVERLAID 6
+#include "third_party/base/optional.h"
 
 class CFX_RenderDevice;
 class CPDF_Dictionary;
@@ -98,13 +91,14 @@ class CPDF_FormControl {
   CPDF_AAction GetAdditionalAction() const;
   CPDF_DefaultAppearance GetDefaultAppearance() const;
 
-  CPDF_Font* GetDefaultControlFont();
+  Optional<WideString> GetDefaultControlFontName() const;
   int GetControlAlignment() const;
 
   ByteString GetOnStateName() const;
   void CheckControl(bool bChecked);
 
  private:
+  RetainPtr<CPDF_Font> GetDefaultControlFont() const;
   FX_ARGB GetColor(int& iColorType, const ByteString& csEntry);
   float GetOriginalColor(int index, const ByteString& csEntry);
   void GetOriginalColor(int& iColorType,
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formfield.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formfield.cpp
index b8d01f87c92..9d71bf34444 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formfield.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formfield.cpp
@@ -12,6 +12,7 @@
 
 #include "constants/form_fields.h"
 #include "constants/form_flags.h"
+#include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
 #include "core/fpdfapi/parser/cfdf_document.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
@@ -21,6 +22,7 @@
 #include "core/fpdfapi/parser/cpdf_number.h"
 #include "core/fpdfapi/parser/cpdf_string.h"
 #include "core/fpdfapi/parser/fpdf_parser_decode.h"
+#include "core/fpdfapi/parser/fpdf_parser_utility.h"
 #include "core/fpdfdoc/cpdf_defaultappearance.h"
 #include "core/fpdfdoc/cpdf_formcontrol.h"
 #include "core/fpdfdoc/cpdf_interactiveform.h"
@@ -900,7 +902,7 @@ void CPDF_FormField::LoadDA() {
     return;
 
   CPDF_Dictionary* pFont = pDR->GetDictFor("Font");
-  if (!pFont)
+  if (!ValidateFontResourceDict(pFont))
     return;
 
   CPDF_DefaultAppearance appearance(DA);
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formfield.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formfield.h
index ab816510af9..a07720fc6a1 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formfield.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_formfield.h
@@ -14,6 +14,7 @@
 #include "core/fpdfdoc/cpdf_aaction.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 
 class CPDF_Dictionary;
@@ -194,15 +195,14 @@ class CPDF_FormField {
   const std::vector<UnownedPtr<CPDF_FormControl>>& GetControls() const;
 
   CPDF_FormField::Type m_Type = kUnknown;
-  uint32_t m_Flags = 0;
   bool m_bReadOnly = false;
   bool m_bRequired = false;
   bool m_bNoExport = false;
-
+  uint32_t m_Flags = 0;
+  float m_FontSize = 0;
   UnownedPtr<CPDF_InteractiveForm> const m_pForm;
   RetainPtr<CPDF_Dictionary> const m_pDict;
-  float m_FontSize = 0;
-  UnownedPtr<CPDF_Font> m_pFont;
+  RetainPtr<CPDF_Font> m_pFont;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_FORMFIELD_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_iconfit.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_iconfit.h
index 7c27d6f1459..3da3dde4f5a 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_iconfit.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_iconfit.h
@@ -9,7 +9,7 @@
 
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_system.h"
-#include "core/fxcrt/unowned_ptr.h"
+#include "core/fxcrt/retain_ptr.h"
 
 class CPDF_Dictionary;
 
@@ -28,7 +28,7 @@ class CPDF_IconFit {
   const CPDF_Dictionary* GetDict() const { return m_pDict.Get(); }
 
  private:
-  UnownedPtr<const CPDF_Dictionary> const m_pDict;
+  RetainPtr<const CPDF_Dictionary> const m_pDict;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_ICONFIT_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_interactiveform.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_interactiveform.cpp
index 2d9ff057833..15a5e26f0e2 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_interactiveform.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_interactiveform.cpp
@@ -36,6 +36,11 @@ namespace {
 
 const int nMaxRecursion = 32;
 
+void AddFont(CPDF_Dictionary*& pFormDict,
+             CPDF_Document* pDocument,
+             const RetainPtr<CPDF_Font>& pFont,
+             ByteString* csNameTag);
+
 ByteString GenerateNewFontResourceName(const CPDF_Dictionary* pResDict,
                                        const ByteString& csPrefix) {
   static const char kDummyFontName[] = "ZiTi";
@@ -72,11 +77,6 @@ ByteString GenerateNewFontResourceName(const CPDF_Dictionary* pResDict,
   return csTmp;
 }
 
-void AddFont(CPDF_Dictionary*& pFormDict,
-             CPDF_Document* pDocument,
-             const CPDF_Font* pFont,
-             ByteString* csNameTag);
-
 void InitDict(CPDF_Dictionary*& pFormDict, CPDF_Document* pDocument) {
   if (!pDocument)
     return;
@@ -91,7 +91,7 @@ void InitDict(CPDF_Dictionary*& pFormDict, CPDF_Document* pDocument) {
   if (!pFormDict->KeyExist("DR")) {
     ByteString csBaseName;
     uint8_t charSet = CPDF_InteractiveForm::GetNativeCharSet();
-    CPDF_Font* pFont = CPDF_InteractiveForm::AddStandardFont(
+    RetainPtr<CPDF_Font> pFont = CPDF_InteractiveForm::AddStandardFont(
         pDocument, CFX_Font::kDefaultAnsiFontName);
     if (pFont)
       AddFont(pFormDict, pDocument, pFont, &csBaseName);
@@ -118,9 +118,9 @@ void InitDict(CPDF_Dictionary*& pFormDict, CPDF_Document* pDocument) {
     pFormDict->SetNewFor<CPDF_String>("DA", csDA, false);
 }
 
-CPDF_Font* GetFont(CPDF_Dictionary* pFormDict,
-                   CPDF_Document* pDocument,
-                   const ByteString& csNameTag) {
+RetainPtr<CPDF_Font> GetFont(CPDF_Dictionary* pFormDict,
+                             CPDF_Document* pDocument,
+                             const ByteString& csNameTag) {
   ByteString csAlias = PDF_NameDecode(csNameTag.AsStringView());
   if (!pFormDict || csAlias.IsEmpty())
     return nullptr;
@@ -130,7 +130,7 @@ CPDF_Font* GetFont(CPDF_Dictionary* pFormDict,
     return nullptr;
 
   CPDF_Dictionary* pFonts = pDR->GetDictFor("Font");
-  if (!pFonts)
+  if (!ValidateFontResourceDict(pFonts))
     return nullptr;
 
   CPDF_Dictionary* pElement = pFonts->GetDictFor(csAlias);
@@ -140,10 +140,10 @@ CPDF_Font* GetFont(CPDF_Dictionary* pFormDict,
   return CPDF_DocPageData::FromDocument(pDocument)->GetFont(pElement);
 }
 
-CPDF_Font* GetNativeFont(CPDF_Dictionary* pFormDict,
-                         CPDF_Document* pDocument,
-                         uint8_t charSet,
-                         ByteString* csNameTag) {
+RetainPtr<CPDF_Font> GetNativeFont(CPDF_Dictionary* pFormDict,
+                                   CPDF_Document* pDocument,
+                                   uint8_t charSet,
+                                   ByteString* csNameTag) {
   if (!pFormDict)
     return nullptr;
 
@@ -152,7 +152,7 @@ CPDF_Font* GetNativeFont(CPDF_Dictionary* pFormDict,
     return nullptr;
 
   CPDF_Dictionary* pFonts = pDR->GetDictFor("Font");
-  if (!pFonts)
+  if (!ValidateFontResourceDict(pFonts))
     return nullptr;
 
   CPDF_DictionaryLocker locker(pFonts);
@@ -166,7 +166,7 @@ CPDF_Font* GetNativeFont(CPDF_Dictionary* pFormDict,
       continue;
 
     auto* pData = CPDF_DocPageData::FromDocument(pDocument);
-    CPDF_Font* pFind = pData->GetFont(pElement);
+    RetainPtr<CPDF_Font> pFind = pData->GetFont(pElement);
     if (!pFind)
       continue;
 
@@ -193,7 +193,7 @@ bool FindFont(CPDF_Dictionary* pFormDict,
     return false;
 
   CPDF_Dictionary* pFonts = pDR->GetDictFor("Font");
-  if (!pFonts)
+  if (!ValidateFontResourceDict(pFonts))
     return false;
 
   CPDF_DictionaryLocker locker(pFonts);
@@ -217,7 +217,7 @@ bool FindFont(CPDF_Dictionary* pFormDict,
 bool FindFont(CPDF_Dictionary* pFormDict,
               CPDF_Document* pDocument,
               ByteString csFontName,
-              CPDF_Font*& pFont,
+              RetainPtr<CPDF_Font>& pFont,
               ByteString* csNameTag) {
   if (!pFormDict)
     return false;
@@ -227,7 +227,7 @@ bool FindFont(CPDF_Dictionary* pFormDict,
     return false;
 
   CPDF_Dictionary* pFonts = pDR->GetDictFor("Font");
-  if (!pFonts)
+  if (!ValidateFontResourceDict(pFonts))
     return false;
 
   if (csFontName.GetLength() > 0)
@@ -247,7 +247,7 @@ bool FindFont(CPDF_Dictionary* pFormDict,
     if (!pFont)
       continue;
 
-    ByteString csBaseFont = pFont->GetBaseFont();
+    ByteString csBaseFont = pFont->GetBaseFontName();
     csBaseFont.Remove(' ');
     if (csBaseFont == csFontName) {
       *csNameTag = csKey;
@@ -259,7 +259,7 @@ bool FindFont(CPDF_Dictionary* pFormDict,
 
 void AddFont(CPDF_Dictionary*& pFormDict,
              CPDF_Document* pDocument,
-             const CPDF_Font* pFont,
+             const RetainPtr<CPDF_Font>& pFont,
              ByteString* csNameTag) {
   if (!pFont)
     return;
@@ -267,7 +267,7 @@ void AddFont(CPDF_Dictionary*& pFormDict,
     InitDict(pFormDict, pDocument);
 
   ByteString csTag;
-  if (FindFont(pFormDict, pFont, &csTag)) {
+  if (FindFont(pFormDict, pFont.Get(), &csTag)) {
     *csNameTag = std::move(csTag);
     return;
   }
@@ -283,7 +283,7 @@ void AddFont(CPDF_Dictionary*& pFormDict,
     pFonts = pDR->SetNewFor<CPDF_Dictionary>("Font");
 
   if (csNameTag->IsEmpty())
-    *csNameTag = pFont->GetBaseFont();
+    *csNameTag = pFont->GetBaseFontName();
 
   csNameTag->Remove(' ');
   *csNameTag = GenerateNewFontResourceName(pDR, *csNameTag);
@@ -291,15 +291,16 @@ void AddFont(CPDF_Dictionary*& pFormDict,
                                     pFont->GetFontDict()->GetObjNum());
 }
 
-CPDF_Font* AddNativeFont(CPDF_Dictionary*& pFormDict,
-                         CPDF_Document* pDocument,
-                         uint8_t charSet,
-                         ByteString* csNameTag) {
+RetainPtr<CPDF_Font> AddNativeFont(CPDF_Dictionary*& pFormDict,
+                                   CPDF_Document* pDocument,
+                                   uint8_t charSet,
+                                   ByteString* csNameTag) {
   if (!pFormDict)
     InitDict(pFormDict, pDocument);
 
   ByteString csTemp;
-  CPDF_Font* pFont = GetNativeFont(pFormDict, pDocument, charSet, &csTemp);
+  RetainPtr<CPDF_Font> pFont =
+      GetNativeFont(pFormDict, pDocument, charSet, &csTemp);
   if (pFont) {
     *csNameTag = std::move(csTemp);
     return pFont;
@@ -311,9 +312,10 @@ CPDF_Font* AddNativeFont(CPDF_Dictionary*& pFormDict,
     return pFont;
   }
   pFont = CPDF_InteractiveForm::AddNativeFont(charSet, pDocument);
-  if (pFont)
-    AddFont(pFormDict, pDocument, pFont, csNameTag);
+  if (!pFont)
+    return nullptr;
 
+  AddFont(pFormDict, pDocument, pFont, csNameTag);
   return pFont;
 }
 
@@ -570,9 +572,9 @@ CFieldTree::Node* CFieldTree::FindNode(const WideString& full_name) {
   return pNode;
 }
 
-CPDF_Font* AddNativeInteractiveFormFont(CPDF_Dictionary*& pFormDict,
-                                        CPDF_Document* pDocument,
-                                        ByteString* csNameTag) {
+RetainPtr<CPDF_Font> AddNativeInteractiveFormFont(CPDF_Dictionary*& pFormDict,
+                                                  CPDF_Document* pDocument,
+                                                  ByteString* csNameTag) {
   uint8_t charSet = CPDF_InteractiveForm::GetNativeCharSet();
   return AddNativeFont(pFormDict, pDocument, charSet, csNameTag);
 }
@@ -612,8 +614,9 @@ void CPDF_InteractiveForm::SetUpdateAP(bool bUpdateAP) {
   s_bUpdateAP = bUpdateAP;
 }
 
-CPDF_Font* CPDF_InteractiveForm::AddStandardFont(CPDF_Document* pDocument,
-                                                 ByteString csFontName) {
+RetainPtr<CPDF_Font> CPDF_InteractiveForm::AddStandardFont(
+    CPDF_Document* pDocument,
+    ByteString csFontName) {
   if (!pDocument || csFontName.IsEmpty())
     return nullptr;
 
@@ -621,7 +624,7 @@ CPDF_Font* CPDF_InteractiveForm::AddStandardFont(CPDF_Document* pDocument,
   if (csFontName == "ZapfDingbats")
     return pPageData->AddStandardFont(csFontName.c_str(), nullptr);
 
-  CPDF_FontEncoding encoding(PDFFONT_ENCODING_WINANSI);
+  static const CPDF_FontEncoding encoding(PDFFONT_ENCODING_WINANSI);
   return pPageData->AddStandardFont(csFontName.c_str(), &encoding);
 }
 
@@ -664,8 +667,9 @@ ByteString CPDF_InteractiveForm::GetNativeFontName(uint8_t charSet,
   return csFontName;
 }
 
-CPDF_Font* CPDF_InteractiveForm::AddNativeFont(uint8_t charSet,
-                                               CPDF_Document* pDocument) {
+RetainPtr<CPDF_Font> CPDF_InteractiveForm::AddNativeFont(
+    uint8_t charSet,
+    CPDF_Document* pDocument) {
   if (!pDocument)
     return nullptr;
 
@@ -681,7 +685,8 @@ CPDF_Font* CPDF_InteractiveForm::AddNativeFont(uint8_t charSet,
   return nullptr;
 }
 
-CPDF_Font* CPDF_InteractiveForm::AddNativeFont(CPDF_Document* pDocument) {
+RetainPtr<CPDF_Font> CPDF_InteractiveForm::AddNativeFont(
+    CPDF_Document* pDocument) {
   return pDocument ? AddNativeFont(GetNativeCharSet(), pDocument) : nullptr;
 }
 
@@ -789,7 +794,8 @@ int CPDF_InteractiveForm::FindFieldInCalculationOrder(
   return -1;
 }
 
-CPDF_Font* CPDF_InteractiveForm::GetFormFont(ByteString csNameTag) const {
+RetainPtr<CPDF_Font> CPDF_InteractiveForm::GetFormFont(
+    ByteString csNameTag) const {
   return GetFont(m_pFormDict.Get(), m_pDocument.Get(), csNameTag);
 }
 
@@ -873,11 +879,7 @@ bool CPDF_InteractiveForm::HasXFAForm() const {
 }
 
 void CPDF_InteractiveForm::FixPageFields(CPDF_Page* pPage) {
-  CPDF_Dictionary* pPageDict = pPage->GetDict();
-  if (!pPageDict)
-    return;
-
-  CPDF_Array* pAnnots = pPageDict->GetArrayFor("Annots");
+  CPDF_Array* pAnnots = pPage->GetDict()->GetArrayFor("Annots");
   if (!pAnnots)
     return;
 
@@ -1086,6 +1088,6 @@ std::unique_ptr<CFDF_Document> CPDF_InteractiveForm::ExportToFDF(
   return pDoc;
 }
 
-void CPDF_InteractiveForm::SetFormNotify(IPDF_FormNotify* pNotify) {
+void CPDF_InteractiveForm::SetNotifierIface(NotifierIface* pNotify) {
   m_pFormNotify = pNotify;
 }
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_interactiveform.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_interactiveform.h
index 91de032a098..7d1f6c2824f 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_interactiveform.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_interactiveform.h
@@ -16,6 +16,7 @@
 #include "core/fpdfdoc/cpdf_formfield.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 
 class CFieldTree;
@@ -26,25 +27,39 @@ class CPDF_Font;
 class CPDF_FormControl;
 class CPDF_Object;
 class CPDF_Page;
-class IPDF_FormNotify;
 
-CPDF_Font* AddNativeInteractiveFormFont(CPDF_Dictionary*& pFormDict,
-                                        CPDF_Document* pDocument,
-                                        ByteString* csNameTag);
+RetainPtr<CPDF_Font> AddNativeInteractiveFormFont(CPDF_Dictionary*& pFormDict,
+                                                  CPDF_Document* pDocument,
+                                                  ByteString* csNameTag);
 
 class CPDF_InteractiveForm {
  public:
+  class NotifierIface {
+   public:
+    virtual ~NotifierIface() = default;
+
+    virtual bool BeforeValueChange(CPDF_FormField* pField,
+                                   const WideString& csValue) = 0;
+    virtual void AfterValueChange(CPDF_FormField* pField) = 0;
+    virtual bool BeforeSelectionChange(CPDF_FormField* pField,
+                                       const WideString& csValue) = 0;
+    virtual void AfterSelectionChange(CPDF_FormField* pField) = 0;
+    virtual void AfterCheckedStatusChange(CPDF_FormField* pField) = 0;
+    virtual void AfterFormReset(CPDF_InteractiveForm* pForm) = 0;
+  };
+
   explicit CPDF_InteractiveForm(CPDF_Document* pDocument);
   ~CPDF_InteractiveForm();
 
   static void SetUpdateAP(bool bUpdateAP);
   static bool IsUpdateAPEnabled();
-  static CPDF_Font* AddStandardFont(CPDF_Document* pDocument,
-                                    ByteString csFontName);
-  static ByteString GetNativeFontName(uint8_t iCharSet, void* pLogFont);
   static uint8_t GetNativeCharSet();
-  static CPDF_Font* AddNativeFont(uint8_t iCharSet, CPDF_Document* pDocument);
-  static CPDF_Font* AddNativeFont(CPDF_Document* pDocument);
+  static ByteString GetNativeFontName(uint8_t iCharSet, void* pLogFont);
+  static RetainPtr<CPDF_Font> AddStandardFont(CPDF_Document* pDocument,
+                                              ByteString csFontName);
+  static RetainPtr<CPDF_Font> AddNativeFont(uint8_t iCharSet,
+                                            CPDF_Document* pDocument);
+  static RetainPtr<CPDF_Font> AddNativeFont(CPDF_Document* pDocument);
 
   size_t CountFields(const WideString& csFieldName) const;
   CPDF_FormField* GetField(uint32_t index, const WideString& csFieldName) const;
@@ -60,7 +75,7 @@ class CPDF_InteractiveForm {
   CPDF_FormField* GetFieldInCalculationOrder(int index);
   int FindFieldInCalculationOrder(const CPDF_FormField* pField);
 
-  CPDF_Font* GetFormFont(ByteString csNameTag) const;
+  RetainPtr<CPDF_Font> GetFormFont(ByteString csNameTag) const;
   CPDF_DefaultAppearance GetDefaultAppearance() const;
   int GetFormAlignment() const;
 
@@ -83,11 +98,11 @@ class CPDF_InteractiveForm {
                  bool bIncludeOrExclude,
                  NotificationOption notify);
 
-  void SetFormNotify(IPDF_FormNotify* pNotify);
+  void SetNotifierIface(NotifierIface* pNotify);
   bool HasXFAForm() const;
   void FixPageFields(CPDF_Page* pPage);
 
-  IPDF_FormNotify* GetFormNotify() const { return m_pFormNotify.Get(); }
+  NotifierIface* GetFormNotify() const { return m_pFormNotify.Get(); }
   CPDF_Document* GetDocument() const { return m_pDocument.Get(); }
   CPDF_Dictionary* GetFormDict() const { return m_pFormDict.Get(); }
 
@@ -111,7 +126,7 @@ class CPDF_InteractiveForm {
   // Points into |m_ControlMap|.
   std::map<const CPDF_FormField*, std::vector<UnownedPtr<CPDF_FormControl>>>
       m_ControlLists;
-  UnownedPtr<IPDF_FormNotify> m_pFormNotify;
+  UnownedPtr<NotifierIface> m_pFormNotify;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_INTERACTIVEFORM_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_metadata.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_metadata.h
index 683f4f1e521..554492a276b 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_metadata.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_metadata.h
@@ -9,7 +9,7 @@
 
 #include <vector>
 
-#include "core/fxcrt/unowned_ptr.h"
+#include "core/fxcrt/retain_ptr.h"
 
 class CPDF_Stream;
 
@@ -40,7 +40,7 @@ class CPDF_Metadata {
   std::vector<UnsupportedFeature> CheckForSharedForm() const;
 
  private:
-  UnownedPtr<const CPDF_Stream> stream_;
+  RetainPtr<const CPDF_Stream> stream_;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_METADATA_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_numbertree.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_numbertree.h
index 1c65fd2caeb..2a3fa6e3bf8 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_numbertree.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_numbertree.h
@@ -7,7 +7,7 @@
 #ifndef CORE_FPDFDOC_CPDF_NUMBERTREE_H_
 #define CORE_FPDFDOC_CPDF_NUMBERTREE_H_
 
-#include "core/fxcrt/unowned_ptr.h"
+#include "core/fxcrt/retain_ptr.h"
 
 class CPDF_Dictionary;
 class CPDF_Object;
@@ -20,7 +20,7 @@ class CPDF_NumberTree {
   const CPDF_Object* LookupValue(int num) const;
 
  protected:
-  UnownedPtr<const CPDF_Dictionary> const m_pRoot;
+  RetainPtr<const CPDF_Dictionary> const m_pRoot;
 };
 
 #endif  // CORE_FPDFDOC_CPDF_NUMBERTREE_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structelement.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structelement.cpp
index 89a5e398dda..50fa83d0260 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structelement.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structelement.cpp
@@ -104,7 +104,7 @@ void CPDF_StructElement::LoadKid(uint32_t PageObjNum,
     return;
 
   if (pKidObj->IsNumber()) {
-    if (m_pTree->GetPage() && m_pTree->GetPage()->GetObjNum() != PageObjNum)
+    if (m_pTree->GetPage()->GetObjNum() != PageObjNum)
       return;
 
     pKid->m_Type = CPDF_StructKid::PageContent;
@@ -120,7 +120,7 @@ void CPDF_StructElement::LoadKid(uint32_t PageObjNum,
     PageObjNum = pRef->GetRefObjNum();
 
   ByteString type = pKidDict->GetStringFor("Type");
-  if ((type == "MCR" || type == "OBJR") && m_pTree->GetPage() &&
+  if ((type == "MCR" || type == "OBJR") &&
       m_pTree->GetPage()->GetObjNum() != PageObjNum) {
     return;
   }
@@ -143,12 +143,6 @@ void CPDF_StructElement::LoadKid(uint32_t PageObjNum,
   }
 
   pKid->m_Type = CPDF_StructKid::Element;
-  pKid->m_pDict = pKidDict;
-  if (m_pTree->GetPage()) {
-    pKid->m_pElement = nullptr;
-    return;
-  }
-
-  pKid->m_pElement =
-      pdfium::MakeRetain<CPDF_StructElement>(m_pTree.Get(), this, pKidDict);
+  pKid->m_pDict.Reset(pKidDict);
+  pKid->m_pElement = nullptr;
 }
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structelement.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structelement.h
index 49044e92676..ae40a40d897 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structelement.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structelement.h
@@ -26,8 +26,8 @@ class CPDF_StructKid {
 
   enum { Invalid, Element, PageContent, StreamContent, Object } m_Type;
 
-  RetainPtr<CPDF_StructElement> m_pElement;      // For Element.
-  UnownedPtr<const CPDF_Dictionary> m_pDict;     // For Element.
+  RetainPtr<CPDF_StructElement> m_pElement;  // For Element.
+  RetainPtr<const CPDF_Dictionary> m_pDict;  // For Element.
   uint32_t m_PageObjNum;  // For PageContent, StreamContent, Object.
   uint32_t m_RefObjNum;   // For StreamContent, Object.
   uint32_t m_ContentId;   // For PageContent, StreamContent.
@@ -62,7 +62,7 @@ class CPDF_StructElement final : public Retainable {
 
   UnownedPtr<CPDF_StructTree> const m_pTree;
   UnownedPtr<CPDF_StructElement> const m_pParent;
-  UnownedPtr<const CPDF_Dictionary> const m_pDict;
+  RetainPtr<const CPDF_Dictionary> const m_pDict;
   const ByteString m_Type;
   std::vector<CPDF_StructKid> m_Kids;
 };
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structtree.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structtree.cpp
index 1b72a5387c0..25eb9cd2ad7 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structtree.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structtree.cpp
@@ -44,7 +44,7 @@ CPDF_StructTree::CPDF_StructTree(const CPDF_Document* pDoc)
 CPDF_StructTree::~CPDF_StructTree() = default;
 
 void CPDF_StructTree::LoadPageTree(const CPDF_Dictionary* pPageDict) {
-  m_pPage = pPageDict;
+  m_pPage.Reset(pPageDict);
   if (!m_pTreeRoot)
     return;
 
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structtree.h b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structtree.h
index 8d8172b19ac..b0eafba9616 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structtree.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_structtree.h
@@ -12,7 +12,6 @@
 #include <vector>
 
 #include "core/fxcrt/retain_ptr.h"
-#include "core/fxcrt/unowned_ptr.h"
 
 class CPDF_Dictionary;
 class CPDF_Document;
@@ -44,9 +43,9 @@ class CPDF_StructTree {
   bool AddTopLevelNode(const CPDF_Dictionary* pDict,
                        const RetainPtr<CPDF_StructElement>& pElement);
 
-  UnownedPtr<const CPDF_Dictionary> const m_pTreeRoot;
-  UnownedPtr<const CPDF_Dictionary> const m_pRoleMap;
-  UnownedPtr<const CPDF_Dictionary> m_pPage;
+  RetainPtr<const CPDF_Dictionary> const m_pTreeRoot;
+  RetainPtr<const CPDF_Dictionary> const m_pRoleMap;
+  RetainPtr<const CPDF_Dictionary> m_pPage;
   std::vector<RetainPtr<CPDF_StructElement>> m_Kids;
 };
 
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_variabletext.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_variabletext.cpp
index fea74445d9c..4373dd6dc8c 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpdf_variabletext.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpdf_variabletext.cpp
@@ -40,34 +40,35 @@ CPDF_VariableText::Provider::~Provider() {}
 
 uint32_t CPDF_VariableText::Provider::GetCharWidth(int32_t nFontIndex,
                                                    uint16_t word) {
-  if (CPDF_Font* pPDFFont = m_pFontMap->GetPDFFont(nFontIndex)) {
-    uint32_t charcode = pPDFFont->CharCodeFromUnicode(word);
-    if (charcode != CPDF_Font::kInvalidCharCode)
-      return pPDFFont->GetCharWidthF(charcode);
-  }
-  return 0;
+  RetainPtr<CPDF_Font> pPDFFont = m_pFontMap->GetPDFFont(nFontIndex);
+  if (!pPDFFont)
+    return 0;
+
+  uint32_t charcode = pPDFFont->CharCodeFromUnicode(word);
+  if (charcode == CPDF_Font::kInvalidCharCode)
+    return 0;
+
+  return pPDFFont->GetCharWidthF(charcode);
 }
 
 int32_t CPDF_VariableText::Provider::GetTypeAscent(int32_t nFontIndex) {
-  if (CPDF_Font* pPDFFont = m_pFontMap->GetPDFFont(nFontIndex))
-    return pPDFFont->GetTypeAscent();
-  return 0;
+  RetainPtr<CPDF_Font> pPDFFont = m_pFontMap->GetPDFFont(nFontIndex);
+  return pPDFFont ? pPDFFont->GetTypeAscent() : 0;
 }
 
 int32_t CPDF_VariableText::Provider::GetTypeDescent(int32_t nFontIndex) {
-  if (CPDF_Font* pPDFFont = m_pFontMap->GetPDFFont(nFontIndex))
-    return pPDFFont->GetTypeDescent();
-  return 0;
+  RetainPtr<CPDF_Font> pPDFFont = m_pFontMap->GetPDFFont(nFontIndex);
+  return pPDFFont ? pPDFFont->GetTypeDescent() : 0;
 }
 
 int32_t CPDF_VariableText::Provider::GetWordFontIndex(uint16_t word,
                                                       int32_t charset,
                                                       int32_t nFontIndex) {
-  if (CPDF_Font* pDefFont = m_pFontMap->GetPDFFont(0)) {
+  if (RetainPtr<CPDF_Font> pDefFont = m_pFontMap->GetPDFFont(0)) {
     if (pDefFont->CharCodeFromUnicode(word) != CPDF_Font::kInvalidCharCode)
       return 0;
   }
-  if (CPDF_Font* pSysFont = m_pFontMap->GetPDFFont(1)) {
+  if (RetainPtr<CPDF_Font> pSysFont = m_pFontMap->GetPDFFont(1)) {
     if (pSysFont->CharCodeFromUnicode(word) != CPDF_Font::kInvalidCharCode)
       return 1;
   }
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpvt_fontmap.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpvt_fontmap.cpp
index 635869a334a..b21bd0d4e22 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpvt_fontmap.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpvt_fontmap.cpp
@@ -10,13 +10,14 @@
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfapi/parser/cpdf_reference.h"
+#include "core/fpdfapi/parser/fpdf_parser_utility.h"
 #include "core/fpdfdoc/cpdf_interactiveform.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "third_party/base/logging.h"
 
 CPVT_FontMap::CPVT_FontMap(CPDF_Document* pDoc,
                            CPDF_Dictionary* pResDict,
-                           CPDF_Font* pDefFont,
+                           const RetainPtr<CPDF_Font>& pDefFont,
                            const ByteString& sDefFontAlias)
     : m_pDocument(pDoc),
       m_pResDict(pResDict),
@@ -26,36 +27,38 @@ CPVT_FontMap::CPVT_FontMap(CPDF_Document* pDoc,
 CPVT_FontMap::~CPVT_FontMap() {}
 
 // static
-CPDF_Font* CPVT_FontMap::GetAnnotSysPDFFont(CPDF_Document* pDoc,
-                                            CPDF_Dictionary* pResDict,
-                                            ByteString* sSysFontAlias) {
+RetainPtr<CPDF_Font> CPVT_FontMap::GetAnnotSysPDFFont(
+    CPDF_Document* pDoc,
+    CPDF_Dictionary* pResDict,
+    ByteString* sSysFontAlias) {
   if (!pDoc || !pResDict)
     return nullptr;
 
   CPDF_Dictionary* pFormDict = pDoc->GetRoot()->GetDictFor("AcroForm");
-  CPDF_Font* pPDFFont =
+  RetainPtr<CPDF_Font> pPDFFont =
       AddNativeInteractiveFormFont(pFormDict, pDoc, sSysFontAlias);
   if (!pPDFFont)
     return nullptr;
 
   CPDF_Dictionary* pFontList = pResDict->GetDictFor("Font");
-  if (pFontList && !pFontList->KeyExist(*sSysFontAlias)) {
+  if (ValidateFontResourceDict(pFontList) &&
+      !pFontList->KeyExist(*sSysFontAlias)) {
     pFontList->SetNewFor<CPDF_Reference>(*sSysFontAlias, pDoc,
                                          pPDFFont->GetFontDict()->GetObjNum());
   }
   return pPDFFont;
 }
 
-CPDF_Font* CPVT_FontMap::GetPDFFont(int32_t nFontIndex) {
+RetainPtr<CPDF_Font> CPVT_FontMap::GetPDFFont(int32_t nFontIndex) {
   switch (nFontIndex) {
     case 0:
-      return m_pDefFont.Get();
+      return m_pDefFont;
     case 1:
       if (!m_pSysFont) {
         m_pSysFont = GetAnnotSysPDFFont(m_pDocument.Get(), m_pResDict.Get(),
                                         &m_sSysFontAlias);
       }
-      return m_pSysFont.Get();
+      return m_pSysFont;
     default:
       return nullptr;
   }
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpvt_fontmap.h b/chromium/third_party/pdfium/core/fpdfdoc/cpvt_fontmap.h
index cce03bf5d28..a85afcfb833 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpvt_fontmap.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpvt_fontmap.h
@@ -11,6 +11,7 @@
 
 #include "core/fpdfdoc/ipvt_fontmap.h"
 #include "core/fxcrt/fx_string.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 
 class CPDF_Document;
@@ -21,12 +22,12 @@ class CPVT_FontMap final : public IPVT_FontMap {
  public:
   CPVT_FontMap(CPDF_Document* pDoc,
                CPDF_Dictionary* pResDict,
-               CPDF_Font* pDefFont,
+               const RetainPtr<CPDF_Font>& pDefFont,
                const ByteString& sDefFontAlias);
   ~CPVT_FontMap() override;
 
   // IPVT_FontMap:
-  CPDF_Font* GetPDFFont(int32_t nFontIndex) override;
+  RetainPtr<CPDF_Font> GetPDFFont(int32_t nFontIndex) override;
   ByteString GetPDFFontAlias(int32_t nFontIndex) override;
   int32_t GetWordFontIndex(uint16_t word,
                            int32_t charset,
@@ -34,15 +35,15 @@ class CPVT_FontMap final : public IPVT_FontMap {
   int32_t CharCodeFromUnicode(int32_t nFontIndex, uint16_t word) override;
   int32_t CharSetFromUnicode(uint16_t word, int32_t nOldCharset) override;
 
-  static CPDF_Font* GetAnnotSysPDFFont(CPDF_Document* pDoc,
-                                       CPDF_Dictionary* pResDict,
-                                       ByteString* sSysFontAlias);
+  static RetainPtr<CPDF_Font> GetAnnotSysPDFFont(CPDF_Document* pDoc,
+                                                 CPDF_Dictionary* pResDict,
+                                                 ByteString* sSysFontAlias);
 
  private:
   UnownedPtr<CPDF_Document> const m_pDocument;
   RetainPtr<CPDF_Dictionary> const m_pResDict;
-  UnownedPtr<CPDF_Font> const m_pDefFont;
-  UnownedPtr<CPDF_Font> m_pSysFont;
+  RetainPtr<CPDF_Font> const m_pDefFont;
+  RetainPtr<CPDF_Font> m_pSysFont;
   const ByteString m_sDefFontAlias;
   ByteString m_sSysFontAlias;
 };
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/cpvt_generateap.cpp b/chromium/third_party/pdfium/core/fpdfdoc/cpvt_generateap.cpp
index 3a9a16df9cb..b66fc3c83e3 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/cpvt_generateap.cpp
+++ b/chromium/third_party/pdfium/core/fpdfdoc/cpvt_generateap.cpp
@@ -59,12 +59,12 @@ ByteString GetPDFWordString(IPVT_FontMap* pFontMap,
   if (!pFontMap)
     return ByteString();
 
-  CPDF_Font* pPDFFont = pFontMap->GetPDFFont(nFontIndex);
+  RetainPtr<CPDF_Font> pPDFFont = pFontMap->GetPDFFont(nFontIndex);
   if (!pPDFFont)
     return ByteString();
 
-  if (pPDFFont->GetBaseFont().Compare("Symbol") == 0 ||
-      pPDFFont->GetBaseFont().Compare("ZapfDingbats") == 0) {
+  if (pPDFFont->GetBaseFontName().Compare("Symbol") == 0 ||
+      pPDFFont->GetBaseFontName().Compare("ZapfDingbats") == 0) {
     return ByteString::Format("%c", Word);
   }
 
@@ -72,6 +72,7 @@ ByteString GetPDFWordString(IPVT_FontMap* pFontMap,
   uint32_t dwCharCode = pPDFFont->CharCodeFromUnicode(Word);
   if (dwCharCode != CPDF_Font::kInvalidCharCode)
     pPDFFont->AppendChar(&sWord, dwCharCode);
+
   return sWord;
 }
 
@@ -367,7 +368,7 @@ ByteString GetDashPatternString(const CPDF_Dictionary& pAnnotDict) {
 
 ByteString GetPopupContentsString(CPDF_Document* pDoc,
                                   const CPDF_Dictionary& pAnnotDict,
-                                  CPDF_Font* pDefFont,
+                                  const RetainPtr<CPDF_Font>& pDefFont,
                                   const ByteString& sFontName) {
   WideString swValue(pAnnotDict.GetUnicodeTextFor(pdfium::form_fields::kT));
   swValue += L'\n';
@@ -761,16 +762,18 @@ bool GeneratePopupAP(CPDF_Document* pDoc, CPDF_Dictionary* pAnnotDict) {
              << rect.Height() << " re b\n";
 
   ByteString sFontName = "FONT";
-  auto pResourceFontDict = GenerateResourceFontDict(pDoc, sFontName);
+  RetainPtr<CPDF_Dictionary> pResourceFontDict =
+      GenerateResourceFontDict(pDoc, sFontName);
+
   auto* pData = CPDF_DocPageData::FromDocument(pDoc);
-  CPDF_Font* pDefFont = pData->GetFont(pResourceFontDict.Get());
+  RetainPtr<CPDF_Font> pDefFont = pData->GetFont(pResourceFontDict.Get());
   if (!pDefFont)
     return false;
 
-  auto pExtGStateDict =
+  RetainPtr<CPDF_Dictionary> pExtGStateDict =
       GenerateExtGStateDict(*pAnnotDict, sExtGSDictName, "Normal");
-  auto pResourceDict = GenerateResourceDict(pDoc, std::move(pExtGStateDict),
-                                            std::move(pResourceFontDict));
+  RetainPtr<CPDF_Dictionary> pResourceDict = GenerateResourceDict(
+      pDoc, std::move(pExtGStateDict), std::move(pResourceFontDict));
 
   sAppStream << GetPopupContentsString(pDoc, *pAnnotDict, pDefFont, sFontName);
   GenerateAndSetAPDict(pDoc, pAnnotDict, &sAppStream, std::move(pResourceDict),
@@ -942,7 +945,7 @@ void CPVT_GenerateAP::GenerateFormAP(CPDF_Document* pDoc,
     return;
 
   CPDF_Dictionary* pDRFontDict = pDRDict->GetDictFor("Font");
-  if (!pDRFontDict)
+  if (!ValidateFontResourceDict(pDRFontDict))
     return;
 
   CPDF_Dictionary* pFontDict = pDRFontDict->GetDictFor(font_name);
@@ -956,14 +959,13 @@ void CPVT_GenerateAP::GenerateFormAP(CPDF_Document* pDoc,
                                            pFontDict->GetObjNum());
   }
   auto* pData = CPDF_DocPageData::FromDocument(pDoc);
-  CPDF_Font* pDefFont = pData->GetFont(pFontDict);
+  RetainPtr<CPDF_Font> pDefFont = pData->GetFont(pFontDict);
   if (!pDefFont)
     return;
 
   CFX_FloatRect rcAnnot = pAnnotDict->GetRectFor(pdfium::annotation::kRect);
-  int32_t nRotate = 0;
-  if (CPDF_Dictionary* pMKDict = pAnnotDict->GetDictFor("MK"))
-    nRotate = pMKDict->GetIntegerFor("R");
+  CPDF_Dictionary* pMKDict = pAnnotDict->GetDictFor("MK");
+  int32_t nRotate = pMKDict ? pMKDict->GetIntegerFor("R") : 0;
 
   CFX_FloatRect rcBBox;
   CFX_Matrix matrix;
@@ -1031,7 +1033,7 @@ void CPVT_GenerateAP::GenerateFormAP(CPDF_Document* pDoc,
   }
   CFX_Color crBorder;
   CFX_Color crBG;
-  if (CPDF_Dictionary* pMKDict = pAnnotDict->GetDictFor("MK")) {
+  if (pMKDict) {
     if (CPDF_Array* pArray = pMKDict->GetArrayFor("BC"))
       crBorder = fpdfdoc::CFXColorFromArray(*pArray);
     if (CPDF_Array* pArray = pMKDict->GetArrayFor("BG"))
@@ -1067,13 +1069,15 @@ void CPVT_GenerateAP::GenerateFormAP(CPDF_Document* pDoc,
   }
   CPDF_Dictionary* pStreamDict = pNormalStream->GetDict();
   if (pStreamDict) {
-    pStreamDict->SetMatrixFor("Matrix", matrix);
-    pStreamDict->SetRectFor("BBox", rcBBox);
     CPDF_Dictionary* pStreamResList = pStreamDict->GetDictFor("Resources");
     if (pStreamResList) {
       CPDF_Dictionary* pStreamResFontList = pStreamResList->GetDictFor("Font");
-      if (!pStreamResFontList)
+      if (pStreamResFontList) {
+        if (!ValidateFontResourceDict(pStreamResFontList))
+          return;
+      } else {
         pStreamResFontList = pStreamResList->SetNewFor<CPDF_Dictionary>("Font");
+      }
       if (!pStreamResFontList->KeyExist(font_name)) {
         pStreamResFontList->SetNewFor<CPDF_Reference>(font_name, pDoc,
                                                       pFontDict->GetObjNum());
@@ -1081,6 +1085,8 @@ void CPVT_GenerateAP::GenerateFormAP(CPDF_Document* pDoc,
     } else {
       pStreamDict->SetFor("Resources", pFormDict->GetDictFor("DR")->Clone());
     }
+    pStreamDict->SetMatrixFor("Matrix", matrix);
+    pStreamDict->SetRectFor("BBox", rcBBox);
   }
   switch (type) {
     case CPVT_GenerateAP::kTextField: {
@@ -1304,28 +1310,33 @@ void CPVT_GenerateAP::GenerateFormAP(CPDF_Document* pDoc,
     }
   }
 
-  if (pNormalStream) {
-    pNormalStream->SetDataFromStringstreamAndRemoveFilter(&sAppStream);
-    pStreamDict = pNormalStream->GetDict();
-    if (pStreamDict) {
-      pStreamDict->SetMatrixFor("Matrix", matrix);
-      pStreamDict->SetRectFor("BBox", rcBBox);
-      CPDF_Dictionary* pStreamResList = pStreamDict->GetDictFor("Resources");
-      if (pStreamResList) {
-        CPDF_Dictionary* pStreamResFontList =
-            pStreamResList->GetDictFor("Font");
-        if (!pStreamResFontList) {
-          pStreamResFontList =
-              pStreamResList->SetNewFor<CPDF_Dictionary>("Font");
-        }
-        if (!pStreamResFontList->KeyExist(font_name)) {
-          pStreamResFontList->SetNewFor<CPDF_Reference>(font_name, pDoc,
-                                                        pFontDict->GetObjNum());
-        }
-      } else {
-        pStreamDict->SetFor("Resources", pFormDict->GetDictFor("DR")->Clone());
-      }
-    }
+  if (!pNormalStream)
+    return;
+
+  pNormalStream->SetDataFromStringstreamAndRemoveFilter(&sAppStream);
+  pStreamDict = pNormalStream->GetDict();
+  if (!pStreamDict)
+    return;
+
+  pStreamDict->SetMatrixFor("Matrix", matrix);
+  pStreamDict->SetRectFor("BBox", rcBBox);
+  CPDF_Dictionary* pStreamResList = pStreamDict->GetDictFor("Resources");
+  if (!pStreamResList) {
+    pStreamDict->SetFor("Resources", pFormDict->GetDictFor("DR")->Clone());
+    return;
+  }
+
+  CPDF_Dictionary* pStreamResFontList = pStreamResList->GetDictFor("Font");
+  if (pStreamResFontList) {
+    if (!ValidateFontResourceDict(pStreamResFontList))
+      return;
+  } else {
+    pStreamResFontList = pStreamResList->SetNewFor<CPDF_Dictionary>("Font");
+  }
+
+  if (!pStreamResFontList->KeyExist(font_name)) {
+    pStreamResFontList->SetNewFor<CPDF_Reference>(font_name, pDoc,
+                                                  pFontDict->GetObjNum());
   }
 }
 
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/ipdf_formnotify.h b/chromium/third_party/pdfium/core/fpdfdoc/ipdf_formnotify.h
deleted file mode 100644
index 6a72c68d702..00000000000
--- a/chromium/third_party/pdfium/core/fpdfdoc/ipdf_formnotify.h
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2016 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef CORE_FPDFDOC_IPDF_FORMNOTIFY_H_
-#define CORE_FPDFDOC_IPDF_FORMNOTIFY_H_
-
-#include "core/fxcrt/fx_string.h"
-
-class CPDF_FormField;
-class CPDF_InteractiveForm;
-
-class IPDF_FormNotify {
- public:
-  virtual ~IPDF_FormNotify() = default;
-
-  virtual bool BeforeValueChange(CPDF_FormField* pField,
-                                 const WideString& csValue) = 0;
-  virtual void AfterValueChange(CPDF_FormField* pField) = 0;
-
-  virtual bool BeforeSelectionChange(CPDF_FormField* pField,
-                                     const WideString& csValue) = 0;
-  virtual void AfterSelectionChange(CPDF_FormField* pField) = 0;
-
-  virtual void AfterCheckedStatusChange(CPDF_FormField* pField) = 0;
-  virtual void AfterFormReset(CPDF_InteractiveForm* pForm) = 0;
-};
-
-#endif  // CORE_FPDFDOC_IPDF_FORMNOTIFY_H_
diff --git a/chromium/third_party/pdfium/core/fpdfdoc/ipvt_fontmap.h b/chromium/third_party/pdfium/core/fpdfdoc/ipvt_fontmap.h
index a27c0ac28a4..e818356ddb6 100644
--- a/chromium/third_party/pdfium/core/fpdfdoc/ipvt_fontmap.h
+++ b/chromium/third_party/pdfium/core/fpdfdoc/ipvt_fontmap.h
@@ -10,6 +10,7 @@
 #include <stdint.h>
 
 #include "core/fxcrt/fx_string.h"
+#include "core/fxcrt/retain_ptr.h"
 
 class CPDF_Font;
 
@@ -17,7 +18,7 @@ class IPVT_FontMap {
  public:
   virtual ~IPVT_FontMap() = default;
 
-  virtual CPDF_Font* GetPDFFont(int32_t nFontIndex) = 0;
+  virtual RetainPtr<CPDF_Font> GetPDFFont(int32_t nFontIndex) = 0;
   virtual ByteString GetPDFFontAlias(int32_t nFontIndex) = 0;
   virtual int32_t GetWordFontIndex(uint16_t word,
                                    int32_t charset,
diff --git a/chromium/third_party/pdfium/core/fpdftext/cpdf_textpage.cpp b/chromium/third_party/pdfium/core/fpdftext/cpdf_textpage.cpp
index 1ba470f7db1..4c992474844 100644
--- a/chromium/third_party/pdfium/core/fpdftext/cpdf_textpage.cpp
+++ b/chromium/third_party/pdfium/core/fpdftext/cpdf_textpage.cpp
@@ -771,14 +771,14 @@ void CPDF_TextPage::ProcessTextObject(
   CPDF_TextObjectItem item;
   prev_Obj.m_pTextObj->GetItemInfo(nItem - 1, &item);
   float prev_width =
-      GetCharWidth(item.m_CharCode, prev_Obj.m_pTextObj->GetFont()) *
+      GetCharWidth(item.m_CharCode, prev_Obj.m_pTextObj->GetFont().Get()) *
       prev_Obj.m_pTextObj->GetFontSize() / 1000;
 
   CFX_Matrix prev_matrix =
       prev_Obj.m_pTextObj->GetTextMatrix() * prev_Obj.m_formMatrix;
   prev_width = prev_matrix.TransformDistance(fabs(prev_width));
   pTextObj->GetItemInfo(0, &item);
-  float this_width = GetCharWidth(item.m_CharCode, pTextObj->GetFont()) *
+  float this_width = GetCharWidth(item.m_CharCode, pTextObj->GetFont().Get()) *
                      pTextObj->GetFontSize() / 1000;
   this_width = fabs(this_width);
 
@@ -845,7 +845,7 @@ FPDFText_MarkedContent CPDF_TextPage::PreMarkedContent(PDFTEXT_Obj Obj) {
   if (actText.IsEmpty())
     return FPDFText_MarkedContent::Pass;
 
-  CPDF_Font* pFont = pTextObj->GetFont();
+  RetainPtr<CPDF_Font> pFont = pTextObj->GetFont();
   bExist = false;
   for (size_t i = 0; i < actText.GetLength(); ++i) {
     if (pFont->CharCodeFromUnicode(actText[i]) != CPDF_Font::kInvalidCharCode) {
@@ -887,7 +887,7 @@ void CPDF_TextPage::ProcessMarkedContent(PDFTEXT_Obj Obj) {
   if (actText.IsEmpty())
     return;
 
-  CPDF_Font* pFont = pTextObj->GetFont();
+  RetainPtr<CPDF_Font> pFont = pTextObj->GetFont();
   CFX_Matrix matrix = pTextObj->GetTextMatrix() * Obj.m_formMatrix;
 
   for (size_t k = 0; k < actText.GetLength(); ++k) {
@@ -939,10 +939,10 @@ void CPDF_TextPage::ProcessTextObject(PDFTEXT_Obj Obj) {
   CPDF_TextObject* pTextObj = Obj.m_pTextObj.Get();
   if (fabs(pTextObj->GetRect().Width()) < kSizeEpsilon)
     return;
+
   CFX_Matrix formMatrix = Obj.m_formMatrix;
-  CPDF_Font* pFont = pTextObj->GetFont();
+  RetainPtr<CPDF_Font> pFont = pTextObj->GetFont();
   CFX_Matrix matrix = pTextObj->GetTextMatrix() * formMatrix;
-
   FPDFText_MarkedContent ePreMKC = PreMarkedContent(Obj);
   if (ePreMKC == FPDFText_MarkedContent::Done) {
     m_pPreTextObj = pTextObj;
@@ -1058,7 +1058,8 @@ void CPDF_TextPage::ProcessTextObject(PDFTEXT_Obj Obj) {
       else
         threshold /= 2;
       if (threshold == 0) {
-        threshold = static_cast<float>(GetCharWidth(item.m_CharCode, pFont));
+        threshold =
+            static_cast<float>(GetCharWidth(item.m_CharCode, pFont.Get()));
         threshold = NormalizeThreshold(threshold, 300, 500, 700);
         threshold = fontsize_h * threshold / 1000;
       }
@@ -1259,10 +1260,10 @@ CPDF_TextPage::GenerateCharacter CPDF_TextPage::ProcessInsertObject(
 
   float last_pos = PrevItem.m_Origin.x;
   uint32_t nLastWidth =
-      GetCharWidth(PrevItem.m_CharCode, m_pPreTextObj->GetFont());
+      GetCharWidth(PrevItem.m_CharCode, m_pPreTextObj->GetFont().Get());
   float last_width = nLastWidth * m_pPreTextObj->GetFontSize() / 1000;
   last_width = fabs(last_width);
-  uint32_t nThisWidth = GetCharWidth(item.m_CharCode, pObj->GetFont());
+  uint32_t nThisWidth = GetCharWidth(item.m_CharCode, pObj->GetFont().Get());
   float this_width = fabs(nThisWidth * pObj->GetFontSize() / 1000);
   float threshold = std::max(last_width, this_width) / 4;
 
@@ -1389,7 +1390,8 @@ bool CPDF_TextPage::IsSameTextObject(CPDF_TextObject* pTextObj1,
 
   CFX_PointF diff = pTextObj1->GetPos() - pTextObj2->GetPos();
   float font_size = pTextObj2->GetFontSize();
-  float char_size = GetCharWidth(itemPer.m_CharCode, pTextObj2->GetFont());
+  float char_size =
+      GetCharWidth(itemPer.m_CharCode, pTextObj2->GetFont().Get());
   float max_pre_size =
       std::max(std::max(rcPreObj.Height(), rcPreObj.Width()), font_size);
   return fabs(diff.x) <= 0.9 * char_size * font_size / 1000 &&
@@ -1427,7 +1429,7 @@ Optional<PAGECHAR_INFO> CPDF_TextPage::GenerateCharInfo(wchar_t unicode) {
   int preWidth = 0;
   if (pPrevCharInfo->m_pTextObj && pPrevCharInfo->m_CharCode != -1) {
     preWidth = GetCharWidth(pPrevCharInfo->m_CharCode,
-                            pPrevCharInfo->m_pTextObj->GetFont());
+                            pPrevCharInfo->m_pTextObj->GetFont().Get());
   }
 
   float fFontSize = pPrevCharInfo->m_pTextObj
diff --git a/chromium/third_party/pdfium/core/fxcodec/fax/faxmodule.cpp b/chromium/third_party/pdfium/core/fxcodec/fax/faxmodule.cpp
index 6d618570f3e..d8df9e16529 100644
--- a/chromium/third_party/pdfium/core/fxcodec/fax/faxmodule.cpp
+++ b/chromium/third_party/pdfium/core/fxcodec/fax/faxmodule.cpp
@@ -478,7 +478,7 @@ class FaxDecoder final : public ScanlineDecoder {
   bool m_bByteAlign = false;
   const bool m_bEndOfLine;
   const bool m_bBlack;
-  pdfium::span<const uint8_t> const m_SrcSpan;
+  const pdfium::span<const uint8_t> m_SrcSpan;
   std::vector<uint8_t> m_ScanlineBuf;
   std::vector<uint8_t> m_RefBuf;
 };
diff --git a/chromium/third_party/pdfium/core/fxcodec/flate/flatemodule.cpp b/chromium/third_party/pdfium/core/fxcodec/flate/flatemodule.cpp
index 31aa519f5e0..587771e269f 100644
--- a/chromium/third_party/pdfium/core/fxcodec/flate/flatemodule.cpp
+++ b/chromium/third_party/pdfium/core/fxcodec/flate/flatemodule.cpp
@@ -605,7 +605,7 @@ class FlateScanlineDecoder : public ScanlineDecoder {
 
  protected:
   std::unique_ptr<z_stream, FlateDeleter> m_pFlate;
-  pdfium::span<const uint8_t> const m_SrcBuf;
+  const pdfium::span<const uint8_t> m_SrcBuf;
   std::unique_ptr<uint8_t, FxFreeDeleter> const m_pScanline;
 };
 
diff --git a/chromium/third_party/pdfium/core/fxcodec/jbig2/JBig2_BitStream.h b/chromium/third_party/pdfium/core/fxcodec/jbig2/JBig2_BitStream.h
index 50a80edc18e..9e6efc4e956 100644
--- a/chromium/third_party/pdfium/core/fxcodec/jbig2/JBig2_BitStream.h
+++ b/chromium/third_party/pdfium/core/fxcodec/jbig2/JBig2_BitStream.h
@@ -44,7 +44,7 @@ class CJBig2_BitStream {
   void AdvanceBit();
   uint32_t LengthInBits() const;
 
-  pdfium::span<const uint8_t> const m_Span;
+  const pdfium::span<const uint8_t> m_Span;
   uint32_t m_dwByteIdx = 0;
   uint32_t m_dwBitIdx = 0;
   const uint32_t m_dwObjNum;
diff --git a/chromium/third_party/pdfium/core/fxcodec/progressivedecoder.cpp b/chromium/third_party/pdfium/core/fxcodec/progressivedecoder.cpp
index 0271a8d1210..88a22daf2b4 100644
--- a/chromium/third_party/pdfium/core/fxcodec/progressivedecoder.cpp
+++ b/chromium/third_party/pdfium/core/fxcodec/progressivedecoder.cpp
@@ -23,12 +23,12 @@
 #include "third_party/base/numerics/safe_math.h"
 #include "third_party/base/ptr_util.h"
 
-#define FXCODEC_BLOCK_SIZE 4096
-
 namespace fxcodec {
 
 namespace {
 
+constexpr size_t kBlockSize = 4096;
+
 #ifdef PDF_ENABLE_XFA_PNG
 #if defined(OS_MACOSX)
 const double kPngGamma = 1.7;
@@ -1235,8 +1235,7 @@ bool ProgressiveDecoder::PngDetectImageTypeInBuffer(
   }
   while (pPngModule->Input(m_pPngContext.get(), m_pCodecMemory, pAttribute)) {
     uint32_t remain_size = static_cast<uint32_t>(m_pFile->GetSize()) - m_offSet;
-    uint32_t input_size =
-        remain_size > FXCODEC_BLOCK_SIZE ? FXCODEC_BLOCK_SIZE : remain_size;
+    uint32_t input_size = std::min<uint32_t>(remain_size, kBlockSize);
     if (input_size == 0) {
       m_pPngContext.reset();
       m_status = FXCODEC_STATUS_ERR_FORMAT;
@@ -1316,8 +1315,7 @@ FXCODEC_STATUS ProgressiveDecoder::PngContinueDecode() {
   }
   while (true) {
     uint32_t remain_size = (uint32_t)m_pFile->GetSize() - m_offSet;
-    uint32_t input_size =
-        remain_size > FXCODEC_BLOCK_SIZE ? FXCODEC_BLOCK_SIZE : remain_size;
+    uint32_t input_size = std::min<uint32_t>(remain_size, kBlockSize);
     if (input_size == 0) {
       m_pPngContext.reset();
       m_pDeviceBitmap = nullptr;
@@ -1525,7 +1523,7 @@ bool ProgressiveDecoder::DetectImageType(FXCODEC_IMAGE_TYPE imageType,
     return TiffDetectImageTypeFromFile(pAttribute);
 #endif  // PDF_ENABLE_XFA_TIFF
 
-  size_t size = std::min<size_t>(m_pFile->GetSize(), FXCODEC_BLOCK_SIZE);
+  size_t size = std::min<size_t>(m_pFile->GetSize(), kBlockSize);
   m_pCodecMemory = pdfium::MakeRetain<CFX_CodecMemory>(size);
   m_offSet = 0;
   if (!m_pFile->ReadBlockAtOffset(m_pCodecMemory->GetBuffer(), m_offSet,
@@ -1582,7 +1580,7 @@ bool ProgressiveDecoder::ReadMoreData(ModuleIface* pModule,
     // Increase the buffer size so that there might be enough contiguous
     // bytes to allow whatever operation is having difficulty to succeed.
     dwBytesToFetchFromFile =
-        std::min<uint32_t>(dwBytesToFetchFromFile, FXCODEC_BLOCK_SIZE);
+        std::min<uint32_t>(dwBytesToFetchFromFile, kBlockSize);
     size_t dwNewSize = m_pCodecMemory->GetSize() + dwBytesToFetchFromFile;
     if (!m_pCodecMemory->TryResize(dwNewSize)) {
       err_status = FXCODEC_STATUS_ERR_MEMORY;
diff --git a/chromium/third_party/pdfium/core/fxcrt/BUILD.gn b/chromium/third_party/pdfium/core/fxcrt/BUILD.gn
index d4a986d8e16..83cf2f79b0e 100644
--- a/chromium/third_party/pdfium/core/fxcrt/BUILD.gn
+++ b/chromium/third_party/pdfium/core/fxcrt/BUILD.gn
@@ -22,6 +22,8 @@ jumbo_source_set("fxcrt") {
     "cfx_readonlymemorystream.h",
     "cfx_seekablestreamproxy.cpp",
     "cfx_seekablestreamproxy.h",
+    "cfx_timer.cpp",
+    "cfx_timer.h",
     "cfx_utf8decoder.cpp",
     "cfx_utf8decoder.h",
     "cfx_utf8encoder.cpp",
@@ -62,6 +64,7 @@ jumbo_source_set("fxcrt") {
     "string_data_template.h",
     "string_pool_template.h",
     "string_view_template.h",
+    "timerhandler_iface.h",
     "tree_node.h",
     "unowned_ptr.h",
     "weak_ptr.h",
@@ -133,6 +136,7 @@ pdfium_unittest_source_set("unittests") {
     "bytestring_unittest.cpp",
     "cfx_bitstream_unittest.cpp",
     "cfx_seekablestreamproxy_unittest.cpp",
+    "cfx_timer_unittest.cpp",
     "cfx_widetextbuf_unittest.cpp",
     "fx_bidi_unittest.cpp",
     "fx_coordinates_unittest.cpp",
diff --git a/chromium/third_party/pdfium/core/fxcrt/cfx_timer.cpp b/chromium/third_party/pdfium/core/fxcrt/cfx_timer.cpp
new file mode 100644
index 00000000000..057cda64aee
--- /dev/null
+++ b/chromium/third_party/pdfium/core/fxcrt/cfx_timer.cpp
@@ -0,0 +1,44 @@
+// Copyright 2017 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
+
+#include "core/fxcrt/cfx_timer.h"
+
+#include <map>
+
+namespace {
+
+std::map<int32_t, CFX_Timer*>& GetPWLTimeMap() {
+  // Leak the object at shutdown.
+  static auto* timeMap = new std::map<int32_t, CFX_Timer*>;
+  return *timeMap;
+}
+
+}  // namespace
+
+CFX_Timer::CFX_Timer(TimerHandlerIface* pTimerHandler,
+                     CallbackIface* pCallbackIface,
+                     int32_t nInterval)
+    : m_nTimerID(pTimerHandler->SetTimer(nInterval, TimerProc)),
+      m_pTimerHandler(pTimerHandler),
+      m_pCallbackIface(pCallbackIface) {
+  ASSERT(m_pCallbackIface);
+  if (HasValidID())
+    GetPWLTimeMap()[m_nTimerID] = this;
+}
+
+CFX_Timer::~CFX_Timer() {
+  if (HasValidID()) {
+    m_pTimerHandler->KillTimer(m_nTimerID);
+    GetPWLTimeMap().erase(m_nTimerID);
+  }
+}
+
+// static
+void CFX_Timer::TimerProc(int32_t idEvent) {
+  auto it = GetPWLTimeMap().find(idEvent);
+  if (it != GetPWLTimeMap().end())
+    it->second->m_pCallbackIface->OnTimerFired();
+}
diff --git a/chromium/third_party/pdfium/core/fxcrt/cfx_timer.h b/chromium/third_party/pdfium/core/fxcrt/cfx_timer.h
new file mode 100644
index 00000000000..fa97dda194f
--- /dev/null
+++ b/chromium/third_party/pdfium/core/fxcrt/cfx_timer.h
@@ -0,0 +1,40 @@
+// Copyright 2017 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
+
+#ifndef CORE_FXCRT_CFX_TIMER_H_
+#define CORE_FXCRT_CFX_TIMER_H_
+
+#include "core/fxcrt/timerhandler_iface.h"
+#include "core/fxcrt/unowned_ptr.h"
+
+class CFX_TimerHandler;
+
+class CFX_Timer {
+ public:
+  class CallbackIface {
+   public:
+    virtual ~CallbackIface() = default;
+    virtual void OnTimerFired() = 0;
+  };
+
+  CFX_Timer(TimerHandlerIface* pTimerHandler,
+            CallbackIface* pCallbackIface,
+            int32_t nInterval);
+  ~CFX_Timer();
+
+  bool HasValidID() const {
+    return m_nTimerID != TimerHandlerIface::kInvalidTimerID;
+  }
+
+ private:
+  static void TimerProc(int32_t idEvent);
+
+  const int32_t m_nTimerID;
+  UnownedPtr<TimerHandlerIface> const m_pTimerHandler;
+  UnownedPtr<CallbackIface> const m_pCallbackIface;
+};
+
+#endif  // CORE_FXCRT_CFX_TIMER_H_
diff --git a/chromium/third_party/pdfium/core/fxcrt/cfx_timer_unittest.cpp b/chromium/third_party/pdfium/core/fxcrt/cfx_timer_unittest.cpp
new file mode 100644
index 00000000000..b95de72ec50
--- /dev/null
+++ b/chromium/third_party/pdfium/core/fxcrt/cfx_timer_unittest.cpp
@@ -0,0 +1,85 @@
+// Copyright 2019 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/fxcrt/cfx_timer.h"
+
+#include <memory>
+
+#include "core/fxcrt/timerhandler_iface.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/base/ptr_util.h"
+
+using testing::_;
+using testing::DoAll;
+using testing::Return;
+using testing::SaveArg;
+
+class MockTimerScheduler : public TimerHandlerIface {
+ public:
+  MOCK_METHOD2(SetTimer, int(int32_t uElapse, TimerCallback lpTimerFunc));
+  MOCK_METHOD1(KillTimer, void(int32_t nID));
+};
+
+class MockTimerCallback : public CFX_Timer::CallbackIface {
+ public:
+  MOCK_METHOD0(OnTimerFired, void());
+};
+
+TEST(CFX_Timer, ValidTimers) {
+  TimerHandlerIface::TimerCallback fn1 = nullptr;
+  TimerHandlerIface::TimerCallback fn2 = nullptr;
+
+  MockTimerScheduler scheduler;
+  EXPECT_CALL(scheduler, SetTimer(100, _))
+      .WillOnce(DoAll(SaveArg<1>(&fn1), Return(1001)));
+  EXPECT_CALL(scheduler, SetTimer(200, _))
+      .WillOnce(DoAll(SaveArg<1>(&fn2), Return(1002)));
+  EXPECT_CALL(scheduler, KillTimer(1001));
+  EXPECT_CALL(scheduler, KillTimer(1002));
+
+  MockTimerCallback cb1;
+  EXPECT_CALL(cb1, OnTimerFired()).Times(1);
+
+  MockTimerCallback cb2;
+  EXPECT_CALL(cb2, OnTimerFired()).Times(2);
+
+  auto timer1 = pdfium::MakeUnique<CFX_Timer>(&scheduler, &cb1, 100);
+  auto timer2 = pdfium::MakeUnique<CFX_Timer>(&scheduler, &cb2, 200);
+  EXPECT_TRUE(timer1->HasValidID());
+  EXPECT_TRUE(timer2->HasValidID());
+
+  // Fire some timers.
+  ASSERT_TRUE(fn1);
+  ASSERT_TRUE(fn2);
+  (*fn1)(1001);
+  (*fn1)(1002);
+  (*fn1)(1002);
+}
+
+TEST(CFX_Timer, MisbehavingEmbedder) {
+  TimerHandlerIface::TimerCallback fn1 = nullptr;
+
+  MockTimerScheduler scheduler;
+  EXPECT_CALL(scheduler, SetTimer(100, _))
+      .WillOnce(DoAll(SaveArg<1>(&fn1), Return(1001)));
+  EXPECT_CALL(scheduler, KillTimer(1001));
+
+  MockTimerCallback cb1;
+  EXPECT_CALL(cb1, OnTimerFired()).Times(0);
+
+  {
+    auto timer1 = pdfium::MakeUnique<CFX_Timer>(&scheduler, &cb1, 100);
+    EXPECT_TRUE(timer1->HasValidID());
+
+    // Fire callback with bad arguments.
+    ASSERT_TRUE(fn1);
+    (*fn1)(-1);
+    (*fn1)(0);
+    (*fn1)(1002);
+  }
+
+  // Fire callback against stale timer.
+  (*fn1)(1001);
+}
diff --git a/chromium/third_party/pdfium/core/fxcrt/fx_coordinates.cpp b/chromium/third_party/pdfium/core/fxcrt/fx_coordinates.cpp
index 2969315a57d..c6d5393b7fb 100644
--- a/chromium/third_party/pdfium/core/fxcrt/fx_coordinates.cpp
+++ b/chromium/third_party/pdfium/core/fxcrt/fx_coordinates.cpp
@@ -268,6 +268,13 @@ FX_RECT CFX_FloatRect::ToRoundedFxRect() const {
                  FXSYS_round(bottom));
 }
 
+FX_RECT CFX_RectF::GetOuterRect() const {
+  return FX_RECT(static_cast<int32_t>(floor(left)),
+                 static_cast<int32_t>(floor(top)),
+                 static_cast<int32_t>(ceil(right())),
+                 static_cast<int32_t>(ceil(bottom())));
+}
+
 #ifndef NDEBUG
 std::ostream& operator<<(std::ostream& os, const CFX_FloatRect& rect) {
   os << "rect[w " << rect.Width() << " x h " << rect.Height() << " (left "
diff --git a/chromium/third_party/pdfium/core/fxcrt/fx_coordinates.h b/chromium/third_party/pdfium/core/fxcrt/fx_coordinates.h
index 5bb36da7143..c3ea4800523 100644
--- a/chromium/third_party/pdfium/core/fxcrt/fx_coordinates.h
+++ b/chromium/third_party/pdfium/core/fxcrt/fx_coordinates.h
@@ -182,7 +182,7 @@ using CFX_VectorF = CFX_VTemplate<float>;
 // LTRB rectangles (y-axis runs downwards).
 // Struct layout is compatible with win32 RECT.
 struct FX_RECT {
-  FX_RECT() : left(0), top(0), right(0), bottom(0) {}
+  FX_RECT() = default;
   FX_RECT(int l, int t, int r, int b) : left(l), top(t), right(r), bottom(b) {}
 
   int Width() const { return right - left; }
@@ -198,7 +198,6 @@ struct FX_RECT {
   }
 
   void Normalize();
-
   void Intersect(const FX_RECT& src);
   void Intersect(int l, int t, int r, int b) { Intersect(FX_RECT(l, t, r, b)); }
 
@@ -218,16 +217,16 @@ struct FX_RECT {
     return x >= left && x < right && y >= top && y < bottom;
   }
 
-  int32_t left;
-  int32_t top;
-  int32_t right;
-  int32_t bottom;
+  int32_t left = 0;
+  int32_t top = 0;
+  int32_t right = 0;
+  int32_t bottom = 0;
 };
 
 // LTRB rectangles (y-axis runs upwards).
 class CFX_FloatRect {
  public:
-  constexpr CFX_FloatRect() : CFX_FloatRect(0.0f, 0.0f, 0.0f, 0.0f) {}
+  constexpr CFX_FloatRect() = default;
   constexpr CFX_FloatRect(float l, float b, float r, float t)
       : left(l), bottom(b), right(r), top(t) {}
 
@@ -310,10 +309,10 @@ class CFX_FloatRect {
   // Rounds LBRT values.
   FX_RECT ToRoundedFxRect() const;
 
-  float left;
-  float bottom;
-  float right;
-  float top;
+  float left = 0.0f;
+  float bottom = 0.0f;
+  float right = 0.0f;
+  float top = 0.0f;
 };
 
 #ifndef NDEBUG
@@ -326,7 +325,7 @@ class CFX_RectF {
   using PointType = CFX_PointF;
   using SizeType = CFX_SizeF;
 
-  CFX_RectF() : left(0), top(0), width(0), height(0) {}
+  CFX_RectF() = default;
   CFX_RectF(float dst_left, float dst_top, float dst_width, float dst_height)
       : left(dst_left), top(dst_top), width(dst_width), height(dst_height) {}
   CFX_RectF(float dst_left, float dst_top, const SizeType& dst_size)
@@ -338,13 +337,14 @@ class CFX_RectF {
       : left(p.x), top(p.y), width(dst_width), height(dst_height) {}
   CFX_RectF(const PointType& p1, const SizeType& s2)
       : left(p1.x), top(p1.y), width(s2.width), height(s2.height) {}
+  explicit CFX_RectF(const FX_RECT& that)
+      : left(static_cast<float>(that.left)),
+        top(static_cast<float>(that.top)),
+        width(static_cast<float>(that.Width())),
+        height(static_cast<float>(that.Height())) {}
 
   // NOLINTNEXTLINE(runtime/explicit)
-  CFX_RectF(const CFX_RectF& other)
-      : left(other.left),
-        top(other.top),
-        width(other.width),
-        height(other.height) {}
+  CFX_RectF(const CFX_RectF& other) = default;
 
   CFX_RectF& operator+=(const PointType& p) {
     left += p.x;
@@ -498,10 +498,14 @@ class CFX_RectF {
     return CFX_FloatRect(left, top, right(), bottom());
   }
 
-  float left;
-  float top;
-  float width;
-  float height;
+  // Returned rect has bounds rounded up/down such that the original is
+  // contained in it.
+  FX_RECT GetOuterRect() const;
+
+  float left = 0.0f;
+  float top = 0.0f;
+  float width = 0.0f;
+  float height = 0.0f;
 };
 
 #ifndef NDEBUG
diff --git a/chromium/third_party/pdfium/core/fxcrt/fx_system.cpp b/chromium/third_party/pdfium/core/fxcrt/fx_system.cpp
index eabf8f4a3df..4f95b6a32da 100644
--- a/chromium/third_party/pdfium/core/fxcrt/fx_system.cpp
+++ b/chromium/third_party/pdfium/core/fxcrt/fx_system.cpp
@@ -14,6 +14,10 @@
 
 namespace {
 
+#if !defined(OS_WIN)
+uint32_t g_last_error = 0;
+#endif
+
 template <typename IntType, typename CharType>
 IntType FXSYS_StrToInt(const CharType* str) {
   if (!str)
@@ -243,4 +247,11 @@ int FXSYS_MultiByteToWideChar(uint32_t codepage,
   return wlen;
 }
 
+void FXSYS_SetLastError(uint32_t err) {
+  g_last_error = err;
+}
+
+uint32_t FXSYS_GetLastError() {
+  return g_last_error;
+}
 #endif  // defined(OS_WIN)
diff --git a/chromium/third_party/pdfium/core/fxcrt/fx_system.h b/chromium/third_party/pdfium/core/fxcrt/fx_system.h
index 6b113c08440..8872c57700c 100644
--- a/chromium/third_party/pdfium/core/fxcrt/fx_system.h
+++ b/chromium/third_party/pdfium/core/fxcrt/fx_system.h
@@ -139,9 +139,9 @@ size_t FXSYS_wcsftime(wchar_t* strDest,
                       size_t maxsize,
                       const wchar_t* format,
                       const struct tm* timeptr);
-
+#define FXSYS_SetLastError SetLastError
+#define FXSYS_GetLastError GetLastError
 #else  // _FX_PLATFORM_ == _FX_PLATFORM_WINDOWS_
-
 int FXSYS_GetACP();
 char* FXSYS_itoa(int value, char* str, int radix);
 int FXSYS_WideCharToMultiByte(uint32_t codepage,
@@ -166,6 +166,8 @@ wchar_t* FXSYS_wcslwr(wchar_t* str);
 wchar_t* FXSYS_wcsupr(wchar_t* str);
 #define FXSYS_pow(a, b) (float)pow(a, b)
 #define FXSYS_wcsftime wcsftime
+void FXSYS_SetLastError(uint32_t err);
+uint32_t FXSYS_GetLastError();
 #endif  // _FX_PLATFORM_ == _FX_PLATFORM_WINDOWS_
 
 #define FXWORD_GET_LSBFIRST(p)                                \
diff --git a/chromium/third_party/pdfium/core/fxcrt/retain_ptr.h b/chromium/third_party/pdfium/core/fxcrt/retain_ptr.h
index 688a622f17a..f69f7648a23 100644
--- a/chromium/third_party/pdfium/core/fxcrt/retain_ptr.h
+++ b/chromium/third_party/pdfium/core/fxcrt/retain_ptr.h
@@ -70,6 +70,9 @@ class RetainPtr {
     return *this;
   }
 
+  // Assigment from raw pointers is intentially not provided to make
+  // reference count churn more visible where possible.
+
   bool operator==(const RetainPtr& that) const { return Get() == that.Get(); }
   bool operator!=(const RetainPtr& that) const { return !(*this == that); }
 
@@ -125,6 +128,16 @@ class Retainable {
   mutable intptr_t m_nRefCount = 0;
 };
 
+template <typename T, typename U>
+inline bool operator==(const U* lhs, const RetainPtr<T>& rhs) {
+  return rhs == lhs;
+}
+
+template <typename T, typename U>
+inline bool operator!=(const U* lhs, const RetainPtr<T>& rhs) {
+  return rhs != lhs;
+}
+
 }  // namespace fxcrt
 
 using fxcrt::ReleaseDeleter;
diff --git a/chromium/third_party/pdfium/core/fxcrt/retain_ptr_unittest.cpp b/chromium/third_party/pdfium/core/fxcrt/retain_ptr_unittest.cpp
index 4405cd2b371..47277df631e 100644
--- a/chromium/third_party/pdfium/core/fxcrt/retain_ptr_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fxcrt/retain_ptr_unittest.cpp
@@ -217,6 +217,17 @@ TEST(RetainPtr, Equals) {
   EXPECT_FALSE(obj1_ptr1 == obj2_ptr1);
 }
 
+TEST(RetainPtr, EqualsReflexive) {
+  PseudoRetainable obj1;
+  PseudoRetainable obj2;
+  RetainPtr<PseudoRetainable> obj1_ptr(&obj1);
+  RetainPtr<PseudoRetainable> obj2_ptr(&obj2);
+  EXPECT_TRUE(&obj1 == obj1_ptr);
+  EXPECT_FALSE(&obj1 == obj2_ptr);
+  EXPECT_FALSE(&obj2 == obj1_ptr);
+  EXPECT_TRUE(&obj2 == obj2_ptr);
+}
+
 TEST(RetainPtr, NotEquals) {
   PseudoRetainable obj1;
   PseudoRetainable obj2;
@@ -236,6 +247,17 @@ TEST(RetainPtr, NotEquals) {
   EXPECT_TRUE(obj1_ptr1 != obj2_ptr1);
 }
 
+TEST(RetainPtr, NotEqualsReflexive) {
+  PseudoRetainable obj1;
+  PseudoRetainable obj2;
+  RetainPtr<PseudoRetainable> obj1_ptr(&obj1);
+  RetainPtr<PseudoRetainable> obj2_ptr(&obj2);
+  EXPECT_FALSE(&obj1 != obj1_ptr);
+  EXPECT_TRUE(&obj1 != obj2_ptr);
+  EXPECT_TRUE(&obj2 != obj1_ptr);
+  EXPECT_FALSE(&obj2 != obj2_ptr);
+}
+
 TEST(RetainPtr, LessThan) {
   PseudoRetainable objs[2];
   RetainPtr<PseudoRetainable> obj1_ptr(&objs[0]);
diff --git a/chromium/third_party/pdfium/core/fxcrt/timerhandler_iface.h b/chromium/third_party/pdfium/core/fxcrt/timerhandler_iface.h
new file mode 100644
index 00000000000..04e781d8559
--- /dev/null
+++ b/chromium/third_party/pdfium/core/fxcrt/timerhandler_iface.h
@@ -0,0 +1,29 @@
+// Copyright 2019 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
+
+#ifndef CORE_FXCRT_TIMERHANDLER_IFACE_H_
+#define CORE_FXCRT_TIMERHANDLER_IFACE_H_
+
+#include "core/fxcrt/fx_system.h"
+
+namespace fxcrt {
+
+class TimerHandlerIface {
+ public:
+  static constexpr int32_t kInvalidTimerID = 0;
+  using TimerCallback = void (*)(int32_t idEvent);
+
+  virtual ~TimerHandlerIface() = default;
+
+  virtual int32_t SetTimer(int32_t uElapse, TimerCallback lpTimerFunc) = 0;
+  virtual void KillTimer(int32_t nTimerID) = 0;
+};
+
+}  // namespace fxcrt
+
+using fxcrt::TimerHandlerIface;
+
+#endif  // CORE_FXCRT_TIMERHANDLER_IFACE_H_
diff --git a/chromium/third_party/pdfium/core/fxcrt/unowned_ptr.h b/chromium/third_party/pdfium/core/fxcrt/unowned_ptr.h
index f7a2354e048..7bbd937cad5 100644
--- a/chromium/third_party/pdfium/core/fxcrt/unowned_ptr.h
+++ b/chromium/third_party/pdfium/core/fxcrt/unowned_ptr.h
@@ -59,16 +59,19 @@ class UnownedPtr {
 
   ~UnownedPtr() { ProbeForLowSeverityLifetimeIssue(); }
 
-  UnownedPtr& operator=(T* that) noexcept {
+  void Reset(T* obj = nullptr) {
     ProbeForLowSeverityLifetimeIssue();
-    m_pObj = that;
+    m_pObj = obj;
+  }
+
+  UnownedPtr& operator=(T* that) noexcept {
+    Reset(that);
     return *this;
   }
 
   UnownedPtr& operator=(const UnownedPtr& that) noexcept {
-    ProbeForLowSeverityLifetimeIssue();
     if (*this != that)
-      m_pObj = that.Get();
+      Reset(that.Get());
     return *this;
   }
 
diff --git a/chromium/third_party/pdfium/core/fxcrt/unowned_ptr_unittest.cpp b/chromium/third_party/pdfium/core/fxcrt/unowned_ptr_unittest.cpp
index 8d3c1b4255d..c12587377b7 100644
--- a/chromium/third_party/pdfium/core/fxcrt/unowned_ptr_unittest.cpp
+++ b/chromium/third_party/pdfium/core/fxcrt/unowned_ptr_unittest.cpp
@@ -26,6 +26,15 @@ void DeleteDangling() {
   }
 }
 
+void ResetDangling() {
+  auto ptr2 = pdfium::MakeUnique<Clink>();
+  {
+    auto ptr1 = pdfium::MakeUnique<Clink>();
+    ptr2->next_.Reset(ptr1.get());
+  }
+  ptr2->next_.Reset();
+}
+
 void AssignDangling() {
   auto ptr2 = pdfium::MakeUnique<Clink>();
   {
@@ -62,6 +71,23 @@ TEST(UnownedPtr, PtrNotOk) {
 #endif
 }
 
+TEST(UnownedPtr, ResetOk) {
+  auto ptr1 = pdfium::MakeUnique<Clink>();
+  {
+    auto ptr2 = pdfium::MakeUnique<Clink>();
+    ptr2->next_.Reset(ptr1.get());
+    ptr2->next_.Reset(nullptr);
+  }
+}
+
+TEST(UnownedPtr, ResetNotOk) {
+#if defined(ADDRESS_SANITIZER)
+  EXPECT_DEATH(ResetDangling(), "");
+#else
+  ResetDangling();
+#endif
+}
+
 TEST(UnownedPtr, AssignOk) {
   auto ptr1 = pdfium::MakeUnique<Clink>();
   {
diff --git a/chromium/third_party/pdfium/core/fxcrt/xml/cfx_xmlparser.h b/chromium/third_party/pdfium/core/fxcrt/xml/cfx_xmlparser.h
index 38866c88b70..87ad9d6014c 100644
--- a/chromium/third_party/pdfium/core/fxcrt/xml/cfx_xmlparser.h
+++ b/chromium/third_party/pdfium/core/fxcrt/xml/cfx_xmlparser.h
@@ -19,12 +19,12 @@ class CFX_XMLElement;
 class CFX_XMLNode;
 class IFX_SeekableReadStream;
 
-class CFX_XMLParser {
+class CFX_XMLParser final {
  public:
   static bool IsXMLNameChar(wchar_t ch, bool bFirstChar);
 
   explicit CFX_XMLParser(const RetainPtr<IFX_SeekableReadStream>& pStream);
-  virtual ~CFX_XMLParser();
+  ~CFX_XMLParser();
 
   std::unique_ptr<CFX_XMLDocument> Parse();
 
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_folderfontinfo.cpp b/chromium/third_party/pdfium/core/fxge/cfx_folderfontinfo.cpp
index af49cee8ee7..f2145a0be41 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_folderfontinfo.cpp
+++ b/chromium/third_party/pdfium/core/fxge/cfx_folderfontinfo.cpp
@@ -327,15 +327,6 @@ void* CFX_FolderFontInfo::MapFont(int weight,
   return nullptr;
 }
 
-#ifdef PDF_ENABLE_XFA
-void* CFX_FolderFontInfo::MapFontByUnicode(uint32_t dwUnicode,
-                                           int weight,
-                                           bool bItalic,
-                                           int pitch_family) {
-  return nullptr;
-}
-#endif  // PDF_ENABLE_XFA
-
 void* CFX_FolderFontInfo::GetFont(const char* face) {
   auto it = m_FontList.find(face);
   return it != m_FontList.end() ? it->second.get() : nullptr;
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_folderfontinfo.h b/chromium/third_party/pdfium/core/fxge/cfx_folderfontinfo.h
index 2781715615a..4fd516d4452 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_folderfontinfo.h
+++ b/chromium/third_party/pdfium/core/fxge/cfx_folderfontinfo.h
@@ -29,12 +29,6 @@ class CFX_FolderFontInfo : public SystemFontInfoIface {
                 int charset,
                 int pitch_family,
                 const char* family) override;
-#ifdef PDF_ENABLE_XFA
-  void* MapFontByUnicode(uint32_t dwUnicode,
-                         int weight,
-                         bool bItalic,
-                         int pitch_family) override;
-#endif  // PDF_ENABLE_XFA
   void* GetFont(const char* face) override;
   uint32_t GetFontData(void* hFont,
                        uint32_t table,
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_font.h b/chromium/third_party/pdfium/core/fxge/cfx_font.h
index d5a4a7e13bd..c7c7932033b 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_font.h
+++ b/chromium/third_party/pdfium/core/fxge/cfx_font.h
@@ -60,6 +60,7 @@ class CFX_Font {
 
 #if !defined(OS_WIN)
   void SetFace(RetainPtr<CFX_Face> face);
+  void SetFontSpan(pdfium::span<uint8_t> pSpan) { m_FontData = pSpan; }
   void SetSubstFont(std::unique_ptr<CFX_SubstFont> subst);
 #endif  // !defined(OS_WIN)
 #endif  // defined(PDF_ENABLE_XFA)
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_pathdata.cpp b/chromium/third_party/pdfium/core/fxge/cfx_pathdata.cpp
index df0ce4d31f7..078a180f890 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_pathdata.cpp
+++ b/chromium/third_party/pdfium/core/fxge/cfx_pathdata.cpp
@@ -30,11 +30,6 @@ bool IsFoldingDiagonalLine(const CFX_PointF& a,
          (a.y - b.y) * (c.x - b.x) == (c.y - b.y) * (a.x - b.x);
 }
 
-bool IsClosedFigure(const FX_PATHPOINT& prev, const FX_PATHPOINT& next) {
-  return prev.m_Type == FXPT_TYPE::MoveTo && next.m_Type == FXPT_TYPE::LineTo &&
-         prev.m_Point == next.m_Point && next.m_CloseFigure;
-}
-
 void UpdateLineEndPoints(CFX_FloatRect* rect,
                          const CFX_PointF& start_pos,
                          const CFX_PointF& end_pos,
@@ -423,12 +418,6 @@ bool CFX_PathData::GetZeroAreaPath(const CFX_Matrix* pMatrix,
       NewPath->AppendPoint(end.m_Point, FXPT_TYPE::LineTo, false);
       continue;
     }
-
-    if (IsClosedFigure(prev, next)) {
-      NewPath->AppendPoint(prev.m_Point, FXPT_TYPE::MoveTo, false);
-      NewPath->AppendPoint(cur.m_Point, FXPT_TYPE::LineTo, false);
-      *bThin = true;
-    }
   }
 
   size_t new_path_size = NewPath->GetPoints().size();
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_renderdevice.cpp b/chromium/third_party/pdfium/core/fxge/cfx_renderdevice.cpp
index 133ebff13d2..b431cc21e1e 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_renderdevice.cpp
+++ b/chromium/third_party/pdfium/core/fxge/cfx_renderdevice.cpp
@@ -481,15 +481,6 @@ bool CFX_RenderDevice::SetClip_PathStroke(
   return true;
 }
 
-#ifdef PDF_ENABLE_XFA
-bool CFX_RenderDevice::SetClip_Rect(const CFX_RectF& rtClip) {
-  return SetClip_Rect(FX_RECT(static_cast<int32_t>(floor(rtClip.left)),
-                              static_cast<int32_t>(floor(rtClip.top)),
-                              static_cast<int32_t>(ceil(rtClip.right())),
-                              static_cast<int32_t>(ceil(rtClip.bottom()))));
-}
-#endif
-
 bool CFX_RenderDevice::SetClip_Rect(const FX_RECT& rect) {
   CFX_PathData path;
   path.AppendRect(rect.left, rect.bottom, rect.right, rect.top);
@@ -840,7 +831,7 @@ bool CFX_RenderDevice::ContinueDIBits(CFX_ImageRenderer* handle,
 
 #ifdef _SKIA_SUPPORT_
 void CFX_RenderDevice::DebugVerifyBitmapIsPreMultiplied() const {
-  SkASSERT(0);
+  NOTREACHED();
 }
 
 bool CFX_RenderDevice::SetBitsWithMask(const RetainPtr<CFX_DIBBase>& pBitmap,
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_renderdevice.h b/chromium/third_party/pdfium/core/fxge/cfx_renderdevice.h
index a20df326608..b8d92217fc3 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_renderdevice.h
+++ b/chromium/third_party/pdfium/core/fxge/cfx_renderdevice.h
@@ -67,13 +67,10 @@ class CFX_RenderDevice {
                               int width,
                               int height) const;
   const FX_RECT& GetClipBox() const { return m_ClipBox; }
+  bool SetClip_Rect(const FX_RECT& pRect);
   bool SetClip_PathFill(const CFX_PathData* pPathData,
                         const CFX_Matrix* pObject2Device,
                         int fill_mode);
-#ifdef PDF_ENABLE_XFA
-  bool SetClip_Rect(const CFX_RectF& rtClip);
-#endif
-  bool SetClip_Rect(const FX_RECT& pRect);
   bool SetClip_PathStroke(const CFX_PathData* pPathData,
                           const CFX_Matrix* pObject2Device,
                           const CFX_GraphStateData* pGraphState);
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_substfont.cpp b/chromium/third_party/pdfium/core/fxge/cfx_substfont.cpp
index 6c5459ede6d..b9936df2af3 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_substfont.cpp
+++ b/chromium/third_party/pdfium/core/fxge/cfx_substfont.cpp
@@ -6,18 +6,6 @@
 
 #include "core/fxge/cfx_substfont.h"
 
-#include "core/fxcrt/fx_codepage.h"
-#include "core/fxge/fx_font.h"
+CFX_SubstFont::CFX_SubstFont() = default;
 
-CFX_SubstFont::CFX_SubstFont()
-    : m_Charset(FX_CHARSET_ANSI),
-      m_Weight(0),
-      m_ItalicAngle(0),
-      m_WeightCJK(0),
-      m_bSubstCJK(false),
-      m_bItalicCJK(false),
-#ifdef PDF_ENABLE_XFA
-      m_bFlagItalic(false),
-#endif  // PDF_ENABLE_XFA
-      m_bFlagMM(false) {
-}
+CFX_SubstFont::~CFX_SubstFont() = default;
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_substfont.h b/chromium/third_party/pdfium/core/fxge/cfx_substfont.h
index e6d93a80a47..c9ffa40f832 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_substfont.h
+++ b/chromium/third_party/pdfium/core/fxge/cfx_substfont.h
@@ -7,24 +7,22 @@
 #ifndef CORE_FXGE_CFX_SUBSTFONT_H_
 #define CORE_FXGE_CFX_SUBSTFONT_H_
 
+#include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_string.h"
 
 class CFX_SubstFont {
  public:
   CFX_SubstFont();
+  ~CFX_SubstFont();
 
   ByteString m_Family;
-  int m_Charset;
-  int m_Weight;
-  int m_ItalicAngle;
-  int m_WeightCJK;
-  bool m_bSubstCJK;
-  bool m_bItalicCJK;
-
-#ifdef PDF_ENABLE_XFA
-  bool m_bFlagItalic;
-#endif  // PDF_ENABLE_XFA
-  bool m_bFlagMM;
+  int m_Charset = FX_CHARSET_ANSI;
+  int m_Weight = 0;
+  int m_ItalicAngle = 0;
+  int m_WeightCJK = 0;
+  bool m_bSubstCJK = false;
+  bool m_bItalicCJK = false;
+  bool m_bFlagMM = false;
 };
 
 #endif  // CORE_FXGE_CFX_SUBSTFONT_H_
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_unicodeencoding.h b/chromium/third_party/pdfium/core/fxge/cfx_unicodeencoding.h
index 338bfba4130..a730dc9d010 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_unicodeencoding.h
+++ b/chromium/third_party/pdfium/core/fxge/cfx_unicodeencoding.h
@@ -11,25 +11,6 @@
 
 #include "core/fxcrt/unowned_ptr.h"
 
-#ifdef PDF_ENABLE_XFA
-#define FXFM_ENC_TAG(a, b, c, d)                                          \
-  (((uint32_t)(a) << 24) | ((uint32_t)(b) << 16) | ((uint32_t)(c) << 8) | \
-   (uint32_t)(d))
-#define FXFM_ENCODING_MS_SYMBOL FXFM_ENC_TAG('s', 'y', 'm', 'b')
-#define FXFM_ENCODING_UNICODE FXFM_ENC_TAG('u', 'n', 'i', 'c')
-#define FXFM_ENCODING_MS_SJIS FXFM_ENC_TAG('s', 'j', 'i', 's')
-#define FXFM_ENCODING_MS_GB2312 FXFM_ENC_TAG('g', 'b', ' ', ' ')
-#define FXFM_ENCODING_MS_BIG5 FXFM_ENC_TAG('b', 'i', 'g', '5')
-#define FXFM_ENCODING_MS_WANSUNG FXFM_ENC_TAG('w', 'a', 'n', 's')
-#define FXFM_ENCODING_MS_JOHAB FXFM_ENC_TAG('j', 'o', 'h', 'a')
-#define FXFM_ENCODING_ADOBE_STANDARD FXFM_ENC_TAG('A', 'D', 'O', 'B')
-#define FXFM_ENCODING_ADOBE_EXPERT FXFM_ENC_TAG('A', 'D', 'B', 'E')
-#define FXFM_ENCODING_ADOBE_CUSTOM FXFM_ENC_TAG('A', 'D', 'B', 'C')
-#define FXFM_ENCODING_ADOBE_LATIN_1 FXFM_ENC_TAG('l', 'a', 't', '1')
-#define FXFM_ENCODING_OLD_LATIN_2 FXFM_ENC_TAG('l', 'a', 't', '2')
-#define FXFM_ENCODING_APPLE_ROMAN FXFM_ENC_TAG('a', 'r', 'm', 'n')
-#endif  // PDF_ENABLE_XFA
-
 class CFX_Font;
 
 class CFX_UnicodeEncoding {
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_unicodeencodingex.cpp b/chromium/third_party/pdfium/core/fxge/cfx_unicodeencodingex.cpp
index 2afbf8f21c4..a2fa24ace48 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_unicodeencodingex.cpp
+++ b/chromium/third_party/pdfium/core/fxge/cfx_unicodeencodingex.cpp
@@ -13,6 +13,23 @@
 #include "core/fxge/fx_freetype.h"
 #include "third_party/base/ptr_util.h"
 
+#define FXFM_ENC_TAG(a, b, c, d)                                          \
+  (((uint32_t)(a) << 24) | ((uint32_t)(b) << 16) | ((uint32_t)(c) << 8) | \
+   (uint32_t)(d))
+#define FXFM_ENCODING_MS_SYMBOL FXFM_ENC_TAG('s', 'y', 'm', 'b')
+#define FXFM_ENCODING_UNICODE FXFM_ENC_TAG('u', 'n', 'i', 'c')
+#define FXFM_ENCODING_MS_SJIS FXFM_ENC_TAG('s', 'j', 'i', 's')
+#define FXFM_ENCODING_MS_GB2312 FXFM_ENC_TAG('g', 'b', ' ', ' ')
+#define FXFM_ENCODING_MS_BIG5 FXFM_ENC_TAG('b', 'i', 'g', '5')
+#define FXFM_ENCODING_MS_WANSUNG FXFM_ENC_TAG('w', 'a', 'n', 's')
+#define FXFM_ENCODING_MS_JOHAB FXFM_ENC_TAG('j', 'o', 'h', 'a')
+#define FXFM_ENCODING_ADOBE_STANDARD FXFM_ENC_TAG('A', 'D', 'O', 'B')
+#define FXFM_ENCODING_ADOBE_EXPERT FXFM_ENC_TAG('A', 'D', 'B', 'E')
+#define FXFM_ENCODING_ADOBE_CUSTOM FXFM_ENC_TAG('A', 'D', 'B', 'C')
+#define FXFM_ENCODING_ADOBE_LATIN_1 FXFM_ENC_TAG('l', 'a', 't', '1')
+#define FXFM_ENCODING_OLD_LATIN_2 FXFM_ENC_TAG('l', 'a', 't', '2')
+#define FXFM_ENCODING_APPLE_ROMAN FXFM_ENC_TAG('a', 'r', 'm', 'n')
+
 namespace {
 
 const uint32_t g_EncodingID[] = {
diff --git a/chromium/third_party/pdfium/core/fxge/cfx_windowsrenderdevice.h b/chromium/third_party/pdfium/core/fxge/cfx_windowsrenderdevice.h
index d2ca8a03cd2..3d96207d389 100644
--- a/chromium/third_party/pdfium/core/fxge/cfx_windowsrenderdevice.h
+++ b/chromium/third_party/pdfium/core/fxge/cfx_windowsrenderdevice.h
@@ -34,7 +34,7 @@ extern PDFiumEnsureTypefaceCharactersAccessible
 #endif
 extern WindowsPrintMode g_pdfium_print_mode;
 
-class CFX_WindowsRenderDevice final : public CFX_RenderDevice {
+class CFX_WindowsRenderDevice : public CFX_RenderDevice {
  public:
   CFX_WindowsRenderDevice(HDC hDC, const EncoderIface* pEncoderIface);
   ~CFX_WindowsRenderDevice() override;
diff --git a/chromium/third_party/pdfium/core/fxge/fx_ge_fontmap.cpp b/chromium/third_party/pdfium/core/fxge/fx_ge_fontmap.cpp
index 74eee2f7325..c99d08dc353 100644
--- a/chromium/third_party/pdfium/core/fxge/fx_ge_fontmap.cpp
+++ b/chromium/third_party/pdfium/core/fxge/fx_ge_fontmap.cpp
@@ -9,15 +9,6 @@
 #include "build/build_config.h"
 #include "core/fxge/systemfontinfo_iface.h"
 
-#ifdef PDF_ENABLE_XFA
-void* SystemFontInfoIface::MapFontByUnicode(uint32_t dwUnicode,
-                                            int weight,
-                                            bool bItalic,
-                                            int pitch_family) {
-  return nullptr;
-}
-#endif  // PDF_ENABLE_XFA
-
 int SystemFontInfoIface::GetFaceIndex(void* hFont) {
   return 0;
 }
diff --git a/chromium/third_party/pdfium/core/fxge/skia/fx_skia_device.cpp b/chromium/third_party/pdfium/core/fxge/skia/fx_skia_device.cpp
index 4169766aaa7..4dea72683d4 100644
--- a/chromium/third_party/pdfium/core/fxge/skia/fx_skia_device.cpp
+++ b/chromium/third_party/pdfium/core/fxge/skia/fx_skia_device.cpp
@@ -272,13 +272,13 @@ void DebugDrawSkiaClipPath(SkCanvas* canvas, const SkPath& path) {}
 static void DebugValidate(const RetainPtr<CFX_DIBitmap>& bitmap,
                           const RetainPtr<CFX_DIBitmap>& device) {
   if (bitmap) {
-    SkASSERT(bitmap->GetBPP() == 8 || bitmap->GetBPP() == 32);
+    ASSERT(bitmap->GetBPP() == 8 || bitmap->GetBPP() == 32);
     if (bitmap->GetBPP() == 32) {
       bitmap->DebugVerifyBitmapIsPreMultiplied(nullptr);
     }
   }
   if (device) {
-    SkASSERT(device->GetBPP() == 8 || device->GetBPP() == 32);
+    ASSERT(device->GetBPP() == 8 || device->GetBPP() == 32);
     if (device->GetBPP() == 32) {
       device->DebugVerifyBitmapIsPreMultiplied(nullptr);
     }
@@ -416,7 +416,7 @@ bool AddColors(const CPDF_ExpIntFunc* pFunc,
 }
 
 uint8_t FloatToByte(float f) {
-  ASSERT(0 <= f);
+  ASSERT(f >= 0);
   ASSERT(f <= 1);
   return (uint8_t)(f * 255.99f);
 }
@@ -699,7 +699,7 @@ bool Upsample(const RetainPtr<CFX_DIBBase>& pSource,
       pSource->DebugVerifyBitmapIsPreMultiplied(buffer);
       break;
     default:
-      SkASSERT(0);  // TODO(caryclark) ensure that all cases are covered
+      NOTREACHED();  // TODO(bug_11) ensure that all cases are covered
       colorType = SkColorType::kUnknown_SkColorType;
   }
   SkImageInfo imageInfo =
@@ -878,6 +878,7 @@ class SkiaState {
     if (Accumulator::kText != m_type) {
       m_positions.setCount(0);
       m_glyphs.setCount(0);
+      m_rsxform.setCount(0);
       if (pFont->GetFaceRec())
         m_pTypeFace.reset(SkSafeRef(pFont->GetDeviceCache()));
       else
@@ -1031,7 +1032,7 @@ class SkiaState {
     while (m_clipIndex > m_commandIndex) {
       do {
         --m_clipIndex;
-        SkASSERT(m_clipIndex >= 0);
+        ASSERT(m_clipIndex >= 0);
       } while (m_commands[m_clipIndex] != Clip::kSave);
       m_pDriver->SkiaCanvas()->restore();
     }
@@ -1113,7 +1114,7 @@ class SkiaState {
       return false;
     Dump(__func__);
     while (Clip::kSave != m_commands[--m_commandIndex]) {
-      SkASSERT(m_commandIndex > 0);
+      ASSERT(m_commandIndex > 0);
     }
     return true;
   }
@@ -1179,7 +1180,7 @@ class SkiaState {
     while (m_clipIndex > limit) {
       do {
         --m_clipIndex;
-        SkASSERT(m_clipIndex >= 0);
+        ASSERT(m_clipIndex >= 0);
       } while (m_commands[m_clipIndex] != Clip::kSave);
       m_pDriver->SkiaCanvas()->restore();
     }
@@ -1187,7 +1188,7 @@ class SkiaState {
       if (Clip::kSave == m_commands[m_clipIndex]) {
         m_pDriver->SkiaCanvas()->save();
       } else {
-        SkASSERT(Clip::kPath == m_commands[m_clipIndex]);
+        ASSERT(Clip::kPath == m_commands[m_clipIndex]);
         m_pDriver->SkiaCanvas()->clipPath(m_clips[m_clipIndex],
                                           SkClipOp::kIntersect, true);
       }
@@ -1277,10 +1278,10 @@ class SkiaState {
     DumpEndPrefix();
     int skCanvasSaveCount = m_pDriver->SkiaCanvas()->getSaveCount();
     int cacheSaveCount = 1;
-    SkASSERT(m_clipIndex <= m_commands.count());
+    ASSERT(m_clipIndex <= m_commands.count());
     for (int index = 0; index < m_clipIndex; ++index)
       cacheSaveCount += Clip::kSave == m_commands[index];
-    SkASSERT(skCanvasSaveCount == cacheSaveCount);
+    ASSERT(skCanvasSaveCount == cacheSaveCount);
 #endif  // SHOW_SKIA_PATH
   }
 
@@ -1337,7 +1338,7 @@ class SkiaState {
       return;
     int aggSaveCount = AggSaveCount(m_pDriver);
     int cacheSaveCount = CacheSaveCount(m_commands, m_commandIndex);
-    SkASSERT(m_clipIndex <= m_commands.count());
+    ASSERT(m_clipIndex <= m_commands.count());
     if (aggSaveCount != cacheSaveCount) {
       // may not signify a bug if counts don't match
       printf("aggSaveCount %d != cacheSaveCount %d\n", aggSaveCount,
@@ -1369,7 +1370,7 @@ class SkiaState {
       }
       if (!foundMatch) {
         DumpClipStacks();
-        SkASSERT(0);
+        NOTREACHED();
       }
     }
 #endif  // SHOW_SKIA_PATH
@@ -1539,7 +1540,7 @@ CFX_SkiaDeviceDriver::CFX_SkiaDeviceDriver(
 #endif  // _SKIA_SUPPORT_PATHS_
       m_bGroupKnockout(bGroupKnockout) {
   SkBitmap skBitmap;
-  SkASSERT(pBitmap->GetBPP() == 8 || pBitmap->GetBPP() == 32);
+  ASSERT(pBitmap->GetBPP() == 8 || pBitmap->GetBPP() == 32);
   SkImageInfo imageInfo = SkImageInfo::Make(
       pBitmap->GetWidth(), pBitmap->GetHeight(),
       pBitmap->GetBPP() == 8 ? kAlpha_8_SkColorType : kN32_SkColorType,
@@ -1675,8 +1676,9 @@ bool CFX_SkiaDeviceDriver::DrawDeviceText(int nChars,
         if (0 == cp.m_AdjustMatrix[1] && 0 == cp.m_AdjustMatrix[2] &&
             1 == cp.m_AdjustMatrix[3]) {
           font.setScaleX(cp.m_AdjustMatrix[0]);
-          auto blob = SkTextBlob::MakeFromText(&glyphs[index], 1, font,
-                                               SkTextEncoding::kGlyphID);
+          auto blob =
+              SkTextBlob::MakeFromText(&glyphs[index], sizeof(glyphs[index]),
+                                       font, SkTextEncoding::kGlyphID);
           m_pCanvas->drawTextBlob(blob, positions[index].fX,
                                   positions[index].fY, paint);
           font.setScaleX(1);
@@ -1690,13 +1692,15 @@ bool CFX_SkiaDeviceDriver::DrawDeviceText(int nChars,
           adjust.setScaleY(cp.m_AdjustMatrix[3]);
           adjust.preTranslate(positions[index].fX, positions[index].fY);
           m_pCanvas->concat(adjust);
-          auto blob = SkTextBlob::MakeFromText(&glyphs[index], 1, font,
-                                               SkTextEncoding::kGlyphID);
+          auto blob =
+              SkTextBlob::MakeFromText(&glyphs[index], sizeof(glyphs[index]),
+                                       font, SkTextEncoding::kGlyphID);
           m_pCanvas->drawTextBlob(blob, 0, 0, paint);
         }
       } else {
-        auto blob = SkTextBlob::MakeFromText(&glyphs[index], 1, font,
-                                             SkTextEncoding::kGlyphID);
+        auto blob =
+            SkTextBlob::MakeFromText(&glyphs[index], sizeof(glyphs[index]),
+                                     font, SkTextEncoding::kGlyphID);
         m_pCanvas->drawTextBlob(blob, positions[index].fX, positions[index].fY,
                                 paint);
       }
@@ -2244,9 +2248,8 @@ bool CFX_SkiaDeviceDriver::GetDIBits(const RetainPtr<CFX_DIBitmap>& pBitmap,
       srcWidth, srcHeight, SkColorType::kN32_SkColorType, kPremul_SkAlphaType);
   SkBitmap skSrcBitmap;
   skSrcBitmap.installPixels(srcImageInfo, srcBuffer, srcRowBytes);
-  SkASSERT(pBitmap);
   uint8_t* dstBuffer = pBitmap->GetBuffer();
-  SkASSERT(dstBuffer);
+  ASSERT(dstBuffer);
   int dstWidth = pBitmap->GetWidth();
   int dstHeight = pBitmap->GetHeight();
   int dstRowBytes = dstWidth * sizeof(uint32_t);
@@ -2672,7 +2675,7 @@ bool CFX_DefaultRenderDevice::SetBitsWithMask(
 
 void CFX_DIBBase::DebugVerifyBitmapIsPreMultiplied(void* opt) const {
 #ifdef SK_DEBUG
-  SkASSERT(32 == GetBPP());
+  ASSERT(GetBPP() == 32);
   const uint32_t* buffer = (const uint32_t*)(opt ? opt : GetBuffer());
   int width = GetWidth();
   int height = GetHeight();
@@ -2685,9 +2688,9 @@ void CFX_DIBBase::DebugVerifyBitmapIsPreMultiplied(void* opt) const {
       uint8_t g = SkGetPackedG32(srcRow[x]);
       uint8_t b = SkGetPackedB32(srcRow[x]);
       SkA32Assert(a);
-      SkASSERT(r <= a);
-      SkASSERT(g <= a);
-      SkASSERT(b <= a);
+      ASSERT(r <= a);
+      ASSERT(g <= a);
+      ASSERT(b <= a);
     }
   }
 #endif  // SK_DEBUG
diff --git a/chromium/third_party/pdfium/core/fxge/skia/fx_skia_device_embeddertest.cpp b/chromium/third_party/pdfium/core/fxge/skia/fx_skia_device_embeddertest.cpp
index 588cb96ce8b..d5065552fed 100644
--- a/chromium/third_party/pdfium/core/fxge/skia/fx_skia_device_embeddertest.cpp
+++ b/chromium/third_party/pdfium/core/fxge/skia/fx_skia_device_embeddertest.cpp
@@ -10,6 +10,7 @@
 #include "core/fxge/skia/fx_skia_device.h"
 #include "core/fxge/text_char_pos.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
+#include "public/cpp/fpdf_scopers.h"
 #include "public/fpdfview.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/skia/include/core/SkPictureRecorder.h"
@@ -118,18 +119,15 @@ void OutOfSequenceClipTest(CFX_SkiaDeviceDriver* driver, const State&) {
 
 void Harness(void (*Test)(CFX_SkiaDeviceDriver*, const State&),
              const State& state) {
-  int h = 1;
-  int w = 4;
-  FPDF_BITMAP bitmap = FPDFBitmap_Create(w, h, 1);
-  EXPECT_NE(nullptr, bitmap);
-  if (!bitmap)
-    return;
-  FPDFBitmap_FillRect(bitmap, 0, 0, w, h, 0x00000000);
-  CFX_DefaultRenderDevice geDevice;
-  RetainPtr<CFX_DIBitmap> pBitmap(CFXDIBitmapFromFPDFBitmap(bitmap));
-  geDevice.Attach(pBitmap, false, nullptr, false);
-  CFX_SkiaDeviceDriver* driver =
-      static_cast<CFX_SkiaDeviceDriver*>(geDevice.GetDeviceDriver());
+  constexpr int kWidth = 4;
+  constexpr int kHeight = 1;
+  ScopedFPDFBitmap bitmap(FPDFBitmap_Create(kWidth, kHeight, 1));
+  ASSERT_TRUE(bitmap);
+  FPDFBitmap_FillRect(bitmap.get(), 0, 0, kWidth, kHeight, 0x00000000);
+  CFX_DefaultRenderDevice device;
+  RetainPtr<CFX_DIBitmap> pBitmap(CFXDIBitmapFromFPDFBitmap(bitmap.get()));
+  device.Attach(pBitmap, false, nullptr, false);
+  auto* driver = static_cast<CFX_SkiaDeviceDriver*>(device.GetDeviceDriver());
   (*Test)(driver, state);
   driver->Flush();
   uint32_t pixel = pBitmap->GetPixel(0, 0);
diff --git a/chromium/third_party/pdfium/core/fxge/systemfontinfo_iface.h b/chromium/third_party/pdfium/core/fxge/systemfontinfo_iface.h
index 520d7371145..d5d84c32471 100644
--- a/chromium/third_party/pdfium/core/fxge/systemfontinfo_iface.h
+++ b/chromium/third_party/pdfium/core/fxge/systemfontinfo_iface.h
@@ -28,14 +28,6 @@ class SystemFontInfoIface {
                         int charset,
                         int pitch_family,
                         const char* face) = 0;
-
-#ifdef PDF_ENABLE_XFA
-  virtual void* MapFontByUnicode(uint32_t dwUnicode,
-                                 int weight,
-                                 bool bItalic,
-                                 int pitch_family);
-#endif  // PDF_ENABLE_XFA
-
   virtual void* GetFont(const char* face) = 0;
   virtual uint32_t GetFontData(void* hFont,
                                uint32_t table,
diff --git a/chromium/third_party/pdfium/fpdfsdk/BUILD.gn b/chromium/third_party/pdfium/fpdfsdk/BUILD.gn
index 0badb3ca5b9..e8d5774fec3 100644
--- a/chromium/third_party/pdfium/fpdfsdk/BUILD.gn
+++ b/chromium/third_party/pdfium/fpdfsdk/BUILD.gn
@@ -8,10 +8,6 @@ import("../testing/test.gni")
 
 jumbo_source_set("fpdfsdk") {
   sources = [
-    "cfx_systemhandler.cpp",
-    "cfx_systemhandler.h",
-    "cpdf_annotcontext.cpp",
-    "cpdf_annotcontext.h",
     "cpdfsdk_actionhandler.cpp",
     "cpdfsdk_actionhandler.h",
     "cpdfsdk_annot.cpp",
@@ -22,6 +18,8 @@ jumbo_source_set("fpdfsdk") {
     "cpdfsdk_annotiteration.h",
     "cpdfsdk_annotiterator.cpp",
     "cpdfsdk_annotiterator.h",
+    "cpdfsdk_appstream.cpp",
+    "cpdfsdk_appstream.h",
     "cpdfsdk_baannot.cpp",
     "cpdfsdk_baannot.h",
     "cpdfsdk_baannothandler.cpp",
@@ -40,6 +38,8 @@ jumbo_source_set("fpdfsdk") {
     "cpdfsdk_interactiveform.h",
     "cpdfsdk_pageview.cpp",
     "cpdfsdk_pageview.h",
+    "cpdfsdk_pauseadapter.cpp",
+    "cpdfsdk_pauseadapter.h",
     "cpdfsdk_widget.cpp",
     "cpdfsdk_widget.h",
     "cpdfsdk_widgethandler.cpp",
@@ -56,6 +56,7 @@ jumbo_source_set("fpdfsdk") {
     "fpdf_ext.cpp",
     "fpdf_flatten.cpp",
     "fpdf_formfill.cpp",
+    "fpdf_javascript.cpp",
     "fpdf_ppo.cpp",
     "fpdf_progressive.cpp",
     "fpdf_save.cpp",
@@ -67,8 +68,6 @@ jumbo_source_set("fpdfsdk") {
     "fpdf_transformpage.cpp",
     "fpdf_view.cpp",
     "ipdfsdk_annothandler.h",
-    "ipdfsdk_pauseadapter.cpp",
-    "ipdfsdk_pauseadapter.h",
   ]
 
   configs += [ "../:pdfium_core_config" ]
@@ -76,7 +75,6 @@ jumbo_source_set("fpdfsdk") {
     "../:pdfium_public_headers",
     "../constants",
     "../core/fdrm",
-    "../core/fpdfapi",
     "../core/fpdfapi/edit",
     "../core/fpdfapi/font",
     "../core/fpdfapi/page",
@@ -84,7 +82,6 @@ jumbo_source_set("fpdfsdk") {
     "../core/fpdfapi/render",
     "../core/fpdfdoc",
     "../core/fpdftext",
-    "../core/fxcodec",
     "../core/fxcrt",
     "../core/fxge",
     "../fxjs",
@@ -94,24 +91,14 @@ jumbo_source_set("fpdfsdk") {
   allow_circular_includes_from = [
     "../fxjs",
     "formfiller",
-    "pwl",
   ]
   visibility = [ "../*" ]
 
   if (pdf_enable_xfa) {
-    sources += [
-      "cpdfsdk_xfawidget.cpp",
-      "cpdfsdk_xfawidget.h",
-      "cpdfsdk_xfawidgethandler.cpp",
-      "cpdfsdk_xfawidgethandler.h",
-    ]
-
     deps += [
       "../fxbarcode",
-      "../xfa/fwl",
       "../xfa/fxfa",
       "../xfa/fxfa/parser",
-      "../xfa/fxgraphics",
       "fpdfxfa",
     ]
     allow_circular_includes_from += [ "fpdfxfa" ]
@@ -128,7 +115,6 @@ pdfium_unittest_source_set("unittests") {
   deps = [
     ":fpdfsdk",
     "../:pdfium_public_headers",
-    "../core/fpdfapi",
     "../core/fpdfapi/page",
     "../core/fpdfapi/parser",
     "../core/fpdfapi/render",
@@ -150,6 +136,7 @@ pdfium_embeddertest_source_set("embeddertests") {
     "fpdf_ext_embeddertest.cpp",
     "fpdf_flatten_embeddertest.cpp",
     "fpdf_formfill_embeddertest.cpp",
+    "fpdf_javascript_embeddertest.cpp",
     "fpdf_ppo_embeddertest.cpp",
     "fpdf_save_embeddertest.cpp",
     "fpdf_searchex_embeddertest.cpp",
diff --git a/chromium/third_party/pdfium/fpdfsdk/cfx_systemhandler.cpp b/chromium/third_party/pdfium/fpdfsdk/cfx_systemhandler.cpp
deleted file mode 100644
index 683369398f7..00000000000
--- a/chromium/third_party/pdfium/fpdfsdk/cfx_systemhandler.cpp
+++ /dev/null
@@ -1,77 +0,0 @@
-// Copyright 2016 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#include "fpdfsdk/cfx_systemhandler.h"
-
-#include <memory>
-
-#include "core/fpdfapi/parser/cpdf_document.h"
-#include "core/fxcrt/fx_codepage.h"
-#include "core/fxge/cfx_gemodule.h"
-#include "fpdfsdk/cpdfsdk_annot.h"
-#include "fpdfsdk/cpdfsdk_formfillenvironment.h"
-#include "fpdfsdk/cpdfsdk_pageview.h"
-#include "fpdfsdk/cpdfsdk_widget.h"
-#include "fpdfsdk/formfiller/cffl_formfiller.h"
-#include "third_party/base/ptr_util.h"
-
-CFX_SystemHandler::CFX_SystemHandler(CPDFSDK_FormFillEnvironment* pFormFillEnv)
-    : m_pFormFillEnv(pFormFillEnv) {
-  ASSERT(m_pFormFillEnv);
-}
-
-CFX_SystemHandler::~CFX_SystemHandler() = default;
-
-void CFX_SystemHandler::InvalidateRect(CPDFSDK_Widget* widget,
-                                       const CFX_FloatRect& rect) {
-  CPDFSDK_PageView* pPageView = widget->GetPageView();
-  IPDF_Page* pPage = widget->GetPage();
-  if (!pPage || !pPageView)
-    return;
-
-  CFX_Matrix device2page = pPageView->GetCurrentMatrix().GetInverse();
-  CFX_PointF left_top = device2page.Transform(CFX_PointF(rect.left, rect.top));
-  CFX_PointF right_bottom =
-      device2page.Transform(CFX_PointF(rect.right, rect.bottom));
-
-  CFX_FloatRect rcPDF(left_top.x, right_bottom.y, right_bottom.x, left_top.y);
-  rcPDF.Normalize();
-  m_pFormFillEnv->Invalidate(pPage, rcPDF.GetOuterRect());
-}
-
-void CFX_SystemHandler::OutputSelectedRect(CFFL_FormFiller* pFormFiller,
-                                           const CFX_FloatRect& rect) {
-  if (!pFormFiller)
-    return;
-
-  CFX_PointF ptA = pFormFiller->PWLtoFFL(CFX_PointF(rect.left, rect.bottom));
-  CFX_PointF ptB = pFormFiller->PWLtoFFL(CFX_PointF(rect.right, rect.top));
-
-  CPDFSDK_Annot* pAnnot = pFormFiller->GetSDKAnnot();
-  IPDF_Page* pPage = pAnnot->GetPage();
-  ASSERT(pPage);
-
-  m_pFormFillEnv->OutputSelectedRect(pPage,
-                                     CFX_FloatRect(ptA.x, ptA.y, ptB.x, ptB.y));
-}
-
-bool CFX_SystemHandler::IsSelectionImplemented() const {
-  FPDF_FORMFILLINFO* pInfo = m_pFormFillEnv->GetFormFillInfo();
-  return pInfo && pInfo->FFI_OutputSelectedRect;
-}
-
-void CFX_SystemHandler::SetCursor(int32_t nCursorType) {
-  m_pFormFillEnv->SetCursor(nCursorType);
-}
-
-int32_t CFX_SystemHandler::SetTimer(int32_t uElapse,
-                                    TimerCallback lpTimerFunc) {
-  return m_pFormFillEnv->SetTimer(uElapse, lpTimerFunc);
-}
-
-void CFX_SystemHandler::KillTimer(int32_t nID) {
-  m_pFormFillEnv->KillTimer(nID);
-}
diff --git a/chromium/third_party/pdfium/fpdfsdk/cfx_systemhandler.h b/chromium/third_party/pdfium/fpdfsdk/cfx_systemhandler.h
deleted file mode 100644
index 49297cde6c8..00000000000
--- a/chromium/third_party/pdfium/fpdfsdk/cfx_systemhandler.h
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright 2016 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef FPDFSDK_CFX_SYSTEMHANDLER_H_
-#define FPDFSDK_CFX_SYSTEMHANDLER_H_
-
-#include "core/fxcrt/fx_coordinates.h"
-#include "core/fxcrt/fx_string.h"
-#include "core/fxcrt/fx_system.h"
-#include "core/fxcrt/unowned_ptr.h"
-
-class CFFL_FormFiller;
-class CPDF_Document;
-class CPDFSDK_FormFillEnvironment;
-class CPDFSDK_Widget;
-
-class CFX_SystemHandler {
- public:
-  static constexpr int32_t kInvalidTimerID = 0;
-  using TimerCallback = void (*)(int32_t idEvent);
-
-  explicit CFX_SystemHandler(CPDFSDK_FormFillEnvironment* pFormFillEnv);
-  ~CFX_SystemHandler();
-
-  void InvalidateRect(CPDFSDK_Widget* widget, const CFX_FloatRect& rect);
-  void OutputSelectedRect(CFFL_FormFiller* pFormFiller,
-                          const CFX_FloatRect& rect);
-  bool IsSelectionImplemented() const;
-  void SetCursor(int32_t nCursorType);
-  int32_t SetTimer(int32_t uElapse, TimerCallback lpTimerFunc);
-  void KillTimer(int32_t nID);
-
- private:
-  UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
-};
-
-#endif  // FPDFSDK_CFX_SYSTEMHANDLER_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annot.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annot.cpp
index b60e05b539b..d6712d09bde 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annot.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annot.cpp
@@ -10,10 +10,6 @@
 
 #include "fpdfsdk/cpdfsdk_pageview.h"
 
-#ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#endif  // PDF_ENABLE_XFA
-
 CPDFSDK_Annot::CPDFSDK_Annot(CPDFSDK_PageView* pPageView)
     : m_pPageView(pPageView) {}
 
@@ -23,22 +19,18 @@ CPDFSDK_BAAnnot* CPDFSDK_Annot::AsBAAnnot() {
   return nullptr;
 }
 
-#ifdef PDF_ENABLE_XFA
-
-bool CPDFSDK_Annot::IsXFAField() const {
-  return false;
-}
-
-CXFA_FFWidget* CPDFSDK_Annot::GetXFAWidget() const {
+CPDFXFA_Widget* CPDFSDK_Annot::AsXFAWidget() {
   return nullptr;
 }
 
-CPDFXFA_Page* CPDFSDK_Annot::GetPDFXFAPage() {
-  return m_pPageView ? m_pPageView->GetPDFXFAPage() : nullptr;
+IPDF_Page* CPDFSDK_Annot::GetXFAPage() {
+#ifdef PDF_ENABLE_XFA
+  if (m_pPageView)
+    return m_pPageView->GetXFAPage();
+#endif
+  return nullptr;
 }
 
-#endif  // PDF_ENABLE_XFA
-
 int CPDFSDK_Annot::GetLayoutOrder() const {
   return 5;
 }
@@ -63,7 +55,7 @@ CFX_FloatRect CPDFSDK_Annot::GetRect() const {
 
 IPDF_Page* CPDFSDK_Annot::GetPage() {
 #ifdef PDF_ENABLE_XFA
-  CPDFXFA_Page* pXFAPage = GetPDFXFAPage();
+  IPDF_Page* pXFAPage = GetXFAPage();
   if (pXFAPage)
     return pXFAPage;
 #endif  // PDF_ENABLE_XFA
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annot.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annot.h
index 324724853e3..e722de180d5 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annot.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annot.h
@@ -12,7 +12,6 @@
 #include "core/fpdfdoc/cpdf_defaultappearance.h"
 #include "core/fxcrt/observed_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
-#include "fpdfsdk/cfx_systemhandler.h"
 
 class CFX_Matrix;
 class CFX_RenderDevice;
@@ -20,24 +19,16 @@ class CPDF_Page;
 class CPDF_RenderOptions;
 class CPDFSDK_BAAnnot;
 class CPDFSDK_PageView;
-class CPDFXFA_Page;
+class CPDFXFA_Widget;
 class IPDF_Page;
 
-#ifdef PDF_ENABLE_XFA
-class CXFA_FFWidget;
-#endif  // PDF_ENABLE_XFA
-
 class CPDFSDK_Annot : public Observable {
  public:
   explicit CPDFSDK_Annot(CPDFSDK_PageView* pPageView);
   virtual ~CPDFSDK_Annot();
 
   virtual CPDFSDK_BAAnnot* AsBAAnnot();
-
-#ifdef PDF_ENABLE_XFA
-  virtual bool IsXFAField() const;
-  virtual CXFA_FFWidget* GetXFAWidget() const;
-#endif  // PDF_ENABLE_XFA
+  virtual CPDFXFA_Widget* AsXFAWidget();
 
   virtual int GetLayoutOrder() const;
   virtual CPDF_Annot* GetPDFAnnot() const;
@@ -46,11 +37,10 @@ class CPDFSDK_Annot : public Observable {
   virtual CFX_FloatRect GetRect() const;
   virtual void SetRect(const CFX_FloatRect& rect);
 
-  IPDF_Page* GetPage();  // Returns XFA Page if possible, else PDF page.
-  CPDF_Page* GetPDFPage();
-#ifdef PDF_ENABLE_XFA
-  CPDFXFA_Page* GetPDFXFAPage();
-#endif  // PDF_ENABLE_XFA
+  // Three cases: PDF page only, XFA page only, or XFA page backed by PDF page.
+  IPDF_Page* GetPage();     // Returns XFA Page if possible, else PDF page.
+  CPDF_Page* GetPDFPage();  // Returns PDF page or nullptr.
+  IPDF_Page* GetXFAPage();  // Returns XFA page or nullptr.
 
   CPDFSDK_PageView* GetPageView() const { return m_pPageView.Get(); }
 
@@ -62,4 +52,8 @@ inline CPDFSDK_BAAnnot* ToBAAnnot(CPDFSDK_Annot* pAnnot) {
   return pAnnot ? pAnnot->AsBAAnnot() : nullptr;
 }
 
+inline CPDFXFA_Widget* ToXFAWidget(CPDFSDK_Annot* pAnnot) {
+  return pAnnot ? pAnnot->AsXFAWidget() : nullptr;
+}
+
 #endif  // FPDFSDK_CPDFSDK_ANNOT_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annothandlermgr.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annothandlermgr.cpp
index a16aeba30e3..b077532e5cb 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annothandlermgr.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annothandlermgr.cpp
@@ -19,44 +19,52 @@
 #include "fpdfsdk/cpdfsdk_pageview.h"
 #include "fpdfsdk/cpdfsdk_widget.h"
 #include "fpdfsdk/cpdfsdk_widgethandler.h"
+#include "fpdfsdk/pwl/cpwl_wnd.h"
 #include "public/fpdf_fwlevent.h"
 #include "third_party/base/ptr_util.h"
 
 #ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/cpdfsdk_xfawidgethandler.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_page.h"
-#include "xfa/fxfa/cxfa_ffpageview.h"
-#include "xfa/fxfa/cxfa_ffwidget.h"
+#include "fpdfsdk/fpdfxfa/cpdfxfa_widget.h"
+#include "fpdfsdk/fpdfxfa/cpdfxfa_widgethandler.h"
 #endif  // PDF_ENABLE_XFA
 
 CPDFSDK_AnnotHandlerMgr::CPDFSDK_AnnotHandlerMgr(
-    CPDFSDK_FormFillEnvironment* pFormFillEnv)
-    : m_pBAAnnotHandler(pdfium::MakeUnique<CPDFSDK_BAAnnotHandler>()),
-      m_pWidgetHandler(pdfium::MakeUnique<CPDFSDK_WidgetHandler>(pFormFillEnv))
-#ifdef PDF_ENABLE_XFA
-      ,
-      m_pXFAWidgetHandler(
-          pdfium::MakeUnique<CPDFSDK_XFAWidgetHandler>(pFormFillEnv))
-#endif  // PDF_ENABLE_XFA
-{
+    std::unique_ptr<CPDFSDK_BAAnnotHandler> pBAAnnotHandler,
+    std::unique_ptr<CPDFSDK_WidgetHandler> pWidgetHandler,
+    std::unique_ptr<IPDFSDK_AnnotHandler> pXFAWidgetHandler)
+    : m_pBAAnnotHandler(std::move(pBAAnnotHandler)),
+      m_pWidgetHandler(std::move(pWidgetHandler)),
+      m_pXFAWidgetHandler(std::move(pXFAWidgetHandler)) {
+  ASSERT(m_pBAAnnotHandler);
+  ASSERT(m_pWidgetHandler);
 }
 
-CPDFSDK_AnnotHandlerMgr::~CPDFSDK_AnnotHandlerMgr() {}
+CPDFSDK_AnnotHandlerMgr::~CPDFSDK_AnnotHandlerMgr() = default;
+
+void CPDFSDK_AnnotHandlerMgr::SetFormFillEnv(
+    CPDFSDK_FormFillEnvironment* pFormFillEnv) {
+  m_pBAAnnotHandler->SetFormFillEnvironment(pFormFillEnv);
+  m_pWidgetHandler->SetFormFillEnvironment(pFormFillEnv);
+  if (m_pXFAWidgetHandler)
+    m_pXFAWidgetHandler->SetFormFillEnvironment(pFormFillEnv);
+}
 
 CPDFSDK_Annot* CPDFSDK_AnnotHandlerMgr::NewAnnot(CPDF_Annot* pAnnot,
                                                  CPDFSDK_PageView* pPageView) {
   ASSERT(pPageView);
-  return GetAnnotHandler(pAnnot->GetSubtype())->NewAnnot(pAnnot, pPageView);
+  return GetAnnotHandlerOfType(pAnnot->GetSubtype())
+      ->NewAnnot(pAnnot, pPageView);
 }
 
 #ifdef PDF_ENABLE_XFA
-CPDFSDK_Annot* CPDFSDK_AnnotHandlerMgr::NewAnnot(CXFA_FFWidget* pAnnot,
-                                                 CPDFSDK_PageView* pPageView) {
+CPDFSDK_Annot* CPDFSDK_AnnotHandlerMgr::NewXFAAnnot(
+    CXFA_FFWidget* pAnnot,
+    CPDFSDK_PageView* pPageView) {
   ASSERT(pAnnot);
   ASSERT(pPageView);
-
-  return GetAnnotHandler(CPDF_Annot::Subtype::XFAWIDGET)
-      ->NewAnnot(pAnnot, pPageView);
+  return static_cast<CPDFXFA_WidgetHandler*>(m_pXFAWidgetHandler.get())
+      ->NewAnnotForXFA(pAnnot, pPageView);
 }
 #endif  // PDF_ENABLE_XFA
 
@@ -103,10 +111,10 @@ bool CPDFSDK_AnnotHandlerMgr::Annot_Redo(CPDFSDK_Annot* pAnnot) {
 
 IPDFSDK_AnnotHandler* CPDFSDK_AnnotHandlerMgr::GetAnnotHandler(
     CPDFSDK_Annot* pAnnot) const {
-  return GetAnnotHandler(pAnnot->GetAnnotSubtype());
+  return GetAnnotHandlerOfType(pAnnot->GetAnnotSubtype());
 }
 
-IPDFSDK_AnnotHandler* CPDFSDK_AnnotHandlerMgr::GetAnnotHandler(
+IPDFSDK_AnnotHandler* CPDFSDK_AnnotHandlerMgr::GetAnnotHandlerOfType(
     CPDF_Annot::Subtype nAnnotSubtype) const {
   if (nAnnotSubtype == CPDF_Annot::Subtype::WIDGET)
     return m_pWidgetHandler.get();
@@ -225,22 +233,25 @@ bool CPDFSDK_AnnotHandlerMgr::Annot_OnChar(CPDFSDK_Annot* pAnnot,
 bool CPDFSDK_AnnotHandlerMgr::Annot_OnKeyDown(CPDFSDK_Annot* pAnnot,
                                               int nKeyCode,
                                               int nFlag) {
-  if (CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag) ||
-      CPDFSDK_FormFillEnvironment::IsALTKeyDown(nFlag)) {
+  if (CPWL_Wnd::IsCTRLKeyDown(nFlag) || CPWL_Wnd::IsALTKeyDown(nFlag)) {
     return GetAnnotHandler(pAnnot)->OnKeyDown(pAnnot, nKeyCode, nFlag);
   }
-
+  ObservedPtr<CPDFSDK_Annot> pObservedAnnot(pAnnot);
   CPDFSDK_PageView* pPage = pAnnot->GetPageView();
   CPDFSDK_Annot* pFocusAnnot = pPage->GetFocusAnnot();
   if (pFocusAnnot && (nKeyCode == FWL_VKEY_Tab)) {
-    ObservedPtr<CPDFSDK_Annot> pNext(GetNextAnnot(
-        pFocusAnnot, !CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag)));
+    ObservedPtr<CPDFSDK_Annot> pNext(
+        GetNextAnnot(pFocusAnnot, !CPWL_Wnd::IsSHIFTKeyDown(nFlag)));
     if (pNext && pNext.Get() != pFocusAnnot) {
       pPage->GetFormFillEnv()->SetFocusAnnot(&pNext);
       return true;
     }
   }
 
+  // Check |pAnnot| again because JS may have destroyed it in |GetNextAnnot|
+  if (!pObservedAnnot)
+    return false;
+
   return GetAnnotHandler(pAnnot)->OnKeyDown(pAnnot, nKeyCode, nFlag);
 }
 
@@ -276,16 +287,13 @@ bool CPDFSDK_AnnotHandlerMgr::Annot_IsIndexSelected(
 bool CPDFSDK_AnnotHandlerMgr::Annot_OnChangeFocus(
     ObservedPtr<CPDFSDK_Annot>* pSetAnnot,
     ObservedPtr<CPDFSDK_Annot>* pKillAnnot) {
-  bool bXFA = (*pSetAnnot && (*pSetAnnot)->GetXFAWidget()) ||
-              (*pKillAnnot && (*pKillAnnot)->GetXFAWidget());
-
-  if (bXFA) {
-    if (IPDFSDK_AnnotHandler* pXFAAnnotHandler =
-            GetAnnotHandler(CPDF_Annot::Subtype::XFAWIDGET))
-      return pXFAAnnotHandler->OnXFAChangedFocus(pKillAnnot, pSetAnnot);
-  }
+  CPDFXFA_Widget* pSetXFAWidget = ToXFAWidget(pSetAnnot->Get());
+  CPDFXFA_Widget* pKillXFAWidget = ToXFAWidget(pKillAnnot->Get());
+  bool bXFA = (pSetXFAWidget && pSetXFAWidget->GetXFAFFWidget()) ||
+              (pKillXFAWidget && pKillXFAWidget->GetXFAFFWidget());
 
-  return true;
+  return !bXFA || static_cast<CPDFXFA_WidgetHandler*>(m_pXFAWidgetHandler.get())
+                      ->OnXFAChangedFocus(pKillAnnot, pSetAnnot);
 }
 #endif  // PDF_ENABLE_XFA
 
@@ -310,25 +318,10 @@ bool CPDFSDK_AnnotHandlerMgr::Annot_OnHitTest(CPDFSDK_PageView* pPageView,
 CPDFSDK_Annot* CPDFSDK_AnnotHandlerMgr::GetNextAnnot(CPDFSDK_Annot* pSDKAnnot,
                                                      bool bNext) {
 #ifdef PDF_ENABLE_XFA
-  CPDFSDK_PageView* pPageView = pSDKAnnot->GetPageView();
-  CPDFXFA_Page* pPage = pPageView->GetPDFXFAPage();
+  IPDF_Page* pPage = pSDKAnnot->GetPageView()->GetXFAPage();
   if (pPage && !pPage->AsPDFPage()) {
     // For xfa annots in XFA pages not backed by PDF pages.
-    std::unique_ptr<IXFA_WidgetIterator> pWidgetIterator(
-        pPage->GetXFAPageView()->CreateWidgetIterator(
-            XFA_TRAVERSEWAY_Tranvalse, XFA_WidgetStatus_Visible |
-                                           XFA_WidgetStatus_Viewable |
-                                           XFA_WidgetStatus_Focused));
-    if (!pWidgetIterator)
-      return nullptr;
-    if (pWidgetIterator->GetCurrentWidget() != pSDKAnnot->GetXFAWidget())
-      pWidgetIterator->SetCurrentWidget(pSDKAnnot->GetXFAWidget());
-    CXFA_FFWidget* hNextFocus = bNext ? pWidgetIterator->MoveToNext()
-                                      : pWidgetIterator->MoveToPrevious();
-    if (!hNextFocus && pSDKAnnot)
-      hNextFocus = pWidgetIterator->MoveToFirst();
-
-    return pPageView->GetAnnotByXFAWidget(hNextFocus);
+    return static_cast<CPDFXFA_Page*>(pPage)->GetNextXFAAnnot(pSDKAnnot, bNext);
   }
 #endif  // PDF_ENABLE_XFA
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annothandlermgr.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annothandlermgr.h
index 30fc32c5ce4..5d70f0053bc 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annothandlermgr.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_annothandlermgr.h
@@ -22,18 +22,24 @@ class CPDFSDK_PageView;
 class IPDFSDK_AnnotHandler;
 
 #ifdef PDF_ENABLE_XFA
-class CPDFSDK_XFAWidgetHandler;
 class CXFA_FFWidget;
 #endif  // PDF_ENABLE_XFA
 
 class CPDFSDK_AnnotHandlerMgr {
  public:
-  explicit CPDFSDK_AnnotHandlerMgr(CPDFSDK_FormFillEnvironment* pFormFillEnv);
+  CPDFSDK_AnnotHandlerMgr(
+      std::unique_ptr<CPDFSDK_BAAnnotHandler> pBAAnnotHandler,
+      std::unique_ptr<CPDFSDK_WidgetHandler> pWidgetHandler,
+      std::unique_ptr<IPDFSDK_AnnotHandler> pXFAWidgetHandler);
+
   ~CPDFSDK_AnnotHandlerMgr();
 
+  void SetFormFillEnv(CPDFSDK_FormFillEnvironment* pFormFillEnv);
+
   CPDFSDK_Annot* NewAnnot(CPDF_Annot* pAnnot, CPDFSDK_PageView* pPageView);
 #ifdef PDF_ENABLE_XFA
-  CPDFSDK_Annot* NewAnnot(CXFA_FFWidget* pAnnot, CPDFSDK_PageView* pPageView);
+  CPDFSDK_Annot* NewXFAAnnot(CXFA_FFWidget* pAnnot,
+                             CPDFSDK_PageView* pPageView);
 #endif  // PDF_ENABLE_XFA
   void ReleaseAnnot(std::unique_ptr<CPDFSDK_Annot> pAnnot);
 
@@ -48,7 +54,6 @@ class CPDFSDK_AnnotHandlerMgr {
   bool Annot_Undo(CPDFSDK_Annot* pAnnot);
   bool Annot_Redo(CPDFSDK_Annot* pAnnot);
 
-  IPDFSDK_AnnotHandler* GetAnnotHandler(CPDFSDK_Annot* pAnnot) const;
   void Annot_OnDraw(CPDFSDK_PageView* pPageView,
                     CPDFSDK_Annot* pAnnot,
                     CFX_RenderDevice* pDevice,
@@ -111,15 +116,16 @@ class CPDFSDK_AnnotHandlerMgr {
                        const CFX_PointF& point);
 
  private:
-  IPDFSDK_AnnotHandler* GetAnnotHandler(
+  IPDFSDK_AnnotHandler* GetAnnotHandler(CPDFSDK_Annot* pAnnot) const;
+  IPDFSDK_AnnotHandler* GetAnnotHandlerOfType(
       CPDF_Annot::Subtype nAnnotSubtype) const;
   CPDFSDK_Annot* GetNextAnnot(CPDFSDK_Annot* pSDKAnnot, bool bNext);
 
-  std::unique_ptr<CPDFSDK_BAAnnotHandler> m_pBAAnnotHandler;
-  std::unique_ptr<CPDFSDK_WidgetHandler> m_pWidgetHandler;
-#ifdef PDF_ENABLE_XFA
-  std::unique_ptr<CPDFSDK_XFAWidgetHandler> m_pXFAWidgetHandler;
-#endif  // PDF_ENABLE_XFA
+  // |m_pBAAnnotHandler| and |m_pWidgetHandler| are always present, but
+  // |m_pXFAWidgetHandler| is only present in XFA mode.
+  std::unique_ptr<CPDFSDK_BAAnnotHandler> const m_pBAAnnotHandler;
+  std::unique_ptr<CPDFSDK_WidgetHandler> const m_pWidgetHandler;
+  std::unique_ptr<IPDFSDK_AnnotHandler> const m_pXFAWidgetHandler;
 };
 
 #endif  // FPDFSDK_CPDFSDK_ANNOTHANDLERMGR_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_appstream.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_appstream.cpp
index 261b274f84a..8c4a96988fa 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_appstream.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_appstream.cpp
@@ -4,11 +4,12 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#include "fpdfsdk/pwl/cpwl_appstream.h"
+#include "fpdfsdk/cpdfsdk_appstream.h"
 
 #include <utility>
 
 #include "constants/form_flags.h"
+#include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfapi/parser/cpdf_name.h"
@@ -18,6 +19,7 @@
 #include "core/fpdfapi/parser/cpdf_string.h"
 #include "core/fpdfapi/parser/fpdf_parser_decode.h"
 #include "core/fpdfdoc/cba_fontmap.h"
+#include "core/fpdfdoc/cpdf_formcontrol.h"
 #include "core/fpdfdoc/cpvt_word.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_interactiveform.h"
@@ -1116,12 +1118,13 @@ void SetDefaultIconName(CPDF_Stream* pIcon, const char* name) {
 
 }  // namespace
 
-CPWL_AppStream::CPWL_AppStream(CPDFSDK_Widget* widget, CPDF_Dictionary* dict)
+CPDFSDK_AppStream::CPDFSDK_AppStream(CPDFSDK_Widget* widget,
+                                     CPDF_Dictionary* dict)
     : widget_(widget), dict_(dict) {}
 
-CPWL_AppStream::~CPWL_AppStream() {}
+CPDFSDK_AppStream::~CPDFSDK_AppStream() {}
 
-void CPWL_AppStream::SetAsPushButton() {
+void CPDFSDK_AppStream::SetAsPushButton() {
   CPDF_FormControl* pControl = widget_->GetFormControl();
   CFX_FloatRect rcWindow = widget_->GetRotatedRect();
   ButtonStyle nLayout = ButtonStyle::kLabel;
@@ -1309,7 +1312,7 @@ void CPWL_AppStream::SetAsPushButton() {
   }
 }
 
-void CPWL_AppStream::SetAsCheckBox() {
+void CPDFSDK_AppStream::SetAsCheckBox() {
   CPDF_FormControl* pControl = widget_->GetFormControl();
   CFX_Color crBackground, crBorder, crText;
   int iColorType;
@@ -1424,7 +1427,7 @@ void CPWL_AppStream::SetAsCheckBox() {
     widget_->SetAppState("Off");
 }
 
-void CPWL_AppStream::SetAsRadioButton() {
+void CPDFSDK_AppStream::SetAsRadioButton() {
   CPDF_FormControl* pControl = widget_->GetFormControl();
   CFX_Color crBackground;
   CFX_Color crBorder;
@@ -1577,7 +1580,7 @@ void CPWL_AppStream::SetAsRadioButton() {
     widget_->SetAppState("Off");
 }
 
-void CPWL_AppStream::SetAsComboBox(Optional<WideString> sValue) {
+void CPDFSDK_AppStream::SetAsComboBox(Optional<WideString> sValue) {
   CPDF_FormControl* pControl = widget_->GetFormControl();
   CPDF_FormField* pField = pControl->GetField();
   std::ostringstream sBody;
@@ -1647,7 +1650,7 @@ void CPWL_AppStream::SetAsComboBox(Optional<WideString> sValue) {
         ByteString());
 }
 
-void CPWL_AppStream::SetAsListBox() {
+void CPDFSDK_AppStream::SetAsListBox() {
   CPDF_FormControl* pControl = widget_->GetFormControl();
   CPDF_FormField* pField = pControl->GetField();
   CFX_FloatRect rcClient = widget_->GetClientRect();
@@ -1731,7 +1734,7 @@ void CPWL_AppStream::SetAsListBox() {
         ByteString());
 }
 
-void CPWL_AppStream::SetAsTextField(Optional<WideString> sValue) {
+void CPDFSDK_AppStream::SetAsTextField(Optional<WideString> sValue) {
   CPDF_FormControl* pControl = widget_->GetFormControl();
   CPDF_FormField* pField = pControl->GetField();
   std::ostringstream sBody;
@@ -1776,10 +1779,9 @@ void CPWL_AppStream::SetAsTextField(Optional<WideString> sValue) {
   if (nMaxLen > 0) {
     if (bCharArray) {
       pEdit->SetCharArray(nMaxLen);
-
       if (IsFloatZero(fFontSize)) {
-        fFontSize = CPWL_Edit::GetCharArrayAutoFontSize(font_map.GetPDFFont(0),
-                                                        rcClient, nMaxLen);
+        fFontSize = CPWL_Edit::GetCharArrayAutoFontSize(
+            font_map.GetPDFFont(0).Get(), rcClient, nMaxLen);
       }
     } else {
       if (sValue.has_value())
@@ -1880,7 +1882,8 @@ void CPWL_AppStream::SetAsTextField(Optional<WideString> sValue) {
         ByteString());
 }
 
-void CPWL_AppStream::AddImage(const ByteString& sAPType, CPDF_Stream* pImage) {
+void CPDFSDK_AppStream::AddImage(const ByteString& sAPType,
+                                 CPDF_Stream* pImage) {
   CPDF_Stream* pStream = dict_->GetStreamFor(sAPType);
   CPDF_Dictionary* pStreamDict = pStream->GetDict();
   ByteString sImageAlias = "IMG";
@@ -1902,9 +1905,9 @@ void CPWL_AppStream::AddImage(const ByteString& sAPType, CPDF_Stream* pImage) {
                                       pImage->GetObjNum());
 }
 
-void CPWL_AppStream::Write(const ByteString& sAPType,
-                           const ByteString& sContents,
-                           const ByteString& sAPState) {
+void CPDFSDK_AppStream::Write(const ByteString& sAPType,
+                              const ByteString& sContents,
+                              const ByteString& sAPState) {
   CPDF_Stream* pStream = nullptr;
   CPDF_Dictionary* pParentDict = nullptr;
   if (sAPState.IsEmpty()) {
@@ -1940,11 +1943,11 @@ void CPWL_AppStream::Write(const ByteString& sAPType,
   pStream->SetDataAndRemoveFilter(sContents.raw_span());
 }
 
-void CPWL_AppStream::Remove(const ByteString& sAPType) {
+void CPDFSDK_AppStream::Remove(const ByteString& sAPType) {
   dict_->RemoveFor(sAPType);
 }
 
-ByteString CPWL_AppStream::GetBackgroundAppStream() const {
+ByteString CPDFSDK_AppStream::GetBackgroundAppStream() const {
   CFX_Color crBackground = widget_->GetFillPWLColor();
   if (crBackground.nColorType != CFX_Color::kTransparent)
     return GetRectFillAppStream(widget_->GetRotatedRect(), crBackground);
@@ -1952,7 +1955,7 @@ ByteString CPWL_AppStream::GetBackgroundAppStream() const {
   return ByteString();
 }
 
-ByteString CPWL_AppStream::GetBorderAppStream() const {
+ByteString CPDFSDK_AppStream::GetBorderAppStream() const {
   CFX_FloatRect rcWindow = widget_->GetRotatedRect();
   CFX_Color crBorder = widget_->GetBorderPWLColor();
   CFX_Color crBackground = widget_->GetFillPWLColor();
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_appstream.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_appstream.h
index bf839cf70a5..8a38a869648 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_appstream.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_appstream.h
@@ -4,8 +4,8 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#ifndef FPDFSDK_PWL_CPWL_APPSTREAM_H_
-#define FPDFSDK_PWL_CPWL_APPSTREAM_H_
+#ifndef FPDFSDK_CPDFSDK_APPSTREAM_H_
+#define FPDFSDK_CPDFSDK_APPSTREAM_H_
 
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/unowned_ptr.h"
@@ -15,10 +15,10 @@ class CPDFSDK_Widget;
 class CPDF_Dictionary;
 class CPDF_Stream;
 
-class CPWL_AppStream {
+class CPDFSDK_AppStream {
  public:
-  CPWL_AppStream(CPDFSDK_Widget* widget, CPDF_Dictionary* dict);
-  ~CPWL_AppStream();
+  CPDFSDK_AppStream(CPDFSDK_Widget* widget, CPDF_Dictionary* dict);
+  ~CPDFSDK_AppStream();
 
   void SetAsPushButton();
   void SetAsCheckBox();
@@ -41,4 +41,4 @@ class CPWL_AppStream {
   RetainPtr<CPDF_Dictionary> const dict_;
 };
 
-#endif  // FPDFSDK_PWL_CPWL_APPSTREAM_H_
+#endif  // FPDFSDK_CPDFSDK_APPSTREAM_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannot.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannot.h
index d4b5b5c3c60..61272e55704 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannot.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannot.h
@@ -13,7 +13,6 @@
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxge/cfx_renderdevice.h"
-#include "fpdfsdk/cfx_systemhandler.h"
 #include "fpdfsdk/cpdfsdk_annot.h"
 
 class CFX_Matrix;
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannothandler.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannothandler.cpp
index 03856eca6f0..6aa6de73ea3 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannothandler.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannothandler.cpp
@@ -17,10 +17,6 @@
 #include "fpdfsdk/cpdfsdk_pageview.h"
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
 
-#ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#endif  // PDF_ENABLE_XFA
-
 namespace {
 
 void UpdateAnnotRects(CPDFSDK_PageView* pPageView, CPDFSDK_BAAnnot* pBAAnnot) {
@@ -42,6 +38,11 @@ CPDFSDK_BAAnnotHandler::CPDFSDK_BAAnnotHandler() {}
 
 CPDFSDK_BAAnnotHandler::~CPDFSDK_BAAnnotHandler() {}
 
+void CPDFSDK_BAAnnotHandler::SetFormFillEnvironment(
+    CPDFSDK_FormFillEnvironment* pFormFillEnv) {
+  // CPDFSDK_BAAnnotHandler does not need it.
+}
+
 bool CPDFSDK_BAAnnotHandler::CanAnswer(CPDFSDK_Annot* pAnnot) {
   return false;
 }
@@ -51,13 +52,6 @@ CPDFSDK_Annot* CPDFSDK_BAAnnotHandler::NewAnnot(CPDF_Annot* pAnnot,
   return new CPDFSDK_BAAnnot(pAnnot, pPage);
 }
 
-#ifdef PDF_ENABLE_XFA
-CPDFSDK_Annot* CPDFSDK_BAAnnotHandler::NewAnnot(CXFA_FFWidget* hWidget,
-                                                CPDFSDK_PageView* pPage) {
-  return nullptr;
-}
-#endif  // PDF_ENABLE_XFA
-
 void CPDFSDK_BAAnnotHandler::ReleaseAnnot(
     std::unique_ptr<CPDFSDK_Annot> pAnnot) {
   // pAnnot deleted by unique_ptr going out of scope.
@@ -68,10 +62,9 @@ void CPDFSDK_BAAnnotHandler::OnDraw(CPDFSDK_PageView* pPageView,
                                     CFX_RenderDevice* pDevice,
                                     const CFX_Matrix& mtUser2Device,
                                     bool bDrawAnnots) {
-#ifdef PDF_ENABLE_XFA
-  if (pAnnot->IsXFAField())
+  if (pAnnot->AsXFAWidget())
     return;
-#endif  // PDF_ENABLE_XFA
+
   if (bDrawAnnots && pAnnot->GetAnnotSubtype() == CPDF_Annot::Subtype::POPUP) {
     pAnnot->AsBAAnnot()->DrawAppearance(pDevice, mtUser2Device,
                                         CPDF_Annot::Normal, nullptr);
@@ -193,14 +186,6 @@ bool CPDFSDK_BAAnnotHandler::IsIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot,
   return false;
 }
 
-#ifdef PDF_ENABLE_XFA
-bool CPDFSDK_BAAnnotHandler::OnXFAChangedFocus(
-    ObservedPtr<CPDFSDK_Annot>* pOldAnnot,
-    ObservedPtr<CPDFSDK_Annot>* pNewAnnot) {
-  return true;
-}
-#endif  // PDF_ENABLE_XFA
-
 CFX_FloatRect CPDFSDK_BAAnnotHandler::GetViewBBox(CPDFSDK_PageView* pPageView,
                                                   CPDFSDK_Annot* pAnnot) {
   return pAnnot->GetRect();
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannothandler.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannothandler.h
index b8a28266cbd..295bf0d4fff 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannothandler.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_baannothandler.h
@@ -20,21 +20,16 @@ class CPDFSDK_FormFillEnvironment;
 class CPDFSDK_Annot;
 class CPDFSDK_PageView;
 
-#ifdef PDF_ENABLE_XFA
-class CXFA_FFWidget;
-#endif  // PDF_ENABLE_XFA
-
 class CPDFSDK_BAAnnotHandler final : public IPDFSDK_AnnotHandler {
  public:
   CPDFSDK_BAAnnotHandler();
   ~CPDFSDK_BAAnnotHandler() override;
 
+  // IPDFSDK_AnnotHandler:
+  void SetFormFillEnvironment(
+      CPDFSDK_FormFillEnvironment* pFormFillEnv) override;
   bool CanAnswer(CPDFSDK_Annot* pAnnot) override;
   CPDFSDK_Annot* NewAnnot(CPDF_Annot* pAnnot, CPDFSDK_PageView* pPage) override;
-#ifdef PDF_ENABLE_XFA
-  CPDFSDK_Annot* NewAnnot(CXFA_FFWidget* hWidget,
-                          CPDFSDK_PageView* pPage) override;
-#endif  // PDF_ENABLE_XFA
   void ReleaseAnnot(std::unique_ptr<CPDFSDK_Annot> pAnnot) override;
   CFX_FloatRect GetViewBBox(CPDFSDK_PageView* pPageView,
                             CPDFSDK_Annot* pAnnot) override;
@@ -103,10 +98,6 @@ class CPDFSDK_BAAnnotHandler final : public IPDFSDK_AnnotHandler {
                         int index,
                         bool selected) override;
   bool IsIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot, int index) override;
-#ifdef PDF_ENABLE_XFA
-  bool OnXFAChangedFocus(ObservedPtr<CPDFSDK_Annot>* pOldAnnot,
-                         ObservedPtr<CPDFSDK_Annot>* pNewAnnot) override;
-#endif  // PDF_ENABLE_XFA
 };
 
 #endif  // FPDFSDK_CPDFSDK_BAANNOTHANDLER_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp
index 9a5e72684ef..3c1dae583de 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp
@@ -12,23 +12,18 @@
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfdoc/cpdf_docjsactions.h"
-#include "fpdfsdk/cfx_systemhandler.h"
 #include "fpdfsdk/cpdfsdk_actionhandler.h"
 #include "fpdfsdk/cpdfsdk_annothandlermgr.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
 #include "fpdfsdk/cpdfsdk_interactiveform.h"
 #include "fpdfsdk/cpdfsdk_pageview.h"
 #include "fpdfsdk/cpdfsdk_widget.h"
+#include "fpdfsdk/formfiller/cffl_formfiller.h"
 #include "fpdfsdk/formfiller/cffl_interactiveformfiller.h"
 #include "fxjs/ijs_runtime.h"
-#include "public/fpdf_fwlevent.h"
 #include "third_party/base/ptr_util.h"
 #include "third_party/base/stl_util.h"
 
-#ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#endif
-
 FPDF_WIDESTRING AsFPDFWideString(ByteString* bsUTF16LE) {
   // Force a private version of the string, since we're about to hand it off
   // to the embedder. Should the embedder modify it by accident, it won't
@@ -39,10 +34,14 @@ FPDF_WIDESTRING AsFPDFWideString(ByteString* bsUTF16LE) {
 
 CPDFSDK_FormFillEnvironment::CPDFSDK_FormFillEnvironment(
     CPDF_Document* pDoc,
-    FPDF_FORMFILLINFO* pFFinfo)
+    FPDF_FORMFILLINFO* pFFinfo,
+    std::unique_ptr<CPDFSDK_AnnotHandlerMgr> pHandlerMgr)
     : m_pInfo(pFFinfo),
       m_pCPDFDoc(pDoc),
-      m_pSysHandler(pdfium::MakeUnique<CFX_SystemHandler>(this)) {}
+      m_pAnnotHandlerMgr(std::move(pHandlerMgr)) {
+  ASSERT(m_pCPDFDoc);
+  m_pAnnotHandlerMgr->SetFormFillEnv(this);
+}
 
 CPDFSDK_FormFillEnvironment::~CPDFSDK_FormFillEnvironment() {
   m_bBeingDestroyed = true;
@@ -65,22 +64,105 @@ CPDFSDK_FormFillEnvironment::~CPDFSDK_FormFillEnvironment() {
     m_pInfo->Release(m_pInfo);
 }
 
-// static
-bool CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(uint32_t nFlag) {
-  return !!(nFlag & FWL_EVENTFLAG_ShiftKey);
+void CPDFSDK_FormFillEnvironment::InvalidateRect(PerWindowData* pWidgetData,
+                                                 const CFX_FloatRect& rect) {
+  auto* pPrivateData = static_cast<CFFL_PrivateData*>(pWidgetData);
+  CPDFSDK_Widget* widget = pPrivateData->pWidget.Get();
+  if (!widget)
+    return;
+
+  CPDFSDK_PageView* pPageView = widget->GetPageView();
+  IPDF_Page* pPage = widget->GetPage();
+  if (!pPage || !pPageView)
+    return;
+
+  CFX_Matrix device2page = pPageView->GetCurrentMatrix().GetInverse();
+  CFX_PointF left_top = device2page.Transform(CFX_PointF(rect.left, rect.top));
+  CFX_PointF right_bottom =
+      device2page.Transform(CFX_PointF(rect.right, rect.bottom));
+
+  CFX_FloatRect rcPDF(left_top.x, right_bottom.y, right_bottom.x, left_top.y);
+  rcPDF.Normalize();
+  Invalidate(pPage, rcPDF.GetOuterRect());
 }
 
-// static
-bool CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(uint32_t nFlag) {
-  return !!(nFlag & FWL_EVENTFLAG_ControlKey);
+void CPDFSDK_FormFillEnvironment::OutputSelectedRect(
+    CFFL_FormFiller* pFormFiller,
+    const CFX_FloatRect& rect) {
+  if (!pFormFiller || !m_pInfo || !m_pInfo->FFI_OutputSelectedRect)
+    return;
+
+  auto* pPage = FPDFPageFromIPDFPage(pFormFiller->GetSDKAnnot()->GetPage());
+  ASSERT(pPage);
+
+  CFX_PointF ptA = pFormFiller->PWLtoFFL(CFX_PointF(rect.left, rect.bottom));
+  CFX_PointF ptB = pFormFiller->PWLtoFFL(CFX_PointF(rect.right, rect.top));
+  m_pInfo->FFI_OutputSelectedRect(m_pInfo, pPage, ptA.x, ptB.y, ptB.x, ptA.y);
 }
 
-// static
-bool CPDFSDK_FormFillEnvironment::IsALTKeyDown(uint32_t nFlag) {
-  return !!(nFlag & FWL_EVENTFLAG_AltKey);
+bool CPDFSDK_FormFillEnvironment::IsSelectionImplemented() const {
+  FPDF_FORMFILLINFO* pInfo = GetFormFillInfo();
+  return pInfo && pInfo->FFI_OutputSelectedRect;
 }
 
 #ifdef PDF_ENABLE_V8
+CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetCurrentView() {
+  IPDF_Page* pPage = IPDFPageFromFPDFPage(GetCurrentPage());
+  return pPage ? GetPageView(pPage, true) : nullptr;
+}
+
+FPDF_PAGE CPDFSDK_FormFillEnvironment::GetCurrentPage() const {
+  if (m_pInfo && m_pInfo->FFI_GetCurrentPage) {
+    return m_pInfo->FFI_GetCurrentPage(
+        m_pInfo, FPDFDocumentFromCPDFDocument(m_pCPDFDoc.Get()));
+  }
+  return nullptr;
+}
+
+WideString CPDFSDK_FormFillEnvironment::GetLanguage() {
+#ifdef PDF_ENABLE_XFA
+  if (!m_pInfo || !m_pInfo->FFI_GetLanguage)
+    return WideString();
+
+  int nRequiredLen = m_pInfo->FFI_GetLanguage(m_pInfo, nullptr, 0);
+  if (nRequiredLen <= 0)
+    return WideString();
+
+  std::vector<uint8_t> pBuff(nRequiredLen);
+  int nActualLen =
+      m_pInfo->FFI_GetLanguage(m_pInfo, pBuff.data(), nRequiredLen);
+  if (nActualLen <= 0 || nActualLen > nRequiredLen)
+    return WideString();
+
+  return WideString::FromUTF16LE(reinterpret_cast<uint16_t*>(pBuff.data()),
+                                 nActualLen / sizeof(uint16_t));
+#else   // PDF_ENABLE_XFA
+  return WideString();
+#endif  // PDF_ENABLE_XFA
+}
+
+WideString CPDFSDK_FormFillEnvironment::GetPlatform() {
+#ifdef PDF_ENABLE_XFA
+  if (!m_pInfo || !m_pInfo->FFI_GetPlatform)
+    return WideString();
+
+  int nRequiredLen = m_pInfo->FFI_GetPlatform(m_pInfo, nullptr, 0);
+  if (nRequiredLen <= 0)
+    return WideString();
+
+  std::vector<uint8_t> pBuff(nRequiredLen);
+  int nActualLen =
+      m_pInfo->FFI_GetPlatform(m_pInfo, pBuff.data(), nRequiredLen);
+  if (nActualLen <= 0 || nActualLen > nRequiredLen)
+    return WideString();
+
+  return WideString::FromUTF16LE(reinterpret_cast<uint16_t*>(pBuff.data()),
+                                 nActualLen / sizeof(uint16_t));
+#else   // PDF_ENABLE_XFA
+  return WideString();
+#endif  // PDF_ENABLE_XFA
+}
+
 int CPDFSDK_FormFillEnvironment::JS_appAlert(const WideString& Msg,
                                              const WideString& Title,
                                              int Type,
@@ -193,9 +275,13 @@ void CPDFSDK_FormFillEnvironment::JS_docgotoPage(int nPageNum) {
   }
   m_pInfo->m_pJsPlatform->Doc_gotoPage(m_pInfo->m_pJsPlatform, nPageNum);
 }
-#endif  // PDF_ENABLE_V8
 
 WideString CPDFSDK_FormFillEnvironment::JS_docGetFilePath() {
+  return GetFilePath();
+}
+#endif  // PDF_ENABLE_V8
+
+WideString CPDFSDK_FormFillEnvironment::GetFilePath() const {
   if (!m_pInfo || !m_pInfo->m_pJsPlatform ||
       !m_pInfo->m_pJsPlatform->Doc_getFilePath) {
     return WideString();
@@ -215,16 +301,16 @@ WideString CPDFSDK_FormFillEnvironment::JS_docGetFilePath() {
   return WideString::FromDefANSI(ByteStringView(pBuff));
 }
 
-void CPDFSDK_FormFillEnvironment::JS_docSubmitForm(void* formData,
-                                                   int length,
-                                                   const WideString& URL) {
+void CPDFSDK_FormFillEnvironment::SubmitForm(pdfium::span<uint8_t> form_data,
+                                             const WideString& URL) {
   if (!m_pInfo || !m_pInfo->m_pJsPlatform ||
       !m_pInfo->m_pJsPlatform->Doc_submitForm) {
     return;
   }
   ByteString bsUrl = URL.ToUTF16LE();
-  m_pInfo->m_pJsPlatform->Doc_submitForm(m_pInfo->m_pJsPlatform, formData,
-                                         length, AsFPDFWideString(&bsUrl));
+  m_pInfo->m_pJsPlatform->Doc_submitForm(m_pInfo->m_pJsPlatform,
+                                         form_data.data(), form_data.size(),
+                                         AsFPDFWideString(&bsUrl));
 }
 
 IJS_Runtime* CPDFSDK_FormFillEnvironment::GetIJSRuntime() {
@@ -234,8 +320,6 @@ IJS_Runtime* CPDFSDK_FormFillEnvironment::GetIJSRuntime() {
 }
 
 CPDFSDK_AnnotHandlerMgr* CPDFSDK_FormFillEnvironment::GetAnnotHandlerMgr() {
-  if (!m_pAnnotHandlerMgr)
-    m_pAnnotHandlerMgr = pdfium::MakeUnique<CPDFSDK_AnnotHandlerMgr>(this);
   return m_pAnnotHandlerMgr.get();
 }
 
@@ -260,16 +344,6 @@ void CPDFSDK_FormFillEnvironment::Invalidate(IPDF_Page* page,
   }
 }
 
-void CPDFSDK_FormFillEnvironment::OutputSelectedRect(
-    IPDF_Page* page,
-    const CFX_FloatRect& rect) {
-  if (m_pInfo && m_pInfo->FFI_OutputSelectedRect) {
-    m_pInfo->FFI_OutputSelectedRect(m_pInfo, FPDFPageFromIPDFPage(page),
-                                    rect.left, rect.top, rect.right,
-                                    rect.bottom);
-  }
-}
-
 void CPDFSDK_FormFillEnvironment::SetCursor(int nCursorType) {
   if (m_pInfo && m_pInfo->FFI_SetCursor)
     m_pInfo->FFI_SetCursor(m_pInfo, nCursorType);
@@ -279,7 +353,7 @@ int CPDFSDK_FormFillEnvironment::SetTimer(int uElapse,
                                           TimerCallback lpTimerFunc) {
   if (m_pInfo && m_pInfo->FFI_SetTimer)
     return m_pInfo->FFI_SetTimer(m_pInfo, uElapse, lpTimerFunc);
-  return CFX_SystemHandler::kInvalidTimerID;
+  return TimerHandlerIface::kInvalidTimerID;
 }
 
 void CPDFSDK_FormFillEnvironment::KillTimer(int nTimerID) {
@@ -292,16 +366,6 @@ void CPDFSDK_FormFillEnvironment::OnChange() {
     m_pInfo->FFI_OnChange(m_pInfo);
 }
 
-#ifdef PDF_ENABLE_V8
-FPDF_PAGE CPDFSDK_FormFillEnvironment::GetCurrentPage() const {
-  if (m_pInfo && m_pInfo->FFI_GetCurrentPage) {
-    return m_pInfo->FFI_GetCurrentPage(
-        m_pInfo, FPDFDocumentFromCPDFDocument(m_pCPDFDoc.Get()));
-  }
-  return nullptr;
-}
-#endif
-
 void CPDFSDK_FormFillEnvironment::ExecuteNamedAction(const char* namedAction) {
   if (m_pInfo && m_pInfo->FFI_ExecuteNamedAction)
     m_pInfo->FFI_ExecuteNamedAction(m_pInfo, namedAction);
@@ -331,7 +395,11 @@ void CPDFSDK_FormFillEnvironment::DoGoToAction(int nPageIndex,
 }
 
 #ifdef PDF_ENABLE_XFA
-void CPDFSDK_FormFillEnvironment::DisplayCaret(CPDFXFA_Page* page,
+int CPDFSDK_FormFillEnvironment::GetPageViewCount() const {
+  return pdfium::CollectionSize<int>(m_PageMap);
+}
+
+void CPDFSDK_FormFillEnvironment::DisplayCaret(IPDF_Page* page,
                                                FPDF_BOOL bVisible,
                                                double left,
                                                double top,
@@ -357,24 +425,6 @@ void CPDFSDK_FormFillEnvironment::SetCurrentPage(int iCurPage) {
       m_pInfo, FPDFDocumentFromCPDFDocument(m_pCPDFDoc.Get()), iCurPage);
 }
 
-WideString CPDFSDK_FormFillEnvironment::GetPlatform() {
-  if (!m_pInfo || !m_pInfo->FFI_GetPlatform)
-    return WideString();
-
-  int nRequiredLen = m_pInfo->FFI_GetPlatform(m_pInfo, nullptr, 0);
-  if (nRequiredLen <= 0)
-    return WideString();
-
-  std::vector<uint8_t> pBuff(nRequiredLen);
-  int nActualLen =
-      m_pInfo->FFI_GetPlatform(m_pInfo, pBuff.data(), nRequiredLen);
-  if (nActualLen <= 0 || nActualLen > nRequiredLen)
-    return WideString();
-
-  return WideString::FromUTF16LE(reinterpret_cast<uint16_t*>(pBuff.data()),
-                                 nActualLen / sizeof(uint16_t));
-}
-
 void CPDFSDK_FormFillEnvironment::GotoURL(const WideString& wsURL) {
   if (!m_pInfo || !m_pInfo->FFI_GotoURL)
     return;
@@ -384,7 +434,7 @@ void CPDFSDK_FormFillEnvironment::GotoURL(const WideString& wsURL) {
                        AsFPDFWideString(&bsTo));
 }
 
-FS_RECTF CPDFSDK_FormFillEnvironment::GetPageViewRect(CPDFXFA_Page* page) {
+FS_RECTF CPDFSDK_FormFillEnvironment::GetPageViewRect(IPDF_Page* page) {
   FS_RECTF rect = {0.0f, 0.0f, 0.0f, 0.0f};
   if (!m_pInfo || !m_pInfo->FFI_GetPageViewRect)
     return rect;
@@ -403,7 +453,7 @@ FS_RECTF CPDFSDK_FormFillEnvironment::GetPageViewRect(CPDFXFA_Page* page) {
   return rect;
 }
 
-bool CPDFSDK_FormFillEnvironment::PopupMenu(CPDFXFA_Page* page,
+bool CPDFSDK_FormFillEnvironment::PopupMenu(IPDF_Page* page,
                                             FPDF_WIDGET hWidget,
                                             int menuFlag,
                                             const CFX_PointF& pt) {
@@ -495,24 +545,6 @@ FPDF_BOOL CPDFSDK_FormFillEnvironment::PutRequestURL(
                                     AsFPDFWideString(&bsEncode));
 }
 
-WideString CPDFSDK_FormFillEnvironment::GetLanguage() {
-  if (!m_pInfo || !m_pInfo->FFI_GetLanguage)
-    return WideString();
-
-  int nRequiredLen = m_pInfo->FFI_GetLanguage(m_pInfo, nullptr, 0);
-  if (nRequiredLen <= 0)
-    return WideString();
-
-  std::vector<uint8_t> pBuff(nRequiredLen);
-  int nActualLen =
-      m_pInfo->FFI_GetLanguage(m_pInfo, pBuff.data(), nRequiredLen);
-  if (nActualLen <= 0 || nActualLen > nRequiredLen)
-    return WideString();
-
-  return WideString::FromUTF16LE(reinterpret_cast<uint16_t*>(pBuff.data()),
-                                 nActualLen / sizeof(uint16_t));
-}
-
 void CPDFSDK_FormFillEnvironment::PageEvent(int iPageCount,
                                             uint32_t dwEventType) const {
   if (m_pInfo && m_pInfo->FFI_PageEvent)
@@ -546,13 +578,6 @@ CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetPageView(
   return pPageView;
 }
 
-#ifdef PDF_ENABLE_V8
-CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetCurrentView() {
-  IPDF_Page* pPage = IPDFPageFromFPDFPage(GetCurrentPage());
-  return pPage ? GetPageView(pPage, true) : nullptr;
-}
-#endif
-
 CPDFSDK_PageView* CPDFSDK_FormFillEnvironment::GetPageView(int nIndex) {
   IPDF_Page* pTempPage = GetPage(nIndex);
   if (!pTempPage)
@@ -573,9 +598,6 @@ void CPDFSDK_FormFillEnvironment::ProcJavascriptFun() {
 }
 
 bool CPDFSDK_FormFillEnvironment::ProcOpenAction() {
-  if (!m_pCPDFDoc)
-    return false;
-
   CPDF_Dictionary* pRoot = m_pCPDFDoc->GetRoot();
   if (!pRoot)
     return false;
@@ -669,6 +691,10 @@ bool CPDFSDK_FormFillEnvironment::SetFocusAnnot(
   ObservedPtr<CPDFSDK_Annot> pLastFocusAnnot(m_pFocusAnnot.Get());
   if (!pAnnotHandler->Annot_OnChangeFocus(pAnnot, &pLastFocusAnnot))
     return false;
+
+  // |pAnnot| may be destroyed in |Annot_OnChangeFocus|.
+  if (!pAnnot->HasObservable())
+    return false;
 #endif  // PDF_ENABLE_XFA
   if (!pAnnotHandler->Annot_OnSetFocus(pAnnot, 0))
     return false;
@@ -709,22 +735,6 @@ bool CPDFSDK_FormFillEnvironment::KillFocusAnnot(uint32_t nFlag) {
   return !m_pFocusAnnot;
 }
 
-#ifdef PDF_ENABLE_XFA
-CPDFXFA_Context* CPDFSDK_FormFillEnvironment::GetXFAContext() const {
-  if (!m_pCPDFDoc)
-    return nullptr;
-  return static_cast<CPDFXFA_Context*>(m_pCPDFDoc->GetExtension());
-}
-
-int CPDFSDK_FormFillEnvironment::GetPageViewCount() const {
-  return pdfium::CollectionSize<int>(m_PageMap);
-}
-
-bool CPDFSDK_FormFillEnvironment::ContainsXFAForm() const {
-  return GetXFAContext()->ContainsXFAForm();
-}
-#endif  // PDF_ENABLE_XFA
-
 int CPDFSDK_FormFillEnvironment::GetPageCount() const {
   CPDF_Document::Extension* pExtension = m_pCPDFDoc->GetExtension();
   return pExtension ? pExtension->GetPageCount() : m_pCPDFDoc->GetPageCount();
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.h
index 0a902c99fd5..1b47e22d98f 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.h
@@ -15,21 +15,18 @@
 #include "core/fpdfapi/page/cpdf_page.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fxcrt/observed_ptr.h"
+#include "core/fxcrt/timerhandler_iface.h"
 #include "fpdfsdk/cpdfsdk_annot.h"
+#include "fpdfsdk/pwl/ipwl_systemhandler.h"
 #include "public/fpdf_formfill.h"
 
 class CFFL_InteractiveFormFiller;
-class CFX_SystemHandler;
 class CPDFSDK_ActionHandler;
 class CPDFSDK_AnnotHandlerMgr;
 class CPDFSDK_InteractiveForm;
 class CPDFSDK_PageView;
 class IJS_Runtime;
 
-#if defined(PDF_ENABLE_XFA)
-class CPDFXFA_Context;
-#endif  // defined(PDF_ENABLE_XFA)
-
 // NOTE: |bsUTF16LE| must outlive the use of the result. Care must be taken
 // since modifying the result would impact |bsUTF16LE|.
 FPDF_WIDESTRING AsFPDFWideString(ByteString* bsUTF16LE);
@@ -45,20 +42,32 @@ FPDF_WIDESTRING AsFPDFWideString(ByteString* bsUTF16LE);
 // hierarcy back to the form fill environment itself, so as to flag any
 // lingering lifetime issues via the memory tools.
 
-class CPDFSDK_FormFillEnvironment final : public Observable {
+class CPDFSDK_FormFillEnvironment final : public Observable,
+                                          public TimerHandlerIface,
+                                          public IPWL_SystemHandler {
  public:
-  CPDFSDK_FormFillEnvironment(CPDF_Document* pDoc, FPDF_FORMFILLINFO* pFFinfo);
-  ~CPDFSDK_FormFillEnvironment();
+  CPDFSDK_FormFillEnvironment(
+      CPDF_Document* pDoc,
+      FPDF_FORMFILLINFO* pFFinfo,
+      std::unique_ptr<CPDFSDK_AnnotHandlerMgr> pHandlerMgr);
+
+  ~CPDFSDK_FormFillEnvironment() override;
+
+  // TimerHandlerIface:
+  int32_t SetTimer(int32_t uElapse, TimerCallback lpTimerFunc) override;
+  void KillTimer(int32_t nTimerID) override;
 
-  static bool IsSHIFTKeyDown(uint32_t nFlag);
-  static bool IsCTRLKeyDown(uint32_t nFlag);
-  static bool IsALTKeyDown(uint32_t nFlag);
+  // IPWL_SystemHandler:
+  void InvalidateRect(PerWindowData* pWidgetData,
+                      const CFX_FloatRect& rect) override;
+  void OutputSelectedRect(CFFL_FormFiller* pFormFiller,
+                          const CFX_FloatRect& rect) override;
+  bool IsSelectionImplemented() const override;
+  void SetCursor(int32_t nCursorType) override;
 
   CPDFSDK_PageView* GetPageView(IPDF_Page* pUnderlyingPage, bool renew);
   CPDFSDK_PageView* GetPageView(int nIndex);
-#ifdef PDF_ENABLE_V8
-  CPDFSDK_PageView* GetCurrentView();
-#endif
+
   void RemovePageView(IPDF_Page* pUnderlyingPage);
   void UpdateAllViews(CPDFSDK_PageView* pSender, CPDFSDK_Annot* pAnnot);
 
@@ -85,17 +94,7 @@ class CPDFSDK_FormFillEnvironment final : public Observable {
 
   void ProcJavascriptFun();
   bool ProcOpenAction();
-
   void Invalidate(IPDF_Page* page, const FX_RECT& rect);
-  void OutputSelectedRect(IPDF_Page* page, const CFX_FloatRect& rect);
-
-  void SetCursor(int nCursorType);
-  int SetTimer(int uElapse, TimerCallback lpTimerFunc);
-  void KillTimer(int nTimerID);
-
-#ifdef PDF_ENABLE_V8
-  FPDF_PAGE GetCurrentPage() const;
-#endif
 
   void OnChange();
   void ExecuteNamedAction(const char* namedAction);
@@ -109,14 +108,54 @@ class CPDFSDK_FormFillEnvironment final : public Observable {
                     int sizeOfArray);
 
   CPDF_Document* GetPDFDocument() const { return m_pCPDFDoc.Get(); }
+  CPDF_Document::Extension* GetDocExtension() const {
+    return m_pCPDFDoc->GetExtension();
+  }
+
+  bool IsJSPlatformPresent() const { return m_pInfo && m_pInfo->m_pJsPlatform; }
 
 #ifdef PDF_ENABLE_V8
+  CPDFSDK_PageView* GetCurrentView();
+  FPDF_PAGE GetCurrentPage() const;
+
+  WideString GetLanguage();
+  WideString GetPlatform();
+
+  int JS_appAlert(const WideString& Msg,
+                  const WideString& Title,
+                  int Type,
+                  int Icon);
+  int JS_appResponse(const WideString& Question,
+                     const WideString& Title,
+                     const WideString& Default,
+                     const WideString& cLabel,
+                     FPDF_BOOL bPassword,
+                     void* response,
+                     int length);
+  void JS_appBeep(int nType);
+  WideString JS_fieldBrowse();
+  void JS_docmailForm(void* mailData,
+                      int length,
+                      FPDF_BOOL bUI,
+                      const WideString& To,
+                      const WideString& Subject,
+                      const WideString& CC,
+                      const WideString& BCC,
+                      const WideString& Msg);
+  void JS_docprint(FPDF_BOOL bUI,
+                   int nStart,
+                   int nEnd,
+                   FPDF_BOOL bSilent,
+                   FPDF_BOOL bShrinkToFit,
+                   FPDF_BOOL bPrintAsImage,
+                   FPDF_BOOL bReverse,
+                   FPDF_BOOL bAnnotations);
+  void JS_docgotoPage(int nPageNum);
+  WideString JS_docGetFilePath();
+
 #ifdef PDF_ENABLE_XFA
-  CPDFXFA_Context* GetXFAContext() const;
   int GetPageViewCount() const;
-  bool ContainsXFAForm() const;
-
-  void DisplayCaret(CPDFXFA_Page* page,
+  void DisplayCaret(IPDF_Page* page,
                     FPDF_BOOL bVisible,
                     double left,
                     double top,
@@ -128,14 +167,12 @@ class CPDFSDK_FormFillEnvironment final : public Observable {
   // TODO(dsinclair): This should probably change to PDFium?
   WideString FFI_GetAppName() const { return WideString(L"Acrobat"); }
 
-  WideString GetPlatform();
   void GotoURL(const WideString& wsURL);
-  FS_RECTF GetPageViewRect(CPDFXFA_Page* page);
-  bool PopupMenu(CPDFXFA_Page* page,
+  FS_RECTF GetPageViewRect(IPDF_Page* page);
+  bool PopupMenu(IPDF_Page* page,
                  FPDF_WIDGET hWidget,
                  int menuFlag,
                  const CFX_PointF& pt);
-
   void EmailTo(FPDF_FILEHANDLER* fileHandler,
                FPDF_WIDESTRING pTo,
                FPDF_WIDESTRING pSubject,
@@ -157,56 +194,22 @@ class CPDFSDK_FormFillEnvironment final : public Observable {
   FPDF_BOOL PutRequestURL(const WideString& wsURL,
                           const WideString& wsData,
                           const WideString& wsEncode);
-  WideString GetLanguage();
 
   void PageEvent(int iPageCount, uint32_t dwEventType) const;
 #endif  // PDF_ENABLE_XFA
-
-  int JS_appAlert(const WideString& Msg,
-                  const WideString& Title,
-                  int Type,
-                  int Icon);
-  int JS_appResponse(const WideString& Question,
-                     const WideString& Title,
-                     const WideString& Default,
-                     const WideString& cLabel,
-                     FPDF_BOOL bPassword,
-                     void* response,
-                     int length);
-  void JS_appBeep(int nType);
-  WideString JS_fieldBrowse();
-  void JS_docmailForm(void* mailData,
-                      int length,
-                      FPDF_BOOL bUI,
-                      const WideString& To,
-                      const WideString& Subject,
-                      const WideString& CC,
-                      const WideString& BCC,
-                      const WideString& Msg);
-  void JS_docprint(FPDF_BOOL bUI,
-                   int nStart,
-                   int nEnd,
-                   FPDF_BOOL bSilent,
-                   FPDF_BOOL bShrinkToFit,
-                   FPDF_BOOL bPrintAsImage,
-                   FPDF_BOOL bReverse,
-                   FPDF_BOOL bAnnotations);
-  void JS_docgotoPage(int nPageNum);
 #endif  // PDF_ENABLE_V8
 
-  bool IsJSPlatformPresent() const { return m_pInfo && m_pInfo->m_pJsPlatform; }
-
-  // TODO(tsepez): required even if !V8, investigate.
-  WideString JS_docGetFilePath();
-  void JS_docSubmitForm(void* formData, int length, const WideString& URL);
-
+  WideString GetFilePath() const;
   ByteString GetAppName() const { return ByteString(); }
-  CFX_SystemHandler* GetSysHandler() const { return m_pSysHandler.get(); }
+  TimerHandlerIface* GetTimerHandler() { return this; }
+  IPWL_SystemHandler* GetSysHandler() { return this; }
   FPDF_FORMFILLINFO* GetFormFillInfo() const { return m_pInfo; }
+  void SubmitForm(pdfium::span<uint8_t> form_data, const WideString& URL);
+
+  CPDFSDK_AnnotHandlerMgr* GetAnnotHandlerMgr();  // Always present.
 
   // Creates if not present.
   CFFL_InteractiveFormFiller* GetInteractiveFormFiller();
-  CPDFSDK_AnnotHandlerMgr* GetAnnotHandlerMgr();  // Creates if not present.
   IJS_Runtime* GetIJSRuntime();                   // Creates if not present.
   CPDFSDK_ActionHandler* GetActionHandler();      // Creates if not present.
   CPDFSDK_InteractiveForm* GetInteractiveForm();  // Creates if not present.
@@ -215,15 +218,14 @@ class CPDFSDK_FormFillEnvironment final : public Observable {
   IPDF_Page* GetPage(int nIndex);
 
   FPDF_FORMFILLINFO* const m_pInfo;
-  std::unique_ptr<CPDFSDK_AnnotHandlerMgr> m_pAnnotHandlerMgr;
   std::unique_ptr<CPDFSDK_ActionHandler> m_pActionHandler;
   std::unique_ptr<IJS_Runtime> m_pIJSRuntime;
   std::map<IPDF_Page*, std::unique_ptr<CPDFSDK_PageView>> m_PageMap;
   std::unique_ptr<CPDFSDK_InteractiveForm> m_pInteractiveForm;
   ObservedPtr<CPDFSDK_Annot> m_pFocusAnnot;
   UnownedPtr<CPDF_Document> const m_pCPDFDoc;
+  std::unique_ptr<CPDFSDK_AnnotHandlerMgr> m_pAnnotHandlerMgr;
   std::unique_ptr<CFFL_InteractiveFormFiller> m_pFormFiller;
-  std::unique_ptr<CFX_SystemHandler> m_pSysHandler;
   bool m_bChangeMask = false;
   bool m_bBeingDestroyed = false;
 };
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_helpers.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_helpers.cpp
index b49f816d890..817cb098203 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_helpers.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_helpers.cpp
@@ -9,7 +9,6 @@
 #include "build/build_config.h"
 #include "constants/form_fields.h"
 #include "constants/stream_dict_common.h"
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/page/cpdf_page.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
@@ -19,11 +18,6 @@
 #include "core/fpdfdoc/cpdf_interactiveform.h"
 #include "core/fpdfdoc/cpdf_metadata.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
-#include "public/fpdf_ext.h"
-
-#ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#endif
 
 namespace {
 
@@ -32,18 +26,14 @@ constexpr char kQuadPoints[] = "QuadPoints";
 // 0 bit: FPDF_POLICY_MACHINETIME_ACCESS
 uint32_t g_sandbox_policy = 0xFFFFFFFF;
 
-#if !defined(OS_WIN)
-int g_last_error = 0;
-#endif
+UNSUPPORT_INFO* g_unsupport_info = nullptr;
 
 bool RaiseUnsupportedError(int nError) {
-  auto* pAdapter = CPDF_ModuleMgr::Get()->GetUnsupportInfoAdapter();
-  if (!pAdapter)
+  if (!g_unsupport_info)
     return false;
 
-  UNSUPPORT_INFO* info = static_cast<UNSUPPORT_INFO*>(pAdapter->info());
-  if (info && info->FSDK_UnSupport_Handler)
-    info->FSDK_UnSupport_Handler(info, nError);
+  if (g_unsupport_info->FSDK_UnSupport_Handler)
+    g_unsupport_info->FSDK_UnSupport_Handler(g_unsupport_info, nError);
   return true;
 }
 
@@ -296,7 +286,7 @@ unsigned long DecodeStreamMaybeCopyAndReturnLength(const CPDF_Stream* stream,
                                                /*decode=*/true);
 }
 
-void FSDK_SetSandBoxPolicy(FPDF_DWORD policy, FPDF_BOOL enable) {
+void SetPDFSandboxPolicy(FPDF_DWORD policy, FPDF_BOOL enable) {
   switch (policy) {
     case FPDF_POLICY_MACHINETIME_ACCESS: {
       if (enable)
@@ -309,7 +299,7 @@ void FSDK_SetSandBoxPolicy(FPDF_DWORD policy, FPDF_BOOL enable) {
   }
 }
 
-FPDF_BOOL FSDK_IsSandBoxPolicyEnabled(FPDF_DWORD policy) {
+FPDF_BOOL IsPDFSandboxPolicyEnabled(FPDF_DWORD policy) {
   switch (policy) {
     case FPDF_POLICY_MACHINETIME_ACCESS:
       return !!(g_sandbox_policy & 0x01);
@@ -318,6 +308,14 @@ FPDF_BOOL FSDK_IsSandBoxPolicyEnabled(FPDF_DWORD policy) {
   }
 }
 
+void SetPDFUnsupportInfo(UNSUPPORT_INFO* unsp_info) {
+  g_unsupport_info = unsp_info;
+}
+
+UNSUPPORT_INFO* GetPDFUnssuportInto() {
+  return g_unsupport_info;
+}
+
 void ReportUnsupportedFeatures(CPDF_Document* pDoc) {
   const CPDF_Dictionary* pRootDict = pDoc->GetRoot();
   if (pRootDict) {
@@ -398,16 +396,6 @@ void CheckForUnsupportedAnnot(const CPDF_Annot* pAnnot) {
   }
 }
 
-#if !defined(OS_WIN)
-void SetLastError(int err) {
-  g_last_error = err;
-}
-
-int GetLastError() {
-  return g_last_error;
-}
-#endif
-
 void ProcessParseError(CPDF_Parser::Error err) {
   uint32_t err_code = FPDF_ERR_SUCCESS;
   // Translate FPDFAPI error code to FPDFVIEW error code
@@ -428,5 +416,5 @@ void ProcessParseError(CPDF_Parser::Error err) {
       err_code = FPDF_ERR_SECURITY;
       break;
   }
-  SetLastError(err_code);
+  FXSYS_SetLastError(err_code);
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_helpers.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_helpers.h
index 5d9522a12cd..d91e0b0fa59 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_helpers.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_helpers.h
@@ -12,6 +12,7 @@
 #include "core/fpdfapi/parser/cpdf_parser.h"
 #include "core/fxge/dib/cfx_dibitmap.h"
 #include "public/fpdf_doc.h"
+#include "public/fpdf_ext.h"
 #include "public/fpdfview.h"
 
 #ifdef PDF_ENABLE_XFA
@@ -39,14 +40,9 @@ class CPDF_TextPage;
 class CPDF_TextPageFind;
 class CPDFSDK_FormFillEnvironment;
 class CPDFSDK_InteractiveForm;
-class IPDFSDK_PauseAdapter;
+class CPDFSDK_PauseAdapter;
 class FX_PATHPOINT;
-
-#ifdef PDF_ENABLE_XFA
-class CPDFXFA_Context;
-class CPDFXFA_Page;
-class CXFA_FFWidget;
-#endif  // PDF_ENABLE_XFA
+struct CPDF_JavaScript;
 
 // Conversions to/from underlying types.
 IPDF_Page* IPDFPageFromFPDFPage(FPDF_PAGE page);
@@ -56,8 +52,8 @@ FPDF_DOCUMENT FPDFDocumentFromCPDFDocument(CPDF_Document* doc);
 CPDF_Document* CPDFDocumentFromFPDFDocument(FPDF_DOCUMENT doc);
 
 // Conversions to/from incomplete FPDF_ API types.
-inline FPDF_ACTION FPDFActionFromCPDFDictionary(CPDF_Dictionary* action) {
-  return reinterpret_cast<FPDF_ACTION>(action);
+inline FPDF_ACTION FPDFActionFromCPDFDictionary(const CPDF_Dictionary* action) {
+  return reinterpret_cast<FPDF_ACTION>(const_cast<CPDF_Dictionary*>(action));
 }
 inline CPDF_Dictionary* CPDFDictionaryFromFPDFAction(FPDF_ACTION action) {
   return reinterpret_cast<CPDF_Dictionary*>(action);
@@ -86,8 +82,10 @@ inline CFX_DIBitmap* CFXDIBitmapFromFPDFBitmap(FPDF_BITMAP bitmap) {
   return reinterpret_cast<CFX_DIBitmap*>(bitmap);
 }
 
-inline FPDF_BOOKMARK FPDFBookmarkFromCPDFDictionary(CPDF_Dictionary* bookmark) {
-  return reinterpret_cast<FPDF_BOOKMARK>(bookmark);
+inline FPDF_BOOKMARK FPDFBookmarkFromCPDFDictionary(
+    const CPDF_Dictionary* bookmark) {
+  return reinterpret_cast<FPDF_BOOKMARK>(
+      const_cast<CPDF_Dictionary*>(bookmark));
 }
 inline CPDF_Dictionary* CPDFDictionaryFromFPDFBookmark(FPDF_BOOKMARK bookmark) {
   return reinterpret_cast<CPDF_Dictionary*>(bookmark);
@@ -100,8 +98,8 @@ inline CPDF_ClipPath* CPDFClipPathFromFPDFClipPath(FPDF_CLIPPATH path) {
   return reinterpret_cast<CPDF_ClipPath*>(path);
 }
 
-inline FPDF_DEST FPDFDestFromCPDFArray(CPDF_Array* dest) {
-  return reinterpret_cast<FPDF_DEST>(dest);
+inline FPDF_DEST FPDFDestFromCPDFArray(const CPDF_Array* dest) {
+  return reinterpret_cast<FPDF_DEST>(const_cast<CPDF_Array*>(dest));
 }
 inline CPDF_Array* CPDFArrayFromFPDFDest(FPDF_DEST dest) {
   return reinterpret_cast<CPDF_Array*>(dest);
@@ -114,6 +112,15 @@ inline CPDF_Font* CPDFFontFromFPDFFont(FPDF_FONT font) {
   return reinterpret_cast<CPDF_Font*>(font);
 }
 
+inline FPDF_JAVASCRIPT_ACTION FPDFJavaScriptActionFromCPDFJavaScriptAction(
+    CPDF_JavaScript* javascript) {
+  return reinterpret_cast<FPDF_JAVASCRIPT_ACTION>(javascript);
+}
+inline CPDF_JavaScript* CPDFJavaScriptActionFromFPDFJavaScriptAction(
+    FPDF_JAVASCRIPT_ACTION javascript) {
+  return reinterpret_cast<CPDF_JavaScript*>(javascript);
+}
+
 inline FPDF_LINK FPDFLinkFromCPDFDictionary(CPDF_Dictionary* link) {
   return reinterpret_cast<FPDF_LINK>(link);
 }
@@ -208,17 +215,9 @@ CPDFSDKFormFillEnvironmentFromFPDFFormHandle(FPDF_FORMHANDLE handle) {
 CPDFSDK_InteractiveForm* FormHandleToInteractiveForm(FPDF_FORMHANDLE hHandle);
 
 ByteString ByteStringFromFPDFWideString(FPDF_WIDESTRING wide_string);
-
 WideString WideStringFromFPDFWideString(FPDF_WIDESTRING wide_string);
 
 #ifdef PDF_ENABLE_XFA
-inline FPDF_WIDGET FPDFWidgetFromCXFAFFWidget(CXFA_FFWidget* widget) {
-  return reinterpret_cast<FPDF_WIDGET>(widget);
-}
-inline CXFA_FFWidget* CXFAFFWidgetFromFPDFWidget(FPDF_WIDGET widget) {
-  return reinterpret_cast<CXFA_FFWidget*>(widget);
-}
-
 // Layering prevents fxcrt from knowing about FPDF_FILEHANDLER, so this can't
 // be a static method of IFX_SeekableStream.
 RetainPtr<IFX_SeekableStream> MakeSeekableStream(
@@ -258,8 +257,8 @@ unsigned long DecodeStreamMaybeCopyAndReturnLength(const CPDF_Stream* stream,
                                                    void* buffer,
                                                    unsigned long buflen);
 
-void FSDK_SetSandBoxPolicy(FPDF_DWORD policy, FPDF_BOOL enable);
-FPDF_BOOL FSDK_IsSandBoxPolicyEnabled(FPDF_DWORD policy);
+void SetPDFSandboxPolicy(FPDF_DWORD policy, FPDF_BOOL enable);
+FPDF_BOOL IsPDFSandboxPolicyEnabled(FPDF_DWORD policy);
 
 // TODO(dsinclair): Where should this live?
 void RenderPageWithContext(CPDF_PageRenderContext* pContext,
@@ -271,16 +270,12 @@ void RenderPageWithContext(CPDF_PageRenderContext* pContext,
                            int rotate,
                            int flags,
                            bool bNeedToRestore,
-                           IPDFSDK_PauseAdapter* pause);
+                           CPDFSDK_PauseAdapter* pause);
 
+void SetPDFUnsupportInfo(UNSUPPORT_INFO* unsp_info);
+UNSUPPORT_INFO* GetPDFUnssuportInto();
 void ReportUnsupportedFeatures(CPDF_Document* pDoc);
 void CheckForUnsupportedAnnot(const CPDF_Annot* pAnnot);
-
-#if !defined(OS_WIN)
-void SetLastError(int err);
-int GetLastError();
-#endif
-
 void ProcessParseError(CPDF_Parser::Error err);
 
 #endif  // FPDFSDK_CPDFSDK_HELPERS_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_interactiveform.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_interactiveform.cpp
index 67fa3e3f33c..9e7c548c8f1 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_interactiveform.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_interactiveform.cpp
@@ -21,6 +21,7 @@
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fpdfdoc/cpdf_actionfields.h"
+#include "core/fpdfdoc/cpdf_formcontrol.h"
 #include "core/fpdfdoc/cpdf_interactiveform.h"
 #include "core/fxcrt/autorestorer.h"
 #include "core/fxge/cfx_graphstatedata.h"
@@ -37,16 +38,6 @@
 #include "fxjs/ijs_runtime.h"
 #include "third_party/base/ptr_util.h"
 
-#ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/cpdfsdk_xfawidget.h"
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#include "fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h"
-#include "xfa/fxfa/cxfa_eventparam.h"
-#include "xfa/fxfa/cxfa_ffdocview.h"
-#include "xfa/fxfa/cxfa_ffwidget.h"
-#include "xfa/fxfa/cxfa_ffwidgethandler.h"
-#endif  // PDF_ENABLE_XFA
-
 namespace {
 
 constexpr uint32_t kWhiteBGR = FXSYS_BGR(255, 255, 255);
@@ -124,17 +115,11 @@ CPDFSDK_InteractiveForm::CPDFSDK_InteractiveForm(
     : m_pFormFillEnv(pFormFillEnv),
       m_pInteractiveForm(pdfium::MakeUnique<CPDF_InteractiveForm>(
           m_pFormFillEnv->GetPDFDocument())) {
-  ASSERT(m_pFormFillEnv);
-  m_pInteractiveForm->SetFormNotify(this);
+  m_pInteractiveForm->SetNotifierIface(this);
   RemoveAllHighLights();
 }
 
-CPDFSDK_InteractiveForm::~CPDFSDK_InteractiveForm() {
-  m_Map.clear();
-#ifdef PDF_ENABLE_XFA
-  m_XFAMap.clear();
-#endif  // PDF_ENABLE_XFA
-}
+CPDFSDK_InteractiveForm::~CPDFSDK_InteractiveForm() = default;
 
 CPDFSDK_Widget* CPDFSDK_InteractiveForm::GetWidget(
     CPDF_FormControl* pControl) const {
@@ -228,27 +213,10 @@ bool CPDFSDK_InteractiveForm::IsCalculateEnabled() const {
 }
 
 #ifdef PDF_ENABLE_XFA
-void CPDFSDK_InteractiveForm::AddXFAMap(CXFA_FFWidget* hWidget,
-                                        CPDFSDK_XFAWidget* pWidget) {
-  ASSERT(hWidget);
-  m_XFAMap[hWidget] = pWidget;
-}
-
-void CPDFSDK_InteractiveForm::RemoveXFAMap(CXFA_FFWidget* hWidget) {
-  ASSERT(hWidget);
-  m_XFAMap.erase(hWidget);
-}
-
-CPDFSDK_XFAWidget* CPDFSDK_InteractiveForm::GetXFAWidget(
-    CXFA_FFWidget* hWidget) {
-  ASSERT(hWidget);
-  auto it = m_XFAMap.find(hWidget);
-  return it != m_XFAMap.end() ? it->second : nullptr;
-}
-
 void CPDFSDK_InteractiveForm::XfaEnableCalculate(bool bEnabled) {
   m_bXfaCalculate = bEnabled;
 }
+
 bool CPDFSDK_InteractiveForm::IsXfaCalculateEnabled() const {
   return m_bXfaCalculate;
 }
@@ -348,14 +316,14 @@ Optional<WideString> CPDFSDK_InteractiveForm::OnFormat(
   return {};
 }
 
-void CPDFSDK_InteractiveForm::ResetFieldAppearance(CPDF_FormField* pFormField,
-                                                   Optional<WideString> sValue,
-                                                   bool bValueChanged) {
+void CPDFSDK_InteractiveForm::ResetFieldAppearance(
+    CPDF_FormField* pFormField,
+    Optional<WideString> sValue) {
   for (int i = 0, sz = pFormField->CountControls(); i < sz; i++) {
     CPDF_FormControl* pFormCtrl = pFormField->GetControl(i);
     ASSERT(pFormCtrl);
     if (CPDFSDK_Widget* pWidget = GetWidget(pFormCtrl))
-      pWidget->ResetAppearance(sValue, bValueChanged);
+      pWidget->ResetAppearance(sValue, true);
   }
 }
 
@@ -485,7 +453,7 @@ bool CPDFSDK_InteractiveForm::SubmitFields(
   if (bUrlEncoded && !FDFToURLEncodedData(&buffer))
     return false;
 
-  m_pFormFillEnv->JS_docSubmitForm(buffer.data(), buffer.size(), csDestination);
+  m_pFormFillEnv->SubmitForm(buffer, csDestination);
   return true;
 }
 
@@ -493,7 +461,7 @@ ByteString CPDFSDK_InteractiveForm::ExportFieldsToFDFTextBuf(
     const std::vector<CPDF_FormField*>& fields,
     bool bIncludeOrExclude) {
   std::unique_ptr<CFDF_Document> pFDF = m_pInteractiveForm->ExportToFDF(
-      m_pFormFillEnv->JS_docGetFilePath(), fields, bIncludeOrExclude, false);
+      m_pFormFillEnv->GetFilePath(), fields, bIncludeOrExclude, false);
 
   return pFDF ? pFDF->WriteToString() : ByteString();
 }
@@ -503,8 +471,8 @@ bool CPDFSDK_InteractiveForm::SubmitForm(const WideString& sDestination,
   if (sDestination.IsEmpty())
     return false;
 
-  std::unique_ptr<CFDF_Document> pFDFDoc = m_pInteractiveForm->ExportToFDF(
-      m_pFormFillEnv->JS_docGetFilePath(), false);
+  std::unique_ptr<CFDF_Document> pFDFDoc =
+      m_pInteractiveForm->ExportToFDF(m_pFormFillEnv->GetFilePath(), false);
   if (!pFDFDoc)
     return false;
 
@@ -516,13 +484,13 @@ bool CPDFSDK_InteractiveForm::SubmitForm(const WideString& sDestination,
   if (bUrlEncoded && !FDFToURLEncodedData(&buffer))
     return false;
 
-  m_pFormFillEnv->JS_docSubmitForm(buffer.data(), buffer.size(), sDestination);
+  m_pFormFillEnv->SubmitForm(buffer, sDestination);
   return true;
 }
 
 ByteString CPDFSDK_InteractiveForm::ExportFormToFDFTextBuf() {
-  std::unique_ptr<CFDF_Document> pFDF = m_pInteractiveForm->ExportToFDF(
-      m_pFormFillEnv->JS_docGetFilePath(), false);
+  std::unique_ptr<CFDF_Document> pFDF =
+      m_pInteractiveForm->ExportToFDF(m_pFormFillEnv->GetFilePath(), false);
 
   return pFDF ? pFDF->WriteToString() : ByteString();
 }
@@ -577,7 +545,7 @@ void CPDFSDK_InteractiveForm::AfterValueChange(CPDF_FormField* pField) {
     return;
 
   OnCalculate(pField);
-  ResetFieldAppearance(pField, OnFormat(pField), true);
+  ResetFieldAppearance(pField, OnFormat(pField));
   UpdateField(pField);
 }
 
@@ -595,7 +563,7 @@ void CPDFSDK_InteractiveForm::AfterSelectionChange(CPDF_FormField* pField) {
     return;
 
   OnCalculate(pField);
-  ResetFieldAppearance(pField, pdfium::nullopt, true);
+  ResetFieldAppearance(pField, pdfium::nullopt);
   UpdateField(pField);
 }
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_interactiveform.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_interactiveform.h
index 151c57d51c2..df931d118d9 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_interactiveform.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_interactiveform.h
@@ -12,7 +12,7 @@
 #include <vector>
 
 #include "core/fpdfdoc/cpdf_action.h"
-#include "core/fpdfdoc/ipdf_formnotify.h"
+#include "core/fpdfdoc/cpdf_interactiveform.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "core/fxge/fx_dib.h"
 #include "fpdfsdk/cpdfsdk_widget.h"
@@ -21,16 +21,11 @@
 class CPDF_Dictionary;
 class CPDF_FormControl;
 class CPDF_FormField;
-class CPDF_InteractiveForm;
 class CPDF_Object;
 class CPDFSDK_FormFillEnvironment;
 
-#ifdef PDF_ENABLE_XFA
-class CPDFSDK_XFAWidget;
-class CXFA_FFWidget;
-#endif  // PDF_ENABLE_XFA
-
-class CPDFSDK_InteractiveForm final : public IPDF_FormNotify {
+class CPDFSDK_InteractiveForm final
+    : public CPDF_InteractiveForm::NotifierIface {
  public:
   explicit CPDFSDK_InteractiveForm(CPDFSDK_FormFillEnvironment* pFormFillEnv);
   ~CPDFSDK_InteractiveForm() override;
@@ -55,9 +50,6 @@ class CPDFSDK_InteractiveForm final : public IPDF_FormNotify {
   bool IsCalculateEnabled() const;
 
 #ifdef PDF_ENABLE_XFA
-  void AddXFAMap(CXFA_FFWidget* hWidget, CPDFSDK_XFAWidget* pWidget);
-  void RemoveXFAMap(CXFA_FFWidget* hWidget);
-  CPDFSDK_XFAWidget* GetXFAWidget(CXFA_FFWidget* hWidget);
   void XfaEnableCalculate(bool bEnabled);
   bool IsXfaCalculateEnabled() const;
   bool IsXfaValidationsEnabled();
@@ -71,8 +63,7 @@ class CPDFSDK_InteractiveForm final : public IPDF_FormNotify {
   Optional<WideString> OnFormat(CPDF_FormField* pFormField);
 
   void ResetFieldAppearance(CPDF_FormField* pFormField,
-                            Optional<WideString> sValue,
-                            bool bValueChanged);
+                            Optional<WideString> sValue);
   void UpdateField(CPDF_FormField* pFormField);
 
   bool DoAction_Hide(const CPDF_Action& action);
@@ -100,7 +91,7 @@ class CPDFSDK_InteractiveForm final : public IPDF_FormNotify {
   FX_COLORREF GetHighlightColor(FormFieldType fieldType);
 
  private:
-  // IPDF_FormNotify:
+  // CPDF_InteractiveForm::NotifierIface:
   bool BeforeValueChange(CPDF_FormField* pField,
                          const WideString& csValue) override;
   void AfterValueChange(CPDF_FormField* pField) override;
@@ -117,13 +108,11 @@ class CPDFSDK_InteractiveForm final : public IPDF_FormNotify {
   std::unique_ptr<CPDF_InteractiveForm> const m_pInteractiveForm;
   std::map<CPDF_FormControl*, CPDFSDK_Widget*> m_Map;
 #ifdef PDF_ENABLE_XFA
-  std::map<CXFA_FFWidget*, CPDFSDK_XFAWidget*> m_XFAMap;
   bool m_bXfaCalculate = true;
   bool m_bXfaValidationsEnabled = true;
 #endif  // PDF_ENABLE_XFA
   bool m_bCalculate = true;
   bool m_bBusy = false;
-
   uint8_t m_HighlightAlpha = 0;
   FX_COLORREF m_HighlightColor[kFormFieldTypeCount];
   bool m_NeedsHighlight[kFormFieldTypeCount];
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pageview.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pageview.cpp
index f272df60f32..7b878f7fd88 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pageview.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pageview.cpp
@@ -24,13 +24,10 @@
 #include "third_party/base/stl_util.h"
 
 #ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_page.h"
+#include "fpdfsdk/fpdfxfa/cpdfxfa_widget.h"
 #include "xfa/fxfa/cxfa_ffdocview.h"
 #include "xfa/fxfa/cxfa_ffpageview.h"
-#include "xfa/fxfa/cxfa_ffwidgethandler.h"
-#include "xfa/fxfa/cxfa_rendercontext.h"
-#include "xfa/fxgraphics/cxfa_graphics.h"
 #endif  // PDF_ENABLE_XFA
 
 CPDFSDK_PageView::CPDFSDK_PageView(CPDFSDK_FormFillEnvironment* pFormFillEnv,
@@ -72,32 +69,14 @@ void CPDFSDK_PageView::PageView_OnDraw(CFX_RenderDevice* pDevice,
   m_curMatrix = mtUser2Device;
 
 #ifdef PDF_ENABLE_XFA
-  CPDFXFA_Page* pPage = GetPDFXFAPage();
+  IPDF_Page* pPage = GetXFAPage();
   if (!pPage)
     return;
 
-  auto* pContext = static_cast<CPDFXFA_Context*>(pPage->GetDocumentExtension());
-  if (pContext->GetFormType() == FormType::kXFAFull) {
-    CFX_RectF rectClip(
-        static_cast<float>(pClip.left), static_cast<float>(pClip.top),
-        static_cast<float>(pClip.Width()), static_cast<float>(pClip.Height()));
-
-    CXFA_Graphics gs(pDevice);
-    gs.SetClipRect(rectClip);
-
-    CXFA_FFPageView* xfaView = pPage->GetXFAPageView();
-    CXFA_RenderContext renderContext(xfaView, rectClip, mtUser2Device);
-    renderContext.DoRender(&gs);
-
-    CXFA_FFDocView* docView = xfaView->GetDocView();
-    if (!docView)
-      return;
-    CPDFSDK_Annot* annot = GetFocusAnnot();
-    if (!annot)
-      return;
-    // Render the focus widget
-    docView->GetWidgetHandler()->RenderWidget(annot->GetXFAWidget(), &gs,
-                                              mtUser2Device, false);
+  CPDF_Document::Extension* pContext = pPage->GetDocument()->GetExtension();
+  if (pContext->ContainsExtensionFullForm()) {
+    static_cast<CPDFXFA_Page*>(pPage)->DrawFocusAnnot(pDevice, GetFocusAnnot(),
+                                                      mtUser2Device, pClip);
     return;
   }
 #endif  // PDF_ENABLE_XFA
@@ -152,7 +131,7 @@ CPDFSDK_Annot* CPDFSDK_PageView::AddAnnot(CXFA_FFWidget* pPDFAnnot) {
     return pSDKAnnot;
 
   CPDFSDK_AnnotHandlerMgr* pAnnotHandler = m_pFormFillEnv->GetAnnotHandlerMgr();
-  pSDKAnnot = pAnnotHandler->NewAnnot(pPDFAnnot, this);
+  pSDKAnnot = pAnnotHandler->NewXFAAnnot(pPDFAnnot, this);
   if (!pSDKAnnot)
     return nullptr;
 
@@ -164,12 +143,12 @@ bool CPDFSDK_PageView::DeleteAnnot(CPDFSDK_Annot* pAnnot) {
   if (!pAnnot)
     return false;
 
-  CPDFXFA_Page* pPage = pAnnot->GetPDFXFAPage();
+  IPDF_Page* pPage = pAnnot->GetXFAPage();
   if (!pPage)
     return false;
 
-  auto* pContext = static_cast<CPDFXFA_Context*>(pPage->GetDocumentExtension());
-  if (!pContext->ContainsXFAForm())
+  CPDF_Document::Extension* pContext = pPage->GetDocument()->GetExtension();
+  if (!pContext->ContainsExtensionForm())
     return false;
 
   ObservedPtr<CPDFSDK_Annot> pObserved(pAnnot);
@@ -215,11 +194,15 @@ CPDFSDK_Annot* CPDFSDK_PageView::GetAnnotByXFAWidget(CXFA_FFWidget* hWidget) {
     return nullptr;
 
   for (CPDFSDK_Annot* pAnnot : m_SDKAnnotArray) {
-    if (pAnnot->GetXFAWidget() == hWidget)
+    if (ToXFAWidget(pAnnot)->GetXFAFFWidget() == hWidget)
       return pAnnot;
   }
   return nullptr;
 }
+
+IPDF_Page* CPDFSDK_PageView::GetXFAPage() {
+  return ToXFAPage(m_page);
+}
 #endif  // PDF_ENABLE_XFA
 
 WideString CPDFSDK_PageView::GetFocusedFormText() {
@@ -497,7 +480,8 @@ void CPDFSDK_PageView::LoadFXAnnots() {
 
 #ifdef PDF_ENABLE_XFA
   RetainPtr<CPDFXFA_Page> protector(ToXFAPage(m_page));
-  if (m_pFormFillEnv->GetXFAContext()->GetFormType() == FormType::kXFAFull) {
+  auto* pContext = m_pFormFillEnv->GetDocExtension();
+  if (pContext->ContainsExtensionFullForm()) {
     CXFA_FFPageView* pageView = protector->GetXFAPageView();
     std::unique_ptr<IXFA_WidgetIterator> pWidgetHandler(
         pageView->CreateWidgetIterator(
@@ -508,7 +492,7 @@ void CPDFSDK_PageView::LoadFXAnnots() {
     }
 
     while (CXFA_FFWidget* pXFAAnnot = pWidgetHandler->MoveToNext()) {
-      CPDFSDK_Annot* pAnnot = pAnnotHandlerMgr->NewAnnot(pXFAAnnot, this);
+      CPDFSDK_Annot* pAnnot = pAnnotHandlerMgr->NewXFAAnnot(pXFAAnnot, this);
       if (!pAnnot)
         continue;
       m_SDKAnnotArray.push_back(pAnnot);
@@ -551,17 +535,10 @@ void CPDFSDK_PageView::UpdateView(CPDFSDK_Annot* pAnnot) {
 
 int CPDFSDK_PageView::GetPageIndex() const {
 #ifdef PDF_ENABLE_XFA
-  auto* pContext = static_cast<CPDFXFA_Context*>(
-      m_page->AsXFAPage()->GetDocumentExtension());
-  switch (pContext->GetFormType()) {
-    case FormType::kXFAFull: {
-      CXFA_FFPageView* pPageView = m_page->AsXFAPage()->GetXFAPageView();
-      return pPageView ? pPageView->GetLayoutItem()->GetPageIndex() : -1;
-    }
-    case FormType::kNone:
-    case FormType::kAcroForm:
-    case FormType::kXFAForeground:
-      break;
+  CPDF_Document::Extension* pContext = m_page->GetDocument()->GetExtension();
+  if (pContext->ContainsExtensionFullForm()) {
+    CXFA_FFPageView* pPageView = m_page->AsXFAPage()->GetXFAPageView();
+    return pPageView ? pPageView->GetLayoutItem()->GetPageIndex() : -1;
   }
 #endif  // PDF_ENABLE_XFA
   return GetPageIndexForStaticPDF();
@@ -593,5 +570,5 @@ CPDFSDK_Annot* CPDFSDK_PageView::GetFocusAnnot() {
 int CPDFSDK_PageView::GetPageIndexForStaticPDF() const {
   const CPDF_Dictionary* pDict = GetPDFPage()->GetDict();
   CPDF_Document* pDoc = m_pFormFillEnv->GetPDFDocument();
-  return (pDoc && pDict) ? pDoc->GetPageIndex(pDict->GetObjNum()) : -1;
+  return pDoc->GetPageIndex(pDict->GetObjNum());
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pageview.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pageview.h
index d5349024e13..1c47503994e 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pageview.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pageview.h
@@ -19,6 +19,7 @@
 class CFX_RenderDevice;
 class CPDF_AnnotList;
 class CPDF_RenderOptions;
+class CPDFSDK_FormFillEnvironment;
 
 class CPDFSDK_PageView final : public CPDF_Page::View {
  public:
@@ -44,7 +45,7 @@ class CPDFSDK_PageView final : public CPDF_Page::View {
   bool DeleteAnnot(CPDFSDK_Annot* pAnnot);
   CPDFSDK_Annot* AddAnnot(CXFA_FFWidget* pPDFAnnot);
   CPDFSDK_Annot* GetAnnotByXFAWidget(CXFA_FFWidget* hWidget);
-  CPDFXFA_Page* GetPDFXFAPage() { return ToXFAPage(m_page); }
+  IPDF_Page* GetXFAPage();
 #endif  // PDF_ENABLE_XFA
 
   CPDF_Page* GetPDFPage() const;
diff --git a/chromium/third_party/pdfium/fpdfsdk/ipdfsdk_pauseadapter.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pauseadapter.cpp
index 3cdf1330d8d..bf3f1c79990 100644
--- a/chromium/third_party/pdfium/fpdfsdk/ipdfsdk_pauseadapter.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pauseadapter.cpp
@@ -4,13 +4,13 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#include "fpdfsdk/ipdfsdk_pauseadapter.h"
+#include "fpdfsdk/cpdfsdk_pauseadapter.h"
 
-IPDFSDK_PauseAdapter::IPDFSDK_PauseAdapter(IFSDK_PAUSE* IPause)
+CPDFSDK_PauseAdapter::CPDFSDK_PauseAdapter(IFSDK_PAUSE* IPause)
     : m_IPause(IPause) {}
 
-IPDFSDK_PauseAdapter::~IPDFSDK_PauseAdapter() {}
+CPDFSDK_PauseAdapter::~CPDFSDK_PauseAdapter() = default;
 
-bool IPDFSDK_PauseAdapter::NeedToPauseNow() {
+bool CPDFSDK_PauseAdapter::NeedToPauseNow() {
   return m_IPause->NeedToPauseNow && m_IPause->NeedToPauseNow(m_IPause.Get());
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/ipdfsdk_pauseadapter.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pauseadapter.h
index 7ee01ba53fa..dfbc2b4126a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/ipdfsdk_pauseadapter.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_pauseadapter.h
@@ -4,18 +4,18 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#ifndef FPDFSDK_IPDFSDK_PAUSEADAPTER_H_
-#define FPDFSDK_IPDFSDK_PAUSEADAPTER_H_
+#ifndef FPDFSDK_CPDFSDK_PAUSEADAPTER_H_
+#define FPDFSDK_CPDFSDK_PAUSEADAPTER_H_
 
 #include "core/fxcrt/fx_system.h"
 #include "core/fxcrt/pauseindicator_iface.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "public/fpdf_progressive.h"
 
-class IPDFSDK_PauseAdapter : public PauseIndicatorIface {
+class CPDFSDK_PauseAdapter final : public PauseIndicatorIface {
  public:
-  explicit IPDFSDK_PauseAdapter(IFSDK_PAUSE* IPause);
-  ~IPDFSDK_PauseAdapter() override;
+  explicit CPDFSDK_PauseAdapter(IFSDK_PAUSE* IPause);
+  ~CPDFSDK_PauseAdapter() override;
 
   bool NeedToPauseNow() override;
 
@@ -23,4 +23,4 @@ class IPDFSDK_PauseAdapter : public PauseIndicatorIface {
   UnownedPtr<IFSDK_PAUSE> const m_IPause;
 };
 
-#endif  // FPDFSDK_IPDFSDK_PAUSEADAPTER_H_
+#endif  // FPDFSDK_CPDFSDK_PAUSEADAPTER_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp
index 8a6f3c2e46b..24289fce082 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp
@@ -26,10 +26,10 @@
 #include "core/fxge/cfx_pathdata.h"
 #include "core/fxge/cfx_renderdevice.h"
 #include "fpdfsdk/cpdfsdk_actionhandler.h"
+#include "fpdfsdk/cpdfsdk_appstream.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_interactiveform.h"
 #include "fpdfsdk/cpdfsdk_pageview.h"
-#include "fpdfsdk/pwl/cpwl_appstream.h"
 #include "fpdfsdk/pwl/cpwl_edit.h"
 
 #ifdef PDF_ENABLE_XFA
@@ -51,11 +51,12 @@ CPDFSDK_Widget::~CPDFSDK_Widget() = default;
 
 #ifdef PDF_ENABLE_XFA
 CXFA_FFWidget* CPDFSDK_Widget::GetMixXFAWidget() const {
-  CPDFXFA_Context* pContext = m_pPageView->GetFormFillEnv()->GetXFAContext();
-  if (pContext->GetFormType() != FormType::kXFAForeground)
+  auto* pContext = m_pPageView->GetFormFillEnv()->GetDocExtension();
+  if (!pContext->ContainsExtensionForegroundForm())
     return nullptr;
 
-  CXFA_FFDocView* pDocView = pContext->GetXFADocView();
+  CXFA_FFDocView* pDocView =
+      static_cast<CPDFXFA_Context*>(pContext)->GetXFADocView();
   if (!pDocView)
     return nullptr;
 
@@ -75,11 +76,12 @@ CXFA_FFWidget* CPDFSDK_Widget::GetMixXFAWidget() const {
 }
 
 CXFA_FFWidget* CPDFSDK_Widget::GetGroupMixXFAWidget() const {
-  CPDFXFA_Context* pContext = m_pPageView->GetFormFillEnv()->GetXFAContext();
-  if (pContext->GetFormType() != FormType::kXFAForeground)
+  auto* pContext = m_pPageView->GetFormFillEnv()->GetDocExtension();
+  if (!pContext->ContainsExtensionForegroundForm())
     return nullptr;
 
-  CXFA_FFDocView* pDocView = pContext->GetXFADocView();
+  CXFA_FFDocView* pDocView =
+      static_cast<CPDFXFA_Context*>(pContext)->GetXFADocView();
   if (!pDocView)
     return nullptr;
 
@@ -88,12 +90,13 @@ CXFA_FFWidget* CPDFSDK_Widget::GetGroupMixXFAWidget() const {
 }
 
 CXFA_FFWidgetHandler* CPDFSDK_Widget::GetXFAWidgetHandler() const {
-  CPDFXFA_Context* pContext = m_pPageView->GetFormFillEnv()->GetXFAContext();
-  if (pContext->GetFormType() != FormType::kXFAForeground)
+  auto* pContext = m_pPageView->GetFormFillEnv()->GetDocExtension();
+  if (!pContext->ContainsExtensionForegroundForm())
     return nullptr;
 
   if (!m_pWidgetHandler) {
-    CXFA_FFDocView* pDocView = pContext->GetXFADocView();
+    CXFA_FFDocView* pDocView =
+        static_cast<CPDFXFA_Context*>(pContext)->GetXFADocView();
     if (pDocView)
       m_pWidgetHandler = pDocView->GetWidgetHandler();
   }
@@ -210,7 +213,8 @@ bool CPDFSDK_Widget::HasXFAAAction(PDFSDK_XFAAActionType eXFAAAT) const {
 bool CPDFSDK_Widget::OnXFAAAction(PDFSDK_XFAAActionType eXFAAAT,
                                   CPDFSDK_FieldAction* data,
                                   CPDFSDK_PageView* pPageView) {
-  CPDFXFA_Context* pContext = m_pPageView->GetFormFillEnv()->GetXFAContext();
+  auto* pContext = static_cast<CPDFXFA_Context*>(
+      m_pPageView->GetFormFillEnv()->GetDocExtension());
 
   ObservedPtr<CXFA_FFWidget> pWidget(GetMixXFAWidget());
   if (!pWidget)
@@ -306,7 +310,8 @@ void CPDFSDK_Widget::Synchronize(bool bSynchronizeElse) {
   }
 
   if (bSynchronizeElse) {
-    CPDFXFA_Context* context = m_pPageView->GetFormFillEnv()->GetXFAContext();
+    auto* context = static_cast<CPDFXFA_Context*>(
+        m_pPageView->GetFormFillEnv()->GetDocExtension());
     context->GetXFADocView()->ProcessValueChanged(node);
   }
 }
@@ -358,9 +363,8 @@ FormFieldType CPDFSDK_Widget::GetFieldType() const {
 
 bool CPDFSDK_Widget::IsAppearanceValid() {
 #ifdef PDF_ENABLE_XFA
-  CPDFXFA_Context* pContext = m_pPageView->GetFormFillEnv()->GetXFAContext();
-  FormType formType = pContext->GetFormType();
-  if (formType == FormType::kXFAFull)
+  auto* pContext = m_pPageView->GetFormFillEnv()->GetDocExtension();
+  if (pContext->ContainsExtensionFullForm())
     return true;
 #endif  // PDF_ENABLE_XFA
   return CPDFSDK_BAAnnot::IsAppearanceValid();
@@ -532,7 +536,7 @@ void CPDFSDK_Widget::SetCheck(bool bChecked, NotificationOption notify) {
                            notify);
 #ifdef PDF_ENABLE_XFA
   if (!IsWidgetAppearanceValid(CPDF_Annot::Normal))
-    ResetAppearance(true);
+    ResetXFAAppearance(true);
   if (notify == NotificationOption::kDoNotNotify)
     Synchronize(true);
 #endif  // PDF_ENABLE_XFA
@@ -583,7 +587,7 @@ bool CPDFSDK_Widget::IsAppModified() const {
 }
 
 #ifdef PDF_ENABLE_XFA
-void CPDFSDK_Widget::ResetAppearance(bool bValueChanged) {
+void CPDFSDK_Widget::ResetXFAAppearance(bool bValueChanged) {
   switch (GetFieldType()) {
     case FormFieldType::kTextField:
     case FormFieldType::kComboBox: {
@@ -605,7 +609,7 @@ void CPDFSDK_Widget::ResetAppearance(Optional<WideString> sValue,
   if (bValueChanged)
     m_nValueAge++;
 
-  CPWL_AppStream appStream(this, GetAPDict());
+  CPDFSDK_AppStream appStream(this, GetAPDict());
   switch (GetFieldType()) {
     case FormFieldType::kPushButton:
       appStream.SetAsPushButton();
@@ -638,11 +642,10 @@ Optional<WideString> CPDFSDK_Widget::OnFormat() {
   return m_pInteractiveForm->OnFormat(pFormField);
 }
 
-void CPDFSDK_Widget::ResetFieldAppearance(bool bValueChanged) {
+void CPDFSDK_Widget::ResetFieldAppearance() {
   CPDF_FormField* pFormField = GetFormField();
   ASSERT(pFormField);
-  m_pInteractiveForm->ResetFieldAppearance(pFormField, pdfium::nullopt,
-                                           bValueChanged);
+  m_pInteractiveForm->ResetFieldAppearance(pFormField, pdfium::nullopt);
 }
 
 void CPDFSDK_Widget::DrawAppearance(CFX_RenderDevice* pDevice,
@@ -718,20 +721,20 @@ CFX_FloatRect CPDFSDK_Widget::GetRotatedRect() const {
   float fHeight = rectAnnot.Height();
 
   CPDF_FormControl* pControl = GetFormControl();
-  CFX_FloatRect rcPDFWindow;
+  CFX_FloatRect rcPWLWindow;
   switch (abs(pControl->GetRotation() % 360)) {
     case 0:
     case 180:
     default:
-      rcPDFWindow = CFX_FloatRect(0, 0, fWidth, fHeight);
+      rcPWLWindow = CFX_FloatRect(0, 0, fWidth, fHeight);
       break;
     case 90:
     case 270:
-      rcPDFWindow = CFX_FloatRect(0, 0, fHeight, fWidth);
+      rcPWLWindow = CFX_FloatRect(0, 0, fHeight, fWidth);
       break;
   }
 
-  return rcPDFWindow;
+  return rcPWLWindow;
 }
 
 CFX_Matrix CPDFSDK_Widget::GetMatrix() const {
@@ -805,7 +808,8 @@ bool CPDFSDK_Widget::OnAAction(CPDF_AAction::AActionType type,
   CPDFSDK_FormFillEnvironment* pFormFillEnv = pPageView->GetFormFillEnv();
 
 #ifdef PDF_ENABLE_XFA
-  CPDFXFA_Context* pContext = pFormFillEnv->GetXFAContext();
+  auto* pContext =
+      static_cast<CPDFXFA_Context*>(pFormFillEnv->GetDocExtension());
   if (CXFA_FFWidget* hWidget = GetMixXFAWidget()) {
     XFA_EVENTTYPE eEventType = GetXFAEventType(type, data->bWillCommit);
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widget.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widget.h
index 81d0a4c2b34..b24ef372684 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widget.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widget.h
@@ -87,10 +87,11 @@ class CPDFSDK_Widget final : public CPDFSDK_BAAnnot {
   void SetTopVisibleIndex(int index);
 
 #ifdef PDF_ENABLE_XFA
-  void ResetAppearance(bool bValueChanged);
+  // TODO(thestig): Figure out if the parameter should be used or removed.
+  void ResetXFAAppearance(bool bValueChanged);
 #endif  // PDF_ENABLE_XFA
   void ResetAppearance(Optional<WideString> sValue, bool bValueChanged);
-  void ResetFieldAppearance(bool bValueChanged);
+  void ResetFieldAppearance();
   void UpdateField();
   Optional<WideString> OnFormat();
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widgethandler.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widgethandler.cpp
index 5919ab47a01..1e4462dae78 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widgethandler.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widgethandler.cpp
@@ -20,20 +20,16 @@
 #include "fpdfsdk/cpdfsdk_widget.h"
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
 
-#ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#endif  // PDF_ENABLE_XFA
-
-CPDFSDK_WidgetHandler::CPDFSDK_WidgetHandler(
-    CPDFSDK_FormFillEnvironment* pFormFillEnv)
-    : m_pFormFillEnv(pFormFillEnv),
-      m_pFormFiller(pFormFillEnv->GetInteractiveFormFiller()) {
-  ASSERT(m_pFormFillEnv);
-  ASSERT(m_pFormFiller);
-}
+CPDFSDK_WidgetHandler::CPDFSDK_WidgetHandler() = default;
 
 CPDFSDK_WidgetHandler::~CPDFSDK_WidgetHandler() = default;
 
+void CPDFSDK_WidgetHandler::SetFormFillEnvironment(
+    CPDFSDK_FormFillEnvironment* pFormFillEnv) {
+  m_pFormFillEnv = pFormFillEnv;
+  m_pFormFiller = m_pFormFillEnv->GetInteractiveFormFiller();
+}
+
 bool CPDFSDK_WidgetHandler::CanAnswer(CPDFSDK_Annot* pAnnot) {
   CPDFSDK_Widget* pWidget = ToCPDFSDKWidget(pAnnot);
   if (pWidget->IsSignatureWidget())
@@ -70,13 +66,6 @@ CPDFSDK_Annot* CPDFSDK_WidgetHandler::NewAnnot(CPDF_Annot* pAnnot,
   return pWidget;
 }
 
-#ifdef PDF_ENABLE_XFA
-CPDFSDK_Annot* CPDFSDK_WidgetHandler::NewAnnot(CXFA_FFWidget* hWidget,
-                                               CPDFSDK_PageView* pPage) {
-  return nullptr;
-}
-#endif  // PDF_ENABLE_XFA
-
 void CPDFSDK_WidgetHandler::ReleaseAnnot(
     std::unique_ptr<CPDFSDK_Annot> pAnnot) {
   ASSERT(pAnnot);
@@ -221,10 +210,10 @@ void CPDFSDK_WidgetHandler::OnLoad(CPDFSDK_Annot* pAnnot) {
 
 #ifdef PDF_ENABLE_XFA
   CPDFSDK_PageView* pPageView = pAnnot->GetPageView();
-  CPDFXFA_Context* pContext = pPageView->GetFormFillEnv()->GetXFAContext();
-  if (pContext->GetFormType() == FormType::kXFAForeground) {
+  auto* pContext = pPageView->GetFormFillEnv()->GetDocExtension();
+  if (pContext->ContainsExtensionForegroundForm()) {
     if (!pWidget->IsAppearanceValid() && !pWidget->GetValue().IsEmpty())
-      pWidget->ResetAppearance(false);
+      pWidget->ResetXFAAppearance(false);
   }
 #endif  // PDF_ENABLE_XFA
 }
@@ -254,14 +243,6 @@ bool CPDFSDK_WidgetHandler::IsIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot,
          m_pFormFiller->IsIndexSelected(pAnnot, index);
 }
 
-#ifdef PDF_ENABLE_XFA
-bool CPDFSDK_WidgetHandler::OnXFAChangedFocus(
-    ObservedPtr<CPDFSDK_Annot>* pOldAnnot,
-    ObservedPtr<CPDFSDK_Annot>* pNewAnnot) {
-  return true;
-}
-#endif  // PDF_ENABLE_XFA
-
 CFX_FloatRect CPDFSDK_WidgetHandler::GetViewBBox(CPDFSDK_PageView* pPageView,
                                                  CPDFSDK_Annot* pAnnot) {
   if (!pAnnot->IsSignatureWidget())
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widgethandler.h b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widgethandler.h
index 747ae2c7291..fa2ac94441f 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widgethandler.h
+++ b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_widgethandler.h
@@ -21,21 +21,15 @@ class CPDFSDK_Annot;
 class CPDFSDK_FormFillEnvironment;
 class CPDFSDK_PageView;
 
-#ifdef PDF_ENABLE_XFA
-class CXFA_FFWidget;
-#endif  // PDF_ENABLE_XFA
-
 class CPDFSDK_WidgetHandler final : public IPDFSDK_AnnotHandler {
  public:
-  explicit CPDFSDK_WidgetHandler(CPDFSDK_FormFillEnvironment* pFormFillEnv);
+  CPDFSDK_WidgetHandler();
   ~CPDFSDK_WidgetHandler() override;
 
+  void SetFormFillEnvironment(
+      CPDFSDK_FormFillEnvironment* pFormFillEnv) override;
   bool CanAnswer(CPDFSDK_Annot* pAnnot) override;
   CPDFSDK_Annot* NewAnnot(CPDF_Annot* pAnnot, CPDFSDK_PageView* pPage) override;
-#ifdef PDF_ENABLE_XFA
-  CPDFSDK_Annot* NewAnnot(CXFA_FFWidget* hWidget,
-                          CPDFSDK_PageView* pPage) override;
-#endif  // PDF_ENABLE_XFA
   void ReleaseAnnot(std::unique_ptr<CPDFSDK_Annot> pAnnot) override;
   CFX_FloatRect GetViewBBox(CPDFSDK_PageView* pPageView,
                             CPDFSDK_Annot* pAnnot) override;
@@ -104,14 +98,10 @@ class CPDFSDK_WidgetHandler final : public IPDFSDK_AnnotHandler {
                         int index,
                         bool selected) override;
   bool IsIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot, int index) override;
-#ifdef PDF_ENABLE_XFA
-  bool OnXFAChangedFocus(ObservedPtr<CPDFSDK_Annot>* pOldAnnot,
-                         ObservedPtr<CPDFSDK_Annot>* pNewAnnot) override;
-#endif  // PDF_ENABLE_XFA
 
  private:
-  UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
-  UnownedPtr<CFFL_InteractiveFormFiller> const m_pFormFiller;
+  UnownedPtr<CPDFSDK_FormFillEnvironment> m_pFormFillEnv;
+  UnownedPtr<CFFL_InteractiveFormFiller> m_pFormFiller;
 };
 
 #endif  // FPDFSDK_CPDFSDK_WIDGETHANDLER_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_xfawidget.cpp b/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_xfawidget.cpp
deleted file mode 100644
index f529a729ef4..00000000000
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_xfawidget.cpp
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2016 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#include "fpdfsdk/cpdfsdk_xfawidget.h"
-
-#include "fpdfsdk/ipdfsdk_annothandler.h"
-#include "xfa/fxfa/cxfa_ffwidget.h"
-
-CPDFSDK_XFAWidget::CPDFSDK_XFAWidget(CXFA_FFWidget* pAnnot,
-                                     CPDFSDK_PageView* pPageView,
-                                     CPDFSDK_InteractiveForm* pInteractiveForm)
-    : CPDFSDK_Annot(pPageView),
-      m_pInteractiveForm(pInteractiveForm),
-      m_pXFAWidget(pAnnot) {}
-
-CPDFSDK_XFAWidget::~CPDFSDK_XFAWidget() = default;
-
-bool CPDFSDK_XFAWidget::IsXFAField() const {
-  return true;
-}
-
-CXFA_FFWidget* CPDFSDK_XFAWidget::GetXFAWidget() const {
-  return m_pXFAWidget.Get();
-}
-
-CPDF_Annot::Subtype CPDFSDK_XFAWidget::GetAnnotSubtype() const {
-  return CPDF_Annot::Subtype::XFAWIDGET;
-}
-
-CFX_FloatRect CPDFSDK_XFAWidget::GetRect() const {
-  return GetXFAWidget()->GetLayoutItem()->GetRect(false).ToFloatRect();
-}
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_button.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_button.cpp
index 06a3542eb95..35209275df9 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_button.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_button.cpp
@@ -6,6 +6,8 @@
 
 #include "fpdfsdk/formfiller/cffl_button.h"
 
+#include "core/fpdfdoc/cpdf_formcontrol.h"
+
 CFFL_Button::CFFL_Button(CPDFSDK_FormFillEnvironment* pFormFillEnv,
                          CPDFSDK_Widget* pWidget)
     : CFFL_FormFiller(pFormFillEnv, pWidget),
@@ -22,7 +24,7 @@ void CFFL_Button::OnMouseEnter(CPDFSDK_PageView* pPageView) {
 void CFFL_Button::OnMouseExit(CPDFSDK_PageView* pPageView) {
   m_bMouseIn = false;
   InvalidateRect(GetViewBBox(pPageView));
-  EndTimer();
+  m_pTimer.reset();
   ASSERT(m_pWidget);
 }
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.cpp
index 3fbcd112c07..b0e60e2b05f 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.cpp
@@ -8,6 +8,7 @@
 
 #include <utility>
 
+#include "core/fpdfdoc/cpdf_formcontrol.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_widget.h"
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
@@ -23,7 +24,7 @@ CFFL_CheckBox::~CFFL_CheckBox() {}
 
 std::unique_ptr<CPWL_Wnd> CFFL_CheckBox::NewPWLWindow(
     const CPWL_Wnd::CreateParams& cp,
-    std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) {
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData) {
   auto pWnd = pdfium::MakeUnique<CPWL_CheckBox>(cp, std::move(pAttachedData));
   pWnd->Realize();
   pWnd->SetCheck(m_pWidget->IsChecked());
@@ -129,5 +130,5 @@ void CFFL_CheckBox::SaveData(CPDFSDK_PageView* pPageView) {
 
 CPWL_CheckBox* CFFL_CheckBox::GetCheckBox(CPDFSDK_PageView* pPageView,
                                           bool bNew) {
-  return static_cast<CPWL_CheckBox*>(GetPDFWindow(pPageView, bNew));
+  return static_cast<CPWL_CheckBox*>(GetPWLWindow(pPageView, bNew));
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.h
index d590b504e76..aff2762fcad 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.h
@@ -21,7 +21,8 @@ class CFFL_CheckBox final : public CFFL_Button {
   // CFFL_Button:
   std::unique_ptr<CPWL_Wnd> NewPWLWindow(
       const CPWL_Wnd::CreateParams& cp,
-      std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) override;
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
+      override;
   bool OnKeyDown(uint32_t nKeyCode, uint32_t nFlags) override;
   bool OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags) override;
   bool OnLButtonUp(CPDFSDK_PageView* pPageView,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.cpp
index 7cce34de8c7..cee4108fe3e 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.cpp
@@ -46,7 +46,7 @@ CPWL_Wnd::CreateParams CFFL_ComboBox::GetCreateParam() {
 
 std::unique_ptr<CPWL_Wnd> CFFL_ComboBox::NewPWLWindow(
     const CPWL_Wnd::CreateParams& cp,
-    std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) {
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData) {
   auto pWnd = pdfium::MakeUnique<CPWL_ComboBox>(cp, std::move(pAttachedData));
   pWnd->AttachFFLData(this);
   pWnd->Realize();
@@ -77,7 +77,7 @@ bool CFFL_ComboBox::OnChar(CPDFSDK_Annot* pAnnot,
 }
 
 bool CFFL_ComboBox::IsDataChanged(CPDFSDK_PageView* pPageView) {
-  auto* pWnd = static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false));
+  auto* pWnd = static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false));
   if (!pWnd)
     return false;
 
@@ -93,7 +93,7 @@ bool CFFL_ComboBox::IsDataChanged(CPDFSDK_PageView* pPageView) {
 
 void CFFL_ComboBox::SaveData(CPDFSDK_PageView* pPageView) {
   CPWL_ComboBox* pWnd =
-      static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false));
+      static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false));
   if (!pWnd)
     return;
 
@@ -112,7 +112,7 @@ void CFFL_ComboBox::SaveData(CPDFSDK_PageView* pPageView) {
   }
   ObservedPtr<CPDFSDK_Widget> observed_widget(m_pWidget.Get());
   ObservedPtr<CFFL_ComboBox> observed_this(this);
-  m_pWidget->ResetFieldAppearance(true);
+  m_pWidget->ResetFieldAppearance();
   if (!observed_widget)
     return;
 
@@ -130,7 +130,7 @@ void CFFL_ComboBox::GetActionData(CPDFSDK_PageView* pPageView,
   switch (type) {
     case CPDF_AAction::kKeyStroke:
       if (CPWL_ComboBox* pComboBox =
-              static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false))) {
+              static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false))) {
         if (CPWL_Edit* pEdit = pComboBox->GetEdit()) {
           fa.bFieldFull = pEdit->IsTextFull();
           int nSelStart = 0;
@@ -150,7 +150,7 @@ void CFFL_ComboBox::GetActionData(CPDFSDK_PageView* pPageView,
       break;
     case CPDF_AAction::kValidate:
       if (CPWL_ComboBox* pComboBox =
-              static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false))) {
+              static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false))) {
         if (CPWL_Edit* pEdit = pComboBox->GetEdit()) {
           fa.sValue = pEdit->GetText();
         }
@@ -171,7 +171,7 @@ void CFFL_ComboBox::SetActionData(CPDFSDK_PageView* pPageView,
   switch (type) {
     case CPDF_AAction::kKeyStroke:
       if (CPWL_ComboBox* pComboBox =
-              static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false))) {
+              static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false))) {
         if (CPWL_Edit* pEdit = pComboBox->GetEdit()) {
           pEdit->SetSelection(fa.nSelStart, fa.nSelEnd);
           pEdit->ReplaceSelection(fa.sChange);
@@ -202,7 +202,7 @@ void CFFL_ComboBox::SaveState(CPDFSDK_PageView* pPageView) {
   ASSERT(pPageView);
 
   if (CPWL_ComboBox* pComboBox =
-          static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false))) {
+          static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false))) {
     m_State.nIndex = pComboBox->GetSelect();
 
     if (CPWL_Edit* pEdit = pComboBox->GetEdit()) {
@@ -216,7 +216,7 @@ void CFFL_ComboBox::RestoreState(CPDFSDK_PageView* pPageView) {
   ASSERT(pPageView);
 
   if (CPWL_ComboBox* pComboBox =
-          static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, true))) {
+          static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, true))) {
     if (m_State.nIndex >= 0) {
       pComboBox->SetSelect(m_State.nIndex);
     } else {
@@ -239,7 +239,7 @@ bool CFFL_ComboBox::SetIndexSelected(int index, bool selected) {
   ASSERT(pPageView);
 
   CPWL_ComboBox* pWnd =
-      static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false));
+      static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false));
   if (!pWnd)
     return false;
 
@@ -258,7 +258,7 @@ bool CFFL_ComboBox::IsIndexSelected(int index) {
   ASSERT(pPageView);
 
   CPWL_ComboBox* pWnd =
-      static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false));
+      static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false));
   if (!pWnd)
     return false;
 
@@ -268,7 +268,7 @@ bool CFFL_ComboBox::IsIndexSelected(int index) {
 #ifdef PDF_ENABLE_XFA
 bool CFFL_ComboBox::IsFieldFull(CPDFSDK_PageView* pPageView) {
   if (CPWL_ComboBox* pComboBox =
-          static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false))) {
+          static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false))) {
     if (CPWL_Edit* pEdit = pComboBox->GetEdit())
       return pEdit->IsTextFull();
   }
@@ -291,7 +291,7 @@ WideString CFFL_ComboBox::GetSelectExportText() {
   WideString swRet;
 
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
-  auto* pComboBox = static_cast<CPWL_ComboBox*>(GetPDFWindow(pPageView, false));
+  auto* pComboBox = static_cast<CPWL_ComboBox*>(GetPWLWindow(pPageView, false));
   int nExport = pComboBox ? pComboBox->GetSelect() : -1;
 
   if (nExport >= 0) {
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.h
index 52eb8742399..2e8cd37c8ae 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_combobox.h
@@ -31,7 +31,8 @@ class CFFL_ComboBox final : public CFFL_TextObject,
   CPWL_Wnd::CreateParams GetCreateParam() override;
   std::unique_ptr<CPWL_Wnd> NewPWLWindow(
       const CPWL_Wnd::CreateParams& cp,
-      std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) override;
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
+      override;
   bool OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags) override;
   bool IsDataChanged(CPDFSDK_PageView* pPageView) override;
   void SaveData(CPDFSDK_PageView* pPageView) override;
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.cpp
index 11074f927e1..65132f41c5c 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.cpp
@@ -10,7 +10,6 @@
 
 #include "constants/form_flags.h"
 #include "core/fpdfapi/page/cpdf_page.h"
-#include "core/fpdfdoc/cba_fontmap.h"
 #include "core/fxge/cfx_renderdevice.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_pageview.h"
@@ -40,7 +39,7 @@ FX_RECT CFFL_FormFiller::GetViewBBox(CPDFSDK_PageView* pPageView) {
   ASSERT(pPageView);
 
   CFX_FloatRect rcAnnot = m_pWidget->GetRect();
-  if (CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false))
+  if (CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false))
     rcAnnot = PWLtoFFL(pWnd->GetWindowRect());
 
   CFX_FloatRect rcWin = rcAnnot;
@@ -59,7 +58,7 @@ void CFFL_FormFiller::OnDraw(CPDFSDK_PageView* pPageView,
                              CPDFSDK_Annot* pAnnot,
                              CFX_RenderDevice* pDevice,
                              const CFX_Matrix& mtUser2Device) {
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   if (pWnd) {
     pWnd->DrawAppearance(pDevice, GetCurMatrix() * mtUser2Device);
     return;
@@ -83,7 +82,7 @@ void CFFL_FormFiller::OnDrawDeactive(CPDFSDK_PageView* pPageView,
 void CFFL_FormFiller::OnMouseEnter(CPDFSDK_PageView* pPageView) {}
 
 void CFFL_FormFiller::OnMouseExit(CPDFSDK_PageView* pPageView) {
-  EndTimer();
+  m_pTimer.reset();
   ASSERT(m_pWidget);
 }
 
@@ -91,7 +90,7 @@ bool CFFL_FormFiller::OnLButtonDown(CPDFSDK_PageView* pPageView,
                                     CPDFSDK_Annot* pAnnot,
                                     uint32_t nFlags,
                                     const CFX_PointF& point) {
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, true);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, true);
   if (!pWnd)
     return false;
 
@@ -107,7 +106,7 @@ bool CFFL_FormFiller::OnLButtonUp(CPDFSDK_PageView* pPageView,
                                   CPDFSDK_Annot* pAnnot,
                                   uint32_t nFlags,
                                   const CFX_PointF& point) {
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   if (!pWnd)
     return false;
 
@@ -119,7 +118,7 @@ bool CFFL_FormFiller::OnLButtonUp(CPDFSDK_PageView* pPageView,
 bool CFFL_FormFiller::OnLButtonDblClk(CPDFSDK_PageView* pPageView,
                                       uint32_t nFlags,
                                       const CFX_PointF& point) {
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   if (!pWnd)
     return false;
 
@@ -130,7 +129,7 @@ bool CFFL_FormFiller::OnLButtonDblClk(CPDFSDK_PageView* pPageView,
 bool CFFL_FormFiller::OnMouseMove(CPDFSDK_PageView* pPageView,
                                   uint32_t nFlags,
                                   const CFX_PointF& point) {
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   if (!pWnd)
     return false;
 
@@ -145,14 +144,14 @@ bool CFFL_FormFiller::OnMouseWheel(CPDFSDK_PageView* pPageView,
   if (!IsValid())
     return false;
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, true);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, true);
   return pWnd && pWnd->OnMouseWheel(zDelta, WndtoPWL(pPageView, point), nFlags);
 }
 
 bool CFFL_FormFiller::OnRButtonDown(CPDFSDK_PageView* pPageView,
                                     uint32_t nFlags,
                                     const CFX_PointF& point) {
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, true);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, true);
   if (!pWnd)
     return false;
 
@@ -163,7 +162,7 @@ bool CFFL_FormFiller::OnRButtonDown(CPDFSDK_PageView* pPageView,
 bool CFFL_FormFiller::OnRButtonUp(CPDFSDK_PageView* pPageView,
                                   uint32_t nFlags,
                                   const CFX_PointF& point) {
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   if (!pWnd)
     return false;
 
@@ -178,7 +177,7 @@ bool CFFL_FormFiller::OnKeyDown(uint32_t nKeyCode, uint32_t nFlags) {
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
   ASSERT(pPageView);
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   return pWnd && pWnd->OnKeyDown(nKeyCode, nFlags);
 }
 
@@ -191,7 +190,7 @@ bool CFFL_FormFiller::OnChar(CPDFSDK_Annot* pAnnot,
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
   ASSERT(pPageView);
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   return pWnd && pWnd->OnChar(nChar, nFlags);
 }
 
@@ -210,7 +209,7 @@ WideString CFFL_FormFiller::GetText() {
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
   ASSERT(pPageView);
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   return pWnd ? pWnd->GetText() : WideString();
 }
 
@@ -221,7 +220,7 @@ WideString CFFL_FormFiller::GetSelectedText() {
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
   ASSERT(pPageView);
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   return pWnd ? pWnd->GetSelectedText() : WideString();
 }
 
@@ -232,7 +231,7 @@ void CFFL_FormFiller::ReplaceSelection(const WideString& text) {
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
   ASSERT(pPageView);
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   if (!pWnd)
     return;
 
@@ -246,7 +245,7 @@ bool CFFL_FormFiller::CanUndo() {
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
   ASSERT(pPageView);
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   return pWnd && pWnd->CanUndo();
 }
 
@@ -257,7 +256,7 @@ bool CFFL_FormFiller::CanRedo() {
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
   ASSERT(pPageView);
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   return pWnd && pWnd->CanRedo();
 }
 
@@ -268,7 +267,7 @@ bool CFFL_FormFiller::Undo() {
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
   ASSERT(pPageView);
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   return pWnd && pWnd->Undo();
 }
 
@@ -279,7 +278,7 @@ bool CFFL_FormFiller::Redo() {
   CPDFSDK_PageView* pPageView = GetCurPageView(true);
   ASSERT(pPageView);
 
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   return pWnd && pWnd->Redo();
 }
 
@@ -287,7 +286,7 @@ void CFFL_FormFiller::SetFocusForAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag) {
   CPDFSDK_Widget* pWidget = ToCPDFSDKWidget(pAnnot);
   IPDF_Page* pPage = pWidget->GetPage();
   CPDFSDK_PageView* pPageView = m_pFormFillEnv->GetPageView(pPage, true);
-  if (CPWL_Wnd* pWnd = GetPDFWindow(pPageView, true))
+  if (CPWL_Wnd* pWnd = GetPWLWindow(pPageView, true))
     pWnd->SetFocus();
 
   m_bValid = true;
@@ -301,21 +300,21 @@ void CFFL_FormFiller::KillFocusForAnnot(uint32_t nFlag) {
   CPDFSDK_PageView* pPageView = GetCurPageView(false);
   if (!pPageView || !CommitData(pPageView, nFlag))
     return;
-  if (CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false))
+  if (CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false))
     pWnd->KillFocus();
 
-  bool bDestroyPDFWindow;
+  bool bDestroyPWLWindow;
   switch (m_pWidget->GetFieldType()) {
     case FormFieldType::kPushButton:
     case FormFieldType::kCheckBox:
     case FormFieldType::kRadioButton:
-      bDestroyPDFWindow = true;
+      bDestroyPWLWindow = true;
       break;
     default:
-      bDestroyPDFWindow = false;
+      bDestroyPWLWindow = false;
       break;
   }
-  EscapeFiller(pPageView, bDestroyPDFWindow);
+  EscapeFiller(pPageView, bDestroyPWLWindow);
 }
 
 bool CFFL_FormFiller::IsValid() const {
@@ -325,7 +324,7 @@ bool CFFL_FormFiller::IsValid() const {
 CPWL_Wnd::CreateParams CFFL_FormFiller::GetCreateParam() {
   CPWL_Wnd::CreateParams cp;
   cp.pProvider.Reset(this);
-  cp.rcRectWnd = GetPDFWindowRect();
+  cp.rcRectWnd = GetPDFAnnotRect();
 
   uint32_t dwCreateFlags = PWS_BORDER | PWS_BACKGROUND | PWS_VISIBLE;
   uint32_t dwFieldFlag = m_pWidget->GetFieldFlags();
@@ -365,11 +364,12 @@ CPWL_Wnd::CreateParams CFFL_FormFiller::GetCreateParam() {
     dwCreateFlags |= PWS_AUTOFONTSIZE;
 
   cp.dwFlags = dwCreateFlags;
+  cp.pTimerHandler = m_pFormFillEnv->GetTimerHandler();
   cp.pSystemHandler = m_pFormFillEnv->GetSysHandler();
   return cp;
 }
 
-CPWL_Wnd* CFFL_FormFiller::GetPDFWindow(CPDFSDK_PageView* pPageView,
+CPWL_Wnd* CFFL_FormFiller::GetPWLWindow(CPDFSDK_PageView* pPageView,
                                         bool bNew) {
   ASSERT(pPageView);
   auto it = m_Maps.find(pPageView);
@@ -378,10 +378,8 @@ CPWL_Wnd* CFFL_FormFiller::GetPDFWindow(CPDFSDK_PageView* pPageView,
       return nullptr;
 
     CPWL_Wnd::CreateParams cp = GetCreateParam();
-    cp.pAttachedWidget.Reset(m_pWidget.Get());
-
     auto pPrivateData = pdfium::MakeUnique<CFFL_PrivateData>();
-    pPrivateData->pWidget = m_pWidget.Get();
+    pPrivateData->pWidget.Reset(m_pWidget.Get());
     pPrivateData->pPageView = pPageView;
     pPrivateData->nWidgetAppearanceAge = m_pWidget->GetAppearanceAge();
     pPrivateData->nWidgetValueAge = 0;
@@ -398,11 +396,11 @@ CPWL_Wnd* CFFL_FormFiller::GetPDFWindow(CPDFSDK_PageView* pPageView,
   if (pPrivateData->nWidgetAppearanceAge == m_pWidget->GetAppearanceAge())
     return pWnd;
 
-  return ResetPDFWindow(
+  return ResetPWLWindow(
       pPageView, pPrivateData->nWidgetValueAge == m_pWidget->GetValueAge());
 }
 
-void CFFL_FormFiller::DestroyPDFWindow(CPDFSDK_PageView* pPageView) {
+void CFFL_FormFiller::DestroyPWLWindow(CPDFSDK_PageView* pPageView) {
   auto it = m_Maps.find(pPageView);
   if (it == m_Maps.end())
     return;
@@ -413,7 +411,7 @@ void CFFL_FormFiller::DestroyPDFWindow(CPDFSDK_PageView* pPageView) {
 }
 
 CFX_Matrix CFFL_FormFiller::GetWindowMatrix(
-    const CPWL_Wnd::PrivateData* pAttached) {
+    const IPWL_SystemHandler::PerWindowData* pAttached) {
   const auto* pPrivateData = static_cast<const CFFL_PrivateData*>(pAttached);
   if (!pPrivateData || !pPrivateData->pPageView)
     return CFX_Matrix();
@@ -445,7 +443,7 @@ CFX_Matrix CFFL_FormFiller::GetCurMatrix() {
   return mt;
 }
 
-CFX_FloatRect CFFL_FormFiller::GetPDFWindowRect() const {
+CFX_FloatRect CFFL_FormFiller::GetPDFAnnotRect() const {
   CFX_FloatRect rectAnnot = m_pWidget->GetPDFAnnot()->GetRect();
 
   float fWidth = rectAnnot.Width();
@@ -461,7 +459,7 @@ CPDFSDK_PageView* CFFL_FormFiller::GetCurPageView(bool renew) {
 }
 
 CFX_FloatRect CFFL_FormFiller::GetFocusBox(CPDFSDK_PageView* pPageView) {
-  CPWL_Wnd* pWnd = GetPDFWindow(pPageView, false);
+  CPWL_Wnd* pWnd = GetPWLWindow(pPageView, false);
   if (!pWnd)
     return CFX_FloatRect();
 
@@ -507,7 +505,7 @@ bool CFFL_FormFiller::CommitData(CPDFSDK_PageView* pPageView, uint32_t nFlag) {
   if (!pFormFiller->OnKeyStrokeCommit(&pObserved, pPageView, nFlag)) {
     if (!pObserved)
       return false;
-    ResetPDFWindow(pPageView, false);
+    ResetPWLWindow(pPageView, false);
     return true;
   }
   if (!pObserved)
@@ -516,7 +514,7 @@ bool CFFL_FormFiller::CommitData(CPDFSDK_PageView* pPageView, uint32_t nFlag) {
   if (!pFormFiller->OnValidate(&pObserved, pPageView, nFlag)) {
     if (!pObserved)
       return false;
-    ResetPDFWindow(pPageView, false);
+    ResetPWLWindow(pPageView, false);
     return true;
   }
   if (!pObserved)
@@ -573,24 +571,24 @@ void CFFL_FormFiller::SaveState(CPDFSDK_PageView* pPageView) {}
 
 void CFFL_FormFiller::RestoreState(CPDFSDK_PageView* pPageView) {}
 
-CPWL_Wnd* CFFL_FormFiller::ResetPDFWindow(CPDFSDK_PageView* pPageView,
+CPWL_Wnd* CFFL_FormFiller::ResetPWLWindow(CPDFSDK_PageView* pPageView,
                                           bool bRestoreValue) {
-  return GetPDFWindow(pPageView, false);
+  return GetPWLWindow(pPageView, false);
 }
 
-void CFFL_FormFiller::TimerProc() {}
+void CFFL_FormFiller::OnTimerFired() {}
 
-CFX_SystemHandler* CFFL_FormFiller::GetSystemHandler() const {
+IPWL_SystemHandler* CFFL_FormFiller::GetSystemHandler() const {
   return m_pFormFillEnv->GetSysHandler();
 }
 
 void CFFL_FormFiller::EscapeFiller(CPDFSDK_PageView* pPageView,
-                                   bool bDestroyPDFWindow) {
+                                   bool bDestroyPWLWindow) {
   m_bValid = false;
 
   InvalidateRect(GetViewBBox(pPageView));
-  if (bDestroyPDFWindow)
-    DestroyPDFWindow(pPageView);
+  if (bDestroyPWLWindow)
+    DestroyPWLWindow(pPageView);
 }
 
 void CFFL_FormFiller::InvalidateRect(const FX_RECT& rect) {
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.h
index 0f098e2c7a6..71dfad7df7b 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.h
@@ -10,18 +10,20 @@
 #include <map>
 #include <memory>
 
-#include "core/fpdfdoc/cba_fontmap.h"
+#include "core/fxcrt/cfx_timer.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "fpdfsdk/cpdfsdk_fieldaction.h"
+#include "fpdfsdk/cpdfsdk_widget.h"
 #include "fpdfsdk/formfiller/cffl_interactiveformfiller.h"
+#include "fpdfsdk/pwl/cpwl_wnd.h"
+#include "fpdfsdk/pwl/ipwl_systemhandler.h"
 
 class CPDFSDK_Annot;
 class CPDFSDK_FormFillEnvironment;
 class CPDFSDK_PageView;
-class CPDFSDK_Widget;
 
 class CFFL_FormFiller : public CPWL_Wnd::ProviderIface,
-                        public CPWL_TimerHandler {
+                        public CFX_Timer::CallbackIface {
  public:
   CFFL_FormFiller(CPDFSDK_FormFillEnvironment* pFormFillEnv,
                   CPDFSDK_Widget* pWidget);
@@ -83,12 +85,12 @@ class CFFL_FormFiller : public CPWL_Wnd::ProviderIface,
   void SetFocusForAnnot(CPDFSDK_Annot* pAnnot, uint32_t nFlag);
   void KillFocusForAnnot(uint32_t nFlag);
 
-  // CPWL_TimerHandler
-  void TimerProc() override;
-  CFX_SystemHandler* GetSystemHandler() const override;
+  // CFX_Timer::CallbackIface:
+  void OnTimerFired() override;
 
   // CPWL_Wnd::ProviderIface:
-  CFX_Matrix GetWindowMatrix(const CPWL_Wnd::PrivateData* pAttached) override;
+  CFX_Matrix GetWindowMatrix(
+      const IPWL_SystemHandler::PerWindowData* pAttached) override;
 
   virtual void GetActionData(CPDFSDK_PageView* pPageView,
                              CPDF_AAction::AActionType type,
@@ -103,8 +105,8 @@ class CFFL_FormFiller : public CPWL_Wnd::ProviderIface,
   virtual CPWL_Wnd::CreateParams GetCreateParam();
   virtual std::unique_ptr<CPWL_Wnd> NewPWLWindow(
       const CPWL_Wnd::CreateParams& cp,
-      std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) = 0;
-  virtual CPWL_Wnd* ResetPDFWindow(CPDFSDK_PageView* pPageView,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData) = 0;
+  virtual CPWL_Wnd* ResetPWLWindow(CPDFSDK_PageView* pPageView,
                                    bool bRestoreValue);
   virtual void SaveState(CPDFSDK_PageView* pPageView);
   virtual void RestoreState(CPDFSDK_PageView* pPageView);
@@ -127,14 +129,14 @@ class CFFL_FormFiller : public CPWL_Wnd::ProviderIface,
   virtual bool IsFieldFull(CPDFSDK_PageView* pPageView);
 #endif  // PDF_ENABLE_XFA
 
-  CPWL_Wnd* GetPDFWindow(CPDFSDK_PageView* pPageView, bool bNew);
-  void DestroyPDFWindow(CPDFSDK_PageView* pPageView);
-  void EscapeFiller(CPDFSDK_PageView* pPageView, bool bDestroyPDFWindow);
-
+  CPWL_Wnd* GetPWLWindow(CPDFSDK_PageView* pPageView, bool bNew);
+  void DestroyPWLWindow(CPDFSDK_PageView* pPageView);
+  void EscapeFiller(CPDFSDK_PageView* pPageView, bool bDestroyPWLWindow);
 
   bool IsValid() const;
-  CFX_FloatRect GetPDFWindowRect() const;
+  CFX_FloatRect GetPDFAnnotRect() const;
 
+  IPWL_SystemHandler* GetSystemHandler() const;
   CPDFSDK_PageView* GetCurPageView(bool renew);
   void SetChangeMark();
 
@@ -154,6 +156,7 @@ class CFFL_FormFiller : public CPWL_Wnd::ProviderIface,
   bool m_bValid = false;
   UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
   UnownedPtr<CPDFSDK_Widget> m_pWidget;
+  std::unique_ptr<CFX_Timer> m_pTimer;
   std::map<CPDFSDK_PageView*, std::unique_ptr<CPWL_Wnd>> m_Maps;
 };
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
index 45247196968..e4caa62cd6e 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp
@@ -127,8 +127,8 @@ void CFFL_InteractiveFormFiller::OnMouseEnter(
       ASSERT(pPageView);
 
       CPDFSDK_FieldAction fa;
-      fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-      fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+      fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+      fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
       pWidget->OnAAction(CPDF_AAction::kCursorEnter, &fa, pPageView);
       m_bNotifying = false;
       if (!pAnnot->HasObservable())
@@ -136,7 +136,7 @@ void CFFL_InteractiveFormFiller::OnMouseEnter(
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget)) {
-          pFormFiller->ResetPDFWindow(pPageView,
+          pFormFiller->ResetPWLWindow(pPageView,
                                       pWidget->GetValueAge() == nValueAge);
         }
       }
@@ -160,8 +160,8 @@ void CFFL_InteractiveFormFiller::OnMouseExit(CPDFSDK_PageView* pPageView,
       ASSERT(pPageView);
 
       CPDFSDK_FieldAction fa;
-      fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-      fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+      fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+      fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
       pWidget->OnAAction(CPDF_AAction::kCursorExit, &fa, pPageView);
       m_bNotifying = false;
       if (!pAnnot->HasObservable())
@@ -169,7 +169,7 @@ void CFFL_InteractiveFormFiller::OnMouseExit(CPDFSDK_PageView* pPageView,
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget)) {
-          pFormFiller->ResetPDFWindow(pPageView,
+          pFormFiller->ResetPWLWindow(pPageView,
                                       nValueAge == pWidget->GetValueAge());
         }
       }
@@ -196,8 +196,8 @@ bool CFFL_InteractiveFormFiller::OnLButtonDown(
       ASSERT(pPageView);
 
       CPDFSDK_FieldAction fa;
-      fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlags);
-      fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlags);
+      fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlags);
+      fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlags);
       pWidget->OnAAction(CPDF_AAction::kButtonDown, &fa, pPageView);
       m_bNotifying = false;
       if (!pAnnot->HasObservable())
@@ -208,7 +208,7 @@ bool CFFL_InteractiveFormFiller::OnLButtonDown(
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget)) {
-          pFormFiller->ResetPDFWindow(pPageView,
+          pFormFiller->ResetPWLWindow(pPageView,
                                       nValueAge == pWidget->GetValueAge());
         }
       }
@@ -274,8 +274,8 @@ bool CFFL_InteractiveFormFiller::OnButtonUp(ObservedPtr<CPDFSDK_Annot>* pAnnot,
   ASSERT(pPageView);
 
   CPDFSDK_FieldAction fa;
-  fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-  fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+  fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+  fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
   pWidget->OnAAction(CPDF_AAction::kButtonUp, &fa, pPageView);
   m_bNotifying = false;
   if (!pAnnot->HasObservable() || !IsValidAnnot(pPageView, pWidget))
@@ -285,7 +285,7 @@ bool CFFL_InteractiveFormFiller::OnButtonUp(ObservedPtr<CPDFSDK_Annot>* pAnnot,
 
   CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget);
   if (pFormFiller)
-    pFormFiller->ResetPDFWindow(pPageView, nValueAge == pWidget->GetValueAge());
+    pFormFiller->ResetPWLWindow(pPageView, nValueAge == pWidget->GetValueAge());
   return true;
 }
 
@@ -400,8 +400,8 @@ bool CFFL_InteractiveFormFiller::OnSetFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot,
       ASSERT(pPageView);
 
       CPDFSDK_FieldAction fa;
-      fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-      fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+      fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+      fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
       pFormFiller->GetActionData(pPageView, CPDF_AAction::kGetFocus, fa);
       pWidget->OnAAction(CPDF_AAction::kGetFocus, &fa, pPageView);
       m_bNotifying = false;
@@ -410,7 +410,7 @@ bool CFFL_InteractiveFormFiller::OnSetFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot,
 
       if (pWidget->IsAppModified()) {
         if (CFFL_FormFiller* pFiller = GetFormFiller(pWidget)) {
-          pFiller->ResetPDFWindow(pPageView,
+          pFiller->ResetPWLWindow(pPageView,
                                   nValueAge == pWidget->GetValueAge());
         }
       }
@@ -451,8 +451,8 @@ bool CFFL_InteractiveFormFiller::OnKillFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot,
   ASSERT(pPageView);
 
   CPDFSDK_FieldAction fa;
-  fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-  fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+  fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+  fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
   pFormFiller->GetActionData(pPageView, CPDF_AAction::kLoseFocus, fa);
   pWidget->OnAAction(CPDF_AAction::kLoseFocus, &fa, pPageView);
   m_bNotifying = false;
@@ -583,13 +583,13 @@ void CFFL_InteractiveFormFiller::UnRegisterFormFiller(CPDFSDK_Annot* pAnnot) {
 }
 
 void CFFL_InteractiveFormFiller::QueryWherePopup(
-    const CPWL_Wnd::PrivateData* pAttached,
+    const IPWL_SystemHandler::PerWindowData* pAttached,
     float fPopupMin,
     float fPopupMax,
     bool* bBottom,
     float* fPopupRet) {
   auto* pData = static_cast<const CFFL_PrivateData*>(pAttached);
-  CPDFSDK_Widget* pWidget = pData->pWidget;
+  CPDFSDK_Widget* pWidget = pData->pWidget.Get();
   CPDF_Page* pPage = pWidget->GetPDFPage();
 
   CFX_FloatRect rcPageView(0, pPage->GetPageHeight(), pPage->GetPageWidth(), 0);
@@ -659,8 +659,8 @@ bool CFFL_InteractiveFormFiller::OnKeyStrokeCommit(
   pWidget->ClearAppModified();
 
   CPDFSDK_FieldAction fa;
-  fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-  fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+  fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+  fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
   fa.bWillCommit = true;
   fa.bKeyDown = true;
   fa.bRC = true;
@@ -691,8 +691,8 @@ bool CFFL_InteractiveFormFiller::OnValidate(ObservedPtr<CPDFSDK_Annot>* pAnnot,
   pWidget->ClearAppModified();
 
   CPDFSDK_FieldAction fa;
-  fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-  fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+  fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+  fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
   fa.bKeyDown = true;
   fa.bRC = true;
 
@@ -738,7 +738,7 @@ void CFFL_InteractiveFormFiller::OnFormat(ObservedPtr<CPDFSDK_Annot>* pAnnot,
     return;
 
   if (sValue.has_value()) {
-    pForm->ResetFieldAppearance(pWidget->GetFormField(), sValue, true);
+    pForm->ResetFieldAppearance(pWidget->GetFormField(), sValue);
     pForm->UpdateField(pWidget->GetFormField());
   }
 
@@ -761,8 +761,8 @@ bool CFFL_InteractiveFormFiller::OnClick(ObservedPtr<CPDFSDK_Annot>* pAnnot,
   uint32_t nValueAge = pWidget->GetValueAge();
 
   CPDFSDK_FieldAction fa;
-  fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-  fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+  fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+  fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
 
   pWidget->OnXFAAAction(PDFSDK_XFA_Click, &fa, pPageView);
   m_bNotifying = false;
@@ -772,7 +772,7 @@ bool CFFL_InteractiveFormFiller::OnClick(ObservedPtr<CPDFSDK_Annot>* pAnnot,
     return false;
 
   if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget))
-    pFormFiller->ResetPDFWindow(pPageView, nValueAge == pWidget->GetValueAge());
+    pFormFiller->ResetPWLWindow(pPageView, nValueAge == pWidget->GetValueAge());
   return false;
 }
 
@@ -791,8 +791,8 @@ bool CFFL_InteractiveFormFiller::OnFull(ObservedPtr<CPDFSDK_Annot>* pAnnot,
   uint32_t nValueAge = pWidget->GetValueAge();
 
   CPDFSDK_FieldAction fa;
-  fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-  fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+  fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+  fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
 
   pWidget->OnXFAAAction(PDFSDK_XFA_Full, &fa, pPageView);
   m_bNotifying = false;
@@ -802,31 +802,11 @@ bool CFFL_InteractiveFormFiller::OnFull(ObservedPtr<CPDFSDK_Annot>* pAnnot,
     return false;
 
   if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget))
-    pFormFiller->ResetPDFWindow(pPageView, nValueAge == pWidget->GetValueAge());
+    pFormFiller->ResetPWLWindow(pPageView, nValueAge == pWidget->GetValueAge());
 
   return true;
 }
 
-bool CFFL_InteractiveFormFiller::OnPopupPreOpen(
-    const CPWL_Wnd::PrivateData* pAttached,
-    uint32_t nFlag) {
-  auto* pData = static_cast<const CFFL_PrivateData*>(pAttached);
-  ASSERT(pData->pWidget);
-
-  ObservedPtr<CPDFSDK_Annot> pObserved(pData->pWidget);
-  return OnPreOpen(&pObserved, pData->pPageView, nFlag) || !pObserved;
-}
-
-bool CFFL_InteractiveFormFiller::OnPopupPostOpen(
-    const CPWL_Wnd::PrivateData* pAttached,
-    uint32_t nFlag) {
-  auto* pData = static_cast<const CFFL_PrivateData*>(pAttached);
-  ASSERT(pData->pWidget);
-
-  ObservedPtr<CPDFSDK_Annot> pObserved(pData->pWidget);
-  return OnPostOpen(&pObserved, pData->pPageView, nFlag) || !pObserved;
-}
-
 bool CFFL_InteractiveFormFiller::OnPreOpen(ObservedPtr<CPDFSDK_Annot>* pAnnot,
                                            CPDFSDK_PageView* pPageView,
                                            uint32_t nFlag) {
@@ -842,8 +822,8 @@ bool CFFL_InteractiveFormFiller::OnPreOpen(ObservedPtr<CPDFSDK_Annot>* pAnnot,
   uint32_t nValueAge = pWidget->GetValueAge();
 
   CPDFSDK_FieldAction fa;
-  fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-  fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+  fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+  fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
 
   pWidget->OnXFAAAction(PDFSDK_XFA_PreOpen, &fa, pPageView);
   m_bNotifying = false;
@@ -853,7 +833,7 @@ bool CFFL_InteractiveFormFiller::OnPreOpen(ObservedPtr<CPDFSDK_Annot>* pAnnot,
     return false;
 
   if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget))
-    pFormFiller->ResetPDFWindow(pPageView, nValueAge == pWidget->GetValueAge());
+    pFormFiller->ResetPWLWindow(pPageView, nValueAge == pWidget->GetValueAge());
 
   return true;
 }
@@ -873,8 +853,8 @@ bool CFFL_InteractiveFormFiller::OnPostOpen(ObservedPtr<CPDFSDK_Annot>* pAnnot,
   uint32_t nValueAge = pWidget->GetValueAge();
 
   CPDFSDK_FieldAction fa;
-  fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-  fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+  fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+  fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
 
   pWidget->OnXFAAAction(PDFSDK_XFA_PostOpen, &fa, pPageView);
   m_bNotifying = false;
@@ -884,7 +864,7 @@ bool CFFL_InteractiveFormFiller::OnPostOpen(ObservedPtr<CPDFSDK_Annot>* pAnnot,
     return false;
 
   if (CFFL_FormFiller* pFormFiller = GetFormFiller(pWidget))
-    pFormFiller->ResetPDFWindow(pPageView, nValueAge == pWidget->GetValueAge());
+    pFormFiller->ResetPWLWindow(pPageView, nValueAge == pWidget->GetValueAge());
 
   return true;
 }
@@ -896,7 +876,7 @@ bool CFFL_InteractiveFormFiller::IsValidAnnot(CPDFSDK_PageView* pPageView,
 }
 
 std::pair<bool, bool> CFFL_InteractiveFormFiller::OnBeforeKeyStroke(
-    const CPWL_Wnd::PrivateData* pAttached,
+    const IPWL_SystemHandler::PerWindowData* pAttached,
     WideString& strChange,
     const WideString& strChangeEx,
     int nSelStart,
@@ -908,11 +888,11 @@ std::pair<bool, bool> CFFL_InteractiveFormFiller::OnBeforeKeyStroke(
       *static_cast<const CFFL_PrivateData*>(pAttached);
   ASSERT(privateData.pWidget);
 
-  CFFL_FormFiller* pFormFiller = GetFormFiller(privateData.pWidget);
+  CFFL_FormFiller* pFormFiller = GetFormFiller(privateData.GetWidget());
 
 #ifdef PDF_ENABLE_XFA
   if (pFormFiller->IsFieldFull(privateData.pPageView)) {
-    ObservedPtr<CPDFSDK_Annot> pObserved(privateData.pWidget);
+    ObservedPtr<CPDFSDK_Annot> pObserved(privateData.GetWidget());
     if (OnFull(&pObserved, privateData.pPageView, nFlag) || !pObserved)
       return {true, true};
   }
@@ -932,8 +912,8 @@ std::pair<bool, bool> CFFL_InteractiveFormFiller::OnBeforeKeyStroke(
       privateData.pPageView->GetFormFillEnv();
 
   CPDFSDK_FieldAction fa;
-  fa.bModifier = CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
-  fa.bShift = CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+  fa.bModifier = CPWL_Wnd::IsCTRLKeyDown(nFlag);
+  fa.bShift = CPWL_Wnd::IsSHIFTKeyDown(nFlag);
   fa.sChange = strChange;
   fa.sChangeEx = strChangeEx;
   fa.bKeyDown = bKeyDown;
@@ -945,19 +925,20 @@ std::pair<bool, bool> CFFL_InteractiveFormFiller::OnBeforeKeyStroke(
                              fa);
   pFormFiller->SaveState(privateData.pPageView);
 
-  ObservedPtr<CPDFSDK_Annot> pObserved(privateData.pWidget);
+  ObservedPtr<CPDFSDK_Annot> pObserved(privateData.GetWidget());
   bool action_status = privateData.pWidget->OnAAction(
       CPDF_AAction::kKeyStroke, &fa, privateData.pPageView);
 
-  if (!pObserved || !IsValidAnnot(privateData.pPageView, privateData.pWidget))
+  if (!pObserved ||
+      !IsValidAnnot(privateData.pPageView, privateData.GetWidget())) {
     return {true, true};
-
+  }
   if (!action_status)
     return {true, false};
 
   bool bExit = false;
   if (nAge != privateData.pWidget->GetAppearanceAge()) {
-    CPWL_Wnd* pWnd = pFormFiller->ResetPDFWindow(
+    CPWL_Wnd* pWnd = pFormFiller->ResetPWLWindow(
         privateData.pPageView, nValueAge == privateData.pWidget->GetValueAge());
     if (!pWnd)
       return {true, true};
@@ -971,19 +952,48 @@ std::pair<bool, bool> CFFL_InteractiveFormFiller::OnBeforeKeyStroke(
   } else {
     pFormFiller->RestoreState(privateData.pPageView);
   }
-  if (pFormFillEnv->GetFocusAnnot() == privateData.pWidget)
+  if (pFormFillEnv->GetFocusAnnot() == privateData.GetWidget())
     return {false, bExit};
 
   pFormFiller->CommitData(privateData.pPageView, nFlag);
   return {false, true};
 }
 
+bool CFFL_InteractiveFormFiller::OnPopupPreOpen(
+    const IPWL_SystemHandler::PerWindowData* pAttached,
+    uint32_t nFlag) {
+#ifdef PDF_ENABLE_XFA
+  auto* pData = static_cast<const CFFL_PrivateData*>(pAttached);
+  ASSERT(pData->pWidget);
+
+  ObservedPtr<CPDFSDK_Annot> pObserved(pData->GetWidget());
+  return OnPreOpen(&pObserved, pData->pPageView, nFlag) || !pObserved;
+#else
+  return false;
+#endif
+}
+
+bool CFFL_InteractiveFormFiller::OnPopupPostOpen(
+    const IPWL_SystemHandler::PerWindowData* pAttached,
+    uint32_t nFlag) {
+#ifdef PDF_ENABLE_XFA
+  auto* pData = static_cast<const CFFL_PrivateData*>(pAttached);
+  ASSERT(pData->pWidget);
+
+  ObservedPtr<CPDFSDK_Annot> pObserved(pData->GetWidget());
+  return OnPostOpen(&pObserved, pData->pPageView, nFlag) || !pObserved;
+#else
+  return false;
+#endif
+}
+
 CFFL_PrivateData::CFFL_PrivateData() = default;
 
 CFFL_PrivateData::CFFL_PrivateData(const CFFL_PrivateData& that) = default;
 
 CFFL_PrivateData::~CFFL_PrivateData() = default;
 
-std::unique_ptr<CPWL_Wnd::PrivateData> CFFL_PrivateData::Clone() const {
+std::unique_ptr<IPWL_SystemHandler::PerWindowData> CFFL_PrivateData::Clone()
+    const {
   return pdfium::MakeUnique<CFFL_PrivateData>(*this);
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.h
index 1370b2584ab..d618d924aae 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.h
@@ -11,9 +11,12 @@
 #include <memory>
 #include <utility>
 
+#include "core/fxcrt/observed_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "fpdfsdk/cpdfsdk_annot.h"
 #include "fpdfsdk/pwl/cpwl_edit.h"
+#include "fpdfsdk/pwl/cpwl_wnd.h"
+#include "fpdfsdk/pwl/ipwl_systemhandler.h"
 
 class CFFL_FormFiller;
 class CPDFSDK_FormFillEnvironment;
@@ -118,46 +121,44 @@ class CFFL_InteractiveFormFiller final : public IPWL_Filler_Notify {
                         bool selected);
   bool IsIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot, int index);
 
-#ifdef PDF_ENABLE_XFA
-  bool OnClick(ObservedPtr<CPDFSDK_Annot>* pAnnot,
-               CPDFSDK_PageView* pPageView,
-               uint32_t nFlag);
-  bool OnFull(ObservedPtr<CPDFSDK_Annot>* pAnnot,
-              CPDFSDK_PageView* pPageView,
-              uint32_t nFlag);
-  bool OnPreOpen(ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                 CPDFSDK_PageView* pPageView,
-                 uint32_t nFlag);
-  bool OnPostOpen(ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                  CPDFSDK_PageView* pPageView,
-                  uint32_t nFlag);
-#endif  // PDF_ENABLE_XFA
-
  private:
   using WidgetToFormFillerMap =
       std::map<CPDFSDK_Annot*, std::unique_ptr<CFFL_FormFiller>>;
 
   // IPWL_Filler_Notify:
-  void QueryWherePopup(const CPWL_Wnd::PrivateData* pAttached,
+  void QueryWherePopup(const IPWL_SystemHandler::PerWindowData* pAttached,
                        float fPopupMin,
                        float fPopupMax,
                        bool* bBottom,
                        float* fPopupRet) override;
   // Returns {bRC, bExit}.
   std::pair<bool, bool> OnBeforeKeyStroke(
-      const CPWL_Wnd::PrivateData* pAttached,
+      const IPWL_SystemHandler::PerWindowData* pAttached,
       WideString& strChange,
       const WideString& strChangeEx,
       int nSelStart,
       int nSelEnd,
       bool bKeyDown,
       uint32_t nFlag) override;
-#ifdef PDF_ENABLE_XFA
-  bool OnPopupPreOpen(const CPWL_Wnd::PrivateData* pAttached,
+  bool OnPopupPreOpen(const IPWL_SystemHandler::PerWindowData* pAttached,
                       uint32_t nFlag) override;
-  bool OnPopupPostOpen(const CPWL_Wnd::PrivateData* pAttached,
+  bool OnPopupPostOpen(const IPWL_SystemHandler::PerWindowData* pAttached,
                        uint32_t nFlag) override;
+
+#ifdef PDF_ENABLE_XFA
   void SetFocusAnnotTab(CPDFSDK_Annot* pWidget, bool bSameField, bool bNext);
+  bool OnClick(ObservedPtr<CPDFSDK_Annot>* pAnnot,
+               CPDFSDK_PageView* pPageView,
+               uint32_t nFlag);
+  bool OnFull(ObservedPtr<CPDFSDK_Annot>* pAnnot,
+              CPDFSDK_PageView* pPageView,
+              uint32_t nFlag);
+  bool OnPreOpen(ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                 CPDFSDK_PageView* pPageView,
+                 uint32_t nFlag);
+  bool OnPostOpen(ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                  CPDFSDK_PageView* pPageView,
+                  uint32_t nFlag);
 #endif  // PDF_ENABLE_XFA
 
   CFFL_FormFiller* GetFormFiller(CPDFSDK_Annot* pAnnot);
@@ -169,16 +170,18 @@ class CFFL_InteractiveFormFiller final : public IPWL_Filler_Notify {
   bool m_bNotifying = false;
 };
 
-class CFFL_PrivateData final : public CPWL_Wnd::PrivateData {
+class CFFL_PrivateData final : public IPWL_SystemHandler::PerWindowData {
  public:
   CFFL_PrivateData();
   CFFL_PrivateData(const CFFL_PrivateData& that);
   ~CFFL_PrivateData() override;
 
   // CPWL_Wnd::PrivateData:
-  std::unique_ptr<CPWL_Wnd::PrivateData> Clone() const override;
+  std::unique_ptr<IPWL_SystemHandler::PerWindowData> Clone() const override;
+
+  CPDFSDK_Widget* GetWidget() const { return pWidget.Get(); }
 
-  CPDFSDK_Widget* pWidget = nullptr;
+  ObservedPtr<CPDFSDK_Widget> pWidget;
   CPDFSDK_PageView* pPageView = nullptr;
   uint32_t nWidgetAppearanceAge = 0;
   uint32_t nWidgetValueAge = 0;
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.cpp
index a90cac68c01..7f2999cc898 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.cpp
@@ -41,7 +41,7 @@ CPWL_Wnd::CreateParams CFFL_ListBox::GetCreateParam() {
 
 std::unique_ptr<CPWL_Wnd> CFFL_ListBox::NewPWLWindow(
     const CPWL_Wnd::CreateParams& cp,
-    std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) {
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData) {
   auto pWnd = pdfium::MakeUnique<CPWL_ListBox>(cp, std::move(pAttachedData));
   pWnd->AttachFFLData(this);
   pWnd->Realize();
@@ -84,7 +84,7 @@ bool CFFL_ListBox::OnChar(CPDFSDK_Annot* pAnnot,
 }
 
 bool CFFL_ListBox::IsDataChanged(CPDFSDK_PageView* pPageView) {
-  auto* pListBox = static_cast<CPWL_ListBox*>(GetPDFWindow(pPageView, false));
+  auto* pListBox = static_cast<CPWL_ListBox*>(GetPWLWindow(pPageView, false));
   if (!pListBox)
     return false;
 
@@ -106,7 +106,7 @@ bool CFFL_ListBox::IsDataChanged(CPDFSDK_PageView* pPageView) {
 
 void CFFL_ListBox::SaveData(CPDFSDK_PageView* pPageView) {
   CPWL_ListBox* pListBox =
-      static_cast<CPWL_ListBox*>(GetPDFWindow(pPageView, false));
+      static_cast<CPWL_ListBox*>(GetPWLWindow(pPageView, false));
   if (!pListBox)
     return;
 
@@ -129,7 +129,7 @@ void CFFL_ListBox::SaveData(CPDFSDK_PageView* pPageView) {
   if (!observed_widget)
     return;
 
-  m_pWidget->ResetFieldAppearance(true);
+  m_pWidget->ResetFieldAppearance();
   if (!observed_widget)
     return;
 
@@ -149,7 +149,7 @@ void CFFL_ListBox::GetActionData(CPDFSDK_PageView* pPageView,
         fa.sValue.clear();
       } else {
         auto* pListBox =
-            static_cast<CPWL_ListBox*>(GetPDFWindow(pPageView, false));
+            static_cast<CPWL_ListBox*>(GetPWLWindow(pPageView, false));
         if (pListBox) {
           int32_t nCurSel = pListBox->GetCurSel();
           if (nCurSel >= 0)
@@ -176,7 +176,7 @@ void CFFL_ListBox::SaveState(CPDFSDK_PageView* pPageView) {
   ASSERT(pPageView);
 
   CPWL_ListBox* pListBox =
-      static_cast<CPWL_ListBox*>(GetPDFWindow(pPageView, false));
+      static_cast<CPWL_ListBox*>(GetPWLWindow(pPageView, false));
   if (!pListBox)
     return;
 
@@ -188,7 +188,7 @@ void CFFL_ListBox::SaveState(CPDFSDK_PageView* pPageView) {
 
 void CFFL_ListBox::RestoreState(CPDFSDK_PageView* pPageView) {
   CPWL_ListBox* pListBox =
-      static_cast<CPWL_ListBox*>(GetPDFWindow(pPageView, false));
+      static_cast<CPWL_ListBox*>(GetPWLWindow(pPageView, false));
   if (!pListBox)
     return;
 
@@ -207,7 +207,7 @@ bool CFFL_ListBox::SetIndexSelected(int index, bool selected) {
   ASSERT(pPageView);
 
   CPWL_ListBox* pListBox =
-      static_cast<CPWL_ListBox*>(GetPDFWindow(pPageView, false));
+      static_cast<CPWL_ListBox*>(GetPWLWindow(pPageView, false));
   if (!pListBox)
     return false;
 
@@ -233,7 +233,7 @@ bool CFFL_ListBox::IsIndexSelected(int index) {
   ASSERT(pPageView);
 
   CPWL_ListBox* pListBox =
-      static_cast<CPWL_ListBox*>(GetPDFWindow(pPageView, false));
+      static_cast<CPWL_ListBox*>(GetPWLWindow(pPageView, false));
   if (!pListBox)
     return false;
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.h
index 3d71e7c057b..b3fe03453d0 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_listbox.h
@@ -24,7 +24,8 @@ class CFFL_ListBox final : public CFFL_TextObject {
   CPWL_Wnd::CreateParams GetCreateParam() override;
   std::unique_ptr<CPWL_Wnd> NewPWLWindow(
       const CPWL_Wnd::CreateParams& cp,
-      std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) override;
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
+      override;
   bool OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags) override;
   bool IsDataChanged(CPDFSDK_PageView* pPageView) override;
   void SaveData(CPDFSDK_PageView* pPageView) override;
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.cpp
index 4f80593973d..e9872f6b24f 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.cpp
@@ -10,6 +10,7 @@
 
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
 #include "fpdfsdk/pwl/cpwl_special_button.h"
+#include "third_party/base/ptr_util.h"
 
 CFFL_PushButton::CFFL_PushButton(CPDFSDK_FormFillEnvironment* pApp,
                                  CPDFSDK_Widget* pWidget)
@@ -19,7 +20,7 @@ CFFL_PushButton::~CFFL_PushButton() = default;
 
 std::unique_ptr<CPWL_Wnd> CFFL_PushButton::NewPWLWindow(
     const CPWL_Wnd::CreateParams& cp,
-    std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) {
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData) {
   auto pWnd = pdfium::MakeUnique<CPWL_PushButton>(cp, std::move(pAttachedData));
   pWnd->Realize();
   return std::move(pWnd);
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.h
index fe4803473d9..9ebaf60769f 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_pushbutton.h
@@ -19,7 +19,8 @@ class CFFL_PushButton final : public CFFL_Button {
   // CFFL_Button:
   std::unique_ptr<CPWL_Wnd> NewPWLWindow(
       const CPWL_Wnd::CreateParams& cp,
-      std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) override;
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
+      override;
 };
 
 #endif  // FPDFSDK_FORMFILLER_CFFL_PUSHBUTTON_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.cpp
index 788db4910d3..caa63490921 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.cpp
@@ -8,6 +8,7 @@
 
 #include <utility>
 
+#include "core/fpdfdoc/cpdf_formcontrol.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_widget.h"
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
@@ -22,7 +23,7 @@ CFFL_RadioButton::~CFFL_RadioButton() {}
 
 std::unique_ptr<CPWL_Wnd> CFFL_RadioButton::NewPWLWindow(
     const CPWL_Wnd::CreateParams& cp,
-    std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) {
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData) {
   auto pWnd =
       pdfium::MakeUnique<CPWL_RadioButton>(cp, std::move(pAttachedData));
   pWnd->Realize();
@@ -118,5 +119,5 @@ void CFFL_RadioButton::SaveData(CPDFSDK_PageView* pPageView) {
 
 CPWL_RadioButton* CFFL_RadioButton::GetRadioButton(CPDFSDK_PageView* pPageView,
                                                    bool bNew) {
-  return static_cast<CPWL_RadioButton*>(GetPDFWindow(pPageView, bNew));
+  return static_cast<CPWL_RadioButton*>(GetPWLWindow(pPageView, bNew));
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.h
index ccbbd3a6503..8ba2f285cd1 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_radiobutton.h
@@ -21,7 +21,8 @@ class CFFL_RadioButton final : public CFFL_Button {
   // CFFL_Button:
   std::unique_ptr<CPWL_Wnd> NewPWLWindow(
       const CPWL_Wnd::CreateParams& cp,
-      std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) override;
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
+      override;
   bool OnKeyDown(uint32_t nKeyCode, uint32_t nFlags) override;
   bool OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags) override;
   bool OnLButtonUp(CPDFSDK_PageView* pPageView,
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.cpp
index a0c60b8e4a2..592211bd576 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.cpp
@@ -72,7 +72,7 @@ CPWL_Wnd::CreateParams CFFL_TextField::GetCreateParam() {
 
 std::unique_ptr<CPWL_Wnd> CFFL_TextField::NewPWLWindow(
     const CPWL_Wnd::CreateParams& cp,
-    std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) {
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData) {
   auto pWnd = pdfium::MakeUnique<CPWL_Edit>(cp, std::move(pAttachedData));
   pWnd->AttachFFLData(this);
   pWnd->Realize();
@@ -107,7 +107,7 @@ bool CFFL_TextField::OnChar(CPDFSDK_Annot* pAnnot,
                                  pAnnot->GetRect().GetOuterRect());
 
       if (m_bValid) {
-        if (CPWL_Wnd* pWnd = GetPDFWindow(pPageView, true))
+        if (CPWL_Wnd* pWnd = GetPWLWindow(pPageView, true))
           pWnd->SetFocus();
         break;
       }
@@ -115,7 +115,7 @@ bool CFFL_TextField::OnChar(CPDFSDK_Annot* pAnnot,
       if (!CommitData(pPageView, nFlags))
         return false;
 
-      DestroyPDFWindow(pPageView);
+      DestroyPWLWindow(pPageView);
       return true;
     }
     case FWL_VKEY_Escape: {
@@ -147,7 +147,7 @@ void CFFL_TextField::SaveData(CPDFSDK_PageView* pPageView) {
   if (!observed_widget)
     return;
 
-  m_pWidget->ResetFieldAppearance(true);
+  m_pWidget->ResetFieldAppearance();
   if (!observed_widget)
     return;
 
@@ -260,5 +260,5 @@ void CFFL_TextField::OnSetFocus(CPWL_Edit* pEdit) {
 }
 
 CPWL_Edit* CFFL_TextField::GetEdit(CPDFSDK_PageView* pPageView, bool bNew) {
-  return static_cast<CPWL_Edit*>(GetPDFWindow(pPageView, bNew));
+  return static_cast<CPWL_Edit*>(GetPWLWindow(pPageView, bNew));
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.h
index e45755fc948..43917fc0f7a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textfield.h
@@ -36,7 +36,8 @@ class CFFL_TextField final : public CFFL_TextObject,
   CPWL_Wnd::CreateParams GetCreateParam() override;
   std::unique_ptr<CPWL_Wnd> NewPWLWindow(
       const CPWL_Wnd::CreateParams& cp,
-      std::unique_ptr<CPWL_Wnd::PrivateData> pAttachedData) override;
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
+      override;
   bool OnChar(CPDFSDK_Annot* pAnnot, uint32_t nChar, uint32_t nFlags) override;
   bool IsDataChanged(CPDFSDK_PageView* pPageView) override;
   void SaveData(CPDFSDK_PageView* pPageView) override;
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textobject.cpp b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textobject.cpp
index 676d4072ff0..6d84960767a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textobject.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textobject.cpp
@@ -5,18 +5,21 @@
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "fpdfsdk/formfiller/cffl_textobject.h"
+
+#include "core/fpdfapi/page/cpdf_page.h"
+#include "core/fpdfdoc/cba_fontmap.h"
 #include "third_party/base/ptr_util.h"
 
-CPWL_Wnd* CFFL_TextObject::ResetPDFWindow(CPDFSDK_PageView* pPageView,
+CPWL_Wnd* CFFL_TextObject::ResetPWLWindow(CPDFSDK_PageView* pPageView,
                                           bool bRestoreValue) {
   if (bRestoreValue)
     SaveState(pPageView);
 
-  DestroyPDFWindow(pPageView);
+  DestroyPWLWindow(pPageView);
   if (bRestoreValue)
     RestoreState(pPageView);
 
-  ObservedPtr<CPWL_Wnd> pRet(GetPDFWindow(pPageView, !bRestoreValue));
+  ObservedPtr<CPWL_Wnd> pRet(GetPWLWindow(pPageView, !bRestoreValue));
   m_pWidget->UpdateField();  // May invoke JS, invalidating |pRet|.
   return pRet.Get();
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textobject.h b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textobject.h
index fcb3c1b971f..a2381afb48c 100644
--- a/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textobject.h
+++ b/chromium/third_party/pdfium/fpdfsdk/formfiller/cffl_textobject.h
@@ -11,12 +11,14 @@
 
 #include "fpdfsdk/formfiller/cffl_formfiller.h"
 
+class CBA_FontMap;
+
 // Class to implement common functionality for CFFL_FormFiller sub-classes with
 // text fields.
 class CFFL_TextObject : public CFFL_FormFiller {
  public:
   // CFFL_FormFiller:
-  CPWL_Wnd* ResetPDFWindow(CPDFSDK_PageView* pPageView,
+  CPWL_Wnd* ResetPWLWindow(CPDFSDK_PageView* pPageView,
                            bool bRestoreValue) override;
 
  protected:
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_annot.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_annot.cpp
index 1274b4a3ee4..211c1020e77 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_annot.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_annot.cpp
@@ -9,6 +9,7 @@
 
 #include "constants/annotation_common.h"
 #include "core/fpdfapi/edit/cpdf_pagecontentgenerator.h"
+#include "core/fpdfapi/page/cpdf_annotcontext.h"
 #include "core/fpdfapi/page/cpdf_form.h"
 #include "core/fpdfapi/page/cpdf_page.h"
 #include "core/fpdfapi/page/cpdf_pageobject.h"
@@ -25,7 +26,6 @@
 #include "core/fpdfdoc/cpdf_interactiveform.h"
 #include "core/fpdfdoc/cpvt_generateap.h"
 #include "core/fxge/cfx_color.h"
-#include "fpdfsdk/cpdf_annotcontext.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
 #include "fpdfsdk/cpdfsdk_interactiveform.h"
 #include "third_party/base/ptr_util.h"
@@ -253,7 +253,7 @@ FPDFPage_CreateAnnot(FPDF_PAGE page, FPDF_ANNOTATION_SUBTYPE subtype) {
 
 FPDF_EXPORT int FPDF_CALLCONV FPDFPage_GetAnnotCount(FPDF_PAGE page) {
   CPDF_Page* pPage = CPDFPageFromFPDFPage(page);
-  if (!pPage || !pPage->GetDict())
+  if (!pPage)
     return 0;
 
   CPDF_Array* pAnnots = pPage->GetDict()->GetArrayFor("Annots");
@@ -263,7 +263,7 @@ FPDF_EXPORT int FPDF_CALLCONV FPDFPage_GetAnnotCount(FPDF_PAGE page) {
 FPDF_EXPORT FPDF_ANNOTATION FPDF_CALLCONV FPDFPage_GetAnnot(FPDF_PAGE page,
                                                             int index) {
   CPDF_Page* pPage = CPDFPageFromFPDFPage(page);
-  if (!pPage || !pPage->GetDict() || index < 0)
+  if (!pPage || index < 0)
     return nullptr;
 
   CPDF_Array* pAnnots = pPage->GetDict()->GetArrayFor("Annots");
@@ -283,7 +283,7 @@ FPDF_EXPORT FPDF_ANNOTATION FPDF_CALLCONV FPDFPage_GetAnnot(FPDF_PAGE page,
 FPDF_EXPORT int FPDF_CALLCONV FPDFPage_GetAnnotIndex(FPDF_PAGE page,
                                                      FPDF_ANNOTATION annot) {
   CPDF_Page* pPage = CPDFPageFromFPDFPage(page);
-  if (!pPage || !pPage->GetDict())
+  if (!pPage)
     return -1;
 
   CPDF_Dictionary* pAnnotDict = GetAnnotDictFromFPDFAnnotation(annot);
@@ -313,7 +313,7 @@ FPDF_EXPORT void FPDF_CALLCONV FPDFPage_CloseAnnot(FPDF_ANNOTATION annot) {
 FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV FPDFPage_RemoveAnnot(FPDF_PAGE page,
                                                          int index) {
   CPDF_Page* pPage = CPDFPageFromFPDFPage(page);
-  if (!pPage || !pPage->GetDict() || index < 0)
+  if (!pPage || index < 0)
     return false;
 
   CPDF_Array* pAnnots = pPage->GetDict()->GetArrayFor("Annots");
@@ -841,17 +841,11 @@ FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV FPDFAnnot_SetFlags(FPDF_ANNOTATION annot,
 }
 
 FPDF_EXPORT int FPDF_CALLCONV
-FPDFAnnot_GetFormFieldFlags(FPDF_FORMHANDLE hHandle,
-                            FPDF_PAGE page,
-                            FPDF_ANNOTATION annot) {
+FPDFAnnot_GetFormFieldFlags(FPDF_FORMHANDLE hHandle, FPDF_ANNOTATION annot) {
   CPDFSDK_InteractiveForm* pForm = FormHandleToInteractiveForm(hHandle);
   if (!pForm)
     return FPDF_FORMFLAG_NONE;
 
-  CPDF_Page* pPage = CPDFPageFromFPDFPage(page);
-  if (!pPage)
-    return FPDF_FORMFLAG_NONE;
-
   CPDF_Dictionary* pAnnotDict = GetAnnotDictFromFPDFAnnotation(annot);
   if (!pAnnotDict)
     return FPDF_FORMFLAG_NONE;
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_annot_embeddertest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_annot_embeddertest.cpp
index aaf3657efdc..625a4b01bba 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_annot_embeddertest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_annot_embeddertest.cpp
@@ -1427,7 +1427,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormFieldFlagsTextField) {
     ASSERT_TRUE(annot);
 
     // Check that the flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_FALSE(flags & FPDF_FORMFLAG_READONLY);
   }
 
@@ -1437,7 +1437,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormFieldFlagsTextField) {
     ASSERT_TRUE(annot);
 
     // Check that the flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_TRUE(flags & FPDF_FORMFLAG_READONLY);
   }
 
@@ -1456,7 +1456,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormFieldFlagsComboBox) {
     ASSERT_TRUE(annot);
 
     // Check that the flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_FALSE(flags & FPDF_FORMFLAG_READONLY);
     EXPECT_TRUE(flags & FPDF_FORMFLAG_CHOICE_COMBO);
     EXPECT_TRUE(flags & FPDF_FORMFLAG_CHOICE_EDIT);
@@ -1468,7 +1468,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormFieldFlagsComboBox) {
     ASSERT_TRUE(annot);
 
     // Check that the flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_FALSE(flags & FPDF_FORMFLAG_READONLY);
     EXPECT_TRUE(flags & FPDF_FORMFLAG_CHOICE_COMBO);
     EXPECT_FALSE(flags & FPDF_FORMFLAG_CHOICE_EDIT);
@@ -1480,7 +1480,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormFieldFlagsComboBox) {
     ASSERT_TRUE(annot);
 
     // Check that the flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_TRUE(flags & FPDF_FORMFLAG_READONLY);
     EXPECT_TRUE(flags & FPDF_FORMFLAG_CHOICE_COMBO);
     EXPECT_FALSE(flags & FPDF_FORMFLAG_CHOICE_EDIT);
@@ -1526,7 +1526,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormAnnotAndCheckFlagsTextField) {
     ASSERT_TRUE(annot);
 
     // Check that interactive form annotation flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_FALSE(flags & FPDF_FORMFLAG_READONLY);
   }
 
@@ -1537,7 +1537,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormAnnotAndCheckFlagsTextField) {
     ASSERT_TRUE(annot);
 
     // Check that interactive form annotation flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_TRUE(flags & FPDF_FORMFLAG_READONLY);
   }
 
@@ -1557,7 +1557,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormAnnotAndCheckFlagsComboBox) {
     ASSERT_TRUE(annot);
 
     // Check that interactive form annotation flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_FALSE(flags & FPDF_FORMFLAG_READONLY);
     EXPECT_TRUE(flags & FPDF_FORMFLAG_CHOICE_COMBO);
     EXPECT_TRUE(flags & FPDF_FORMFLAG_CHOICE_EDIT);
@@ -1570,7 +1570,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormAnnotAndCheckFlagsComboBox) {
     ASSERT_TRUE(annot);
 
     // Check that interactive form annotation flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_FALSE(flags & FPDF_FORMFLAG_READONLY);
     EXPECT_TRUE(flags & FPDF_FORMFLAG_CHOICE_COMBO);
     EXPECT_FALSE(flags & FPDF_FORMFLAG_CHOICE_EDIT);
@@ -1583,7 +1583,7 @@ TEST_F(FPDFAnnotEmbedderTest, GetFormAnnotAndCheckFlagsComboBox) {
     ASSERT_TRUE(annot);
 
     // Check that interactive form annotation flag values are as expected.
-    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), page, annot.get());
+    int flags = FPDFAnnot_GetFormFieldFlags(form_handle(), annot.get());
     EXPECT_TRUE(flags & FPDF_FORMFLAG_READONLY);
     EXPECT_TRUE(flags & FPDF_FORMFLAG_CHOICE_COMBO);
     EXPECT_FALSE(flags & FPDF_FORMFLAG_CHOICE_EDIT);
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_catalog_unittest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_catalog_unittest.cpp
index 1b12506190f..68655da3104 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_catalog_unittest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_catalog_unittest.cpp
@@ -6,8 +6,8 @@
 
 #include <memory>
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfapi/parser/cpdf_number.h"
@@ -31,7 +31,7 @@ class CPDF_TestDocument final : public CPDF_Document {
 class PDFCatalogTest : public testing::Test {
  public:
   void SetUp() override {
-    CPDF_ModuleMgr::Create();
+    CPDF_PageModule::Create();
     auto pTestDoc = pdfium::MakeUnique<CPDF_TestDocument>();
     m_pDoc.reset(FPDFDocumentFromCPDFDocument(pTestDoc.release()));
     m_pRootObj = pdfium::MakeRetain<CPDF_Dictionary>();
@@ -39,7 +39,7 @@ class PDFCatalogTest : public testing::Test {
 
   void TearDown() override {
     m_pDoc.reset();
-    CPDF_ModuleMgr::Destroy();
+    CPDF_PageModule::Destroy();
   }
 
  protected:
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_dataavail.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_dataavail.cpp
index aa3968ff2de..2384b6e222a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_dataavail.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_dataavail.cpp
@@ -52,18 +52,16 @@ namespace {
 
 class FPDF_FileAvailContext final : public CPDF_DataAvail::FileAvail {
  public:
-  FPDF_FileAvailContext() : m_pfileAvail(nullptr) {}
-  ~FPDF_FileAvailContext() override {}
-
-  void Set(FX_FILEAVAIL* pfileAvail) { m_pfileAvail = pfileAvail; }
+  explicit FPDF_FileAvailContext(FX_FILEAVAIL* avail) : avail_(avail) {}
+  ~FPDF_FileAvailContext() override = default;
 
   // CPDF_DataAvail::FileAvail:
   bool IsDataAvail(FX_FILESIZE offset, size_t size) override {
-    return !!m_pfileAvail->IsDataAvail(m_pfileAvail, offset, size);
+    return !!avail_->IsDataAvail(avail_, offset, size);
   }
 
  private:
-  FX_FILEAVAIL* m_pfileAvail;
+  FX_FILEAVAIL* const avail_;
 };
 
 class FPDF_FileAccessContext final : public IFX_SeekableReadStream {
@@ -71,10 +69,8 @@ class FPDF_FileAccessContext final : public IFX_SeekableReadStream {
   template <typename T, typename... Args>
   friend RetainPtr<T> pdfium::MakeRetain(Args&&... args);
 
-  void Set(FPDF_FILEACCESS* pFile) { m_pFileAccess = pFile; }
-
-  // IFX_SeekableReadStream
-  FX_FILESIZE GetSize() override { return m_pFileAccess->m_FileLen; }
+  // IFX_SeekableReadStream:
+  FX_FILESIZE GetSize() override { return file_->m_FileLen; }
 
   bool ReadBlockAtOffset(void* buffer,
                          FX_FILESIZE offset,
@@ -85,15 +81,15 @@ class FPDF_FileAccessContext final : public IFX_SeekableReadStream {
     FX_SAFE_FILESIZE new_pos = pdfium::base::checked_cast<FX_FILESIZE>(size);
     new_pos += offset;
     return new_pos.IsValid() && new_pos.ValueOrDie() <= GetSize() &&
-           m_pFileAccess->m_GetBlock(m_pFileAccess->m_Param, offset,
-                                     static_cast<uint8_t*>(buffer), size);
+           file_->m_GetBlock(file_->m_Param, offset,
+                             static_cast<uint8_t*>(buffer), size);
   }
 
  private:
-  FPDF_FileAccessContext() : m_pFileAccess(nullptr) {}
+  explicit FPDF_FileAccessContext(FPDF_FILEACCESS* file) : file_(file) {}
   ~FPDF_FileAccessContext() override = default;
 
-  FPDF_FILEACCESS* m_pFileAccess;
+  FPDF_FILEACCESS* const file_;
 };
 
 class FPDF_DownloadHintsContext final : public CPDF_DataAvail::DownloadHints {
@@ -116,14 +112,20 @@ class FPDF_DownloadHintsContext final : public CPDF_DataAvail::DownloadHints {
 
 class FPDF_AvailContext {
  public:
-  FPDF_AvailContext()
-      : m_FileAvail(pdfium::MakeUnique<FPDF_FileAvailContext>()),
-        m_FileRead(pdfium::MakeRetain<FPDF_FileAccessContext>()) {}
-  ~FPDF_AvailContext() {}
-
-  std::unique_ptr<FPDF_FileAvailContext> m_FileAvail;
-  RetainPtr<FPDF_FileAccessContext> m_FileRead;
-  std::unique_ptr<CPDF_DataAvail> m_pDataAvail;
+  FPDF_AvailContext(FX_FILEAVAIL* file_avail, FPDF_FILEACCESS* file)
+      : file_avail_(pdfium::MakeUnique<FPDF_FileAvailContext>(file_avail)),
+        file_read_(pdfium::MakeRetain<FPDF_FileAccessContext>(file)),
+        data_avail_(pdfium::MakeUnique<CPDF_DataAvail>(file_avail_.get(),
+                                                       file_read_,
+                                                       true)) {}
+  ~FPDF_AvailContext() = default;
+
+  CPDF_DataAvail* data_avail() { return data_avail_.get(); }
+
+ private:
+  std::unique_ptr<FPDF_FileAvailContext> const file_avail_;
+  RetainPtr<FPDF_FileAccessContext> const file_read_;
+  std::unique_ptr<CPDF_DataAvail> const data_avail_;
 };
 
 FPDF_AvailContext* FPDFAvailContextFromFPDFAvail(FPDF_AVAIL avail) {
@@ -134,11 +136,7 @@ FPDF_AvailContext* FPDFAvailContextFromFPDFAvail(FPDF_AVAIL avail) {
 
 FPDF_EXPORT FPDF_AVAIL FPDF_CALLCONV FPDFAvail_Create(FX_FILEAVAIL* file_avail,
                                                       FPDF_FILEACCESS* file) {
-  auto pAvail = pdfium::MakeUnique<FPDF_AvailContext>();
-  pAvail->m_FileAvail->Set(file_avail);
-  pAvail->m_FileRead->Set(file);
-  pAvail->m_pDataAvail = pdfium::MakeUnique<CPDF_DataAvail>(
-      pAvail->m_FileAvail.get(), pAvail->m_FileRead, true);
+  auto pAvail = pdfium::MakeUnique<FPDF_AvailContext>(file_avail, file);
   return pAvail.release();  // Caller takes ownership.
 }
 
@@ -149,21 +147,21 @@ FPDF_EXPORT void FPDF_CALLCONV FPDFAvail_Destroy(FPDF_AVAIL avail) {
 
 FPDF_EXPORT int FPDF_CALLCONV FPDFAvail_IsDocAvail(FPDF_AVAIL avail,
                                                    FX_DOWNLOADHINTS* hints) {
-  if (!avail)
+  auto* avail_context = FPDFAvailContextFromFPDFAvail(avail);
+  if (!avail_context)
     return PDF_DATA_ERROR;
   FPDF_DownloadHintsContext hints_context(hints);
-  return FPDFAvailContextFromFPDFAvail(avail)->m_pDataAvail->IsDocAvail(
-      &hints_context);
+  return avail_context->data_avail()->IsDocAvail(&hints_context);
 }
 
 FPDF_EXPORT FPDF_DOCUMENT FPDF_CALLCONV
 FPDFAvail_GetDocument(FPDF_AVAIL avail, FPDF_BYTESTRING password) {
-  auto* pDataAvail = FPDFAvailContextFromFPDFAvail(avail);
-  if (!pDataAvail)
+  auto* avail_context = FPDFAvailContextFromFPDFAvail(avail);
+  if (!avail_context)
     return nullptr;
   CPDF_Parser::Error error;
   std::unique_ptr<CPDF_Document> document;
-  std::tie(error, document) = pDataAvail->m_pDataAvail->ParseDocument(
+  std::tie(error, document) = avail_context->data_avail()->ParseDocument(
       pdfium::MakeUnique<CPDF_DocRenderData>(),
       pdfium::MakeUnique<CPDF_DocPageData>(), password);
   if (error != CPDF_Parser::SUCCESS) {
@@ -187,26 +185,27 @@ FPDF_EXPORT int FPDF_CALLCONV FPDFAvail_GetFirstPageNum(FPDF_DOCUMENT doc) {
 FPDF_EXPORT int FPDF_CALLCONV FPDFAvail_IsPageAvail(FPDF_AVAIL avail,
                                                     int page_index,
                                                     FX_DOWNLOADHINTS* hints) {
-  if (!avail)
+  auto* avail_context = FPDFAvailContextFromFPDFAvail(avail);
+  if (!avail_context)
     return PDF_DATA_ERROR;
   if (page_index < 0)
     return PDF_DATA_NOTAVAIL;
   FPDF_DownloadHintsContext hints_context(hints);
-  return FPDFAvailContextFromFPDFAvail(avail)->m_pDataAvail->IsPageAvail(
-      page_index, &hints_context);
+  return avail_context->data_avail()->IsPageAvail(page_index, &hints_context);
 }
 
 FPDF_EXPORT int FPDF_CALLCONV FPDFAvail_IsFormAvail(FPDF_AVAIL avail,
                                                     FX_DOWNLOADHINTS* hints) {
-  if (!avail)
+  auto* avail_context = FPDFAvailContextFromFPDFAvail(avail);
+  if (!avail_context)
     return PDF_FORM_ERROR;
   FPDF_DownloadHintsContext hints_context(hints);
-  return FPDFAvailContextFromFPDFAvail(avail)->m_pDataAvail->IsFormAvail(
-      &hints_context);
+  return avail_context->data_avail()->IsFormAvail(&hints_context);
 }
 
 FPDF_EXPORT int FPDF_CALLCONV FPDFAvail_IsLinearized(FPDF_AVAIL avail) {
-  if (!avail)
+  auto* avail_context = FPDFAvailContextFromFPDFAvail(avail);
+  if (!avail_context)
     return PDF_LINEARIZATION_UNKNOWN;
-  return FPDFAvailContextFromFPDFAvail(avail)->m_pDataAvail->IsLinearizedPDF();
+  return avail_context->data_avail()->IsLinearizedPDF();
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_dataavail_embeddertest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_dataavail_embeddertest.cpp
index 137c5c91c12..02b481c6eaa 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_dataavail_embeddertest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_dataavail_embeddertest.cpp
@@ -4,7 +4,6 @@
 
 #include <algorithm>
 #include <memory>
-#include <set>
 #include <string>
 #include <utility>
 #include <vector>
@@ -30,7 +29,7 @@ class MockDownloadHints final : public FX_DOWNLOADHINTS {
     FX_DOWNLOADHINTS::AddSegment = SAddSegment;
   }
 
-  ~MockDownloadHints() {}
+  ~MockDownloadHints() = default;
 };
 
 class TestAsyncLoader final : public FX_DOWNLOADHINTS, FX_FILEAVAIL {
@@ -148,7 +147,7 @@ class TestAsyncLoader final : public FX_DOWNLOADHINTS, FX_FILEAVAIL {
   FPDF_FILEACCESS file_access_;
 
   std::unique_ptr<char, pdfium::FreeDeleter> file_contents_;
-  size_t file_length_;
+  size_t file_length_ = 0;
   std::vector<std::pair<size_t, size_t>> requested_segments_;
   size_t max_requested_bound_ = 0;
   bool is_new_data_available_ = true;
@@ -184,9 +183,8 @@ TEST_F(FPDFDataAvailEmbedderTest, LoadUsingHintTables) {
 
   // No new data available, to prevent load "Pages" node.
   loader.set_is_new_data_available(false);
-  FPDF_PAGE page = FPDF_LoadPage(document(), 1);
+  ScopedFPDFPage page(FPDF_LoadPage(document(), 1));
   EXPECT_TRUE(page);
-  FPDF_ClosePage(page);
 }
 
 TEST_F(FPDFDataAvailEmbedderTest, CheckFormAvailIfLinearized) {
@@ -196,8 +194,8 @@ TEST_F(FPDFDataAvailEmbedderTest, CheckFormAvailIfLinearized) {
   document_ = FPDFAvail_GetDocument(avail_, nullptr);
   ASSERT_TRUE(document_);
 
-  // Prevent access to non requested data to coerce the parser to send new
-  // request for non available (non requested before) data.
+  // Prevent access to non-requested data to coerce the parser to send new
+  // request for non available (non-requested before) data.
   loader.set_is_new_data_available(false);
   loader.ClearRequestedSegments();
 
@@ -223,8 +221,8 @@ TEST_F(FPDFDataAvailEmbedderTest,
   EXPECT_GT(loader.file_access()->m_FileLen,
             loader.max_already_available_bound());
 
-  // Prevent access to non requested data to coerce the parser to send new
-  // request for non available (non requested before) data.
+  // Prevent access to non-requested data to coerce the parser to send new
+  // request for non available (non-requested before) data.
   loader.set_is_new_data_available(false);
   FPDFAvail_IsPageAvail(avail_, first_page_num, loader.hints());
 
@@ -244,9 +242,8 @@ TEST_F(FPDFDataAvailEmbedderTest,
 
   // Prevent loading data, while page loading.
   loader.set_is_new_data_available(false);
-  FPDF_PAGE page = FPDF_LoadPage(document(), first_page_num);
+  ScopedFPDFPage page(FPDF_LoadPage(document(), first_page_num));
   EXPECT_TRUE(page);
-  FPDF_ClosePage(page);
 }
 
 TEST_F(FPDFDataAvailEmbedderTest, LoadSecondPageIfLinearizedWithHints) {
@@ -258,8 +255,8 @@ TEST_F(FPDFDataAvailEmbedderTest, LoadSecondPageIfLinearizedWithHints) {
 
   static constexpr uint32_t kSecondPageNum = 1;
 
-  // Prevent access to non requested data to coerce the parser to send new
-  // request for non available (non requested before) data.
+  // Prevent access to non-requested data to coerce the parser to send new
+  // request for non available (non-requested before) data.
   loader.set_is_new_data_available(false);
   loader.ClearRequestedSegments();
 
@@ -272,9 +269,8 @@ TEST_F(FPDFDataAvailEmbedderTest, LoadSecondPageIfLinearizedWithHints) {
 
   // Prevent loading data, while page loading.
   loader.set_is_new_data_available(false);
-  FPDF_PAGE page = FPDF_LoadPage(document(), kSecondPageNum);
+  ScopedFPDFPage page(FPDF_LoadPage(document(), kSecondPageNum));
   EXPECT_TRUE(page);
-  FPDF_ClosePage(page);
 }
 
 TEST_F(FPDFDataAvailEmbedderTest, LoadInfoAfterReceivingWholeDocument) {
@@ -378,3 +374,20 @@ TEST_F(FPDFDataAvailEmbedderTest, TryLoadNonExistsInfo) {
   // Test that api is robust enough to handle the bad case.
   EXPECT_FALSE(FPDF_GetMetaText(document_, "Type", nullptr, 0));
 }
+
+TEST_F(FPDFDataAvailEmbedderTest, BadInputsToAPIs) {
+  EXPECT_EQ(PDF_DATA_ERROR, FPDFAvail_IsDocAvail(nullptr, nullptr));
+  EXPECT_FALSE(FPDFAvail_GetDocument(nullptr, nullptr));
+  EXPECT_EQ(0, FPDFAvail_GetFirstPageNum(nullptr));
+  EXPECT_EQ(PDF_DATA_ERROR, FPDFAvail_IsPageAvail(nullptr, 0, nullptr));
+  EXPECT_EQ(PDF_FORM_ERROR, FPDFAvail_IsFormAvail(nullptr, nullptr));
+  EXPECT_EQ(PDF_LINEARIZATION_UNKNOWN, FPDFAvail_IsLinearized(nullptr));
+}
+
+TEST_F(FPDFDataAvailEmbedderTest, NegativePageIndex) {
+  TestAsyncLoader loader("linearized.pdf");
+  avail_ = FPDFAvail_Create(loader.file_avail(), loader.file_access());
+  ASSERT_EQ(PDF_DATA_AVAIL, FPDFAvail_IsDocAvail(avail_, loader.hints()));
+  EXPECT_EQ(PDF_DATA_NOTAVAIL,
+            FPDFAvail_IsPageAvail(avail_, -1, loader.hints()));
+}
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_doc.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_doc.cpp
index b9bf93d67ba..5b7c727f4ee 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_doc.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_doc.cpp
@@ -343,7 +343,7 @@ FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV FPDFLink_Enumerate(FPDF_PAGE page,
   if (!start_pos || !link_annot)
     return false;
   CPDF_Page* pPage = CPDFPageFromFPDFPage(page);
-  if (!pPage || !pPage->GetDict())
+  if (!pPage)
     return false;
   CPDF_Array* pAnnots = pPage->GetDict()->GetArrayFor("Annots");
   if (!pAnnots)
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_doc_unittest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_doc_unittest.cpp
index 032f95f991f..2beadd4b295 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_doc_unittest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_doc_unittest.cpp
@@ -7,8 +7,8 @@
 #include <memory>
 #include <vector>
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
@@ -44,7 +44,7 @@ class PDFDocTest : public testing::Test {
   };
 
   void SetUp() override {
-    CPDF_ModuleMgr::Create();
+    CPDF_PageModule::Create();
     auto pTestDoc = pdfium::MakeUnique<CPDF_TestDocument>();
     m_pIndirectObjs = pTestDoc->GetHolder();
     m_pRootObj.Reset(m_pIndirectObjs->NewIndirect<CPDF_Dictionary>());
@@ -56,7 +56,7 @@ class PDFDocTest : public testing::Test {
     m_pRootObj = nullptr;
     m_pIndirectObjs = nullptr;
     m_pDoc.reset();
-    CPDF_ModuleMgr::Destroy();
+    CPDF_PageModule::Destroy();
   }
 
   std::vector<DictObjInfo> CreateDictObjs(int num) {
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_edit_embeddertest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_edit_embeddertest.cpp
index 3276066a594..a8c33c776cd 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_edit_embeddertest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_edit_embeddertest.cpp
@@ -431,6 +431,102 @@ TEST_F(FPDFEditEmbedderTest, AddPaths) {
   VerifySavedDocument(612, 792, kLastMD5);
 }
 
+TEST_F(FPDFEditEmbedderTest, ClipPath) {
+  // Load document with a clipped rectangle.
+  EXPECT_TRUE(OpenDocument("clip_path.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  ASSERT_TRUE(page);
+
+  ASSERT_EQ(1, FPDFPage_CountObjects(page));
+
+  FPDF_PAGEOBJECT triangle = FPDFPage_GetObject(page, 0);
+  ASSERT_TRUE(triangle);
+
+  // Test that we got the expected triangle.
+  ASSERT_EQ(4, FPDFPath_CountSegments(triangle));
+
+  FPDF_PATHSEGMENT segment = FPDFPath_GetPathSegment(triangle, 0);
+  float x;
+  float y;
+  EXPECT_TRUE(FPDFPathSegment_GetPoint(segment, &x, &y));
+  EXPECT_EQ(10, x);
+  EXPECT_EQ(10, y);
+  EXPECT_EQ(FPDF_SEGMENT_MOVETO, FPDFPathSegment_GetType(segment));
+  EXPECT_FALSE(FPDFPathSegment_GetClose(segment));
+
+  segment = FPDFPath_GetPathSegment(triangle, 1);
+  EXPECT_TRUE(FPDFPathSegment_GetPoint(segment, &x, &y));
+  EXPECT_EQ(25, x);
+  EXPECT_EQ(40, y);
+  EXPECT_EQ(FPDF_SEGMENT_LINETO, FPDFPathSegment_GetType(segment));
+  EXPECT_FALSE(FPDFPathSegment_GetClose(segment));
+
+  segment = FPDFPath_GetPathSegment(triangle, 2);
+  EXPECT_TRUE(FPDFPathSegment_GetPoint(segment, &x, &y));
+  EXPECT_EQ(40, x);
+  EXPECT_EQ(10, y);
+  EXPECT_EQ(FPDF_SEGMENT_LINETO, FPDFPathSegment_GetType(segment));
+  EXPECT_FALSE(FPDFPathSegment_GetClose(segment));
+
+  segment = FPDFPath_GetPathSegment(triangle, 3);
+  EXPECT_TRUE(FPDFPathSegment_GetPoint(segment, &x, &y));
+  EXPECT_TRUE(FPDFPathSegment_GetClose(segment));
+
+  // Test FPDFPageObj_GetClipPath().
+  ASSERT_EQ(nullptr, FPDFPageObj_GetClipPath(nullptr));
+
+  FPDF_CLIPPATH clip_path = FPDFPageObj_GetClipPath(triangle);
+  ASSERT_TRUE(clip_path);
+
+  // Test FPDFClipPath_CountPaths().
+  ASSERT_EQ(-1, FPDFClipPath_CountPaths(nullptr));
+  ASSERT_EQ(1, FPDFClipPath_CountPaths(clip_path));
+
+  // Test FPDFClipPath_CountPathSegments().
+  ASSERT_EQ(-1, FPDFClipPath_CountPathSegments(nullptr, 0));
+  ASSERT_EQ(-1, FPDFClipPath_CountPathSegments(clip_path, -1));
+  ASSERT_EQ(-1, FPDFClipPath_CountPathSegments(clip_path, 1));
+  ASSERT_EQ(4, FPDFClipPath_CountPathSegments(clip_path, 0));
+
+  // FPDFClipPath_GetPathSegment() negative testing.
+  ASSERT_EQ(nullptr, FPDFClipPath_GetPathSegment(nullptr, 0, 0));
+  ASSERT_EQ(nullptr, FPDFClipPath_GetPathSegment(clip_path, -1, 0));
+  ASSERT_EQ(nullptr, FPDFClipPath_GetPathSegment(clip_path, 1, 0));
+  ASSERT_EQ(nullptr, FPDFClipPath_GetPathSegment(clip_path, 0, -1));
+  ASSERT_EQ(nullptr, FPDFClipPath_GetPathSegment(clip_path, 0, 4));
+
+  // FPDFClipPath_GetPathSegment() positive testing.
+  segment = FPDFClipPath_GetPathSegment(clip_path, 0, 0);
+  EXPECT_TRUE(FPDFPathSegment_GetPoint(segment, &x, &y));
+  EXPECT_EQ(10, x);
+  EXPECT_EQ(15, y);
+  EXPECT_EQ(FPDF_SEGMENT_MOVETO, FPDFPathSegment_GetType(segment));
+  EXPECT_FALSE(FPDFPathSegment_GetClose(segment));
+
+  segment = FPDFClipPath_GetPathSegment(clip_path, 0, 1);
+  EXPECT_TRUE(FPDFPathSegment_GetPoint(segment, &x, &y));
+  EXPECT_EQ(40, x);
+  EXPECT_EQ(15, y);
+  EXPECT_EQ(FPDF_SEGMENT_LINETO, FPDFPathSegment_GetType(segment));
+  EXPECT_FALSE(FPDFPathSegment_GetClose(segment));
+
+  segment = FPDFClipPath_GetPathSegment(clip_path, 0, 2);
+  EXPECT_TRUE(FPDFPathSegment_GetPoint(segment, &x, &y));
+  EXPECT_EQ(40, x);
+  EXPECT_EQ(35, y);
+  EXPECT_EQ(FPDF_SEGMENT_LINETO, FPDFPathSegment_GetType(segment));
+  EXPECT_FALSE(FPDFPathSegment_GetClose(segment));
+
+  segment = FPDFClipPath_GetPathSegment(clip_path, 0, 3);
+  EXPECT_TRUE(FPDFPathSegment_GetPoint(segment, &x, &y));
+  EXPECT_EQ(10, x);
+  EXPECT_EQ(35, y);
+  EXPECT_EQ(FPDF_SEGMENT_LINETO, FPDFPathSegment_GetType(segment));
+  EXPECT_FALSE(FPDFPathSegment_GetClose(segment));
+
+  UnloadPage(page);
+}
+
 TEST_F(FPDFEditEmbedderTest, SetText) {
   // Load document with some text.
   EXPECT_TRUE(OpenDocument("hello_world.pdf"));
@@ -1991,12 +2087,12 @@ TEST_F(FPDFEditEmbedderTest, AddStandardFontText2) {
   ScopedFPDFPage page(FPDFPage_New(CreateNewDocument(), 0, 612, 792));
 
   // Load a standard font.
-  FPDF_FONT font = FPDFText_LoadStandardFont(document(), "Helvetica");
+  ScopedFPDFFont font(FPDFText_LoadStandardFont(document(), "Helvetica"));
   ASSERT_TRUE(font);
 
   // Add some text to the page.
   FPDF_PAGEOBJECT text_object =
-      FPDFPageObj_CreateTextObj(document(), font, 12.0f);
+      FPDFPageObj_CreateTextObj(document(), font.get(), 12.0f);
   EXPECT_TRUE(text_object);
   ScopedFPDFWideString text =
       GetFPDFWideString(L"I'm at the bottom of the page");
@@ -2040,7 +2136,7 @@ TEST_F(FPDFEditEmbedderTest, LoadStandardFonts) {
       "TimesNewRoman-Italic",
       "ZapfDingbats"};
   for (const char* font_name : kStandardFontNames) {
-    FPDF_FONT font = FPDFText_LoadStandardFont(document(), font_name);
+    ScopedFPDFFont font(FPDFText_LoadStandardFont(document(), font_name));
     EXPECT_TRUE(font) << font_name << " should be considered a standard font.";
   }
   static constexpr const char* kNotStandardFontNames[] = {
@@ -2049,7 +2145,7 @@ TEST_F(FPDFEditEmbedderTest, LoadStandardFonts) {
       "TestFontName", "Quack",     "Symbol-Italic",
       "Zapf"};
   for (const char* font_name : kNotStandardFontNames) {
-    FPDF_FONT font = FPDFText_LoadStandardFont(document(), font_name);
+    ScopedFPDFFont font(FPDFText_LoadStandardFont(document(), font_name));
     EXPECT_FALSE(font) << font_name
                        << " should not be considered a standard font.";
   }
@@ -2175,7 +2271,7 @@ TEST_F(FPDFEditEmbedderTest, DoubleGenerating) {
 TEST_F(FPDFEditEmbedderTest, LoadSimpleType1Font) {
   CreateNewDocument();
   // TODO(npm): use other fonts after disallowing loading any font as any type
-  const CPDF_Font* stock_font =
+  RetainPtr<CPDF_Font> stock_font =
       CPDF_Font::GetStockFont(cpdf_doc(), "Times-Bold");
   pdfium::span<const uint8_t> span = stock_font->GetFont()->GetFontSpan();
   ScopedFPDFFont font(FPDFText_LoadFont(document(), span.data(), span.size(),
@@ -2204,7 +2300,8 @@ TEST_F(FPDFEditEmbedderTest, LoadSimpleType1Font) {
 
 TEST_F(FPDFEditEmbedderTest, LoadSimpleTrueTypeFont) {
   CreateNewDocument();
-  const CPDF_Font* stock_font = CPDF_Font::GetStockFont(cpdf_doc(), "Courier");
+  RetainPtr<CPDF_Font> stock_font =
+      CPDF_Font::GetStockFont(cpdf_doc(), "Courier");
   pdfium::span<const uint8_t> span = stock_font->GetFont()->GetFontSpan();
   ScopedFPDFFont font(FPDFText_LoadFont(document(), span.data(), span.size(),
                                         FPDF_FONT_TRUETYPE, false));
@@ -2232,7 +2329,7 @@ TEST_F(FPDFEditEmbedderTest, LoadSimpleTrueTypeFont) {
 
 TEST_F(FPDFEditEmbedderTest, LoadCIDType0Font) {
   CreateNewDocument();
-  const CPDF_Font* stock_font =
+  RetainPtr<CPDF_Font> stock_font =
       CPDF_Font::GetStockFont(cpdf_doc(), "Times-Roman");
   pdfium::span<const uint8_t> span = stock_font->GetFont()->GetFontSpan();
   ScopedFPDFFont font(FPDFText_LoadFont(document(), span.data(), span.size(),
@@ -2281,7 +2378,7 @@ TEST_F(FPDFEditEmbedderTest, LoadCIDType0Font) {
 
 TEST_F(FPDFEditEmbedderTest, LoadCIDType2Font) {
   CreateNewDocument();
-  const CPDF_Font* stock_font =
+  RetainPtr<CPDF_Font> stock_font =
       CPDF_Font::GetStockFont(cpdf_doc(), "Helvetica-Oblique");
   pdfium::span<const uint8_t> span = stock_font->GetFont()->GetFontSpan();
   ScopedFPDFFont font(FPDFText_LoadFont(document(), span.data(), span.size(),
@@ -2334,7 +2431,8 @@ TEST_F(FPDFEditEmbedderTest, AddTrueTypeFontText) {
   // Start with a blank page
   FPDF_PAGE page = FPDFPage_New(CreateNewDocument(), 0, 612, 792);
   {
-    const CPDF_Font* stock_font = CPDF_Font::GetStockFont(cpdf_doc(), "Arial");
+    RetainPtr<CPDF_Font> stock_font =
+        CPDF_Font::GetStockFont(cpdf_doc(), "Arial");
     pdfium::span<const uint8_t> span = stock_font->GetFont()->GetFontSpan();
     ScopedFPDFFont font(FPDFText_LoadFont(document(), span.data(), span.size(),
                                           FPDF_FONT_TRUETYPE, 0));
@@ -2644,7 +2742,8 @@ TEST_F(FPDFEditEmbedderTest, AddMarkedText) {
   // Start with a blank page.
   FPDF_PAGE page = FPDFPage_New(CreateNewDocument(), 0, 612, 792);
 
-  const CPDF_Font* stock_font = CPDF_Font::GetStockFont(cpdf_doc(), "Arial");
+  RetainPtr<CPDF_Font> stock_font =
+      CPDF_Font::GetStockFont(cpdf_doc(), "Arial");
   pdfium::span<const uint8_t> span = stock_font->GetFont()->GetFontSpan();
   ScopedFPDFFont font(FPDFText_LoadFont(document(), span.data(), span.size(),
                                         FPDF_FONT_TRUETYPE, 0));
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_edit_unittest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_edit_unittest.cpp
index 1fcd93d3744..6aa24f4190a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_edit_unittest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_edit_unittest.cpp
@@ -4,12 +4,12 @@
 
 #include "public/fpdf_edit.h"
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 class PDFEditTest : public testing::Test {
-  void SetUp() override { CPDF_ModuleMgr::Create(); }
-  void TearDown() override { CPDF_ModuleMgr::Destroy(); }
+  void SetUp() override { CPDF_PageModule::Create(); }
+  void TearDown() override { CPDF_PageModule::Destroy(); }
 };
 
 TEST_F(PDFEditTest, LineJoin) {
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_editimg.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_editimg.cpp
index e253186c258..fc12b2bf1e5 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_editimg.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_editimg.cpp
@@ -8,7 +8,6 @@
 
 #include <utility>
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/page/cpdf_dibbase.h"
 #include "core/fpdfapi/page/cpdf_image.h"
 #include "core/fpdfapi/page/cpdf_imageobject.h"
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_editimg_unittest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_editimg_unittest.cpp
index 81a4877dee0..89fb9c5674a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_editimg_unittest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_editimg_unittest.cpp
@@ -4,13 +4,13 @@
 
 #include "public/fpdf_edit.h"
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "public/cpp/fpdf_scopers.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 class PDFEditImgTest : public testing::Test {
-  void SetUp() override { CPDF_ModuleMgr::Create(); }
-  void TearDown() override { CPDF_ModuleMgr::Destroy(); }
+  void SetUp() override { CPDF_PageModule::Create(); }
+  void TearDown() override { CPDF_PageModule::Destroy(); }
 };
 
 TEST_F(PDFEditImgTest, InsertObjectWithInvalidPage) {
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_editpage.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_editpage.cpp
index eaa88d93465..802cd901cd0 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_editpage.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_editpage.cpp
@@ -61,7 +61,7 @@ bool IsPageObject(CPDF_Page* pPage) {
     return false;
 
   const CPDF_Dictionary* pFormDict = pPage->GetDict();
-  if (!pFormDict || !pFormDict->KeyExist("Type"))
+  if (!pFormDict->KeyExist("Type"))
     return false;
 
   const CPDF_Object* pObject = pFormDict->GetObjectFor("Type")->GetDirect();
@@ -161,7 +161,7 @@ FPDF_EXPORT FPDF_DOCUMENT FPDF_CALLCONV FPDF_CreateNewDocument() {
 
   time_t currentTime;
   ByteString DateStr;
-  if (FSDK_IsSandBoxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS)) {
+  if (IsPDFSandboxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS)) {
     if (FXSYS_time(&currentTime) != -1) {
       tm* pTM = FXSYS_localtime(&currentTime);
       if (pTM) {
@@ -174,7 +174,7 @@ FPDF_EXPORT FPDF_DOCUMENT FPDF_CALLCONV FPDF_CreateNewDocument() {
 
   CPDF_Dictionary* pInfoDict = pDoc->GetInfo();
   if (pInfoDict) {
-    if (FSDK_IsSandBoxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS))
+    if (IsPDFSandboxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS))
       pInfoDict->SetNewFor<CPDF_String>("CreationDate", DateStr, false);
     pInfoDict->SetNewFor<CPDF_String>("Creator", L"PDFium");
   }
@@ -221,9 +221,8 @@ FPDF_EXPORT FPDF_PAGE FPDF_CALLCONV FPDFPage_New(FPDF_DOCUMENT document,
   pPageDict->SetNewFor<CPDF_Dictionary>(pdfium::page_object::kResources);
 
 #ifdef PDF_ENABLE_XFA
-  auto* pContext = static_cast<CPDFXFA_Context*>(pDoc->GetExtension());
-  if (pContext) {
-    auto pXFAPage = pdfium::MakeRetain<CPDFXFA_Page>(pContext, page_index);
+  if (pDoc->GetExtension()) {
+    auto pXFAPage = pdfium::MakeRetain<CPDFXFA_Page>(pDoc, page_index);
     pXFAPage->LoadPDFPageFromDict(pPageDict);
     return FPDFPageFromIPDFPage(pXFAPage.Leak());  // Caller takes ownership.
   }
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_edittext.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_edittext.cpp
index ce4c4148404..3d3ba2694ec 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_edittext.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_edittext.cpp
@@ -9,7 +9,6 @@
 #include <utility>
 #include <vector>
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/font/cpdf_type1font.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
@@ -261,10 +260,10 @@ CPDF_Stream* LoadUnicode(CPDF_Document* pDoc,
   return stream;
 }
 
-CPDF_Font* LoadSimpleFont(CPDF_Document* pDoc,
-                          std::unique_ptr<CFX_Font> pFont,
-                          pdfium::span<const uint8_t> span,
-                          int font_type) {
+RetainPtr<CPDF_Font> LoadSimpleFont(CPDF_Document* pDoc,
+                                    std::unique_ptr<CFX_Font> pFont,
+                                    pdfium::span<const uint8_t> span,
+                                    int font_type) {
   CPDF_Dictionary* pFontDict = pDoc->NewIndirect<CPDF_Dictionary>();
   pFontDict->SetNewFor<CPDF_Name>("Type", "Font");
   pFontDict->SetNewFor<CPDF_Name>(
@@ -309,10 +308,10 @@ CPDF_Font* LoadSimpleFont(CPDF_Document* pDoc,
   return CPDF_DocPageData::FromDocument(pDoc)->GetFont(pFontDict);
 }
 
-CPDF_Font* LoadCompositeFont(CPDF_Document* pDoc,
-                             std::unique_ptr<CFX_Font> pFont,
-                             pdfium::span<const uint8_t> span,
-                             int font_type) {
+RetainPtr<CPDF_Font> LoadCompositeFont(CPDF_Document* pDoc,
+                                       std::unique_ptr<CFX_Font> pFont,
+                                       pdfium::span<const uint8_t> span,
+                                       int font_type) {
   CPDF_Dictionary* pFontDict = pDoc->NewIndirect<CPDF_Dictionary>();
   pFontDict->SetNewFor<CPDF_Name>("Type", "Font");
   pFontDict->SetNewFor<CPDF_Name>("Subtype", "Type0");
@@ -444,7 +443,8 @@ FPDFPageObj_NewTextObj(FPDF_DOCUMENT document,
   if (!pDoc)
     return nullptr;
 
-  CPDF_Font* pFont = CPDF_Font::GetStockFont(pDoc, ByteStringView(font));
+  RetainPtr<CPDF_Font> pFont =
+      CPDF_Font::GetStockFont(pDoc, ByteStringView(font));
   if (!pFont)
     return nullptr;
 
@@ -493,9 +493,10 @@ FPDF_EXPORT FPDF_FONT FPDF_CALLCONV FPDFText_LoadFont(FPDF_DOCUMENT document,
   if (!pFont->LoadEmbedded(span))
     return nullptr;
 
+  // Caller takes ownership.
   return FPDFFontFromCPDFFont(
-      cid ? LoadCompositeFont(pDoc, std::move(pFont), span, font_type)
-          : LoadSimpleFont(pDoc, std::move(pFont), span, font_type));
+      cid ? LoadCompositeFont(pDoc, std::move(pFont), span, font_type).Leak()
+          : LoadSimpleFont(pDoc, std::move(pFont), span, font_type).Leak());
 }
 
 FPDF_EXPORT FPDF_FONT FPDF_CALLCONV
@@ -504,8 +505,9 @@ FPDFText_LoadStandardFont(FPDF_DOCUMENT document, FPDF_BYTESTRING font) {
   if (!pDoc)
     return nullptr;
 
+  // Caller takes ownership.
   return FPDFFontFromCPDFFont(
-      CPDF_Font::GetStockFont(pDoc, ByteStringView(font)));
+      CPDF_Font::GetStockFont(pDoc, ByteStringView(font)).Leak());
 }
 
 FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV FPDFText_GetMatrix(FPDF_PAGEOBJECT text,
@@ -539,17 +541,16 @@ FPDFTextObj_GetFontName(FPDF_PAGEOBJECT text,
   if (!pTextObj)
     return 0;
 
-  CPDF_Font* pPdfFont = pTextObj->GetFont();
+  RetainPtr<CPDF_Font> pPdfFont = pTextObj->GetFont();
   if (!pPdfFont)
     return 0;
 
   CFX_Font* pFont = pPdfFont->GetFont();
-  ASSERT(pFont);
-
   ByteString name = pFont->GetFamilyName();
   unsigned long dwStringLen = name.GetLength() + 1;
   if (buffer && length >= dwStringLen)
     memcpy(buffer, name.c_str(), dwStringLen);
+
   return dwStringLen;
 }
 
@@ -571,17 +572,8 @@ FPDFTextObj_GetText(FPDF_PAGEOBJECT text_object,
 }
 
 FPDF_EXPORT void FPDF_CALLCONV FPDFFont_Close(FPDF_FONT font) {
-  CPDF_Font* pFont = CPDFFontFromFPDFFont(font);
-  if (!pFont)
-    return;
-
-  CPDF_Document* pDoc = pFont->GetDocument();
-  if (!pDoc)
-    return;
-
-  auto* pPageData = CPDF_DocPageData::FromDocument(pDoc);
-  if (!pPageData->IsForceClear())
-    pPageData->ReleaseFont(pFont->GetFontDict());
+  // Take back ownership from caller and release.
+  RetainPtr<CPDF_Font>().Unleak(CPDFFontFromFPDFFont(font));
 }
 
 FPDF_EXPORT FPDF_PAGEOBJECT FPDF_CALLCONV
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_ext.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_ext.cpp
index e757481ceea..dc928f6285b 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_ext.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_ext.cpp
@@ -6,7 +6,6 @@
 
 #include "public/fpdf_ext.h"
 
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfdoc/cpdf_interactiveform.h"
@@ -15,10 +14,6 @@
 #include "fpdfsdk/cpdfsdk_helpers.h"
 #include "third_party/base/ptr_util.h"
 
-#ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#endif  // PDF_ENABLE_XFA
-
 static_assert(static_cast<int>(UnsupportedFeature::kDocumentXFAForm) ==
                   FPDF_UNSP_DOC_XFAFORM,
               "UnsupportedFeature::kDocumentXFAForm value mismatch");
@@ -74,8 +69,7 @@ FSDK_SetUnSpObjProcessHandler(UNSUPPORT_INFO* unsp_info) {
   if (!unsp_info || unsp_info->version != 1)
     return false;
 
-  CPDF_ModuleMgr::Get()->SetUnsupportInfoAdapter(
-      pdfium::MakeUnique<fpdfapi::UnsupportedInfoAdapter>(unsp_info));
+  SetPDFUnsupportInfo(unsp_info);
   return true;
 }
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_flatten.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_flatten.cpp
index fad2be33b4a..424e1b4115a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_flatten.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_flatten.cpp
@@ -84,7 +84,7 @@ int ParserAnnots(CPDF_Document* pSourceDoc,
                  std::vector<CFX_FloatRect>* pRectArray,
                  std::vector<CPDF_Dictionary*>* pObjectArray,
                  int nUsage) {
-  if (!pSourceDoc || !pPageDic)
+  if (!pSourceDoc)
     return FLATTEN_FAIL;
 
   GetContentsRect(pSourceDoc, pPageDic, pRectArray);
@@ -253,7 +253,7 @@ FPDF_EXPORT int FPDF_CALLCONV FPDFPage_Flatten(FPDF_PAGE page, int nFlag) {
 
   CPDF_Document* pDocument = pPage->GetDocument();
   CPDF_Dictionary* pPageDict = pPage->GetDict();
-  if (!pDocument || !pPageDict)
+  if (!pDocument)
     return FLATTEN_FAIL;
 
   std::vector<CPDF_Dictionary*> ObjectArray;
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_formfill.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_formfill.cpp
index 5293f052dd8..35685c8983b 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_formfill.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_formfill.cpp
@@ -7,6 +7,7 @@
 #include "public/fpdf_formfill.h"
 
 #include <memory>
+#include <utility>
 #include <vector>
 
 #include "core/fpdfapi/page/cpdf_occontext.h"
@@ -19,19 +20,19 @@
 #include "core/fpdfdoc/cpdf_interactiveform.h"
 #include "core/fxge/cfx_defaultrenderdevice.h"
 #include "fpdfsdk/cpdfsdk_actionhandler.h"
+#include "fpdfsdk/cpdfsdk_baannothandler.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
 #include "fpdfsdk/cpdfsdk_interactiveform.h"
 #include "fpdfsdk/cpdfsdk_pageview.h"
+#include "fpdfsdk/cpdfsdk_widgethandler.h"
 #include "public/fpdfview.h"
 #include "third_party/base/ptr_util.h"
 
 #ifdef PDF_ENABLE_XFA
 #include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_page.h"
-#include "xfa/fxfa/cxfa_ffdocview.h"
-#include "xfa/fxfa/cxfa_ffpageview.h"
-#include "xfa/fxfa/cxfa_ffwidget.h"
+#include "fpdfsdk/fpdfxfa/cpdfxfa_widgethandler.h"
 
 static_assert(static_cast<int>(AlertButton::kDefault) ==
                   JSPLATFORM_ALERT_BUTTON_DEFAULT,
@@ -249,45 +250,14 @@ FPDFPage_HasFormFieldAtPoint(FPDF_FORMHANDLE hHandle,
     return pFormField ? static_cast<int>(pFormField->GetFieldType()) : -1;
   }
 
-  if (!hHandle)
-    return -1;
-
 #ifdef PDF_ENABLE_XFA
   CPDFXFA_Page* pXFAPage = ToXFAPage(IPDFPageFromFPDFPage(page));
-  if (!pXFAPage)
-    return -1;
-
-  CXFA_FFPageView* pPageView = pXFAPage->GetXFAPageView();
-  if (!pPageView)
-    return -1;
-
-  CXFA_FFDocView* pDocView = pPageView->GetDocView();
-  if (!pDocView)
-    return -1;
-
-  CXFA_FFWidgetHandler* pWidgetHandler = pDocView->GetWidgetHandler();
-  if (!pWidgetHandler)
-    return -1;
-
-  std::unique_ptr<IXFA_WidgetIterator> pWidgetIterator(
-      pPageView->CreateWidgetIterator(XFA_TRAVERSEWAY_Form,
-                                      XFA_WidgetStatus_Viewable));
-  if (!pWidgetIterator)
-    return -1;
-
-  CXFA_FFWidget* pXFAAnnot;
-  while ((pXFAAnnot = pWidgetIterator->MoveToNext()) != nullptr) {
-    if (pXFAAnnot->GetFormFieldType() == FormFieldType::kXFA)
-      continue;
-
-    CFX_FloatRect rcWidget = pXFAAnnot->GetWidgetRect().ToFloatRect();
-    rcWidget.Inflate(1.0f, 1.0f);
-    if (rcWidget.Contains(CFX_PointF(static_cast<float>(page_x),
-                                     static_cast<float>(page_y)))) {
-      return static_cast<int>(pXFAAnnot->GetFormFieldType());
-    }
+  if (pXFAPage) {
+    return pXFAPage->HasFormFieldAtPoint(
+        CFX_PointF(static_cast<float>(page_x), static_cast<float>(page_y)));
   }
 #endif  // PDF_ENABLE_XFA
+
   return -1;
 }
 
@@ -316,9 +286,9 @@ FPDF_EXPORT FPDF_FORMHANDLE FPDF_CALLCONV
 FPDFDOC_InitFormFillEnvironment(FPDF_DOCUMENT document,
                                 FPDF_FORMFILLINFO* formInfo) {
 #ifdef PDF_ENABLE_XFA
-  const int kRequiredVersion = 2;
+  constexpr int kRequiredVersion = 2;
 #else   // PDF_ENABLE_XFA
-  const int kRequiredVersion = 1;
+  constexpr int kRequiredVersion = 1;
 #endif  // PDF_ENABLE_XFA
   if (!formInfo || formInfo->version != kRequiredVersion)
     return nullptr;
@@ -338,8 +308,16 @@ FPDFDOC_InitFormFillEnvironment(FPDF_DOCUMENT document,
   }
 #endif
 
+  std::unique_ptr<IPDFSDK_AnnotHandler> pXFAHandler;
+#ifdef PDF_ENABLE_XFA
+  pXFAHandler = pdfium::MakeUnique<CPDFXFA_WidgetHandler>();
+#endif  // PDF_ENABLE_XFA
+
   auto pFormFillEnv = pdfium::MakeUnique<CPDFSDK_FormFillEnvironment>(
-      CPDFDocumentFromFPDFDocument(document), formInfo);
+      pDocument, formInfo,
+      pdfium::MakeUnique<CPDFSDK_AnnotHandlerMgr>(
+          pdfium::MakeUnique<CPDFSDK_BAAnnotHandler>(),
+          pdfium::MakeUnique<CPDFSDK_WidgetHandler>(), std::move(pXFAHandler)));
 
 #ifdef PDF_ENABLE_XFA
   if (pContext)
@@ -363,8 +341,10 @@ FPDFDOC_ExitFormFillEnvironment(FPDF_FORMHANDLE hHandle) {
   pFormFillEnv->ClearAllFocusedAnnots();
   // If the document was closed first, it's possible the XFA document
   // is now a nullptr.
-  if (pFormFillEnv->GetXFAContext())
-    pFormFillEnv->GetXFAContext()->SetFormFillEnv(nullptr);
+  auto* pContext =
+      static_cast<CPDFXFA_Context*>(pFormFillEnv->GetDocExtension());
+  if (pContext)
+    pContext->SetFormFillEnv(nullptr);
 #endif  // PDF_ENABLE_XFA
   delete pFormFillEnv;
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_formfill_embeddertest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_formfill_embeddertest.cpp
index bfcbe8c732c..33353aafb1e 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_formfill_embeddertest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_formfill_embeddertest.cpp
@@ -368,6 +368,10 @@ class FPDFFormFillListBoxFormEmbedderTest
     // - "Listbox_SingleSelect" - Ff: 0, 3 options with pair values.
     // - "Listbox_MultiSelect" - Ff: 2097152, 26 options with single values.
     // - "Listbox_ReadOnly" - Ff: 1, 3 options with single values.
+    // - "Listbox_MultiSelectMultipleSelected" - Ff: 2097152, 5 options with
+    // single values.
+    // - "Listbox_SingleSelectLastSelected" - Ff: 0, 10 options with single
+    // values.
     return "listbox_form.pdf";
   }
 
@@ -382,6 +386,17 @@ class FPDFFormFillListBoxFormEmbedderTest
               GetFormTypeAtPoint(MultiSelectFirstVisibleOption()));
     EXPECT_EQ(GetFormType(),
               GetFormTypeAtPoint(MultiSelectSecondVisibleOption()));
+    EXPECT_EQ(
+        GetFormType(),
+        GetFormTypeAtPoint(MultiSelectMultipleSelectedFirstVisibleOption()));
+    EXPECT_EQ(
+        GetFormType(),
+        GetFormTypeAtPoint(MultiSelectMultipleSelectedSecondVisibleOption()));
+    EXPECT_EQ(GetFormType(),
+              GetFormTypeAtPoint(SingleSelectLastSelectedFirstVisibleOption()));
+    EXPECT_EQ(
+        GetFormType(),
+        GetFormTypeAtPoint(SingleSelectLastSelectedSecondVisibleOption()));
   }
 
   void ClickOnSingleSelectFormOption(int item_index) {
@@ -408,6 +423,30 @@ class FPDFFormFillListBoxFormEmbedderTest
     }
   }
 
+  void ClickOnMultiSelectMultipleSelectedFormOption(int item_index) {
+    // Only two indices are visible so can only click on those
+    // without scrolling.
+    ASSERT(item_index >= 0);
+    ASSERT(item_index < 2);
+    if (item_index == 0) {
+      ClickOnFormFieldAtPoint(MultiSelectMultipleSelectedFirstVisibleOption());
+    } else {
+      ClickOnFormFieldAtPoint(MultiSelectMultipleSelectedSecondVisibleOption());
+    }
+  }
+
+  void ClickOnSingleSelectLastSelectedFormOption(int item_index) {
+    // Only two indices are visible so can only click on those
+    // without scrolling.
+    ASSERT(item_index >= 0);
+    ASSERT(item_index < 2);
+    if (item_index == 0) {
+      ClickOnFormFieldAtPoint(SingleSelectLastSelectedFirstVisibleOption());
+    } else {
+      ClickOnFormFieldAtPoint(SingleSelectLastSelectedSecondVisibleOption());
+    }
+  }
+
   void FocusOnSingleSelectForm() {
     FocusOnPoint(SingleSelectFirstVisibleOption());
   }
@@ -416,6 +455,14 @@ class FPDFFormFillListBoxFormEmbedderTest
     FocusOnPoint(MultiSelectFirstVisibleOption());
   }
 
+  void FocusOnMultiSelectMultipleSelectedForm() {
+    FocusOnPoint(MultiSelectMultipleSelectedFirstVisibleOption());
+  }
+
+  void FocusOnSingleSelectLastSelectedForm() {
+    FocusOnPoint(SingleSelectLastSelectedFirstVisibleOption());
+  }
+
   void FocusOnPoint(const CFX_PointF& point) {
     EXPECT_EQ(true, FORM_OnFocus(form_handle(), page(), 0, point.x, point.y));
   }
@@ -440,12 +487,40 @@ class FPDFFormFillListBoxFormEmbedderTest
     return point;
   }
 
+  const CFX_PointF& MultiSelectMultipleSelectedFirstVisibleOption() const {
+    static const CFX_PointF point(
+        kFormBeginX, kMultiFormMultipleSelectedYFirstVisibleOption);
+    return point;
+  }
+
+  const CFX_PointF& MultiSelectMultipleSelectedSecondVisibleOption() const {
+    static const CFX_PointF point(
+        kFormBeginX, kMultiFormMultipleSelectedYSecondVisibleOption);
+    return point;
+  }
+
+  const CFX_PointF& SingleSelectLastSelectedFirstVisibleOption() const {
+    static const CFX_PointF point(kFormBeginX,
+                                  kSingleFormLastSelectedYFirstVisibleOption);
+    return point;
+  }
+
+  const CFX_PointF& SingleSelectLastSelectedSecondVisibleOption() const {
+    static const CFX_PointF point(kFormBeginX,
+                                  kSingleFormLastSelectedYSecondVisibleOption);
+    return point;
+  }
+
  private:
   static constexpr float kFormBeginX = 102.0;
   static constexpr float kSingleFormYFirstVisibleOption = 371.0;
   static constexpr float kSingleFormYSecondVisibleOption = 358.0;
   static constexpr float kMultiFormYFirstVisibleOption = 423.0;
   static constexpr float kMultiFormYSecondVisibleOption = 408.0;
+  static constexpr float kMultiFormMultipleSelectedYFirstVisibleOption = 223.0;
+  static constexpr float kMultiFormMultipleSelectedYSecondVisibleOption = 208.0;
+  static constexpr float kSingleFormLastSelectedYFirstVisibleOption = 123.0;
+  static constexpr float kSingleFormLastSelectedYSecondVisibleOption = 108.0;
 };
 
 TEST_F(FPDFFormFillEmbedderTest, FirstTest) {
@@ -2126,9 +2201,13 @@ TEST_F(FPDFFormFillListBoxFormEmbedderTest,
     CheckIsIndexSelected(i, expected);
   }
 
-  ClickOnMultiSelectFormOption(0);
+  // TODO(bug_1377): Behavior should be changed to the one described below.
+  // Multiselect field set to 'Cherry' (index 2), which is index 1 among the
+  // visible form options because the listbox is scrolled down to have 'Banana'
+  // (index 1) at the top.
+  ClickOnMultiSelectFormOption(1);
   for (int i = 0; i < 26; i++) {
-    bool expected = i == 0;
+    bool expected = i == 1;
     CheckIsIndexSelected(i, expected);
   }
 }
@@ -2263,6 +2342,7 @@ TEST_F(FPDFFormFillListBoxFormEmbedderTest,
 
   // Check that above actions are interchangeable with click actions, should be
   // able to use a combination of both.
+  // TODO(bug_1377): Change to click on form option 0 instead of form option 1
   ClickOnMultiSelectFormOption(1);
   for (int i = 0; i < 26; i++) {
     bool expected = i == 1;
@@ -2271,6 +2351,51 @@ TEST_F(FPDFFormFillListBoxFormEmbedderTest,
   CheckFocusedFieldText(L"Banana");
 }
 
+TEST_F(FPDFFormFillListBoxFormEmbedderTest, CheckIfMultipleSelected) {
+  // Multiselect field set to 'Gamma' (index 2) and 'Epsilon' (index 4) upon
+  // opening.
+  FocusOnMultiSelectMultipleSelectedForm();
+  for (int i = 0; i < 5; i++) {
+    // TODO(bug_1377): Should be selected at index 2 and index 4.
+    bool expected = false;
+    CheckIsIndexSelected(i, expected);
+  }
+}
+
+TEST_F(FPDFFormFillListBoxFormEmbedderTest,
+       CheckIfVerticalScrollIsAtFirstSelected) {
+  // Multiselect field set to 'Gamma' (index 2) and 'Epsilon' (index 4) upon
+  // opening.
+
+  // TODO(bug_1377): Behavior should be changed to the one described below.
+  // The top visible option is 'Gamma' (index 2), so the first selection should
+  // not change. The second selection, 'Epsilon,' should be deselected.
+  ClickOnMultiSelectMultipleSelectedFormOption(0);
+  for (int i = 0; i < 5; i++) {
+    bool expected = i == 0;
+    CheckIsIndexSelected(i, expected);
+  }
+}
+
+TEST_F(FPDFFormFillListBoxFormEmbedderTest, CheckForNoOverscroll) {
+  // Only the last option in the list, 'Saskatchewan', is selected.
+  FocusOnSingleSelectLastSelectedForm();
+  for (int i = 0; i < 10; i++) {
+    bool expected = i == 9;
+    CheckIsIndexSelected(i, expected);
+  }
+
+  // Even though the top index is specified to be at 'Saskatchewan' (index 9),
+  // the top visible option will be the one above it, 'Quebec' (index 8), to
+  // prevent overscrolling. Therefore, clicking on the first visible option of
+  // the list should select 'Quebec' instead of 'Saskatchewan.'
+  ClickOnSingleSelectLastSelectedFormOption(0);
+  for (int i = 0; i < 10; i++) {
+    bool expected = i == 8;
+    CheckIsIndexSelected(i, expected);
+  }
+}
+
 TEST_F(FPDFFormFillTextFormEmbedderTest, ReplaceSelection) {
   ScopedFPDFWideString text_to_insert = GetFPDFWideString(L"XYZ");
   ClickOnFormFieldAtPoint(RegularFormBegin());
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_javascript.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_javascript.cpp
new file mode 100644
index 00000000000..c2d119bb242
--- /dev/null
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_javascript.cpp
@@ -0,0 +1,85 @@
+// Copyright 2019 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "public/fpdf_javascript.h"
+
+#include <memory>
+
+#include "core/fpdfapi/parser/cpdf_dictionary.h"
+#include "core/fpdfapi/parser/cpdf_document.h"
+#include "core/fpdfdoc/cpdf_action.h"
+#include "core/fpdfdoc/cpdf_nametree.h"
+#include "fpdfsdk/cpdfsdk_helpers.h"
+#include "third_party/base/ptr_util.h"
+
+struct CPDF_JavaScript {
+  WideString name;
+  WideString script;
+};
+
+FPDF_EXPORT int FPDF_CALLCONV
+FPDFDoc_GetJavaScriptActionCount(FPDF_DOCUMENT document) {
+  CPDF_Document* doc = CPDFDocumentFromFPDFDocument(document);
+  return doc ? CPDF_NameTree(doc, "JavaScript").GetCount() : -1;
+}
+
+FPDF_EXPORT FPDF_JAVASCRIPT_ACTION FPDF_CALLCONV
+FPDFDoc_GetJavaScriptAction(FPDF_DOCUMENT document, int index) {
+  CPDF_Document* doc = CPDFDocumentFromFPDFDocument(document);
+  if (!doc || index < 0)
+    return nullptr;
+
+  CPDF_NameTree name_tree(doc, "JavaScript");
+  if (static_cast<size_t>(index) >= name_tree.GetCount())
+    return nullptr;
+
+  WideString name;
+  CPDF_Dictionary* obj =
+      ToDictionary(name_tree.LookupValueAndName(index, &name));
+  if (!obj)
+    return nullptr;
+
+  // Validate |obj|. Type is optional, but must be valid if present.
+  CPDF_Action action(obj);
+  if (action.GetType() != CPDF_Action::JavaScript)
+    return nullptr;
+
+  Optional<WideString> script = action.MaybeGetJavaScript();
+  if (!script.has_value())
+    return nullptr;
+
+  auto js = pdfium::MakeUnique<CPDF_JavaScript>();
+  js->name = name;
+  js->script = script.value();
+  return FPDFJavaScriptActionFromCPDFJavaScriptAction(js.release());
+}
+
+FPDF_EXPORT void FPDF_CALLCONV
+FPDFDoc_CloseJavaScriptAction(FPDF_JAVASCRIPT_ACTION javascript) {
+  // Take object back across API and destroy it.
+  std::unique_ptr<CPDF_JavaScript>(
+      CPDFJavaScriptActionFromFPDFJavaScriptAction(javascript));
+}
+
+FPDF_EXPORT unsigned long FPDF_CALLCONV
+FPDFJavaScriptAction_GetName(FPDF_JAVASCRIPT_ACTION javascript,
+                             FPDF_WCHAR* buffer,
+                             unsigned long buflen) {
+  CPDF_JavaScript* js =
+      CPDFJavaScriptActionFromFPDFJavaScriptAction(javascript);
+  if (!js)
+    return 0;
+  return Utf16EncodeMaybeCopyAndReturnLength(js->name, buffer, buflen);
+}
+
+FPDF_EXPORT unsigned long FPDF_CALLCONV
+FPDFJavaScriptAction_GetScript(FPDF_JAVASCRIPT_ACTION javascript,
+                               FPDF_WCHAR* buffer,
+                               unsigned long buflen) {
+  CPDF_JavaScript* js =
+      CPDFJavaScriptActionFromFPDFJavaScriptAction(javascript);
+  if (!js)
+    return 0;
+  return Utf16EncodeMaybeCopyAndReturnLength(js->script, buffer, buflen);
+}
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_javascript_embeddertest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_javascript_embeddertest.cpp
new file mode 100644
index 00000000000..35deb69799b
--- /dev/null
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_javascript_embeddertest.cpp
@@ -0,0 +1,130 @@
+// Copyright 2019 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "core/fxcrt/fx_memory.h"
+#include "public/fpdf_javascript.h"
+#include "public/fpdfview.h"
+#include "testing/embedder_test.h"
+#include "testing/fx_string_testhelpers.h"
+#include "testing/utils/hash.h"
+
+class FPDFJavaScriptEmbedderTest : public EmbedderTest {};
+
+TEST_F(FPDFJavaScriptEmbedderTest, CountJS) {
+  // Open a file with JS.
+  ASSERT_TRUE(OpenDocument("bug_679649.pdf"));
+  EXPECT_EQ(1, FPDFDoc_GetJavaScriptActionCount(document()));
+}
+
+TEST_F(FPDFJavaScriptEmbedderTest, CountNoJS) {
+  // Open a file without JS.
+  ASSERT_TRUE(OpenDocument("hello_world.pdf"));
+  EXPECT_EQ(0, FPDFDoc_GetJavaScriptActionCount(document()));
+
+  // Provide no document.
+  EXPECT_EQ(-1, FPDFDoc_GetJavaScriptActionCount(nullptr));
+}
+
+TEST_F(FPDFJavaScriptEmbedderTest, GetJS) {
+  ASSERT_TRUE(OpenDocument("js.pdf"));
+  EXPECT_EQ(6, FPDFDoc_GetJavaScriptActionCount(document()));
+
+  ScopedFPDFJavaScriptAction js;
+  js.reset(FPDFDoc_GetJavaScriptAction(document(), -1));
+  EXPECT_FALSE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(document(), 6));
+  EXPECT_FALSE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(nullptr, -1));
+  EXPECT_FALSE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(nullptr, 0));
+  EXPECT_FALSE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(nullptr, 1));
+  EXPECT_FALSE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(nullptr, 2));
+  EXPECT_FALSE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(nullptr, 5));
+  EXPECT_FALSE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(nullptr, 6));
+  EXPECT_FALSE(js);
+
+  js.reset(FPDFDoc_GetJavaScriptAction(document(), 0));
+  EXPECT_TRUE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(document(), 1));
+  EXPECT_TRUE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(document(), 2));
+  EXPECT_TRUE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(document(), 3));
+  EXPECT_FALSE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(document(), 4));
+  EXPECT_FALSE(js);
+  js.reset(FPDFDoc_GetJavaScriptAction(document(), 5));
+  EXPECT_FALSE(js);
+}
+
+TEST_F(FPDFJavaScriptEmbedderTest, GetJSName) {
+  ASSERT_TRUE(OpenDocument("bug_679649.pdf"));
+  ScopedFPDFJavaScriptAction js(FPDFDoc_GetJavaScriptAction(document(), 0));
+  ASSERT_TRUE(js);
+
+  {
+    FPDF_WCHAR buf[10];
+    EXPECT_EQ(0u, FPDFJavaScriptAction_GetName(nullptr, nullptr, 0));
+    EXPECT_EQ(0u, FPDFJavaScriptAction_GetName(nullptr, buf, 0));
+    EXPECT_EQ(0u, FPDFJavaScriptAction_GetName(nullptr, buf, sizeof(buf)));
+  }
+
+  constexpr size_t kExpectedLength = 22;
+  ASSERT_EQ(kExpectedLength,
+            FPDFJavaScriptAction_GetName(js.get(), nullptr, 0));
+
+  // Check that the name not returned if the buffer is too small.
+  // The result buffer should be overwritten with an empty string.
+  std::vector<FPDF_WCHAR> buf = GetFPDFWideStringBuffer(kExpectedLength);
+  // Write in the buffer to verify it's not overwritten.
+  memcpy(buf.data(), "abcdefgh", 8);
+  EXPECT_EQ(kExpectedLength, FPDFJavaScriptAction_GetName(js.get(), buf.data(),
+                                                          kExpectedLength - 1));
+  EXPECT_EQ(0, memcmp(buf.data(), "abcdefgh", 8));
+
+  EXPECT_EQ(kExpectedLength, FPDFJavaScriptAction_GetName(js.get(), buf.data(),
+                                                          kExpectedLength));
+  EXPECT_EQ(L"startDelay", GetPlatformWString(buf.data()));
+}
+
+TEST_F(FPDFJavaScriptEmbedderTest, GetJSScript) {
+  ASSERT_TRUE(OpenDocument("bug_679649.pdf"));
+  ScopedFPDFJavaScriptAction js(FPDFDoc_GetJavaScriptAction(document(), 0));
+  ASSERT_TRUE(js);
+
+  {
+    FPDF_WCHAR buf[10];
+    EXPECT_EQ(0u, FPDFJavaScriptAction_GetScript(nullptr, nullptr, 0));
+    EXPECT_EQ(0u, FPDFJavaScriptAction_GetScript(nullptr, buf, 0));
+    EXPECT_EQ(0u, FPDFJavaScriptAction_GetScript(nullptr, buf, sizeof(buf)));
+  }
+
+  constexpr size_t kExpectedLength = 218;
+  ASSERT_EQ(kExpectedLength,
+            FPDFJavaScriptAction_GetScript(js.get(), nullptr, 0));
+
+  // Check that the string value of an AP is not returned if the buffer is too
+  // small. The result buffer should be overwritten with an empty string.
+  std::vector<FPDF_WCHAR> buf = GetFPDFWideStringBuffer(kExpectedLength);
+  // Write in the buffer to verify it's not overwritten.
+  memcpy(buf.data(), "abcdefgh", 8);
+  EXPECT_EQ(kExpectedLength, FPDFJavaScriptAction_GetScript(
+                                 js.get(), buf.data(), kExpectedLength - 1));
+  EXPECT_EQ(0, memcmp(buf.data(), "abcdefgh", 8));
+
+  static const wchar_t kExpectedScript[] =
+      L"function ping() {\n  app.alert(\"ping\");\n}\n"
+      L"var timer = app.setTimeOut(\"ping()\", 100);\napp.clearTimeOut(timer);";
+  EXPECT_EQ(kExpectedLength, FPDFJavaScriptAction_GetScript(
+                                 js.get(), buf.data(), kExpectedLength));
+  EXPECT_EQ(kExpectedScript, GetPlatformWString(buf.data()));
+}
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_progressive.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_progressive.cpp
index c151e7c411b..212509f7349 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_progressive.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_progressive.cpp
@@ -14,7 +14,7 @@
 #include "core/fxge/cfx_defaultrenderdevice.h"
 #include "core/fxge/cfx_renderdevice.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
-#include "fpdfsdk/ipdfsdk_pauseadapter.h"
+#include "fpdfsdk/cpdfsdk_pauseadapter.h"
 #include "public/fpdfview.h"
 #include "third_party/base/ptr_util.h"
 
@@ -55,9 +55,9 @@ FPDF_EXPORT int FPDF_CALLCONV FPDF_RenderPageBitmap_Start(FPDF_BITMAP bitmap,
   pContext->m_pDevice = std::move(pOwnedDevice);
   pDevice->Attach(pBitmap, !!(flags & FPDF_REVERSE_BYTE_ORDER), nullptr, false);
 
-  IPDFSDK_PauseAdapter IPauseAdapter(pause);
+  CPDFSDK_PauseAdapter pause_adapter(pause);
   RenderPageWithContext(pContext, page, start_x, start_y, size_x, size_y,
-                        rotate, flags, false, &IPauseAdapter);
+                        rotate, flags, false, &pause_adapter);
 
 #ifdef _SKIA_SUPPORT_PATHS_
   pDevice->Flush(false);
@@ -82,8 +82,8 @@ FPDF_EXPORT int FPDF_CALLCONV FPDF_RenderPage_Continue(FPDF_PAGE page,
   auto* pContext =
       static_cast<CPDF_PageRenderContext*>(pPage->GetRenderContext());
   if (pContext && pContext->m_pRenderer) {
-    IPDFSDK_PauseAdapter IPauseAdapter(pause);
-    pContext->m_pRenderer->Continue(&IPauseAdapter);
+    CPDFSDK_PauseAdapter pause_adapter(pause);
+    pContext->m_pRenderer->Continue(&pause_adapter);
 #ifdef _SKIA_SUPPORT_PATHS_
     CFX_RenderDevice* pDevice = pContext->m_pDevice.get();
     pDevice->Flush(false);
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_save.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_save.cpp
index 22af561a17b..2dfd7593620 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_save.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_save.cpp
@@ -28,13 +28,8 @@
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fxcrt/cfx_memorystream.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#include "fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h"
 #include "public/fpdf_formfill.h"
-#include "xfa/fxfa/cxfa_eventparam.h"
-#include "xfa/fxfa/cxfa_ffapp.h"
 #include "xfa/fxfa/cxfa_ffdocview.h"
-#include "xfa/fxfa/cxfa_ffwidgethandler.h"
-#include "xfa/fxfa/cxfa_readynodeiterator.h"
 #include "xfa/fxfa/parser/cxfa_object.h"
 #endif
 
@@ -52,7 +47,7 @@ bool SaveXFADocumentData(CPDFXFA_Context* pContext,
   if (!pContext)
     return false;
 
-  if (!pContext->ContainsXFAForm())
+  if (!pContext->ContainsExtensionForm())
     return true;
 
   CXFA_FFDocView* pXFADocView = pContext->GetXFADocView();
@@ -173,49 +168,6 @@ bool SaveXFADocumentData(CPDFXFA_Context* pContext,
   }
   return true;
 }
-
-bool SendPostSaveToXFADoc(CPDFXFA_Context* pContext) {
-  if (!pContext)
-    return false;
-
-  if (!pContext->ContainsXFAForm())
-    return true;
-
-  CXFA_FFDocView* pXFADocView = pContext->GetXFADocView();
-  if (!pXFADocView)
-    return false;
-
-  CXFA_FFWidgetHandler* pWidgetHandler = pXFADocView->GetWidgetHandler();
-  auto it = pXFADocView->CreateReadyNodeIterator();
-  while (CXFA_Node* pNode = it->MoveToNext()) {
-    CXFA_EventParam preParam;
-    preParam.m_eType = XFA_EVENT_PostSave;
-    pWidgetHandler->ProcessEvent(pNode, &preParam);
-  }
-  pXFADocView->UpdateDocView();
-  pContext->ClearChangeMark();
-  return true;
-}
-
-bool SendPreSaveToXFADoc(CPDFXFA_Context* pContext,
-                         std::vector<RetainPtr<IFX_SeekableStream>>* fileList) {
-  if (!pContext->ContainsXFAForm())
-    return true;
-
-  CXFA_FFDocView* pXFADocView = pContext->GetXFADocView();
-  if (!pXFADocView)
-    return true;
-
-  CXFA_FFWidgetHandler* pWidgetHandler = pXFADocView->GetWidgetHandler();
-  auto it = pXFADocView->CreateReadyNodeIterator();
-  while (CXFA_Node* pNode = it->MoveToNext()) {
-    CXFA_EventParam preParam;
-    preParam.m_eType = XFA_EVENT_PreSave;
-    pWidgetHandler->ProcessEvent(pNode, &preParam);
-  }
-  pXFADocView->UpdateDocView();
-  return SaveXFADocumentData(pContext, fileList);
-}
 #endif  // PDF_ENABLE_XFA
 
 bool DoDocSave(FPDF_DOCUMENT document,
@@ -230,7 +182,8 @@ bool DoDocSave(FPDF_DOCUMENT document,
   auto* pContext = static_cast<CPDFXFA_Context*>(pPDFDoc->GetExtension());
   if (pContext) {
     std::vector<RetainPtr<IFX_SeekableStream>> fileList;
-    SendPreSaveToXFADoc(pContext, &fileList);
+    pContext->SendPreSaveToXFADoc(&fileList);
+    SaveXFADocumentData(pContext, &fileList);
   }
 #endif  // PDF_ENABLE_XFA
 
@@ -249,7 +202,8 @@ bool DoDocSave(FPDF_DOCUMENT document,
   bool bRet = fileMaker.Create(flags);
 
 #ifdef PDF_ENABLE_XFA
-  SendPostSaveToXFADoc(pContext);
+  if (pContext)
+    pContext->SendPostSaveToXFADoc();
 #endif  // PDF_ENABLE_XFA
 
   return bRet;
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_text.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_text.cpp
index cc7ca5bce00..793d2243dde 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_text.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_text.cpp
@@ -23,11 +23,6 @@
 #include "third_party/base/ptr_util.h"
 #include "third_party/base/stl_util.h"
 
-#ifdef PDF_ENABLE_XFA
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#include "fpdfsdk/fpdfxfa/cpdfxfa_page.h"
-#endif  // PDF_ENABLE_XFA
-
 #if defined(OS_WIN)
 #include <tchar.h>
 #endif
@@ -108,19 +103,42 @@ FPDFText_GetFontInfo(FPDF_TEXTPAGE text_page,
   if (!charinfo.m_pTextObj)
     return 0;
 
-  CPDF_Font* font = charinfo.m_pTextObj->GetFont();
+  RetainPtr<CPDF_Font> font = charinfo.m_pTextObj->GetFont();
   if (!font)
     return 0;
 
   if (flags)
     *flags = font->GetFontFlags();
-  ByteString basefont = font->GetBaseFont();
+
+  ByteString basefont = font->GetBaseFontName();
   unsigned long length = basefont.GetLength() + 1;
   if (buffer && buflen >= length)
     memcpy(buffer, basefont.c_str(), length);
+
   return length;
 }
 
+FPDF_EXPORT double FPDF_CALLCONV FPDFText_GetCharAngle(FPDF_TEXTPAGE text_page,
+                                                       int index) {
+  CPDF_TextPage* textpage = GetTextPageForValidIndex(text_page, index);
+  if (!textpage)
+    return -1;
+
+  FPDF_CHAR_INFO charinfo;
+  textpage->GetCharInfo(index, &charinfo);
+  // On the left is our current Matrix and on the right a generic rotation
+  // matrix for our coordinate space.
+  // | a  b  0 |    | cos(t)  -sin(t)  0 |
+  // | c  d  0 |    | sin(t)   cos(t)  0 |
+  // | e  f  1 |    |   0        0     1 |
+  // Calculate the angle of the vector
+  double angle = atan2(charinfo.m_Matrix.c, charinfo.m_Matrix.a);
+  if (angle < 0)
+    angle = 2 * FX_PI + angle;
+
+  return angle;
+}
+
 FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV FPDFText_GetCharBox(FPDF_TEXTPAGE text_page,
                                                         int index,
                                                         double* left,
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_text_embeddertest.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_text_embeddertest.cpp
index d0e63acd8a9..521831eb090 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_text_embeddertest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_text_embeddertest.cpp
@@ -7,6 +7,7 @@
 #include <utility>
 #include <vector>
 
+#include "build/build_config.h"
 #include "core/fxcrt/fx_memory.h"
 #include "core/fxge/fx_font.h"
 #include "public/cpp/fpdf_scopers.h"
@@ -392,6 +393,45 @@ TEST_F(FPDFTextEmbedderTest, TextSearchConsecutive) {
   UnloadPage(page);
 }
 
+// Fails on Windows. https://crbug.com/pdfium/1370
+#if defined(OS_WIN)
+#define MAYBE_TextSearchLatinExtended DISABLED_TextSearchLatinExtended
+#else
+#define MAYBE_TextSearchLatinExtended TextSearchLatinExtended
+#endif
+TEST_F(FPDFTextEmbedderTest, MAYBE_TextSearchLatinExtended) {
+  ASSERT_TRUE(OpenDocument("latin_extended.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  ASSERT_TRUE(page);
+
+  FPDF_TEXTPAGE textpage = FPDFText_LoadPage(page);
+  ASSERT_TRUE(textpage);
+
+  // Upper/lowercase 'a' with breve.
+  constexpr FPDF_WCHAR kNeedleUpper[] = {0x0102, 0x0000};
+  constexpr FPDF_WCHAR kNeedleLower[] = {0x0103, 0x0000};
+
+  for (const auto* needle : {kNeedleUpper, kNeedleLower}) {
+    ScopedFPDFTextFind search(FPDFText_FindStart(textpage, needle, 0, 0));
+    EXPECT_TRUE(search);
+    EXPECT_EQ(0, FPDFText_GetSchResultIndex(search.get()));
+    EXPECT_EQ(0, FPDFText_GetSchCount(search.get()));
+
+    // Should find 2 results at position 21/22, both with length 1.
+    EXPECT_TRUE(FPDFText_FindNext(search.get()));
+    EXPECT_EQ(2, FPDFText_GetSchResultIndex(search.get()));
+    EXPECT_EQ(1, FPDFText_GetSchCount(search.get()));
+    EXPECT_TRUE(FPDFText_FindNext(search.get()));
+    EXPECT_EQ(3, FPDFText_GetSchResultIndex(search.get()));
+    EXPECT_EQ(1, FPDFText_GetSchCount(search.get()));
+    // And no more than 2 results.
+    EXPECT_FALSE(FPDFText_FindNext(search.get()));
+  }
+
+  FPDFText_ClosePage(textpage);
+  UnloadPage(page);
+}
+
 // Test that the page has characters despite a bad stream length.
 TEST_F(FPDFTextEmbedderTest, StreamLengthPastEndOfFile) {
   ASSERT_TRUE(OpenDocument("bug_57.pdf"));
@@ -1173,3 +1213,41 @@ TEST_F(FPDFTextEmbedderTest, Bug_1139) {
   FPDFText_ClosePage(text_page);
   UnloadPage(page);
 }
+
+TEST_F(FPDFTextEmbedderTest, GetCharAngle) {
+  ASSERT_TRUE(OpenDocument("rotated_text.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  ASSERT_TRUE(page);
+
+  FPDF_TEXTPAGE text_page = FPDFText_LoadPage(page);
+  ASSERT_TRUE(text_page);
+
+  static constexpr int kSubstringsSize[] = {FX_ArraySize("Hello,"),
+                                            FX_ArraySize(" world!\r\n"),
+                                            FX_ArraySize("Goodbye,")};
+
+  // -1 for CountChars not including the \0, but +1 for the extra control
+  // character.
+  EXPECT_EQ(kHelloGoodbyeTextSize, FPDFText_CountChars(text_page));
+
+  EXPECT_EQ(-1, FPDFText_GetCharAngle(nullptr, 0));
+  EXPECT_EQ(-1, FPDFText_GetCharAngle(text_page, -1));
+  EXPECT_EQ(-1, FPDFText_GetCharAngle(text_page, kHelloGoodbyeTextSize + 1));
+
+  // Test GetCharAngle for every quadrant
+  EXPECT_NEAR(FX_PI / 4.0, FPDFText_GetCharAngle(text_page, 0), 0.001);
+  EXPECT_NEAR(3 * FX_PI / 4.0,
+              FPDFText_GetCharAngle(text_page, kSubstringsSize[0]), 0.001);
+  EXPECT_NEAR(
+      5 * FX_PI / 4.0,
+      FPDFText_GetCharAngle(text_page, kSubstringsSize[0] + kSubstringsSize[1]),
+      0.001);
+  EXPECT_NEAR(
+      7 * FX_PI / 4.0,
+      FPDFText_GetCharAngle(text_page, kSubstringsSize[0] + kSubstringsSize[1] +
+                                           kSubstringsSize[2]),
+      0.001);
+
+  FPDFText_ClosePage(text_page);
+  UnloadPage(page);
+}
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_thumbnail.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_thumbnail.cpp
index b3b6ea1225b..818b5f174f8 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_thumbnail.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_thumbnail.cpp
@@ -23,7 +23,7 @@ const CPDF_Stream* CPDFStreamForThumbnailFromPage(FPDF_PAGE page) {
     return nullptr;
 
   const CPDF_Dictionary* page_dict = p_page->GetDict();
-  if (!page_dict || !page_dict->KeyExist("Type"))
+  if (!page_dict->KeyExist("Type"))
     return nullptr;
 
   return page_dict->GetStreamFor("Thumb");
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_transformpage.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_transformpage.cpp
index 9ad59822dab..788c393afcc 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_transformpage.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_transformpage.cpp
@@ -60,9 +60,7 @@ bool GetBoundingBox(CPDF_Page* page,
 }
 
 CPDF_Object* GetPageContent(CPDF_Dictionary* pPageDict) {
-  return pPageDict
-             ? pPageDict->GetDirectObjectFor(pdfium::page_object::kContents)
-             : nullptr;
+  return pPageDict->GetDirectObjectFor(pdfium::page_object::kContents);
 }
 
 }  // namespace
@@ -272,6 +270,59 @@ FPDFPageObj_TransformClipPath(FPDF_PAGEOBJECT page_object,
   pPageObj->TransformGeneralState(matrix);
 }
 
+FPDF_EXPORT FPDF_CLIPPATH FPDF_CALLCONV
+FPDFPageObj_GetClipPath(FPDF_PAGEOBJECT page_object) {
+  CPDF_PageObject* pPageObj = CPDFPageObjectFromFPDFPageObject(page_object);
+  if (!pPageObj)
+    return nullptr;
+
+  return FPDFClipPathFromCPDFClipPath(&pPageObj->m_ClipPath);
+}
+
+FPDF_EXPORT int FPDF_CALLCONV FPDFClipPath_CountPaths(FPDF_CLIPPATH clip_path) {
+  CPDF_ClipPath* pClipPath = CPDFClipPathFromFPDFClipPath(clip_path);
+  if (!pClipPath)
+    return -1;
+
+  return pClipPath->GetPathCount();
+}
+
+FPDF_EXPORT int FPDF_CALLCONV
+FPDFClipPath_CountPathSegments(FPDF_CLIPPATH clip_path, int path_index) {
+  CPDF_ClipPath* pClipPath = CPDFClipPathFromFPDFClipPath(clip_path);
+  if (!pClipPath)
+    return -1;
+
+  if (path_index < 0 ||
+      static_cast<size_t>(path_index) >= pClipPath->GetPathCount()) {
+    return -1;
+  }
+
+  return pdfium::CollectionSize<int>(
+      pClipPath->GetPath(path_index).GetPoints());
+}
+
+FPDF_EXPORT FPDF_PATHSEGMENT FPDF_CALLCONV
+FPDFClipPath_GetPathSegment(FPDF_CLIPPATH clip_path,
+                            int path_index,
+                            int segment_index) {
+  CPDF_ClipPath* pClipPath = CPDFClipPathFromFPDFClipPath(clip_path);
+  if (!pClipPath)
+    return nullptr;
+
+  if (path_index < 0 ||
+      static_cast<size_t>(path_index) >= pClipPath->GetPathCount()) {
+    return nullptr;
+  }
+
+  const std::vector<FX_PATHPOINT>& points =
+      pClipPath->GetPath(path_index).GetPoints();
+  if (!pdfium::IndexInBounds(points, segment_index))
+    return nullptr;
+
+  return FPDFPathSegmentFromFXPathPoint(&points[segment_index]);
+}
+
 FPDF_EXPORT FPDF_CLIPPATH FPDF_CALLCONV FPDF_CreateClipPath(float left,
                                                             float bottom,
                                                             float right,
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_view.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdf_view.cpp
index 10a84675c03..0e96a3df28d 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_view.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_view.cpp
@@ -11,10 +11,10 @@
 #include <vector>
 
 #include "build/build_config.h"
-#include "core/fpdfapi/cpdf_modulemgr.h"
 #include "core/fpdfapi/page/cpdf_docpagedata.h"
 #include "core/fpdfapi/page/cpdf_occontext.h"
 #include "core/fpdfapi/page/cpdf_page.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
@@ -41,7 +41,7 @@
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
 #include "fpdfsdk/cpdfsdk_pageview.h"
-#include "fpdfsdk/ipdfsdk_pauseadapter.h"
+#include "fpdfsdk/cpdfsdk_pauseadapter.h"
 #include "fxjs/ijs_runtime.h"
 #include "public/fpdf_formfill.h"
 #include "third_party/base/ptr_util.h"
@@ -54,12 +54,7 @@
 #endif  // PDF_ENABLE_XFA
 
 #if defined(OS_WIN)
-#include "core/fxcodec/basic/basicmodule.h"
-#include "core/fxcodec/fax/faxmodule.h"
-#include "core/fxcodec/flate/flatemodule.h"
-#include "core/fxcodec/jpeg/jpegmodule.h"
-#include "core/fxge/cfx_windowsrenderdevice.h"
-#include "core/fxge/win32/cfx_psrenderer.h"
+#include "core/fpdfapi/render/cpdf_windowsrenderdevice.h"
 #include "public/fpdf_edit.h"
 
 // These checks are here because core/ and public/ cannot depend on each other.
@@ -83,19 +78,13 @@ namespace {
 
 bool g_bLibraryInitialized = false;
 
-#if defined(OS_WIN)
-constexpr EncoderIface kEncoderIface = {
-    BasicModule::A85Encode, FaxModule::FaxEncode, FlateModule::Encode,
-    JpegModule::JpegEncode, BasicModule::RunLengthEncode};
-#endif  // defined(OS_WIN)
-
 void RenderPageImpl(CPDF_PageRenderContext* pContext,
                     CPDF_Page* pPage,
                     const CFX_Matrix& matrix,
                     const FX_RECT& clipping_rect,
                     int flags,
                     bool bNeedToRestore,
-                    IPDFSDK_PauseAdapter* pause) {
+                    CPDFSDK_PauseAdapter* pause) {
   if (!pContext->m_pOptions)
     pContext->m_pOptions = pdfium::MakeUnique<CPDF_RenderOptions>();
 
@@ -179,7 +168,7 @@ FPDF_InitLibraryWithConfig(const FPDF_LIBRARY_CONFIG* config) {
 
   FXMEM_InitializePartitionAlloc();
   CFX_GEModule::Create(config ? config->m_pUserFontPaths : nullptr);
-  CPDF_ModuleMgr::Create();
+  CPDF_PageModule::Create();
 
 #ifdef PDF_ENABLE_XFA
   BC_Library_Init();
@@ -198,7 +187,7 @@ FPDF_EXPORT void FPDF_CALLCONV FPDF_DestroyLibrary() {
   BC_Library_Destroy();
 #endif  // PDF_ENABLE_XFA
 
-  CPDF_ModuleMgr::Destroy();
+  CPDF_PageModule::Destroy();
   CFX_GEModule::Destroy();
   IJS_Runtime::Destroy();
 
@@ -207,7 +196,7 @@ FPDF_EXPORT void FPDF_CALLCONV FPDF_DestroyLibrary() {
 
 FPDF_EXPORT void FPDF_CALLCONV FPDF_SetSandBoxPolicy(FPDF_DWORD policy,
                                                      FPDF_BOOL enable) {
-  return FSDK_SetSandBoxPolicy(policy, enable);
+  return SetPDFSandboxPolicy(policy, enable);
 }
 
 #if defined(OS_WIN)
@@ -563,8 +552,7 @@ FPDF_EXPORT void FPDF_CALLCONV FPDF_RenderPage(HDC dc,
       pContext->m_pOptions->GetOptions().bBreakForMasks = true;
     }
   } else {
-    pContext->m_pDevice =
-        pdfium::MakeUnique<CFX_WindowsRenderDevice>(dc, &kEncoderIface);
+    pContext->m_pDevice = pdfium::MakeUnique<CPDF_WindowsRenderDevice>(dc);
   }
 
   RenderPageWithContext(pContext, page, start_x, start_y, size_x, size_y,
@@ -592,8 +580,7 @@ FPDF_EXPORT void FPDF_CALLCONV FPDF_RenderPage(HDC dc,
     pOwnedContext = pdfium::MakeUnique<CPDF_PageRenderContext>();
     pContext = pOwnedContext.get();
     pPage->SetRenderContext(std::move(pOwnedContext));
-    pContext->m_pDevice =
-        pdfium::MakeUnique<CFX_WindowsRenderDevice>(dc, &kEncoderIface);
+    pContext->m_pDevice = pdfium::MakeUnique<CPDF_WindowsRenderDevice>(dc);
     pContext->m_pOptions = pdfium::MakeUnique<CPDF_RenderOptions>();
     pContext->m_pOptions->GetOptions().bBreakForMasks = true;
 
@@ -610,7 +597,7 @@ FPDF_EXPORT void FPDF_CALLCONV FPDF_RenderPage(HDC dc,
       pContext->m_pRenderer->Continue(nullptr);
     }
   } else if (bNewBitmap) {
-    CFX_WindowsRenderDevice WinDC(dc, &kEncoderIface);
+    CPDF_WindowsRenderDevice WinDC(dc);
     bool bitsStretched = false;
     if (WinDC.GetDeviceType() == DeviceType::kPrinter) {
       auto pDst = pdfium::MakeRetain<CFX_DIBitmap>();
@@ -755,7 +742,7 @@ FPDF_EXPORT void FPDF_CALLCONV FPDF_CloseDocument(FPDF_DOCUMENT document) {
 }
 
 FPDF_EXPORT unsigned long FPDF_CALLCONV FPDF_GetLastError() {
-  return GetLastError();
+  return FXSYS_GetLastError();
 }
 
 FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV FPDF_DeviceToPage(FPDF_PAGE page,
@@ -917,7 +904,7 @@ void RenderPageWithContext(CPDF_PageRenderContext* pContext,
                            int rotate,
                            int flags,
                            bool bNeedToRestore,
-                           IPDFSDK_PauseAdapter* pause) {
+                           CPDFSDK_PauseAdapter* pause) {
   CPDF_Page* pPage = CPDFPageFromFPDFPage(page);
   if (!pPage)
     return;
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdf_view_c_api_test.c b/chromium/third_party/pdfium/fpdfsdk/fpdf_view_c_api_test.c
index a9897ee2210..396b6d99631 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdf_view_c_api_test.c
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdf_view_c_api_test.c
@@ -19,6 +19,7 @@
 #include "public/fpdf_flatten.h"
 #include "public/fpdf_formfill.h"
 #include "public/fpdf_fwlevent.h"
+#include "public/fpdf_javascript.h"
 #include "public/fpdf_ppo.h"
 #include "public/fpdf_progressive.h"
 #include "public/fpdf_save.h"
@@ -271,6 +272,13 @@ int CheckPDFiumCApi() {
     CHK(FPDF_SetFormFieldHighlightAlpha);
     CHK(FPDF_SetFormFieldHighlightColor);
 
+    // fpdf_javascript.h
+    CHK(FPDFDoc_CloseJavaScriptAction);
+    CHK(FPDFDoc_GetJavaScriptAction);
+    CHK(FPDFDoc_GetJavaScriptActionCount);
+    CHK(FPDFJavaScriptAction_GetName);
+    CHK(FPDFJavaScriptAction_GetScript);
+
     // fpdf_ppo.h
     CHK(FPDF_CopyViewerPreferences);
     CHK(FPDF_ImportNPagesToOne);
@@ -324,6 +332,7 @@ int CheckPDFiumCApi() {
     CHK(FPDFText_FindPrev);
     CHK(FPDFText_FindStart);
     CHK(FPDFText_GetBoundedText);
+    CHK(FPDFText_GetCharAngle);
     CHK(FPDFText_GetCharBox);
     CHK(FPDFText_GetCharIndexAtPos);
     CHK(FPDFText_GetCharOrigin);
@@ -342,6 +351,10 @@ int CheckPDFiumCApi() {
     CHK(FPDFPage_GetThumbnailAsBitmap);
 
     // fpdf_transformpage.h
+    CHK(FPDFClipPath_CountPathSegments);
+    CHK(FPDFClipPath_CountPaths);
+    CHK(FPDFClipPath_GetPathSegment);
+    CHK(FPDFPageObj_GetClipPath);
     CHK(FPDFPageObj_TransformClipPath);
     CHK(FPDFPage_GetArtBox);
     CHK(FPDFPage_GetBleedBox);
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/BUILD.gn b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/BUILD.gn
index a3025a63e00..b3f821e7a21 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/BUILD.gn
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/BUILD.gn
@@ -16,8 +16,10 @@ jumbo_source_set("fpdfxfa") {
     "cpdfxfa_docenvironment.h",
     "cpdfxfa_page.cpp",
     "cpdfxfa_page.h",
-    "cxfa_fwladaptertimermgr.cpp",
-    "cxfa_fwladaptertimermgr.h",
+    "cpdfxfa_widget.cpp",
+    "cpdfxfa_widget.h",
+    "cpdfxfa_widgethandler.cpp",
+    "cpdfxfa_widgethandler.h",
   ]
   deps = [
     "../../:pdfium_public_headers",
@@ -26,10 +28,10 @@ jumbo_source_set("fpdfxfa") {
     "../../core/fpdfapi/render",
     "../../core/fxcrt",
     "../../fxjs",
-    "../../xfa/fgas",
     "../../xfa/fwl",
     "../../xfa/fxfa",
     "../../xfa/fxfa/parser",
+    "../../xfa/fxgraphics",
   ]
   configs += [ "../../:pdfium_core_config" ]
   visibility = [ "../../*" ]
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
index 8af985f3c97..7d759483d73 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
@@ -11,16 +11,13 @@
 
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
-#include "fpdfsdk/cpdfsdk_helpers.h"
 #include "fpdfsdk/cpdfsdk_pageview.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_page.h"
-#include "fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h"
 #include "fxjs/cjs_runtime.h"
 #include "fxjs/ijs_runtime.h"
 #include "public/fpdf_formfill.h"
 #include "third_party/base/ptr_util.h"
 #include "third_party/base/stl_util.h"
-#include "xfa/fgas/font/cfgas_defaultfontmanager.h"
 #include "xfa/fxfa/cxfa_eventparam.h"
 #include "xfa/fxfa/cxfa_ffapp.h"
 #include "xfa/fxfa/cxfa_ffdoc.h"
@@ -28,6 +25,7 @@
 #include "xfa/fxfa/cxfa_ffpageview.h"
 #include "xfa/fxfa/cxfa_ffwidgethandler.h"
 #include "xfa/fxfa/cxfa_fontmgr.h"
+#include "xfa/fxfa/cxfa_readynodeiterator.h"
 
 namespace {
 
@@ -105,13 +103,13 @@ bool CPDFXFA_Context::LoadXFADoc() {
   m_pXFADoc =
       CXFA_FFDoc::CreateAndOpen(m_pXFAApp.get(), &m_DocEnv, m_pPDFDoc.Get());
   if (!m_pXFADoc) {
-    SetLastError(FPDF_ERR_XFALOAD);
+    FXSYS_SetLastError(FPDF_ERR_XFALOAD);
     return false;
   }
 
   CJS_Runtime* actual_runtime = GetCJSRuntime();  // Null if a stub.
   if (!actual_runtime) {
-    SetLastError(FPDF_ERR_XFALOAD);
+    FXSYS_SetLastError(FPDF_ERR_XFALOAD);
     return false;
   }
 
@@ -124,7 +122,7 @@ bool CPDFXFA_Context::LoadXFADoc() {
   m_pXFADocView = m_pXFADoc->CreateDocView();
   if (m_pXFADocView->StartLayout() < 0) {
     CloseXFADoc();
-    SetLastError(FPDF_ERR_XFALAYOUT);
+    FXSYS_SetLastError(FPDF_ERR_XFALAYOUT);
     return false;
   }
 
@@ -159,7 +157,7 @@ RetainPtr<CPDFXFA_Page> CPDFXFA_Context::GetXFAPage(int page_index) {
     m_XFAPageList.resize(m_nPageCount);
   }
 
-  auto pPage = pdfium::MakeRetain<CPDFXFA_Page>(this, page_index);
+  auto pPage = pdfium::MakeRetain<CPDFXFA_Page>(GetPDFDoc(), page_index);
   if (!pPage->LoadPage())
     return nullptr;
 
@@ -206,6 +204,19 @@ uint32_t CPDFXFA_Context::GetUserPermissions() const {
   return 0xFFFFFFFF;
 }
 
+bool CPDFXFA_Context::ContainsExtensionForm() const {
+  return m_FormType == FormType::kXFAFull ||
+         m_FormType == FormType::kXFAForeground;
+}
+
+bool CPDFXFA_Context::ContainsExtensionFullForm() const {
+  return m_FormType == FormType::kXFAFull;
+}
+
+bool CPDFXFA_Context::ContainsExtensionForegroundForm() const {
+  return m_FormType == FormType::kXFAForeground;
+}
+
 void CPDFXFA_Context::ClearChangeMark() {
   if (m_pFormFillEnv)
     m_pFormFillEnv->ClearChangeMark();
@@ -302,8 +313,45 @@ bool CPDFXFA_Context::PutRequestURL(const WideString& wsURL,
          m_pFormFillEnv->PutRequestURL(wsURL, wsData, wsEncode);
 }
 
-std::unique_ptr<IFWL_AdapterTimerMgr> CPDFXFA_Context::NewTimerMgr() {
-  if (!m_pFormFillEnv)
-    return nullptr;
-  return pdfium::MakeUnique<CXFA_FWLAdapterTimerMgr>(m_pFormFillEnv.Get());
+TimerHandlerIface* CPDFXFA_Context::GetTimerHandler() const {
+  return m_pFormFillEnv ? m_pFormFillEnv->GetTimerHandler() : nullptr;
+}
+
+void CPDFXFA_Context::SendPostSaveToXFADoc() {
+  if (!ContainsExtensionForm())
+    return;
+
+  CXFA_FFDocView* pXFADocView = GetXFADocView();
+  if (!pXFADocView)
+    return;
+
+  CXFA_FFWidgetHandler* pWidgetHandler = pXFADocView->GetWidgetHandler();
+  auto it = pXFADocView->CreateReadyNodeIterator();
+  while (CXFA_Node* pNode = it->MoveToNext()) {
+    CXFA_EventParam preParam;
+    preParam.m_eType = XFA_EVENT_PostSave;
+    pWidgetHandler->ProcessEvent(pNode, &preParam);
+  }
+  pXFADocView->UpdateDocView();
+  ClearChangeMark();
+}
+
+void CPDFXFA_Context::SendPreSaveToXFADoc(
+    std::vector<RetainPtr<IFX_SeekableStream>>* fileList) {
+  if (!ContainsExtensionForm())
+    return;
+
+  CXFA_FFDocView* pXFADocView = GetXFADocView();
+  if (!pXFADocView)
+    return;
+
+  CXFA_FFWidgetHandler* pWidgetHandler = pXFADocView->GetWidgetHandler();
+  auto it = pXFADocView->CreateReadyNodeIterator();
+  while (CXFA_Node* pNode = it->MoveToNext()) {
+    CXFA_EventParam preParam;
+    preParam.m_eType = XFA_EVENT_PreSave;
+    pWidgetHandler->ProcessEvent(pNode, &preParam);
+  }
+  pXFADocView->UpdateDocView();
+  return;
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_context.h b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_context.h
index 3f7780b9d2d..310b18f44cf 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_context.h
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_context.h
@@ -13,6 +13,7 @@
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fxcrt/fx_system.h"
 #include "core/fxcrt/observed_ptr.h"
+#include "core/fxcrt/timerhandler_iface.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h"
@@ -42,11 +43,6 @@ class CPDFXFA_Context final : public CPDF_Document::Extension,
   CXFA_FFDoc* GetXFADoc() { return m_pXFADoc.get(); }
   CXFA_FFDocView* GetXFADocView() const { return m_pXFADocView.Get(); }
   FormType GetFormType() const { return m_FormType; }
-  bool ContainsXFAForm() const {
-    return m_FormType == FormType::kXFAFull ||
-           m_FormType == FormType::kXFAForeground;
-  }
-
   CPDFSDK_FormFillEnvironment* GetFormFillEnv() const {
     return m_pFormFillEnv.Get();
   }
@@ -61,13 +57,15 @@ class CPDFXFA_Context final : public CPDF_Document::Extension,
   int GetPageCount() const override;
   void DeletePage(int page_index) override;
   uint32_t GetUserPermissions() const override;
+  bool ContainsExtensionForm() const override;
+  bool ContainsExtensionFullForm() const override;
+  bool ContainsExtensionForegroundForm() const override;
 
   // IFXA_AppProvider:
   WideString GetLanguage() override;
   WideString GetPlatform() override;
   WideString GetAppName() override;
   WideString GetAppTitle() const override;
-
   void Beep(uint32_t dwType) override;
   int32_t MsgBox(const WideString& wsMessage,
                  const WideString& wsTitle,
@@ -88,8 +86,11 @@ class CPDFXFA_Context final : public CPDF_Document::Extension,
   bool PutRequestURL(const WideString& wsURL,
                      const WideString& wsData,
                      const WideString& wsEncode) override;
+  TimerHandlerIface* GetTimerHandler() const override;
 
-  std::unique_ptr<IFWL_AdapterTimerMgr> NewTimerMgr() override;
+  void SendPostSaveToXFADoc();
+  void SendPreSaveToXFADoc(
+      std::vector<RetainPtr<IFX_SeekableStream>>* fileList);
 
  private:
   friend class CPDFXFA_DocEnvironment;
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp
index 8dd06a5efc7..662af58cd95 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp
@@ -21,7 +21,6 @@
 #include "fpdfsdk/cpdfsdk_pageview.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_page.h"
-#include "fxjs/ijs_runtime.h"
 #include "xfa/fxfa/cxfa_ffdocview.h"
 #include "xfa/fxfa/cxfa_ffwidget.h"
 #include "xfa/fxfa/cxfa_ffwidgethandler.h"
@@ -233,7 +232,6 @@ bool CPDFXFA_DocEnvironment::GetPopupPos(CXFA_FFWidget* hWidget,
   }
 
   pPopupRect->height = popup_height;
-
   return true;
 }
 
@@ -268,8 +266,7 @@ bool CPDFXFA_DocEnvironment::PopupMenu(CXFA_FFWidget* hWidget,
   if (hWidget->CanSelectAll())
     menuFlag |= FXFA_MENU_SELECTALL;
 
-  return pFormFillEnv->PopupMenu(
-      pPage.Get(), FPDFWidgetFromCXFAFFWidget(hWidget), menuFlag, ptPopup);
+  return pFormFillEnv->PopupMenu(pPage.Get(), nullptr, menuFlag, ptPopup);
 }
 
 void CPDFXFA_DocEnvironment::PageViewEvent(CXFA_FFPageView* pPageView,
@@ -365,7 +362,7 @@ int32_t CPDFXFA_DocEnvironment::GetCurrentPage(CXFA_FFDoc* hDoc) {
 void CPDFXFA_DocEnvironment::SetCurrentPage(CXFA_FFDoc* hDoc,
                                             int32_t iCurPage) {
   if (hDoc != m_pContext->GetXFADoc() || !m_pContext->GetFormFillEnv() ||
-      !m_pContext->ContainsXFAForm() || iCurPage < 0 ||
+      !m_pContext->ContainsExtensionForm() || iCurPage < 0 ||
       iCurPage >= m_pContext->GetFormFillEnv()->GetPageCount()) {
     return;
   }
@@ -420,7 +417,7 @@ void CPDFXFA_DocEnvironment::ExportData(CXFA_FFDoc* hDoc,
   if (hDoc != m_pContext->GetXFADoc())
     return;
 
-  if (!m_pContext->ContainsXFAForm())
+  if (!m_pContext->ContainsExtensionForm())
     return;
 
   CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
@@ -601,86 +598,31 @@ FX_ARGB CPDFXFA_DocEnvironment::GetHighlightColor(CXFA_FFDoc* hDoc) {
                                 pForm->GetHighlightColor(FormFieldType::kXFA));
 }
 
-#ifdef PDF_XFA_ELEMENT_SUBMIT_ENABLED
-bool CPDFXFA_DocEnvironment::NotifySubmit(bool bPrevOrPost) {
-  if (bPrevOrPost)
-    return OnBeforeNotifySubmit();
-
-  OnAfterNotifySubmit();
-  return true;
-}
-
-bool CPDFXFA_DocEnvironment::OnBeforeNotifySubmit() {
-  if (!m_pContext->ContainsXFAForm())
-    return true;
-
-  CXFA_FFDocView* docView = m_pContext->GetXFADocView();
-  if (!docView)
-    return true;
-
-  CXFA_FFWidgetHandler* pWidgetHandler = docView->GetWidgetHandler();
-  if (!pWidgetHandler)
-    return true;
-
-  auto it = docView->CreateReadyNodeIterator();
-  if (it) {
-    CXFA_EventParam Param;
-    Param.m_eType = XFA_EVENT_PreSubmit;
-    while (CXFA_Node* pNode = it->MoveToNext())
-      pWidgetHandler->ProcessEvent(pNode, &Param);
-  }
-
-  it = docView->CreateReadyNodeIterator();
-  if (!it)
-    return true;
-
-  (void)it->MoveToNext();
-  CXFA_Node* pNode = it->MoveToNext();
-
-  while (pNode) {
-    if (pNode->ProcessValidate(docView, -1) == XFA_EventError::kError) {
-      CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
-      if (!pFormFillEnv)
-        return false;
-
-      pFormFillEnv->JS_appAlert(WideString::FromDefANSI(IDS_XFA_Validate_Input),
-                                WideString(), JSPLATFORM_ALERT_BUTTON_OK,
-                                JSPLATFORM_ALERT_ICON_WARNING);
-      return false;
-    }
-    pNode = it->MoveToNext();
-  }
+IJS_Runtime* CPDFXFA_DocEnvironment::GetIJSRuntime(CXFA_FFDoc* hDoc) const {
+  if (hDoc != m_pContext->GetXFADoc())
+    return nullptr;
 
-  docView->UpdateDocView();
-  return true;
+  CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
+  return pFormFillEnv ? pFormFillEnv->GetIJSRuntime() : nullptr;
 }
 
-void CPDFXFA_DocEnvironment::OnAfterNotifySubmit() {
-  if (!m_pContext->ContainsXFAForm())
-    return;
-
-  if (!m_pContext->GetXFADocView())
-    return;
-
-  CXFA_FFWidgetHandler* pWidgetHandler =
-      m_pContext->GetXFADocView()->GetWidgetHandler();
-  if (!pWidgetHandler)
-    return;
+RetainPtr<IFX_SeekableReadStream> CPDFXFA_DocEnvironment::OpenLinkedFile(
+    CXFA_FFDoc* hDoc,
+    const WideString& wsLink) {
+  CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
+  if (!pFormFillEnv)
+    return nullptr;
 
-  auto it = m_pContext->GetXFADocView()->CreateReadyNodeIterator();
-  if (!it)
-    return;
+  ByteString bs = wsLink.ToUTF16LE();
+  FPDF_FILEHANDLER* pFileHandler =
+      pFormFillEnv->OpenFile(0, AsFPDFWideString(&bs), "rb");
+  if (!pFileHandler)
+    return nullptr;
 
-  CXFA_EventParam Param;
-  Param.m_eType = XFA_EVENT_PostSubmit;
-  CXFA_Node* pNode = it->MoveToNext();
-  while (pNode) {
-    pWidgetHandler->ProcessEvent(pNode, &Param);
-    pNode = it->MoveToNext();
-  }
-  m_pContext->GetXFADocView()->UpdateDocView();
+  return MakeSeekableStream(pFileHandler);
 }
 
+#ifdef PDF_XFA_ELEMENT_SUBMIT_ENABLED
 bool CPDFXFA_DocEnvironment::Submit(CXFA_FFDoc* hDoc, CXFA_Submit* submit) {
   if (!NotifySubmit(true) || !m_pContext->GetXFADocView())
     return false;
@@ -692,20 +634,69 @@ bool CPDFXFA_DocEnvironment::Submit(CXFA_FFDoc* hDoc, CXFA_Submit* submit) {
 }
 #endif  // PDF_XFA_ELEMENT_SUBMIT_ENABLED
 
-RetainPtr<IFX_SeekableReadStream> CPDFXFA_DocEnvironment::OpenLinkedFile(
-    CXFA_FFDoc* hDoc,
-    const WideString& wsLink) {
-  CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
-  if (!pFormFillEnv)
-    return nullptr;
+bool CPDFXFA_DocEnvironment::MailToInfo(WideString& csURL,
+                                        WideString& csToAddress,
+                                        WideString& csCCAddress,
+                                        WideString& csBCCAddress,
+                                        WideString& csSubject,
+                                        WideString& csMsg) {
+  WideString srcURL = csURL;
+  srcURL.TrimLeft();
+  if (srcURL.Left(7).CompareNoCase(L"mailto:") != 0)
+    return false;
 
-  ByteString bs = wsLink.ToUTF16LE();
-  FPDF_FILEHANDLER* pFileHandler =
-      pFormFillEnv->OpenFile(0, AsFPDFWideString(&bs), "rb");
-  if (!pFileHandler)
-    return nullptr;
+  auto pos = srcURL.Find(L'?');
 
-  return MakeSeekableStream(pFileHandler);
+  {
+    WideString tmp;
+    if (!pos.has_value()) {
+      pos = srcURL.Find(L'@');
+      if (!pos.has_value())
+        return false;
+
+      tmp = srcURL.Right(csURL.GetLength() - 7);
+    } else {
+      tmp = srcURL.Left(pos.value());
+      tmp = tmp.Right(tmp.GetLength() - 7);
+    }
+    tmp.Trim();
+    csToAddress = std::move(tmp);
+  }
+
+  srcURL = srcURL.Right(srcURL.GetLength() - (pos.value() + 1));
+  while (!srcURL.IsEmpty()) {
+    srcURL.Trim();
+    pos = srcURL.Find(L'&');
+    WideString tmp = (!pos.has_value()) ? srcURL : srcURL.Left(pos.value());
+    tmp.Trim();
+    if (tmp.GetLength() >= 3 && tmp.Left(3).CompareNoCase(L"cc=") == 0) {
+      tmp = tmp.Right(tmp.GetLength() - 3);
+      if (!csCCAddress.IsEmpty())
+        csCCAddress += L';';
+      csCCAddress += tmp;
+    } else if (tmp.GetLength() >= 4 &&
+               tmp.Left(4).CompareNoCase(L"bcc=") == 0) {
+      tmp = tmp.Right(tmp.GetLength() - 4);
+      if (!csBCCAddress.IsEmpty())
+        csBCCAddress += L';';
+      csBCCAddress += tmp;
+    } else if (tmp.GetLength() >= 8 &&
+               tmp.Left(8).CompareNoCase(L"subject=") == 0) {
+      tmp = tmp.Right(tmp.GetLength() - 8);
+      csSubject += tmp;
+    } else if (tmp.GetLength() >= 5 &&
+               tmp.Left(5).CompareNoCase(L"body=") == 0) {
+      tmp = tmp.Right(tmp.GetLength() - 5);
+      csMsg += tmp;
+    }
+    srcURL = pos.has_value()
+                 ? srcURL.Right(csURL.GetLength() - (pos.value() + 1))
+                 : WideString();
+  }
+  csToAddress.Replace(L",", L";");
+  csCCAddress.Replace(L",", L";");
+  csBCCAddress.Replace(L",", L";");
+  return true;
 }
 
 bool CPDFXFA_DocEnvironment::ExportSubmitFile(FPDF_FILEHANDLER* pFileHandler,
@@ -824,72 +815,86 @@ void CPDFXFA_DocEnvironment::ToXFAContentFlags(WideString csSrcContent,
   }
 }
 
-bool CPDFXFA_DocEnvironment::MailToInfo(WideString& csURL,
-                                        WideString& csToAddress,
-                                        WideString& csCCAddress,
-                                        WideString& csBCCAddress,
-                                        WideString& csSubject,
-                                        WideString& csMsg) {
-  WideString srcURL = csURL;
-  srcURL.TrimLeft();
-  if (srcURL.Left(7).CompareNoCase(L"mailto:") != 0)
-    return false;
+#ifdef PDF_XFA_ELEMENT_SUBMIT_ENABLED
+bool CPDFXFA_DocEnvironment::OnBeforeNotifySubmit() {
+  if (!m_pContext->ContainsXFAForm())
+    return true;
 
-  auto pos = srcURL.Find(L'?');
+  CXFA_FFDocView* docView = m_pContext->GetXFADocView();
+  if (!docView)
+    return true;
 
-  {
-    WideString tmp;
-    if (!pos.has_value()) {
-      pos = srcURL.Find(L'@');
-      if (!pos.has_value())
+  CXFA_FFWidgetHandler* pWidgetHandler = docView->GetWidgetHandler();
+  if (!pWidgetHandler)
+    return true;
+
+  auto it = docView->CreateReadyNodeIterator();
+  if (it) {
+    CXFA_EventParam Param;
+    Param.m_eType = XFA_EVENT_PreSubmit;
+    while (CXFA_Node* pNode = it->MoveToNext())
+      pWidgetHandler->ProcessEvent(pNode, &Param);
+  }
+
+  it = docView->CreateReadyNodeIterator();
+  if (!it)
+    return true;
+
+  (void)it->MoveToNext();
+  CXFA_Node* pNode = it->MoveToNext();
+
+  while (pNode) {
+    if (pNode->ProcessValidate(docView, -1) == XFA_EventError::kError) {
+      CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
+      if (!pFormFillEnv)
         return false;
 
-      tmp = srcURL.Right(csURL.GetLength() - 7);
-    } else {
-      tmp = srcURL.Left(pos.value());
-      tmp = tmp.Right(tmp.GetLength() - 7);
+      pFormFillEnv->JS_appAlert(WideString::FromDefANSI(IDS_XFA_Validate_Input),
+                                WideString(), JSPLATFORM_ALERT_BUTTON_OK,
+                                JSPLATFORM_ALERT_ICON_WARNING);
+      return false;
     }
-    tmp.Trim();
-    csToAddress = std::move(tmp);
+    pNode = it->MoveToNext();
   }
 
-  srcURL = srcURL.Right(srcURL.GetLength() - (pos.value() + 1));
-  while (!srcURL.IsEmpty()) {
-    srcURL.Trim();
-    pos = srcURL.Find(L'&');
-    WideString tmp = (!pos.has_value()) ? srcURL : srcURL.Left(pos.value());
-    tmp.Trim();
-    if (tmp.GetLength() >= 3 && tmp.Left(3).CompareNoCase(L"cc=") == 0) {
-      tmp = tmp.Right(tmp.GetLength() - 3);
-      if (!csCCAddress.IsEmpty())
-        csCCAddress += L';';
-      csCCAddress += tmp;
-    } else if (tmp.GetLength() >= 4 &&
-               tmp.Left(4).CompareNoCase(L"bcc=") == 0) {
-      tmp = tmp.Right(tmp.GetLength() - 4);
-      if (!csBCCAddress.IsEmpty())
-        csBCCAddress += L';';
-      csBCCAddress += tmp;
-    } else if (tmp.GetLength() >= 8 &&
-               tmp.Left(8).CompareNoCase(L"subject=") == 0) {
-      tmp = tmp.Right(tmp.GetLength() - 8);
-      csSubject += tmp;
-    } else if (tmp.GetLength() >= 5 &&
-               tmp.Left(5).CompareNoCase(L"body=") == 0) {
-      tmp = tmp.Right(tmp.GetLength() - 5);
-      csMsg += tmp;
-    }
-    srcURL = pos.has_value()
-                 ? srcURL.Right(csURL.GetLength() - (pos.value() + 1))
-                 : WideString();
+  docView->UpdateDocView();
+  return true;
+}
+
+void CPDFXFA_DocEnvironment::OnAfterNotifySubmit() {
+  if (!m_pContext->ContainsXFAForm())
+    return;
+
+  if (!m_pContext->GetXFADocView())
+    return;
+
+  CXFA_FFWidgetHandler* pWidgetHandler =
+      m_pContext->GetXFADocView()->GetWidgetHandler();
+  if (!pWidgetHandler)
+    return;
+
+  auto it = m_pContext->GetXFADocView()->CreateReadyNodeIterator();
+  if (!it)
+    return;
+
+  CXFA_EventParam Param;
+  Param.m_eType = XFA_EVENT_PostSubmit;
+  CXFA_Node* pNode = it->MoveToNext();
+  while (pNode) {
+    pWidgetHandler->ProcessEvent(pNode, &Param);
+    pNode = it->MoveToNext();
   }
-  csToAddress.Replace(L",", L";");
-  csCCAddress.Replace(L",", L";");
-  csBCCAddress.Replace(L",", L";");
+  m_pContext->GetXFADocView()->UpdateDocView();
+}
+
+bool CPDFXFA_DocEnvironment::NotifySubmit(bool bPrevOrPost) {
+  if (bPrevOrPost)
+    return OnBeforeNotifySubmit();
+
+  OnAfterNotifySubmit();
   return true;
 }
 
-#ifdef PDF_XFA_ELEMENT_SUBMIT_ENABLED
 bool CPDFXFA_DocEnvironment::SubmitInternal(CXFA_FFDoc* hDoc,
                                             CXFA_Submit* submit) {
   CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
@@ -968,35 +973,3 @@ bool CPDFXFA_DocEnvironment::SubmitInternal(CXFA_FFDoc* hDoc,
   return true;
 }
 #endif  // PDF_XFA_ELEMENT_SUBMIT_ENABLED
-
-bool CPDFXFA_DocEnvironment::SetPropertyInNonXFAGlobalObject(
-    CXFA_FFDoc* hDoc,
-    ByteStringView szPropName,
-    CFXJSE_Value* pValue) {
-  if (hDoc != m_pContext->GetXFADoc())
-    return false;
-
-  CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
-  if (!pFormFillEnv)
-    return false;
-
-  IJS_Runtime* pIJSRuntime = pFormFillEnv->GetIJSRuntime();
-  IJS_Runtime::ScopedEventContext pContext(pIJSRuntime);
-  return pIJSRuntime->SetValueByNameInGlobalObject(szPropName, pValue);
-}
-
-bool CPDFXFA_DocEnvironment::GetPropertyFromNonXFAGlobalObject(
-    CXFA_FFDoc* hDoc,
-    ByteStringView szPropName,
-    CFXJSE_Value* pValue) {
-  if (hDoc != m_pContext->GetXFADoc())
-    return false;
-
-  CPDFSDK_FormFillEnvironment* pFormFillEnv = m_pContext->GetFormFillEnv();
-  if (!pFormFillEnv)
-    return false;
-
-  IJS_Runtime* pIJSRuntime = pFormFillEnv->GetIJSRuntime();
-  IJS_Runtime::ScopedEventContext pContext(pIJSRuntime);
-  return pIJSRuntime->GetValueByNameFromGlobalObject(szPropName, pValue);
-}
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h
index 7c86bd814b1..100e664d820 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.h
@@ -13,34 +13,28 @@
 #include "xfa/fxfa/fxfa.h"
 
 class CPDFXFA_Context;
+class IJS_Runtime;
 
 class CPDFXFA_DocEnvironment final : public IXFA_DocEnvironment {
  public:
   explicit CPDFXFA_DocEnvironment(CPDFXFA_Context*);
   ~CPDFXFA_DocEnvironment() override;
 
-  // IXFA_DocEnvironment
+  // IXFA_DocEnvironment:
   void SetChangeMark(CXFA_FFDoc* hDoc) override;
-  // Used in dynamic xfa.
   void InvalidateRect(CXFA_FFPageView* pPageView, const CFX_RectF& rt) override;
-  // Show or hide caret.
   void DisplayCaret(CXFA_FFWidget* hWidget,
                     bool bVisible,
                     const CFX_RectF* pRtAnchor) override;
-  // dwPos: (0:bottom 1:top)
   bool GetPopupPos(CXFA_FFWidget* hWidget,
                    float fMinPopup,
                    float fMaxPopup,
                    const CFX_RectF& rtAnchor,
                    CFX_RectF* pPopupRect) override;
   bool PopupMenu(CXFA_FFWidget* hWidget, const CFX_PointF& ptPopup) override;
-
-  // dwFlags XFA_PAGEVIEWEVENT_Added, XFA_PAGEVIEWEVENT_Removing
   void PageViewEvent(CXFA_FFPageView* pPageView, uint32_t dwFlags) override;
   void WidgetPostAdd(CXFA_FFWidget* hWidget) override;
   void WidgetPreRemove(CXFA_FFWidget* hWidget) override;
-
-  // Host method
   int32_t CountPages(CXFA_FFDoc* hDoc) override;
   int32_t GetCurrentPage(CXFA_FFDoc* hDoc) override;
   void SetCurrentPage(CXFA_FFDoc* hDoc, int32_t iCurPage) override;
@@ -60,30 +54,16 @@ class CPDFXFA_DocEnvironment final : public IXFA_DocEnvironment {
              int32_t nEndPage,
              uint32_t dwOptions) override;
   FX_ARGB GetHighlightColor(CXFA_FFDoc* hDoc) override;
-
-#ifdef PDF_XFA_ELEMENT_SUBMIT_ENABLED
-  bool Submit(CXFA_FFDoc* hDoc, CXFA_Submit* submit) override;
-#endif  // PDF_XFA_ELEMENT_SUBMIT_ENABLED
-
-  bool GetPropertyFromNonXFAGlobalObject(CXFA_FFDoc* hDoc,
-                                         ByteStringView szPropName,
-                                         CFXJSE_Value* pValue) override;
-  bool SetPropertyInNonXFAGlobalObject(CXFA_FFDoc* hDoc,
-                                       ByteStringView szPropName,
-                                       CFXJSE_Value* pValue) override;
-
+  IJS_Runtime* GetIJSRuntime(CXFA_FFDoc* hDoc) const override;
   RetainPtr<IFX_SeekableReadStream> OpenLinkedFile(
       CXFA_FFDoc* hDoc,
       const WideString& wsLink) override;
 
- private:
 #ifdef PDF_XFA_ELEMENT_SUBMIT_ENABLED
-  bool OnBeforeNotifySubmit();
-  void OnAfterNotifySubmit();
-  bool NotifySubmit(bool bPrevOrPost);
-  bool SubmitInternal(CXFA_FFDoc* hDoc, CXFA_Submit* submit);
+  bool Submit(CXFA_FFDoc* hDoc, CXFA_Submit* submit) override;
 #endif  // PDF_XFA_ELEMENT_SUBMIT_ENABLED
 
+ private:
   bool MailToInfo(WideString& csURL,
                   WideString& csToAddress,
                   WideString& csCCAddress,
@@ -96,6 +76,13 @@ class CPDFXFA_DocEnvironment final : public IXFA_DocEnvironment {
                         FPDF_DWORD flag);
   void ToXFAContentFlags(WideString csSrcContent, FPDF_DWORD& flag);
 
+#ifdef PDF_XFA_ELEMENT_SUBMIT_ENABLED
+  bool OnBeforeNotifySubmit();
+  void OnAfterNotifySubmit();
+  bool NotifySubmit(bool bPrevOrPost);
+  bool SubmitInternal(CXFA_FFDoc* hDoc, CXFA_Submit* submit);
+#endif  // PDF_XFA_ELEMENT_SUBMIT_ENABLED
+
   UnownedPtr<CPDFXFA_Context> const m_pContext;
 };
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page.cpp
index c0f383cb99b..79b3e874a1a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page.cpp
@@ -6,19 +6,25 @@
 
 #include "fpdfsdk/fpdfxfa/cpdfxfa_page.h"
 
+#include <memory>
+
 #include "core/fpdfapi/page/cpdf_page.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfapi/render/cpdf_pagerendercache.h"
+#include "fpdfsdk/cpdfsdk_pageview.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#include "fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h"
-#include "public/fpdf_formfill.h"
-#include "third_party/base/compiler_specific.h"
+#include "fpdfsdk/fpdfxfa/cpdfxfa_widget.h"
+#include "third_party/base/ptr_util.h"
 #include "xfa/fxfa/cxfa_ffdocview.h"
 #include "xfa/fxfa/cxfa_ffpageview.h"
+#include "xfa/fxfa/cxfa_ffwidget.h"
+#include "xfa/fxfa/cxfa_ffwidgethandler.h"
+#include "xfa/fxfa/cxfa_rendercontext.h"
+#include "xfa/fxgraphics/cxfa_graphics.h"
 
-CPDFXFA_Page::CPDFXFA_Page(CPDFXFA_Context* pContext, int page_index)
-    : m_pContext(pContext), m_iPageIndex(page_index) {
-  ASSERT(m_pContext);
+CPDFXFA_Page::CPDFXFA_Page(CPDF_Document* pDocument, int page_index)
+    : m_pDocument(pDocument), m_iPageIndex(page_index) {
+  ASSERT(m_pDocument->GetExtension());
   ASSERT(m_iPageIndex >= 0);
 }
 
@@ -33,7 +39,7 @@ CPDFXFA_Page* CPDFXFA_Page::AsXFAPage() {
 }
 
 CPDF_Document* CPDFXFA_Page::GetDocument() const {
-  return m_pContext->GetPDFDoc();
+  return m_pDocument.Get();
 }
 
 bool CPDFXFA_Page::LoadPDFPage() {
@@ -49,12 +55,14 @@ bool CPDFXFA_Page::LoadPDFPage() {
 }
 
 CXFA_FFPageView* CPDFXFA_Page::GetXFAPageView() const {
-  CXFA_FFDocView* pXFADocView = m_pContext->GetXFADocView();
+  auto* pContext = static_cast<CPDFXFA_Context*>(m_pDocument->GetExtension());
+  CXFA_FFDocView* pXFADocView = pContext->GetXFADocView();
   return pXFADocView ? pXFADocView->GetPageView(m_iPageIndex) : nullptr;
 }
 
 bool CPDFXFA_Page::LoadPage() {
-  switch (m_pContext->GetFormType()) {
+  auto* pContext = static_cast<CPDFXFA_Context*>(m_pDocument->GetExtension());
+  switch (pContext->GetFormType()) {
     case FormType::kNone:
     case FormType::kAcroForm:
     case FormType::kXFAForeground:
@@ -74,16 +82,13 @@ void CPDFXFA_Page::LoadPDFPageFromDict(CPDF_Dictionary* pPageDict) {
   m_pPDFPage->ParseContent();
 }
 
-CPDF_Document::Extension* CPDFXFA_Page::GetDocumentExtension() const {
-  return m_pContext.Get();
-}
-
 float CPDFXFA_Page::GetPageWidth() const {
   CXFA_FFPageView* pPageView = GetXFAPageView();
   if (!m_pPDFPage && !pPageView)
     return 0.0f;
 
-  switch (m_pContext->GetFormType()) {
+  auto* pContext = static_cast<CPDFXFA_Context*>(m_pDocument->GetExtension());
+  switch (pContext->GetFormType()) {
     case FormType::kNone:
     case FormType::kAcroForm:
     case FormType::kXFAForeground:
@@ -104,7 +109,8 @@ float CPDFXFA_Page::GetPageHeight() const {
   if (!m_pPDFPage && !pPageView)
     return 0.0f;
 
-  switch (m_pContext->GetFormType()) {
+  auto* pContext = static_cast<CPDFXFA_Context*>(m_pDocument->GetExtension());
+  switch (pContext->GetFormType()) {
     case FormType::kNone:
     case FormType::kAcroForm:
     case FormType::kXFAForeground:
@@ -151,7 +157,8 @@ CFX_Matrix CPDFXFA_Page::GetDisplayMatrix(const FX_RECT& rect,
   if (!m_pPDFPage && !pPageView)
     return CFX_Matrix();
 
-  switch (m_pContext->GetFormType()) {
+  auto* pContext = static_cast<CPDFXFA_Context*>(m_pDocument->GetExtension());
+  switch (pContext->GetFormType()) {
     case FormType::kNone:
     case FormType::kAcroForm:
     case FormType::kXFAForeground:
@@ -166,3 +173,89 @@ CFX_Matrix CPDFXFA_Page::GetDisplayMatrix(const FX_RECT& rect,
 
   return CFX_Matrix();
 }
+
+CPDFSDK_Annot* CPDFXFA_Page::GetNextXFAAnnot(CPDFSDK_Annot* pSDKAnnot,
+                                             bool bNext) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pSDKAnnot);
+  if (!pXFAWidget)
+    return nullptr;
+
+  ObservedPtr<CPDFSDK_Annot> pObservedAnnot(pSDKAnnot);
+  CPDFSDK_PageView* pPageView = pSDKAnnot->GetPageView();
+  std::unique_ptr<IXFA_WidgetIterator> pWidgetIterator(
+      GetXFAPageView()->CreateWidgetIterator(XFA_TRAVERSEWAY_Tranvalse,
+                                             XFA_WidgetStatus_Visible |
+                                                 XFA_WidgetStatus_Viewable |
+                                                 XFA_WidgetStatus_Focused));
+
+  // Check |pSDKAnnot| again because JS may have destroyed it
+  if (!pObservedAnnot || !pWidgetIterator)
+    return nullptr;
+
+  if (pWidgetIterator->GetCurrentWidget() != pXFAWidget->GetXFAFFWidget())
+    pWidgetIterator->SetCurrentWidget(pXFAWidget->GetXFAFFWidget());
+
+  CXFA_FFWidget* hNextFocus =
+      bNext ? pWidgetIterator->MoveToNext() : pWidgetIterator->MoveToPrevious();
+  if (!hNextFocus && pSDKAnnot)
+    hNextFocus = pWidgetIterator->MoveToFirst();
+
+  return pPageView->GetAnnotByXFAWidget(hNextFocus);
+}
+
+int CPDFXFA_Page::HasFormFieldAtPoint(const CFX_PointF& point) const {
+  CXFA_FFPageView* pPageView = GetXFAPageView();
+  if (!pPageView)
+    return -1;
+
+  CXFA_FFDocView* pDocView = pPageView->GetDocView();
+  if (!pDocView)
+    return -1;
+
+  CXFA_FFWidgetHandler* pWidgetHandler = pDocView->GetWidgetHandler();
+  if (!pWidgetHandler)
+    return -1;
+
+  std::unique_ptr<IXFA_WidgetIterator> pWidgetIterator(
+      pPageView->CreateWidgetIterator(XFA_TRAVERSEWAY_Form,
+                                      XFA_WidgetStatus_Viewable));
+  if (!pWidgetIterator)
+    return -1;
+
+  CXFA_FFWidget* pXFAAnnot;
+  while ((pXFAAnnot = pWidgetIterator->MoveToNext()) != nullptr) {
+    if (pXFAAnnot->GetFormFieldType() == FormFieldType::kXFA)
+      continue;
+
+    CFX_FloatRect rcWidget = pXFAAnnot->GetWidgetRect().ToFloatRect();
+    rcWidget.Inflate(1.0f, 1.0f);
+    if (rcWidget.Contains(point))
+      return static_cast<int>(pXFAAnnot->GetFormFieldType());
+  }
+
+  return -1;
+}
+
+void CPDFXFA_Page::DrawFocusAnnot(CFX_RenderDevice* pDevice,
+                                  CPDFSDK_Annot* pAnnot,
+                                  const CFX_Matrix& mtUser2Device,
+                                  const FX_RECT& rtClip) {
+  CFX_RectF rectClip(rtClip);
+  CXFA_Graphics gs(pDevice);
+  gs.SetClipRect(rectClip);
+
+  CXFA_FFPageView* xfaView = GetXFAPageView();
+  CXFA_RenderContext renderContext(xfaView, rectClip, mtUser2Device);
+  renderContext.DoRender(&gs);
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
+    return;
+
+  CXFA_FFDocView* docView = xfaView->GetDocView();
+  if (!docView)
+    return;
+
+  docView->GetWidgetHandler()->RenderWidget(pXFAWidget->GetXFAFFWidget(), &gs,
+                                            mtUser2Device, false);
+}
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page.h b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page.h
index 8db57356c53..73d54211267 100644
--- a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page.h
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page.h
@@ -9,15 +9,16 @@
 
 #include "core/fpdfapi/page/cpdf_page.h"
 #include "core/fpdfapi/page/ipdf_page.h"
-#include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_system.h"
 #include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "third_party/base/optional.h"
 
+class CFX_RenderDevice;
 class CPDF_Dictionary;
-class CPDFXFA_Context;
+class CPDF_Document;
+class CPDFSDK_Annot;
 class CXFA_FFPageView;
 
 class CPDFXFA_Page final : public IPDF_Page {
@@ -43,20 +44,25 @@ class CPDFXFA_Page final : public IPDF_Page {
 
   bool LoadPage();
   void LoadPDFPageFromDict(CPDF_Dictionary* pPageDict);
-  CPDF_Document::Extension* GetDocumentExtension() const;
   int GetPageIndex() const { return m_iPageIndex; }
   void SetXFAPageViewIndex(int index) { m_iPageIndex = index; }
   CXFA_FFPageView* GetXFAPageView() const;
+  CPDFSDK_Annot* GetNextXFAAnnot(CPDFSDK_Annot* pSDKAnnot, bool bNext);
+  int HasFormFieldAtPoint(const CFX_PointF& point) const;
+  void DrawFocusAnnot(CFX_RenderDevice* pDevice,
+                      CPDFSDK_Annot* pAnnot,
+                      const CFX_Matrix& mtUser2Device,
+                      const FX_RECT& rtClip);
 
  private:
   // Refcounted class.
-  CPDFXFA_Page(CPDFXFA_Context* pContext, int page_index);
+  CPDFXFA_Page(CPDF_Document* pDocument, int page_index);
   ~CPDFXFA_Page() override;
 
   bool LoadPDFPage();
 
-  RetainPtr<CPDF_Page> m_pPDFPage;
-  UnownedPtr<CPDFXFA_Context> const m_pContext;
+  RetainPtr<CPDF_Page> m_pPDFPage;  // Backing page, if any.
+  UnownedPtr<CPDF_Document> const m_pDocument;
   int m_iPageIndex;
 };
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_widget.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_widget.cpp
new file mode 100644
index 00000000000..f4c9934f1cd
--- /dev/null
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_widget.cpp
@@ -0,0 +1,31 @@
+// Copyright 2016 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
+
+#include "fpdfsdk/fpdfxfa/cpdfxfa_widget.h"
+
+#include "fpdfsdk/ipdfsdk_annothandler.h"
+#include "xfa/fxfa/cxfa_ffwidget.h"
+
+CPDFXFA_Widget::CPDFXFA_Widget(CXFA_FFWidget* pXFAFFWidget,
+                               CPDFSDK_PageView* pPageView,
+                               CPDFSDK_InteractiveForm* pInteractiveForm)
+    : CPDFSDK_Annot(pPageView),
+      m_pInteractiveForm(pInteractiveForm),
+      m_pXFAFFWidget(pXFAFFWidget) {}
+
+CPDFXFA_Widget::~CPDFXFA_Widget() = default;
+
+CPDFXFA_Widget* CPDFXFA_Widget::AsXFAWidget() {
+  return this;
+}
+
+CPDF_Annot::Subtype CPDFXFA_Widget::GetAnnotSubtype() const {
+  return CPDF_Annot::Subtype::XFAWIDGET;
+}
+
+CFX_FloatRect CPDFXFA_Widget::GetRect() const {
+  return GetXFAFFWidget()->GetLayoutItem()->GetRect(false).ToFloatRect();
+}
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_xfawidget.h b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_widget.h
index 3ee5cdef65c..76d98785ca2 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_xfawidget.h
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_widget.h
@@ -4,44 +4,39 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#ifndef FPDFSDK_CPDFSDK_XFAWIDGET_H_
-#define FPDFSDK_CPDFSDK_XFAWIDGET_H_
+#ifndef FPDFSDK_FPDFXFA_CPDFXFA_WIDGET_H_
+#define FPDFSDK_FPDFXFA_CPDFXFA_WIDGET_H_
 
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/observed_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "fpdfsdk/cpdfsdk_annot.h"
+#include "xfa/fxfa/cxfa_ffwidget.h"
 
 class CPDFSDK_InteractiveForm;
 class CPDFSDK_PageView;
-class CXFA_FFWidget;
 
-class CPDFSDK_XFAWidget final : public CPDFSDK_Annot {
+class CPDFXFA_Widget final : public CPDFSDK_Annot {
  public:
-  CPDFSDK_XFAWidget(CXFA_FFWidget* pAnnot,
-                    CPDFSDK_PageView* pPageView,
-                    CPDFSDK_InteractiveForm* pInteractiveForm);
-  ~CPDFSDK_XFAWidget() override;
+  CPDFXFA_Widget(CXFA_FFWidget* pXFAFFWidget,
+                 CPDFSDK_PageView* pPageView,
+                 CPDFSDK_InteractiveForm* pInteractiveForm);
+  ~CPDFXFA_Widget() override;
 
   // CPDFSDK_Annot:
-  bool IsXFAField() const override;
-  CXFA_FFWidget* GetXFAWidget() const override;
+  CPDFXFA_Widget* AsXFAWidget() override;
   CPDF_Annot::Subtype GetAnnotSubtype() const override;
   CFX_FloatRect GetRect() const override;
 
+  CXFA_FFWidget* GetXFAFFWidget() const { return m_pXFAFFWidget.Get(); }
   CPDFSDK_InteractiveForm* GetInteractiveForm() const {
     return m_pInteractiveForm.Get();
   }
 
  private:
   UnownedPtr<CPDFSDK_InteractiveForm> const m_pInteractiveForm;
-  ObservedPtr<CXFA_FFWidget> const m_pXFAWidget;
+  ObservedPtr<CXFA_FFWidget> const m_pXFAFFWidget;
 };
 
-inline CPDFSDK_XFAWidget* ToXFAWidget(CPDFSDK_Annot* pAnnot) {
-  return pAnnot && pAnnot->GetAnnotSubtype() == CPDF_Annot::Subtype::XFAWIDGET
-      ? static_cast<CPDFSDK_XFAWidget*>(pAnnot) : nullptr;
-}
-
-#endif  // FPDFSDK_CPDFSDK_XFAWIDGET_H_
+#endif  // FPDFSDK_FPDFXFA_CPDFXFA_WIDGET_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_xfawidgethandler.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_widgethandler.cpp
index bbecd7cbbf6..b2bc251f04a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_xfawidgethandler.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_widgethandler.cpp
@@ -4,15 +4,14 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#include "fpdfsdk/cpdfsdk_xfawidgethandler.h"
+#include "fpdfsdk/fpdfxfa/cpdfxfa_widgethandler.h"
 
-#include "core/fpdfdoc/cpdf_interactiveform.h"
 #include "fpdfsdk/cpdfsdk_annot.h"
 #include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fpdfsdk/cpdfsdk_interactiveform.h"
 #include "fpdfsdk/cpdfsdk_pageview.h"
-#include "fpdfsdk/cpdfsdk_xfawidget.h"
 #include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
+#include "fpdfsdk/fpdfxfa/cpdfxfa_widget.h"
 #include "public/fpdf_fwlevent.h"
 #include "xfa/fwl/cfwl_app.h"
 #include "xfa/fwl/fwl_widgetdef.h"
@@ -201,63 +200,64 @@ CHECK_FWL_VKEY_ENUM____(FWL_VKEY_Unknown);
 
 #undef CHECK_FWL_VKEY_ENUM____
 
-CPDFSDK_XFAWidgetHandler::CPDFSDK_XFAWidgetHandler(
-    CPDFSDK_FormFillEnvironment* pFormFillEnv)
-    : m_pFormFillEnv(pFormFillEnv) {}
+CPDFXFA_WidgetHandler::CPDFXFA_WidgetHandler() = default;
 
-CPDFSDK_XFAWidgetHandler::~CPDFSDK_XFAWidgetHandler() {}
+CPDFXFA_WidgetHandler::~CPDFXFA_WidgetHandler() = default;
 
-bool CPDFSDK_XFAWidgetHandler::CanAnswer(CPDFSDK_Annot* pAnnot) {
-  return !!pAnnot->GetXFAWidget();
+void CPDFXFA_WidgetHandler::SetFormFillEnvironment(
+    CPDFSDK_FormFillEnvironment* pFormFillEnv) {
+  m_pFormFillEnv = pFormFillEnv;
 }
 
-CPDFSDK_Annot* CPDFSDK_XFAWidgetHandler::NewAnnot(CPDF_Annot* pAnnot,
-                                                  CPDFSDK_PageView* pPage) {
+bool CPDFXFA_WidgetHandler::CanAnswer(CPDFSDK_Annot* pAnnot) {
+  CPDFXFA_Widget* pWidget = ToXFAWidget(pAnnot);
+  return pWidget && pWidget->GetXFAFFWidget();
+}
+
+CPDFSDK_Annot* CPDFXFA_WidgetHandler::NewAnnot(CPDF_Annot* pAnnot,
+                                               CPDFSDK_PageView* pPage) {
   return nullptr;
 }
 
-CPDFSDK_Annot* CPDFSDK_XFAWidgetHandler::NewAnnot(CXFA_FFWidget* pAnnot,
-                                                  CPDFSDK_PageView* pPage) {
+CPDFSDK_Annot* CPDFXFA_WidgetHandler::NewAnnotForXFA(CXFA_FFWidget* pAnnot,
+                                                     CPDFSDK_PageView* pPage) {
   CPDFSDK_InteractiveForm* pForm = m_pFormFillEnv->GetInteractiveForm();
-  CPDFSDK_XFAWidget* pWidget = new CPDFSDK_XFAWidget(pAnnot, pPage, pForm);
-  pForm->AddXFAMap(pAnnot, pWidget);
-  return pWidget;
+  return new CPDFXFA_Widget(pAnnot, pPage, pForm);
 }
 
-void CPDFSDK_XFAWidgetHandler::OnDraw(CPDFSDK_PageView* pPageView,
-                                      CPDFSDK_Annot* pAnnot,
-                                      CFX_RenderDevice* pDevice,
-                                      const CFX_Matrix& mtUser2Device,
-                                      bool bDrawAnnots) {
-  ASSERT(pPageView);
-  ASSERT(pAnnot);
-
-  CXFA_Graphics gs(pDevice);
+void CPDFXFA_WidgetHandler::OnDraw(CPDFSDK_PageView* pPageView,
+                                   CPDFSDK_Annot* pAnnot,
+                                   CFX_RenderDevice* pDevice,
+                                   const CFX_Matrix& mtUser2Device,
+                                   bool bDrawAnnots) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  ASSERT(pXFAWidget);
 
   bool bIsHighlight = false;
   if (pPageView->GetFormFillEnv()->GetFocusAnnot() != pAnnot)
     bIsHighlight = true;
 
-  GetXFAWidgetHandler(pAnnot)->RenderWidget(pAnnot->GetXFAWidget(), &gs,
-                                            mtUser2Device, bIsHighlight);
+  CXFA_Graphics gs(pDevice);
+  GetXFAFFWidgetHandler(pXFAWidget)
+      ->RenderWidget(pXFAWidget->GetXFAFFWidget(), &gs, mtUser2Device,
+                     bIsHighlight);
 
   // to do highlight and shadow
 }
 
-void CPDFSDK_XFAWidgetHandler::OnLoad(CPDFSDK_Annot* pAnnot) {}
+void CPDFXFA_WidgetHandler::OnLoad(CPDFSDK_Annot* pAnnot) {}
 
-void CPDFSDK_XFAWidgetHandler::ReleaseAnnot(
+void CPDFXFA_WidgetHandler::ReleaseAnnot(
     std::unique_ptr<CPDFSDK_Annot> pAnnot) {
-  CPDFSDK_XFAWidget* pWidget = ToXFAWidget(pAnnot.get());
-  pWidget->GetInteractiveForm()->RemoveXFAMap(pWidget->GetXFAWidget());
 }
 
-CFX_FloatRect CPDFSDK_XFAWidgetHandler::GetViewBBox(CPDFSDK_PageView* pPageView,
-                                                    CPDFSDK_Annot* pAnnot) {
-  CXFA_Node* node = pAnnot->GetXFAWidget()->GetNode();
+CFX_FloatRect CPDFXFA_WidgetHandler::GetViewBBox(CPDFSDK_PageView* pPageView,
+                                                 CPDFSDK_Annot* pAnnot) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  CXFA_Node* node = pXFAWidget->GetXFAFFWidget()->GetNode();
   ASSERT(node->IsWidgetReady());
 
-  CFX_RectF rcBBox = pAnnot->GetXFAWidget()->GetBBox(
+  CFX_RectF rcBBox = pXFAWidget->GetXFAFFWidget()->GetBBox(
       node->GetFFWidgetType() == XFA_FFWidgetType::kSignature
           ? CXFA_FFWidget::kDrawFocus
           : CXFA_FFWidget::kDoNotDrawFocus);
@@ -267,70 +267,86 @@ CFX_FloatRect CPDFSDK_XFAWidgetHandler::GetViewBBox(CPDFSDK_PageView* pPageView,
   return rcWidget;
 }
 
-WideString CPDFSDK_XFAWidgetHandler::GetText(CPDFSDK_Annot* pAnnot) {
-  if (!pAnnot)
+WideString CPDFXFA_WidgetHandler::GetText(CPDFSDK_Annot* pAnnot) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return WideString();
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->GetText(pAnnot->GetXFAWidget());
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->GetText(pXFAWidget->GetXFAFFWidget());
 }
 
-WideString CPDFSDK_XFAWidgetHandler::GetSelectedText(CPDFSDK_Annot* pAnnot) {
-  if (!pAnnot)
+WideString CPDFXFA_WidgetHandler::GetSelectedText(CPDFSDK_Annot* pAnnot) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return WideString();
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->GetSelectedText(pAnnot->GetXFAWidget());
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->GetSelectedText(pXFAWidget->GetXFAFFWidget());
 }
 
-void CPDFSDK_XFAWidgetHandler::ReplaceSelection(CPDFSDK_Annot* pAnnot,
-                                                const WideString& text) {
-  if (!pAnnot)
+void CPDFXFA_WidgetHandler::ReplaceSelection(CPDFSDK_Annot* pAnnot,
+                                             const WideString& text) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->PasteText(pAnnot->GetXFAWidget(), text);
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->PasteText(pXFAWidget->GetXFAFFWidget(), text);
 }
 
-bool CPDFSDK_XFAWidgetHandler::CanUndo(CPDFSDK_Annot* pAnnot) {
-  if (!pAnnot)
+bool CPDFXFA_WidgetHandler::CanUndo(CPDFSDK_Annot* pAnnot) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return false;
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->CanUndo(pAnnot->GetXFAWidget());
+
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->CanUndo(pXFAWidget->GetXFAFFWidget());
 }
 
-bool CPDFSDK_XFAWidgetHandler::CanRedo(CPDFSDK_Annot* pAnnot) {
-  if (!pAnnot)
+bool CPDFXFA_WidgetHandler::CanRedo(CPDFSDK_Annot* pAnnot) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return false;
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->CanRedo(pAnnot->GetXFAWidget());
+
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->CanRedo(pXFAWidget->GetXFAFFWidget());
 }
 
-bool CPDFSDK_XFAWidgetHandler::Undo(CPDFSDK_Annot* pAnnot) {
-  if (!pAnnot)
+bool CPDFXFA_WidgetHandler::Undo(CPDFSDK_Annot* pAnnot) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return false;
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->Undo(pAnnot->GetXFAWidget());
+
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->Undo(pXFAWidget->GetXFAFFWidget());
 }
 
-bool CPDFSDK_XFAWidgetHandler::Redo(CPDFSDK_Annot* pAnnot) {
-  if (!pAnnot)
+bool CPDFXFA_WidgetHandler::Redo(CPDFSDK_Annot* pAnnot) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return false;
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->Redo(pAnnot->GetXFAWidget());
+
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->Redo(pXFAWidget->GetXFAFFWidget());
 }
 
-bool CPDFSDK_XFAWidgetHandler::HitTest(CPDFSDK_PageView* pPageView,
-                                       CPDFSDK_Annot* pAnnot,
-                                       const CFX_PointF& point) {
-  if (!pPageView || !pAnnot)
+bool CPDFXFA_WidgetHandler::HitTest(CPDFSDK_PageView* pPageView,
+                                    CPDFSDK_Annot* pAnnot,
+                                    const CFX_PointF& point) {
+  if (!pPageView)
+    return false;
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return false;
 
   CPDFSDK_FormFillEnvironment* pFormFillEnv = pPageView->GetFormFillEnv();
   if (!pFormFillEnv)
     return false;
 
-  CPDFXFA_Context* pContext = pFormFillEnv->GetXFAContext();
+  auto* pContext =
+      static_cast<CPDFXFA_Context*>(pFormFillEnv->GetDocExtension());
   if (!pContext)
     return false;
 
@@ -343,169 +359,215 @@ bool CPDFSDK_XFAWidgetHandler::HitTest(CPDFSDK_PageView* pPageView,
     return false;
 
   FWL_WidgetHit dwHitTest =
-      pWidgetHandler->OnHitTest(pAnnot->GetXFAWidget(), point);
+      pWidgetHandler->OnHitTest(pXFAWidget->GetXFAFFWidget(), point);
   return dwHitTest != FWL_WidgetHit::Unknown;
 }
 
-void CPDFSDK_XFAWidgetHandler::OnMouseEnter(CPDFSDK_PageView* pPageView,
-                                            ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                            uint32_t nFlag) {
-  if (!pPageView || !pAnnot->HasObservable())
+void CPDFXFA_WidgetHandler::OnMouseEnter(CPDFSDK_PageView* pPageView,
+                                         ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                         uint32_t nFlag) {
+  if (!pPageView)
     return;
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  pWidgetHandler->OnMouseEnter((*pAnnot)->GetXFAWidget());
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
+    return;
+
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  pWidgetHandler->OnMouseEnter(pXFAWidget->GetXFAFFWidget());
 }
 
-void CPDFSDK_XFAWidgetHandler::OnMouseExit(CPDFSDK_PageView* pPageView,
-                                           ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                           uint32_t nFlag) {
-  if (!pPageView || !pAnnot->HasObservable())
+void CPDFXFA_WidgetHandler::OnMouseExit(CPDFSDK_PageView* pPageView,
+                                        ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                        uint32_t nFlag) {
+  if (!pPageView)
     return;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  pWidgetHandler->OnMouseExit((*pAnnot)->GetXFAWidget());
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
+    return;
+
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  pWidgetHandler->OnMouseExit(pXFAWidget->GetXFAFFWidget());
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnLButtonDown(CPDFSDK_PageView* pPageView,
-                                             ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                             uint32_t nFlags,
-                                             const CFX_PointF& point) {
-  if (!pPageView || !pAnnot->HasObservable())
+bool CPDFXFA_WidgetHandler::OnLButtonDown(CPDFSDK_PageView* pPageView,
+                                          ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                          uint32_t nFlags,
+                                          const CFX_PointF& point) {
+  if (!pPageView)
+    return false;
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  return pWidgetHandler->OnLButtonDown((*pAnnot)->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnLButtonDown(pXFAWidget->GetXFAFFWidget(),
                                        GetFWLFlags(nFlags), point);
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnLButtonUp(CPDFSDK_PageView* pPageView,
-                                           ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                           uint32_t nFlags,
-                                           const CFX_PointF& point) {
-  if (!pPageView || !pAnnot->HasObservable())
+bool CPDFXFA_WidgetHandler::OnLButtonUp(CPDFSDK_PageView* pPageView,
+                                        ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                        uint32_t nFlags,
+                                        const CFX_PointF& point) {
+  if (!pPageView)
+    return false;
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  return pWidgetHandler->OnLButtonUp((*pAnnot)->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnLButtonUp(pXFAWidget->GetXFAFFWidget(),
                                      GetFWLFlags(nFlags), point);
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnLButtonDblClk(
-    CPDFSDK_PageView* pPageView,
-    ObservedPtr<CPDFSDK_Annot>* pAnnot,
-    uint32_t nFlags,
-    const CFX_PointF& point) {
-  if (!pPageView || !pAnnot->HasObservable())
+bool CPDFXFA_WidgetHandler::OnLButtonDblClk(CPDFSDK_PageView* pPageView,
+                                            ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                            uint32_t nFlags,
+                                            const CFX_PointF& point) {
+  if (!pPageView)
+    return false;
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  return pWidgetHandler->OnLButtonDblClk((*pAnnot)->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnLButtonDblClk(pXFAWidget->GetXFAFFWidget(),
                                          GetFWLFlags(nFlags), point);
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnMouseMove(CPDFSDK_PageView* pPageView,
-                                           ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                           uint32_t nFlags,
-                                           const CFX_PointF& point) {
-  if (!pPageView || !pAnnot->HasObservable())
+bool CPDFXFA_WidgetHandler::OnMouseMove(CPDFSDK_PageView* pPageView,
+                                        ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                        uint32_t nFlags,
+                                        const CFX_PointF& point) {
+  if (!pPageView)
+    return false;
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  return pWidgetHandler->OnMouseMove((*pAnnot)->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnMouseMove(pXFAWidget->GetXFAFFWidget(),
                                      GetFWLFlags(nFlags), point);
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnMouseWheel(CPDFSDK_PageView* pPageView,
-                                            ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                            uint32_t nFlags,
-                                            short zDelta,
-                                            const CFX_PointF& point) {
-  if (!pPageView || !pAnnot->HasObservable())
+bool CPDFXFA_WidgetHandler::OnMouseWheel(CPDFSDK_PageView* pPageView,
+                                         ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                         uint32_t nFlags,
+                                         short zDelta,
+                                         const CFX_PointF& point) {
+  if (!pPageView)
+    return false;
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  return pWidgetHandler->OnMouseWheel((*pAnnot)->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnMouseWheel(pXFAWidget->GetXFAFFWidget(),
                                       GetFWLFlags(nFlags), zDelta, point);
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnRButtonDown(CPDFSDK_PageView* pPageView,
-                                             ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                             uint32_t nFlags,
-                                             const CFX_PointF& point) {
-  if (!pPageView || !pAnnot->HasObservable())
+bool CPDFXFA_WidgetHandler::OnRButtonDown(CPDFSDK_PageView* pPageView,
+                                          ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                          uint32_t nFlags,
+                                          const CFX_PointF& point) {
+  if (!pPageView)
+    return false;
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  return pWidgetHandler->OnRButtonDown((*pAnnot)->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnRButtonDown(pXFAWidget->GetXFAFFWidget(),
                                        GetFWLFlags(nFlags), point);
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnRButtonUp(CPDFSDK_PageView* pPageView,
-                                           ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                           uint32_t nFlags,
-                                           const CFX_PointF& point) {
-  if (!pPageView || !pAnnot->HasObservable())
+bool CPDFXFA_WidgetHandler::OnRButtonUp(CPDFSDK_PageView* pPageView,
+                                        ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                        uint32_t nFlags,
+                                        const CFX_PointF& point) {
+  if (!pPageView)
+    return false;
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  return pWidgetHandler->OnRButtonUp((*pAnnot)->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnRButtonUp(pXFAWidget->GetXFAFFWidget(),
                                      GetFWLFlags(nFlags), point);
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnRButtonDblClk(
-    CPDFSDK_PageView* pPageView,
-    ObservedPtr<CPDFSDK_Annot>* pAnnot,
-    uint32_t nFlags,
-    const CFX_PointF& point) {
-  if (!pPageView || !pAnnot->HasObservable())
+bool CPDFXFA_WidgetHandler::OnRButtonDblClk(CPDFSDK_PageView* pPageView,
+                                            ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                            uint32_t nFlags,
+                                            const CFX_PointF& point) {
+  if (!pPageView)
+    return false;
+
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot->Get());
-  return pWidgetHandler->OnRButtonDblClk((*pAnnot)->GetXFAWidget(),
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnRButtonDblClk(pXFAWidget->GetXFAFFWidget(),
                                          GetFWLFlags(nFlags), point);
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnChar(CPDFSDK_Annot* pAnnot,
-                                      uint32_t nChar,
-                                      uint32_t nFlags) {
-  if (!pAnnot)
+bool CPDFXFA_WidgetHandler::OnChar(CPDFSDK_Annot* pAnnot,
+                                   uint32_t nChar,
+                                   uint32_t nFlags) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnChar(pAnnot->GetXFAWidget(), nChar,
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnChar(pXFAWidget->GetXFAFFWidget(), nChar,
                                 GetFWLFlags(nFlags));
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnKeyDown(CPDFSDK_Annot* pAnnot,
-                                         int nKeyCode,
-                                         int nFlag) {
-  if (!pAnnot)
+bool CPDFXFA_WidgetHandler::OnKeyDown(CPDFSDK_Annot* pAnnot,
+                                      int nKeyCode,
+                                      int nFlag) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnKeyDown(pAnnot->GetXFAWidget(), nKeyCode,
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnKeyDown(pXFAWidget->GetXFAFFWidget(), nKeyCode,
                                    GetFWLFlags(nFlag));
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnKeyUp(CPDFSDK_Annot* pAnnot,
-                                       int nKeyCode,
-                                       int nFlag) {
-  if (!pAnnot)
+bool CPDFXFA_WidgetHandler::OnKeyUp(CPDFSDK_Annot* pAnnot,
+                                    int nKeyCode,
+                                    int nFlag) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot);
+  if (!pXFAWidget)
     return false;
 
-  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAWidgetHandler(pAnnot);
-  return pWidgetHandler->OnKeyUp(pAnnot->GetXFAWidget(), nKeyCode,
+  CXFA_FFWidgetHandler* pWidgetHandler = GetXFAFFWidgetHandler(pXFAWidget);
+  return pWidgetHandler->OnKeyUp(pXFAWidget->GetXFAFFWidget(), nKeyCode,
                                  GetFWLFlags(nFlag));
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnSetFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                          uint32_t nFlag) {
+bool CPDFXFA_WidgetHandler::OnSetFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                       uint32_t nFlag) {
   return true;
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnKillFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot,
-                                           uint32_t nFlag) {
-  CXFA_FFWidget* hWidget = *pAnnot ? (*pAnnot)->GetXFAWidget() : nullptr;
+bool CPDFXFA_WidgetHandler::OnKillFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                        uint32_t nFlag) {
+  CPDFXFA_Widget* pXFAWidget = ToXFAWidget(pAnnot->Get());
+  if (!pXFAWidget)
+    return true;
+
+  CXFA_FFWidget* hWidget = pXFAWidget->GetXFAFFWidget();
   if (!hWidget)
     return true;
 
@@ -517,19 +579,23 @@ bool CPDFSDK_XFAWidgetHandler::OnKillFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot,
   return true;
 }
 
-bool CPDFSDK_XFAWidgetHandler::OnXFAChangedFocus(
+bool CPDFXFA_WidgetHandler::OnXFAChangedFocus(
     ObservedPtr<CPDFSDK_Annot>* pOldAnnot,
     ObservedPtr<CPDFSDK_Annot>* pNewAnnot) {
   CXFA_FFWidgetHandler* pWidgetHandler = nullptr;
   if (pOldAnnot->HasObservable())
-    pWidgetHandler = GetXFAWidgetHandler(pOldAnnot->Get());
+    pWidgetHandler = GetXFAFFWidgetHandler(pOldAnnot->Get());
   else if (pNewAnnot->HasObservable())
-    pWidgetHandler = GetXFAWidgetHandler(pNewAnnot->Get());
+    pWidgetHandler = GetXFAFFWidgetHandler(pNewAnnot->Get());
 
   if (!pWidgetHandler)
     return true;
 
-  CXFA_FFWidget* hWidget = *pNewAnnot ? (*pNewAnnot)->GetXFAWidget() : nullptr;
+  CPDFXFA_Widget* pNewXFAWidget = ToXFAWidget(pNewAnnot->Get());
+  if (!pNewXFAWidget)
+    return true;
+
+  CXFA_FFWidget* hWidget = pNewXFAWidget->GetXFAFFWidget();
   if (!hWidget)
     return true;
 
@@ -537,27 +603,30 @@ bool CPDFSDK_XFAWidgetHandler::OnXFAChangedFocus(
   if (!pXFAPageView)
     return true;
 
+  ObservedPtr<CXFA_FFPageView> pObservedXFAPageView(pXFAPageView);
   bool bRet = pXFAPageView->GetDocView()->SetFocus(hWidget);
-  if (pXFAPageView->GetDocView()->GetFocusWidget() == hWidget)
+
+  // Check |pXFAPageView| again because |SetFocus| can trigger JS to destroy it.
+  if (pObservedXFAPageView &&
+      pXFAPageView->GetDocView()->GetFocusWidget() == hWidget) {
     bRet = true;
+  }
 
   return bRet;
 }
 
-bool CPDFSDK_XFAWidgetHandler::SetIndexSelected(
-    ObservedPtr<CPDFSDK_Annot>* pAnnot,
-    int index,
-    bool selected) {
+bool CPDFXFA_WidgetHandler::SetIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                             int index,
+                                             bool selected) {
   return false;
 }
 
-bool CPDFSDK_XFAWidgetHandler::IsIndexSelected(
-    ObservedPtr<CPDFSDK_Annot>* pAnnot,
-    int index) {
+bool CPDFXFA_WidgetHandler::IsIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot,
+                                            int index) {
   return false;
 }
 
-CXFA_FFWidgetHandler* CPDFSDK_XFAWidgetHandler::GetXFAWidgetHandler(
+CXFA_FFWidgetHandler* CPDFXFA_WidgetHandler::GetXFAFFWidgetHandler(
     CPDFSDK_Annot* pAnnot) {
   if (!pAnnot)
     return nullptr;
@@ -570,7 +639,7 @@ CXFA_FFWidgetHandler* CPDFSDK_XFAWidgetHandler::GetXFAWidgetHandler(
   if (!pFormFillEnv)
     return nullptr;
 
-  CPDFXFA_Context* pDoc = pFormFillEnv->GetXFAContext();
+  auto* pDoc = static_cast<CPDFXFA_Context*>(pFormFillEnv->GetDocExtension());
   if (!pDoc)
     return nullptr;
 
@@ -581,7 +650,7 @@ CXFA_FFWidgetHandler* CPDFSDK_XFAWidgetHandler::GetXFAWidgetHandler(
   return pDocView->GetWidgetHandler();
 }
 
-uint32_t CPDFSDK_XFAWidgetHandler::GetFWLFlags(uint32_t dwFlag) {
+uint32_t CPDFXFA_WidgetHandler::GetFWLFlags(uint32_t dwFlag) {
   uint32_t dwFWLFlag = 0;
 
   if (dwFlag & FWL_EVENTFLAG_ControlKey)
diff --git a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_xfawidgethandler.h b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_widgethandler.h
index 4ddc15b1bc0..99260520d63 100644
--- a/chromium/third_party/pdfium/fpdfsdk/cpdfsdk_xfawidgethandler.h
+++ b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_widgethandler.h
@@ -4,8 +4,8 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#ifndef FPDFSDK_CPDFSDK_XFAWIDGETHANDLER_H_
-#define FPDFSDK_CPDFSDK_XFAWIDGETHANDLER_H_
+#ifndef FPDFSDK_FPDFXFA_CPDFXFA_WIDGETHANDLER_H_
+#define FPDFSDK_FPDFXFA_CPDFXFA_WIDGETHANDLER_H_
 
 #include <memory>
 
@@ -22,15 +22,16 @@ class CPDFSDK_PageView;
 class CXFA_FFWidget;
 class CXFA_FFWidgetHandler;
 
-class CPDFSDK_XFAWidgetHandler final : public IPDFSDK_AnnotHandler {
+class CPDFXFA_WidgetHandler final : public IPDFSDK_AnnotHandler {
  public:
-  explicit CPDFSDK_XFAWidgetHandler(CPDFSDK_FormFillEnvironment* pApp);
-  ~CPDFSDK_XFAWidgetHandler() override;
+  CPDFXFA_WidgetHandler();
+  ~CPDFXFA_WidgetHandler() override;
 
+  // IPDFSDK_AnnotHandler:
+  void SetFormFillEnvironment(
+      CPDFSDK_FormFillEnvironment* pFormFillEnv) override;
   bool CanAnswer(CPDFSDK_Annot* pAnnot) override;
   CPDFSDK_Annot* NewAnnot(CPDF_Annot* pAnnot, CPDFSDK_PageView* pPage) override;
-  CPDFSDK_Annot* NewAnnot(CXFA_FFWidget* pAnnot,
-                          CPDFSDK_PageView* pPage) override;
   void ReleaseAnnot(std::unique_ptr<CPDFSDK_Annot> pAnnot) override;
   CFX_FloatRect GetViewBBox(CPDFSDK_PageView* pPageView,
                             CPDFSDK_Annot* pAnnot) override;
@@ -94,18 +95,20 @@ class CPDFSDK_XFAWidgetHandler final : public IPDFSDK_AnnotHandler {
   bool OnKeyUp(CPDFSDK_Annot* pAnnot, int nKeyCode, int nFlag) override;
   bool OnSetFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot, uint32_t nFlag) override;
   bool OnKillFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot, uint32_t nFlag) override;
-  bool OnXFAChangedFocus(ObservedPtr<CPDFSDK_Annot>* pOldAnnot,
-                         ObservedPtr<CPDFSDK_Annot>* pNewAnnot) override;
   bool SetIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot,
                         int index,
                         bool selected) override;
   bool IsIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot, int index) override;
 
+  CPDFSDK_Annot* NewAnnotForXFA(CXFA_FFWidget* pAnnot, CPDFSDK_PageView* pPage);
+  bool OnXFAChangedFocus(ObservedPtr<CPDFSDK_Annot>* pOldAnnot,
+                         ObservedPtr<CPDFSDK_Annot>* pNewAnnot);
+
  private:
-  CXFA_FFWidgetHandler* GetXFAWidgetHandler(CPDFSDK_Annot* pAnnot);
+  CXFA_FFWidgetHandler* GetXFAFFWidgetHandler(CPDFSDK_Annot* pAnnot);
   uint32_t GetFWLFlags(uint32_t dwFlag);
 
-  UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
+  UnownedPtr<CPDFSDK_FormFillEnvironment> m_pFormFillEnv;
 };
 
-#endif  // FPDFSDK_CPDFSDK_XFAWIDGETHANDLER_H_
+#endif  // FPDFSDK_FPDFXFA_CPDFXFA_WIDGETHANDLER_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.cpp b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.cpp
deleted file mode 100644
index 6b17955d476..00000000000
--- a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.cpp
+++ /dev/null
@@ -1,81 +0,0 @@
-// Copyright 2014 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#include "fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h"
-
-#include <memory>
-#include <utility>
-#include <vector>
-
-#include "fpdfsdk/cpdfsdk_formfillenvironment.h"
-
-namespace {
-
-std::vector<std::unique_ptr<CFWL_TimerInfo>>* g_TimerArray = nullptr;
-
-class CFWL_FWLAdapterTimerInfo final : public CFWL_TimerInfo {
- public:
-  CFWL_FWLAdapterTimerInfo(IFWL_AdapterTimerMgr* mgr,
-                           int32_t event,
-                           CFWL_Timer* timer)
-      : CFWL_TimerInfo(mgr), idEvent(event), pTimer(timer) {}
-
-  int32_t idEvent;
-  CFWL_Timer* pTimer;
-};
-
-void TimerProc(int32_t idEvent) {
-  if (!g_TimerArray)
-    return;
-
-  for (const auto& info : *g_TimerArray) {
-    auto* pInfo = static_cast<CFWL_FWLAdapterTimerInfo*>(info.get());
-    if (pInfo->idEvent == idEvent) {
-      pInfo->pTimer->Run(pInfo);
-      break;
-    }
-  }
-}
-
-}  // namespace
-
-
-CXFA_FWLAdapterTimerMgr::CXFA_FWLAdapterTimerMgr(
-    CPDFSDK_FormFillEnvironment* pFormFillEnv)
-    : m_pFormFillEnv(pFormFillEnv) {}
-
-CXFA_FWLAdapterTimerMgr::~CXFA_FWLAdapterTimerMgr() = default;
-
-CFWL_TimerInfo* CXFA_FWLAdapterTimerMgr::Start(CFWL_Timer* pTimer,
-                                               uint32_t dwElapse,
-                                               bool bImmediately) {
-  if (!g_TimerArray)
-    g_TimerArray = new std::vector<std::unique_ptr<CFWL_TimerInfo>>;
-
-  if (!m_pFormFillEnv)
-    return nullptr;
-
-  int32_t id_event = m_pFormFillEnv->SetTimer(dwElapse, TimerProc);
-  g_TimerArray->push_back(
-      pdfium::MakeUnique<CFWL_FWLAdapterTimerInfo>(this, id_event, pTimer));
-  return g_TimerArray->back().get();
-}
-
-void CXFA_FWLAdapterTimerMgr::Stop(CFWL_TimerInfo* pTimerInfo) {
-  if (!pTimerInfo || !m_pFormFillEnv)
-    return;
-
-  CFWL_FWLAdapterTimerInfo* pInfo =
-      static_cast<CFWL_FWLAdapterTimerInfo*>(pTimerInfo);
-  m_pFormFillEnv->KillTimer(pInfo->idEvent);
-  if (!g_TimerArray)
-    return;
-
-  pdfium::FakeUniquePtr<CFWL_TimerInfo> fake(pInfo);
-  auto it = std::find(g_TimerArray->begin(), g_TimerArray->end(), fake);
-  if (it != g_TimerArray->end())
-    g_TimerArray->erase(it);
-}
diff --git a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h b/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h
deleted file mode 100644
index bb5afb8c166..00000000000
--- a/chromium/third_party/pdfium/fpdfsdk/fpdfxfa/cxfa_fwladaptertimermgr.h
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2014 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef FPDFSDK_FPDFXFA_CXFA_FWLADAPTERTIMERMGR_H_
-#define FPDFSDK_FPDFXFA_CXFA_FWLADAPTERTIMERMGR_H_
-
-#include <vector>
-
-#include "core/fxcrt/unowned_ptr.h"
-#include "fpdfsdk/fpdfxfa/cpdfxfa_context.h"
-#include "xfa/fwl/cfwl_timerinfo.h"
-#include "xfa/fwl/ifwl_adaptertimermgr.h"
-
-class CXFA_FWLAdapterTimerMgr final : public IFWL_AdapterTimerMgr {
- public:
-  explicit CXFA_FWLAdapterTimerMgr(CPDFSDK_FormFillEnvironment* pFormFillEnv);
-  ~CXFA_FWLAdapterTimerMgr() override;
-
-  CFWL_TimerInfo* Start(CFWL_Timer* pTimer,
-                        uint32_t dwElapse,
-                        bool bImmediately) override;
-  void Stop(CFWL_TimerInfo* pTimerInfo) override;
-
- private:
-  UnownedPtr<CPDFSDK_FormFillEnvironment> const m_pFormFillEnv;
-};
-
-#endif  // FPDFSDK_FPDFXFA_CXFA_FWLADAPTERTIMERMGR_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/ipdfsdk_annothandler.h b/chromium/third_party/pdfium/fpdfsdk/ipdfsdk_annothandler.h
index 55920b1b90d..24b6ff044ea 100644
--- a/chromium/third_party/pdfium/fpdfsdk/ipdfsdk_annothandler.h
+++ b/chromium/third_party/pdfium/fpdfsdk/ipdfsdk_annothandler.h
@@ -15,25 +15,18 @@
 class CFX_Matrix;
 class CFX_RenderDevice;
 class CPDF_Annot;
+class CPDFSDK_FormFillEnvironment;
 class CPDFSDK_PageView;
 
-#ifdef PDF_ENABLE_XFA
-class CXFA_FFWidget;
-#endif  // PDF_ENABLE_XFA
-
 class IPDFSDK_AnnotHandler {
  public:
   virtual ~IPDFSDK_AnnotHandler() = default;
 
+  virtual void SetFormFillEnvironment(
+      CPDFSDK_FormFillEnvironment* pFormFillEnv) = 0;
   virtual bool CanAnswer(CPDFSDK_Annot* pAnnot) = 0;
   virtual CPDFSDK_Annot* NewAnnot(CPDF_Annot* pAnnot,
                                   CPDFSDK_PageView* pPage) = 0;
-
-#ifdef PDF_ENABLE_XFA
-  virtual CPDFSDK_Annot* NewAnnot(CXFA_FFWidget* hWidget,
-                                  CPDFSDK_PageView* pPage) = 0;
-#endif  // PDF_ENABLE_XFA
-
   virtual void ReleaseAnnot(std::unique_ptr<CPDFSDK_Annot> pAnnot) = 0;
   virtual CFX_FloatRect GetViewBBox(CPDFSDK_PageView* pPageView,
                                     CPDFSDK_Annot* pAnnot) = 0;
@@ -54,7 +47,6 @@ class IPDFSDK_AnnotHandler {
                       const CFX_Matrix& mtUser2Device,
                       bool bDrawAnnots) = 0;
   virtual void OnLoad(CPDFSDK_Annot* pAnnot) = 0;
-
   virtual void OnMouseEnter(CPDFSDK_PageView* pPageView,
                             ObservedPtr<CPDFSDK_Annot>* pAnnot,
                             uint32_t nFlag) = 0;
@@ -103,17 +95,11 @@ class IPDFSDK_AnnotHandler {
                           uint32_t nFlag) = 0;
   virtual bool OnKillFocus(ObservedPtr<CPDFSDK_Annot>* pAnnot,
                            uint32_t nFlag) = 0;
-
   virtual bool SetIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot,
                                 int index,
                                 bool selected) = 0;
   virtual bool IsIndexSelected(ObservedPtr<CPDFSDK_Annot>* pAnnot,
                                int index) = 0;
-
-#ifdef PDF_ENABLE_XFA
-  virtual bool OnXFAChangedFocus(ObservedPtr<CPDFSDK_Annot>* pOldAnnot,
-                                 ObservedPtr<CPDFSDK_Annot>* pNewAnnot) = 0;
-#endif  // PDF_ENABLE_XFA
 };
 
 #endif  // FPDFSDK_IPDFSDK_ANNOTHANDLER_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/BUILD.gn b/chromium/third_party/pdfium/fpdfsdk/pwl/BUILD.gn
index 60dc9574646..94396e33291 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/BUILD.gn
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/BUILD.gn
@@ -8,8 +8,6 @@ import("../../testing/test.gni")
 
 jumbo_source_set("pwl") {
   sources = [
-    "cpwl_appstream.cpp",
-    "cpwl_appstream.h",
     "cpwl_button.cpp",
     "cpwl_button.h",
     "cpwl_caret.cpp",
@@ -32,12 +30,9 @@ jumbo_source_set("pwl") {
     "cpwl_scroll_bar.h",
     "cpwl_special_button.cpp",
     "cpwl_special_button.h",
-    "cpwl_timer.cpp",
-    "cpwl_timer.h",
-    "cpwl_timer_handler.cpp",
-    "cpwl_timer_handler.h",
     "cpwl_wnd.cpp",
     "cpwl_wnd.h",
+    "ipwl_systemhandler.h",
   ]
   configs += [ "../../:pdfium_core_config" ]
   deps = [
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/README.md b/chromium/third_party/pdfium/fpdfsdk/pwl/README.md
index 1a73250d0ef..d9be3b1299a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/README.md
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/README.md
@@ -17,5 +17,5 @@ classes are controllers for each widget. The hierarchy is:
     * CPWL_ScrollBar
 
 Widgets are rendered to Appearance Streams, with the case all centralized in
-CPWL_AppStream.
+CPDFSDK_AppStream.
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_button.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_button.cpp
index cf0f348a8b8..b81afae89f3 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_button.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_button.cpp
@@ -8,10 +8,9 @@
 
 #include <utility>
 
-#include "fpdfsdk/pwl/cpwl_wnd.h"
-
-CPWL_Button::CPWL_Button(const CreateParams& cp,
-                         std::unique_ptr<PrivateData> pAttachedData)
+CPWL_Button::CPWL_Button(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Wnd(cp, std::move(pAttachedData)) {
   GetCreationParams()->eCursorType = FXCT_HAND;
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_button.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_button.h
index 6d4aec6b8a8..e7760dd85e8 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_button.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_button.h
@@ -10,11 +10,12 @@
 #include <memory>
 
 #include "fpdfsdk/pwl/cpwl_wnd.h"
+#include "fpdfsdk/pwl/ipwl_systemhandler.h"
 
 class CPWL_Button : public CPWL_Wnd {
  public:
   CPWL_Button(const CreateParams& cp,
-              std::unique_ptr<PrivateData> pAttachedData);
+              std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_Button() override;
 
   // CPWL_Wnd
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_caret.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_caret.cpp
index 74479550f68..739fd370444 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_caret.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_caret.cpp
@@ -12,10 +12,11 @@
 #include "core/fxge/cfx_graphstatedata.h"
 #include "core/fxge/cfx_pathdata.h"
 #include "core/fxge/cfx_renderdevice.h"
-#include "fpdfsdk/pwl/cpwl_wnd.h"
+#include "third_party/base/ptr_util.h"
 
-CPWL_Caret::CPWL_Caret(const CreateParams& cp,
-                       std::unique_ptr<PrivateData> pAttachedData)
+CPWL_Caret::CPWL_Caret(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Wnd(cp, std::move(pAttachedData)) {}
 
 CPWL_Caret::~CPWL_Caret() = default;
@@ -50,7 +51,7 @@ void CPWL_Caret::DrawThisAppearance(CFX_RenderDevice* pDevice,
                     FXFILL_ALTERNATE);
 }
 
-void CPWL_Caret::TimerProc() {
+void CPWL_Caret::OnTimerFired() {
   m_bFlash = !m_bFlash;
   InvalidateRect(nullptr);
   // Note, |this| may no longer be viable at this point. If more work needs
@@ -72,7 +73,7 @@ void CPWL_Caret::SetCaret(bool bVisible,
     if (!IsVisible())
       return;
 
-    EndTimer();
+    m_pTimer.reset();
     CPWL_Wnd::SetVisible(false);
     // Note, |this| may no longer be viable at this point. If more work needs
     // to be done, check the return value of SetVisible().
@@ -84,8 +85,8 @@ void CPWL_Caret::SetCaret(bool bVisible,
 
     m_ptHead = ptHead;
     m_ptFoot = ptFoot;
-    EndTimer();
-    BeginTimer(kCaretFlashIntervalMs);
+    m_pTimer = pdfium::MakeUnique<CFX_Timer>(GetTimerHandler(), this,
+                                             kCaretFlashIntervalMs);
 
     if (!CPWL_Wnd::SetVisible(true))
       return;
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_caret.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_caret.h
index 44c20f3e72d..71788efb11d 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_caret.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_caret.h
@@ -9,20 +9,23 @@
 
 #include <memory>
 
+#include "core/fxcrt/cfx_timer.h"
 #include "fpdfsdk/pwl/cpwl_wnd.h"
 
-class CPWL_Caret final : public CPWL_Wnd {
+class CPWL_Caret final : public CPWL_Wnd, public CFX_Timer::CallbackIface {
  public:
   CPWL_Caret(const CreateParams& cp,
-             std::unique_ptr<PrivateData> pAttachedData);
+             std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_Caret() override;
 
-  // CPWL_Wnd
+  // CPWL_Wnd:
   void DrawThisAppearance(CFX_RenderDevice* pDevice,
                           const CFX_Matrix& mtUser2Device) override;
   bool InvalidateRect(CFX_FloatRect* pRect) override;
   bool SetVisible(bool bVisible) override;
-  void TimerProc() override;
+
+  // CFX_Timer::CallbackIface:
+  void OnTimerFired() override;
 
   void SetCaret(bool bVisible,
                 const CFX_PointF& ptHead,
@@ -37,6 +40,7 @@ class CPWL_Caret final : public CPWL_Wnd {
   CFX_PointF m_ptFoot;
   float m_fWidth = 0.4f;
   CFX_FloatRect m_rcInvalid;
+  std::unique_ptr<CFX_Timer> m_pTimer;
 };
 
 #endif  // FPDFSDK_PWL_CPWL_CARET_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box.cpp
index 055f63f2128..8192da27f7c 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box.cpp
@@ -18,6 +18,7 @@
 #include "fpdfsdk/pwl/cpwl_list_impl.h"
 #include "fpdfsdk/pwl/cpwl_wnd.h"
 #include "public/fpdf_fwlevent.h"
+#include "third_party/base/ptr_util.h"
 
 namespace {
 
@@ -27,8 +28,9 @@ constexpr int kDefaultButtonWidth = 13;
 
 }  // namespace
 
-CPWL_CBListBox::CPWL_CBListBox(const CreateParams& cp,
-                               std::unique_ptr<PrivateData> pAttachedData)
+CPWL_CBListBox::CPWL_CBListBox(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_ListBox(cp, std::move(pAttachedData)) {}
 
 CPWL_CBListBox::~CPWL_CBListBox() = default;
@@ -101,8 +103,9 @@ bool CPWL_CBListBox::OnCharNotify(uint16_t nChar, uint32_t nFlag) {
   return OnNotifySelectionChanged(true, nFlag);
 }
 
-CPWL_CBButton::CPWL_CBButton(const CreateParams& cp,
-                             std::unique_ptr<PrivateData> pAttachedData)
+CPWL_CBButton::CPWL_CBButton(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Wnd(cp, std::move(pAttachedData)) {}
 
 CPWL_CBButton::~CPWL_CBButton() = default;
@@ -158,8 +161,9 @@ bool CPWL_CBButton::OnLButtonUp(const CFX_PointF& point, uint32_t nFlag) {
   return true;
 }
 
-CPWL_ComboBox::CPWL_ComboBox(const CreateParams& cp,
-                             std::unique_ptr<PrivateData> pAttachedData)
+CPWL_ComboBox::CPWL_ComboBox(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Wnd(cp, std::move(pAttachedData)) {
   GetCreationParams()->dwFlags &= ~PWS_HSCROLL;
   GetCreationParams()->dwFlags &= ~PWS_VSCROLL;
@@ -444,13 +448,10 @@ bool CPWL_ComboBox::SetPopup(bool bPopup) {
     return true;
 
   ObservedPtr<CPWL_ComboBox> thisObserved(this);
-
-#ifdef PDF_ENABLE_XFA
   if (m_pFillerNotify->OnPopupPreOpen(GetAttachedData(), 0))
     return !!thisObserved;
   if (!thisObserved)
     return false;
-#endif  // PDF_ENABLE_XFA
 
   float fBorderWidth = m_pList->GetBorderWidth() * 2;
   float fPopupMin = 0.0f;
@@ -478,12 +479,7 @@ bool CPWL_ComboBox::SetPopup(bool bPopup) {
   if (!Move(rcWindow, true, true))
     return false;
 
-#ifdef PDF_ENABLE_XFA
   m_pFillerNotify->OnPopupPostOpen(GetAttachedData(), 0);
-  if (!thisObserved)
-    return false;
-#endif  // PDF_ENABLE_XFA
-
   return !!thisObserved;
 }
 
@@ -498,14 +494,12 @@ bool CPWL_ComboBox::OnKeyDown(uint16_t nChar, uint32_t nFlag) {
   switch (nChar) {
     case FWL_VKEY_Up:
       if (m_pList->GetCurSel() > 0) {
-#ifdef PDF_ENABLE_XFA
         if (m_pFillerNotify) {
           if (m_pFillerNotify->OnPopupPreOpen(GetAttachedData(), nFlag))
             return false;
           if (m_pFillerNotify->OnPopupPostOpen(GetAttachedData(), nFlag))
             return false;
         }
-#endif  // PDF_ENABLE_XFA
         if (m_pList->IsMovementKey(nChar)) {
           if (m_pList->OnMovementKeyDown(nChar, nFlag))
             return false;
@@ -515,14 +509,12 @@ bool CPWL_ComboBox::OnKeyDown(uint16_t nChar, uint32_t nFlag) {
       return true;
     case FWL_VKEY_Down:
       if (m_pList->GetCurSel() < m_pList->GetCount() - 1) {
-#ifdef PDF_ENABLE_XFA
         if (m_pFillerNotify) {
           if (m_pFillerNotify->OnPopupPreOpen(GetAttachedData(), nFlag))
             return false;
           if (m_pFillerNotify->OnPopupPostOpen(GetAttachedData(), nFlag))
             return false;
         }
-#endif  // PDF_ENABLE_XFA
         if (m_pList->IsMovementKey(nChar)) {
           if (m_pList->OnMovementKeyDown(nChar, nFlag))
             return false;
@@ -549,14 +541,12 @@ bool CPWL_ComboBox::OnChar(uint16_t nChar, uint32_t nFlag) {
   if (HasFlag(PCBS_ALLOWCUSTOMTEXT))
     return m_pEdit->OnChar(nChar, nFlag);
 
-#ifdef PDF_ENABLE_XFA
   if (m_pFillerNotify) {
     if (m_pFillerNotify->OnPopupPreOpen(GetAttachedData(), nFlag))
       return false;
     if (m_pFillerNotify->OnPopupPostOpen(GetAttachedData(), nFlag))
       return false;
   }
-#endif  // PDF_ENABLE_XFA
   if (!m_pList->IsChar(nChar, nFlag))
     return false;
   return m_pList->OnCharNotify(nChar, nFlag);
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box.h
index c059b5ca2a7..8b9bf122d6d 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box.h
@@ -16,8 +16,9 @@
 
 class CPWL_CBListBox final : public CPWL_ListBox {
  public:
-  CPWL_CBListBox(const CreateParams& cp,
-                 std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_CBListBox(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_CBListBox() override;
 
   // CPWL_ListBox
@@ -31,8 +32,9 @@ class CPWL_CBListBox final : public CPWL_ListBox {
 
 class CPWL_CBButton final : public CPWL_Wnd {
  public:
-  CPWL_CBButton(const CreateParams& cp,
-                std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_CBButton(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_CBButton() override;
 
   // CPWL_Wnd
@@ -44,8 +46,9 @@ class CPWL_CBButton final : public CPWL_Wnd {
 
 class CPWL_ComboBox final : public CPWL_Wnd {
  public:
-  CPWL_ComboBox(const CreateParams& cp,
-                std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_ComboBox(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_ComboBox() override;
 
   CPWL_Edit* GetEdit() const { return m_pEdit.Get(); }
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box_embeddertest.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box_embeddertest.cpp
index 855f894f2dc..7d3dd4d3668 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box_embeddertest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_combo_box_embeddertest.cpp
@@ -65,7 +65,7 @@ class CPWLComboBoxEditEmbedderTest : public EmbedderTest {
     ASSERT_TRUE(m_pFormFiller);
 
     CPWL_Wnd* pWindow =
-        m_pFormFiller->GetPDFWindow(m_pFormFillEnv->GetPageView(0), false);
+        m_pFormFiller->GetPWLWindow(m_pFormFillEnv->GetPageView(0), false);
     ASSERT_TRUE(pWindow);
     m_pComboBox = static_cast<CPWL_ComboBox*>(pWindow);
   }
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit.cpp
index 6f529711172..77491dad6bf 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit.cpp
@@ -27,8 +27,9 @@
 #include "fpdfsdk/pwl/cpwl_wnd.h"
 #include "public/fpdf_fwlevent.h"
 
-CPWL_Edit::CPWL_Edit(const CreateParams& cp,
-                     std::unique_ptr<PrivateData> pAttachedData)
+CPWL_Edit::CPWL_Edit(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_EditCtrl(cp, std::move(pAttachedData)) {}
 
 CPWL_Edit::~CPWL_Edit() {
@@ -172,7 +173,7 @@ void CPWL_Edit::DrawThisAppearance(CFX_RenderDevice* pDevice,
     switch (GetBorderStyle()) {
       case BorderStyle::SOLID: {
         CFX_GraphStateData gsd;
-        gsd.m_LineWidth = (float)GetBorderWidth();
+        gsd.m_LineWidth = GetBorderWidth();
 
         CFX_PathData path;
 
@@ -237,10 +238,9 @@ void CPWL_Edit::DrawThisAppearance(CFX_RenderDevice* pDevice,
     pRange = &wrRange;
   }
 
-  CFX_SystemHandler* pSysHandler = GetSystemHandler();
   CPWL_EditImpl::DrawEdit(pDevice, mtUser2Device, m_pEdit.get(),
                           GetTextColor().ToFXColor(GetTransparency()), rcClip,
-                          CFX_PointF(), pRange, pSysHandler,
+                          CFX_PointF(), pRange, GetSystemHandler(),
                           m_pFormFiller.Get());
 }
 
@@ -279,10 +279,6 @@ bool CPWL_Edit::OnRButtonUp(const CFX_PointF& point, uint32_t nFlag) {
   if (!HasFlag(PES_TEXTOVERFLOW) && !ClientHitTest(point))
     return true;
 
-  CFX_SystemHandler* pSH = GetSystemHandler();
-  if (!pSH)
-    return false;
-
   SetFocus();
 
   return false;
@@ -392,7 +388,7 @@ void CPWL_Edit::SetCharArray(int32_t nCharArray) {
   if (!pFontMap)
     return;
 
-  float fFontSize = GetCharArrayAutoFontSize(pFontMap->GetPDFFont(0),
+  float fFontSize = GetCharArrayAutoFontSize(pFontMap->GetPDFFont(0).Get(),
                                              GetClientRect(), nCharArray);
   if (fFontSize <= 0.0f)
     return;
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit.h
index 0e16a7f3c29..1de382e0697 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit.h
@@ -13,19 +13,24 @@
 #include "core/fpdfdoc/cpvt_wordrange.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "fpdfsdk/pwl/cpwl_edit_ctrl.h"
+#include "fpdfsdk/pwl/ipwl_systemhandler.h"
+
+class CPDF_Font;
 
 class IPWL_Filler_Notify {
  public:
   virtual ~IPWL_Filler_Notify() = default;
 
   // Must write to |bBottom| and |fPopupRet|.
-  virtual void QueryWherePopup(const CPWL_Wnd::PrivateData* pAttached,
-                               float fPopupMin,
-                               float fPopupMax,
-                               bool* bBottom,
-                               float* fPopupRet) = 0;
+  virtual void QueryWherePopup(
+      const IPWL_SystemHandler::PerWindowData* pAttached,
+      float fPopupMin,
+      float fPopupMax,
+      bool* bBottom,
+      float* fPopupRet) = 0;
+
   virtual std::pair<bool, bool> OnBeforeKeyStroke(
-      const CPWL_Wnd::PrivateData* pAttached,
+      const IPWL_SystemHandler::PerWindowData* pAttached,
       WideString& strChange,
       const WideString& strChangeEx,
       int nSelStart,
@@ -33,17 +38,19 @@ class IPWL_Filler_Notify {
       bool bKeyDown,
       uint32_t nFlag) = 0;
 
-#ifdef PDF_ENABLE_XFA
-  virtual bool OnPopupPreOpen(const CPWL_Wnd::PrivateData* pAttached,
-                              uint32_t nFlag) = 0;
-  virtual bool OnPopupPostOpen(const CPWL_Wnd::PrivateData* pAttached,
-                               uint32_t nFlag) = 0;
-#endif  // PDF_ENABLE_XFA
+  virtual bool OnPopupPreOpen(
+      const IPWL_SystemHandler::PerWindowData* pAttached,
+      uint32_t nFlag) = 0;
+
+  virtual bool OnPopupPostOpen(
+      const IPWL_SystemHandler::PerWindowData* pAttached,
+      uint32_t nFlag) = 0;
 };
 
 class CPWL_Edit final : public CPWL_EditCtrl {
  public:
-  CPWL_Edit(const CreateParams& cp, std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_Edit(const CreateParams& cp,
+            std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_Edit() override;
 
   // CPWL_EditCtrl
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_ctrl.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_ctrl.cpp
index 7e03e55503b..efdafceb2ac 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_ctrl.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_ctrl.cpp
@@ -17,8 +17,9 @@
 #include "public/fpdf_fwlevent.h"
 #include "third_party/base/ptr_util.h"
 
-CPWL_EditCtrl::CPWL_EditCtrl(const CreateParams& cp,
-                             std::unique_ptr<PrivateData> pAttachedData)
+CPWL_EditCtrl::CPWL_EditCtrl(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Wnd(cp, std::move(pAttachedData)),
       m_pEdit(pdfium::MakeUnique<CPWL_EditImpl>()) {
   GetCreationParams()->eCursorType = FXCT_VBEAM;
@@ -34,20 +35,14 @@ void CPWL_EditCtrl::OnCreated() {
   m_pEdit->Initialize();
 }
 
-bool CPWL_EditCtrl::IsWndHorV() {
+bool CPWL_EditCtrl::IsWndHorV() const {
   CFX_Matrix mt = GetWindowMatrix();
   return mt.Transform(CFX_PointF(1, 1)).y == mt.Transform(CFX_PointF(0, 1)).y;
 }
 
 void CPWL_EditCtrl::SetCursor() {
-  if (IsValid()) {
-    if (CFX_SystemHandler* pSH = GetSystemHandler()) {
-      if (IsWndHorV())
-        pSH->SetCursor(FXCT_VBEAM);
-      else
-        pSH->SetCursor(FXCT_HBEAM);
-    }
-  }
+  if (IsValid())
+    GetSystemHandler()->SetCursor(IsWndHorV() ? FXCT_VBEAM : FXCT_HBEAM);
 }
 
 WideString CPWL_EditCtrl::GetSelectedText() {
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_ctrl.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_ctrl.h
index aeeb7f65573..9cd92bfeb42 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_ctrl.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_ctrl.h
@@ -23,8 +23,9 @@ enum PWL_EDIT_ALIGNFORMAT_V { PEAV_TOP = 0, PEAV_CENTER, PEAV_BOTTOM };
 
 class CPWL_EditCtrl : public CPWL_Wnd {
  public:
-  CPWL_EditCtrl(const CreateParams& cp,
-                std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_EditCtrl(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_EditCtrl() override;
 
   void SetSelection(int32_t nStartChar, int32_t nEndChar);
@@ -74,7 +75,7 @@ class CPWL_EditCtrl : public CPWL_Wnd {
   void CutText();
   void InsertWord(uint16_t word, int32_t nCharset);
   void InsertReturn();
-  bool IsWndHorV();
+  bool IsWndHorV() const;
   void Delete();
   void Backspace();
   void GetCaretInfo(CFX_PointF* ptHead, CFX_PointF* ptFoot) const;
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_embeddertest.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_embeddertest.cpp
index ea8092ae39c..4e9327c231b 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_embeddertest.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_embeddertest.cpp
@@ -65,7 +65,7 @@ class CPWLEditEmbedderTest : public EmbedderTest {
     ASSERT_TRUE(m_pFormFiller);
 
     CPWL_Wnd* pWindow =
-        m_pFormFiller->GetPDFWindow(m_pFormFillEnv->GetPageView(0), false);
+        m_pFormFiller->GetPWLWindow(m_pFormFillEnv->GetPageView(0), false);
     ASSERT_TRUE(pWindow);
     m_pEdit = static_cast<CPWL_Edit*>(pWindow);
   }
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_impl.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_impl.cpp
index 613cda9a8f4..070547835d7 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_impl.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_impl.cpp
@@ -21,10 +21,10 @@
 #include "core/fxge/cfx_graphstatedata.h"
 #include "core/fxge/cfx_pathdata.h"
 #include "core/fxge/cfx_renderdevice.h"
-#include "fpdfsdk/cfx_systemhandler.h"
 #include "fpdfsdk/pwl/cpwl_edit.h"
 #include "fpdfsdk/pwl/cpwl_edit_ctrl.h"
 #include "fpdfsdk/pwl/cpwl_scroll_bar.h"
+#include "fpdfsdk/pwl/ipwl_systemhandler.h"
 #include "third_party/base/compiler_specific.h"
 #include "third_party/base/ptr_util.h"
 
@@ -112,33 +112,28 @@ IPVT_FontMap* CPWL_EditImpl_Provider::GetFontMap() const {
 
 uint32_t CPWL_EditImpl_Provider::GetCharWidth(int32_t nFontIndex,
                                               uint16_t word) {
-  if (CPDF_Font* pPDFFont = m_pFontMap->GetPDFFont(nFontIndex)) {
-    uint32_t charcode = word;
+  RetainPtr<CPDF_Font> pPDFFont = m_pFontMap->GetPDFFont(nFontIndex);
+  if (!pPDFFont)
+    return 0;
 
-    if (pPDFFont->IsUnicodeCompatible())
-      charcode = pPDFFont->CharCodeFromUnicode(word);
-    else
-      charcode = m_pFontMap->CharCodeFromUnicode(nFontIndex, word);
+  uint32_t charcode = pPDFFont->IsUnicodeCompatible()
+                          ? pPDFFont->CharCodeFromUnicode(word)
+                          : m_pFontMap->CharCodeFromUnicode(nFontIndex, word);
 
-    if (charcode != CPDF_Font::kInvalidCharCode)
-      return pPDFFont->GetCharWidthF(charcode);
-  }
+  if (charcode == CPDF_Font::kInvalidCharCode)
+    return 0;
 
-  return 0;
+  return pPDFFont->GetCharWidthF(charcode);
 }
 
 int32_t CPWL_EditImpl_Provider::GetTypeAscent(int32_t nFontIndex) {
-  if (CPDF_Font* pPDFFont = m_pFontMap->GetPDFFont(nFontIndex))
-    return pPDFFont->GetTypeAscent();
-
-  return 0;
+  RetainPtr<CPDF_Font> pPDFFont = m_pFontMap->GetPDFFont(nFontIndex);
+  return pPDFFont ? pPDFFont->GetTypeAscent() : 0;
 }
 
 int32_t CPWL_EditImpl_Provider::GetTypeDescent(int32_t nFontIndex) {
-  if (CPDF_Font* pPDFFont = m_pFontMap->GetPDFFont(nFontIndex))
-    return pPDFFont->GetTypeDescent();
-
-  return 0;
+  RetainPtr<CPDF_Font> pPDFFont = m_pFontMap->GetPDFFont(nFontIndex);
+  return pPDFFont ? pPDFFont->GetTypeDescent() : 0;
 }
 
 int32_t CPWL_EditImpl_Provider::GetWordFontIndex(uint16_t word,
@@ -463,7 +458,7 @@ void CPWL_EditImpl::DrawEdit(CFX_RenderDevice* pDevice,
                              const CFX_FloatRect& rcClip,
                              const CFX_PointF& ptOffset,
                              const CPVT_WordRange* pRange,
-                             CFX_SystemHandler* pSystemHandler,
+                             IPWL_SystemHandler* pSystemHandler,
                              CFFL_FormFiller* pFFLData) {
   const bool bContinuous =
       pEdit->GetCharArray() == 0 && pEdit->GetCharSpace() <= 0.0f;
@@ -503,7 +498,7 @@ void CPWL_EditImpl::DrawEdit(CFX_RenderDevice* pDevice,
       bSelect = place > wrSelect.BeginPos && place <= wrSelect.EndPos;
       crCurFill = bSelect ? crWhite : crTextFill;
     }
-    if (pSystemHandler && pSystemHandler->IsSelectionImplemented()) {
+    if (pSystemHandler->IsSelectionImplemented()) {
       crCurFill = crTextFill;
       crOldFill = crCurFill;
     }
@@ -513,7 +508,7 @@ void CPWL_EditImpl::DrawEdit(CFX_RenderDevice* pDevice,
         CPVT_Line line;
         pIterator->GetLine(line);
 
-        if (pSystemHandler && pSystemHandler->IsSelectionImplemented()) {
+        if (pSystemHandler->IsSelectionImplemented()) {
           CFX_FloatRect rc(word.ptWord.x, line.ptLine.y + line.fLineDescent,
                            word.ptWord.x + word.fWidth,
                            line.ptLine.y + line.fLineAscent);
@@ -536,7 +531,7 @@ void CPWL_EditImpl::DrawEdit(CFX_RenderDevice* pDevice,
           if (sTextBuf.tellp() > 0) {
             DrawTextString(pDevice,
                            CFX_PointF(ptBT.x + ptOffset.x, ptBT.y + ptOffset.y),
-                           pFontMap->GetPDFFont(nFontIndex), fFontSize,
+                           pFontMap->GetPDFFont(nFontIndex).Get(), fFontSize,
                            mtUser2Device, ByteString(sTextBuf), crOldFill);
 
             sTextBuf.str("");
@@ -552,7 +547,8 @@ void CPWL_EditImpl::DrawEdit(CFX_RenderDevice* pDevice,
         DrawTextString(
             pDevice,
             CFX_PointF(word.ptWord.x + ptOffset.x, word.ptWord.y + ptOffset.y),
-            pFontMap->GetPDFFont(word.nFontIndex), fFontSize, mtUser2Device,
+            pFontMap->GetPDFFont(word.nFontIndex).Get(), fFontSize,
+            mtUser2Device,
             pEdit->GetPDFWordString(word.nFontIndex, word.Word, SubWord),
             crCurFill);
       }
@@ -563,8 +559,8 @@ void CPWL_EditImpl::DrawEdit(CFX_RenderDevice* pDevice,
   if (sTextBuf.tellp() > 0) {
     DrawTextString(pDevice,
                    CFX_PointF(ptBT.x + ptOffset.x, ptBT.y + ptOffset.y),
-                   pFontMap->GetPDFFont(nFontIndex), fFontSize, mtUser2Device,
-                   ByteString(sTextBuf), crOldFill);
+                   pFontMap->GetPDFFont(nFontIndex).Get(), fFontSize,
+                   mtUser2Device, ByteString(sTextBuf), crOldFill);
   }
 }
 
@@ -1878,7 +1874,7 @@ ByteString CPWL_EditImpl::GetPDFWordString(int32_t nFontIndex,
                                            uint16_t Word,
                                            uint16_t SubWord) {
   IPVT_FontMap* pFontMap = GetFontMap();
-  CPDF_Font* pPDFFont = pFontMap->GetPDFFont(nFontIndex);
+  RetainPtr<CPDF_Font> pPDFFont = pFontMap->GetPDFFont(nFontIndex);
   if (!pPDFFont)
     return ByteString();
 
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_impl.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_impl.h
index 889ed780843..1e36b2e2cfe 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_impl.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_edit_impl.h
@@ -25,9 +25,9 @@ class CPWL_EditImpl;
 class CPWL_EditImpl_Iterator;
 class CPWL_EditImpl_Provider;
 class CFX_RenderDevice;
-class CFX_SystemHandler;
 class CPWL_Edit;
 class CPWL_EditCtrl;
+class IPWL_SystemHandler;
 class IFX_Edit_UndoItem;
 
 struct CPWL_EditImpl_LineRect {
@@ -261,7 +261,7 @@ class CPWL_EditImpl {
                        const CFX_FloatRect& rcClip,
                        const CFX_PointF& ptOffset,
                        const CPVT_WordRange* pRange,
-                       CFX_SystemHandler* pSystemHandler,
+                       IPWL_SystemHandler* pSystemHandler,
                        CFFL_FormFiller* pFFLData);
 
   CPWL_EditImpl();
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_icon.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_icon.cpp
index 946c76fd7b9..e64cadde42b 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_icon.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_icon.cpp
@@ -13,10 +13,12 @@
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
+#include "core/fpdfdoc/cpdf_iconfit.h"
 #include "fpdfsdk/pwl/cpwl_wnd.h"
 
-CPWL_Icon::CPWL_Icon(const CreateParams& cp,
-                     std::unique_ptr<PrivateData> pAttachedData)
+CPWL_Icon::CPWL_Icon(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Wnd(cp, std::move(pAttachedData)) {}
 
 CPWL_Icon::~CPWL_Icon() = default;
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_icon.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_icon.h
index c1cc195b641..db654f8e48b 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_icon.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_icon.h
@@ -14,9 +14,13 @@
 #include "core/fxcrt/unowned_ptr.h"
 #include "fpdfsdk/pwl/cpwl_wnd.h"
 
+class CPDF_IconFit;
+class CPDF_Stream;
+
 class CPWL_Icon final : public CPWL_Wnd {
  public:
-  CPWL_Icon(const CreateParams& cp, std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_Icon(const CreateParams& cp,
+            std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_Icon() override;
 
   void SetIconFit(CPDF_IconFit* pIconFit) { m_pIconFit = pIconFit; }
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_box.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_box.cpp
index 6b9f83738b5..56712a854c5 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_box.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_box.cpp
@@ -65,8 +65,9 @@ void CPWL_List_Notify::IOnInvalidateRect(CFX_FloatRect* pRect) {
   m_pList->InvalidateRect(pRect);
 }
 
-CPWL_ListBox::CPWL_ListBox(const CreateParams& cp,
-                           std::unique_ptr<PrivateData> pAttachedData)
+CPWL_ListBox::CPWL_ListBox(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Wnd(cp, std::move(pAttachedData)),
       m_pList(pdfium::MakeUnique<CPWL_ListCtrl>()) {}
 
@@ -107,15 +108,13 @@ void CPWL_ListBox::DrawThisAppearance(CFX_RenderDevice* pDevice,
     CFX_PointF ptOffset(rcItem.left, (rcItem.top + rcItem.bottom) * 0.5f);
     if (CPWL_EditImpl* pEdit = m_pList->GetItemEdit(i)) {
       CFX_FloatRect rcContent = pEdit->GetContentRect();
-      if (rcContent.Width() > rcClient.Width())
-        rcItem.Intersect(rcList);
-      else
-        rcItem.Intersect(rcClient);
+      rcItem.Intersect(rcContent.Width() > rcClient.Width() ? rcList
+                                                            : rcClient);
     }
 
+    IPWL_SystemHandler* pSysHandler = GetSystemHandler();
     if (m_pList->IsItemSelected(i)) {
-      CFX_SystemHandler* pSysHandler = GetSystemHandler();
-      if (pSysHandler && pSysHandler->IsSelectionImplemented()) {
+      if (pSysHandler->IsSelectionImplemented()) {
         CPWL_EditImpl::DrawEdit(pDevice, mtUser2Device, m_pList->GetItemEdit(i),
                                 GetTextColor().ToFXColor(255), rcList, ptOffset,
                                 nullptr, pSysHandler, m_pFormFiller.Get());
@@ -129,7 +128,6 @@ void CPWL_ListBox::DrawThisAppearance(CFX_RenderDevice* pDevice,
                                 m_pFormFiller.Get());
       }
     } else {
-      CFX_SystemHandler* pSysHandler = GetSystemHandler();
       CPWL_EditImpl::DrawEdit(pDevice, mtUser2Device, m_pList->GetItemEdit(i),
                               GetTextColor().ToFXColor(255), rcList, ptOffset,
                               nullptr, pSysHandler, nullptr);
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_box.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_box.h
index ab53b703f3e..ba3a653bd9c 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_box.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_box.h
@@ -38,8 +38,9 @@ class CPWL_List_Notify {
 
 class CPWL_ListBox : public CPWL_Wnd {
  public:
-  CPWL_ListBox(const CreateParams& cp,
-               std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_ListBox(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_ListBox() override;
 
   // CPWL_Wnd
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_impl.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_impl.cpp
index e06dedbabb4..37a6ea29499 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_impl.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_impl.cpp
@@ -299,7 +299,7 @@ CFX_FloatRect CPWL_ListCtrl::GetItemRect(int32_t nIndex) const {
 }
 
 CFX_FloatRect CPWL_ListCtrl::GetItemRectInternal(int32_t nIndex) const {
-  if (!pdfium::IndexInBounds(m_ListItems, nIndex) || !m_ListItems[nIndex])
+  if (!IsValid(nIndex))
     return CFX_FloatRect();
 
   CFX_FloatRect rcItem = m_ListItems[nIndex]->GetRect();
@@ -497,17 +497,14 @@ CFX_FloatRect CPWL_ListCtrl::GetContentRect() const {
 
 void CPWL_ListCtrl::ReArrange(int32_t nItemIndex) {
   float fPosY = 0.0f;
-  if (pdfium::IndexInBounds(m_ListItems, nItemIndex - 1) &&
-      m_ListItems[nItemIndex - 1]) {
+  if (IsValid(nItemIndex - 1))
     fPosY = m_ListItems[nItemIndex - 1]->GetRect().bottom;
-  }
+
   for (const auto& pListItem : m_ListItems) {
-    if (pListItem) {
-      float fListItemHeight = pListItem->GetItemHeight();
-      pListItem->SetRect(
-          CFX_FloatRect(0.0f, fPosY + fListItemHeight, 0.0f, fPosY));
-      fPosY += fListItemHeight;
-    }
+    float fListItemHeight = pListItem->GetItemHeight();
+    pListItem->SetRect(
+        CFX_FloatRect(0.0f, fPosY + fListItemHeight, 0.0f, fPosY));
+    fPosY += fListItemHeight;
   }
   SetContentRect(CFX_FloatRect(0.0f, fPosY, 0.0f, 0.0f));
   SetScrollInfo();
@@ -542,8 +539,6 @@ int32_t CPWL_ListCtrl::GetItemIndex(const CFX_PointF& point) const {
   bool bFirst = true;
   bool bLast = true;
   for (const auto& pListItem : m_ListItems) {
-    if (!pListItem)
-      continue;
     CFX_FloatRect rcListItem = pListItem->GetRect();
     if (IsFloatBigger(pt.y, rcListItem.top))
       bFirst = false;
@@ -555,7 +550,7 @@ int32_t CPWL_ListCtrl::GetItemIndex(const CFX_PointF& point) const {
   if (bFirst)
     return 0;
   if (bLast)
-    return pdfium::CollectionSize<int32_t>(m_ListItems) - 1;
+    return GetCount() - 1;
   return -1;
 }
 
@@ -574,7 +569,7 @@ void CPWL_ListCtrl::AddItem(const WideString& str) {
 }
 
 CPWL_EditImpl* CPWL_ListCtrl::GetItemEdit(int32_t nIndex) const {
-  if (!pdfium::IndexInBounds(m_ListItems, nIndex) || !m_ListItems[nIndex])
+  if (!IsValid(nIndex))
     return nullptr;
   return m_ListItems[nIndex]->GetEdit();
 }
@@ -584,7 +579,7 @@ int32_t CPWL_ListCtrl::GetCount() const {
 }
 
 float CPWL_ListCtrl::GetFirstHeight() const {
-  if (m_ListItems.empty() || !m_ListItems.front())
+  if (m_ListItems.empty())
     return 1.0f;
   return m_ListItems.front()->GetItemHeight();
 }
@@ -592,7 +587,7 @@ float CPWL_ListCtrl::GetFirstHeight() const {
 int32_t CPWL_ListCtrl::GetFirstSelected() const {
   int32_t i = 0;
   for (const auto& pListItem : m_ListItems) {
-    if (pListItem && pListItem->IsSelected())
+    if (pListItem->IsSelected())
       return i;
     ++i;
   }
@@ -601,7 +596,7 @@ int32_t CPWL_ListCtrl::GetFirstSelected() const {
 
 int32_t CPWL_ListCtrl::GetLastSelected() const {
   for (auto iter = m_ListItems.rbegin(); iter != m_ListItems.rend(); ++iter) {
-    if (*iter && (*iter)->IsSelected())
+    if ((*iter)->IsSelected())
       return &*iter - &m_ListItems.front();
   }
   return -1;
@@ -609,7 +604,7 @@ int32_t CPWL_ListCtrl::GetLastSelected() const {
 
 int32_t CPWL_ListCtrl::FindNext(int32_t nIndex, wchar_t nChar) const {
   int32_t nCircleIndex = nIndex;
-  int32_t sz = pdfium::CollectionSize<int32_t>(m_ListItems);
+  int32_t sz = GetCount();
   for (int32_t i = 0; i < sz; i++) {
     nCircleIndex++;
     if (nCircleIndex >= sz)
@@ -625,12 +620,11 @@ int32_t CPWL_ListCtrl::FindNext(int32_t nIndex, wchar_t nChar) const {
 }
 
 bool CPWL_ListCtrl::IsItemSelected(int32_t nIndex) const {
-  return pdfium::IndexInBounds(m_ListItems, nIndex) && m_ListItems[nIndex] &&
-         m_ListItems[nIndex]->IsSelected();
+  return IsValid(nIndex) && m_ListItems[nIndex]->IsSelected();
 }
 
 void CPWL_ListCtrl::SetItemSelect(int32_t nIndex, bool bSelected) {
-  if (pdfium::IndexInBounds(m_ListItems, nIndex) && m_ListItems[nIndex])
+  if (IsValid(nIndex))
     m_ListItems[nIndex]->SetSelect(bSelected);
 }
 
@@ -639,7 +633,7 @@ bool CPWL_ListCtrl::IsValid(int32_t nItemIndex) const {
 }
 
 WideString CPWL_ListCtrl::GetItemText(int32_t nIndex) const {
-  if (pdfium::IndexInBounds(m_ListItems, nIndex) && m_ListItems[nIndex])
+  if (IsValid(nIndex))
     return m_ListItems[nIndex]->GetText();
   return WideString();
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_impl.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_impl.h
index baf5c6f5e95..dee6b6188bb 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_impl.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_list_impl.h
@@ -20,13 +20,13 @@ class CPWL_EditImpl_Iterator;
 class CPWL_List_Notify;
 class IPVT_FontMap;
 
-class CPLST_Select {
+class CPLST_Select final {
  public:
   enum State { DESELECTING = -1, NORMAL = 0, SELECTING = 1 };
   using const_iterator = std::map<int32_t, State>::const_iterator;
 
   CPLST_Select();
-  virtual ~CPLST_Select();
+  ~CPLST_Select();
 
   void Add(int32_t nItemIndex);
   void Add(int32_t nBeginIndex, int32_t nEndIndex);
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_scroll_bar.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_scroll_bar.cpp
index 42437c7e07c..bf4d1da980a 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_scroll_bar.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_scroll_bar.cpp
@@ -14,6 +14,7 @@
 #include "core/fxge/cfx_pathdata.h"
 #include "core/fxge/cfx_renderdevice.h"
 #include "fpdfsdk/pwl/cpwl_wnd.h"
+#include "third_party/base/ptr_util.h"
 
 namespace {
 
@@ -105,10 +106,11 @@ void PWL_SCROLL_PRIVATEDATA::SubBig() {
     SetPos(ScrollRange.fMin);
 }
 
-CPWL_SBButton::CPWL_SBButton(const CreateParams& cp,
-                             std::unique_ptr<PrivateData> pAttachedData,
-                             PWL_SCROLLBAR_TYPE eScrollBarType,
-                             PWL_SBBUTTON_TYPE eButtonType)
+CPWL_SBButton::CPWL_SBButton(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData,
+    PWL_SCROLLBAR_TYPE eScrollBarType,
+    PWL_SBBUTTON_TYPE eButtonType)
     : CPWL_Wnd(cp, std::move(pAttachedData)),
       m_eScrollBarType(eScrollBarType),
       m_eSBButtonType(eButtonType) {
@@ -297,9 +299,10 @@ bool CPWL_SBButton::OnMouseMove(const CFX_PointF& point, uint32_t nFlag) {
   return true;
 }
 
-CPWL_ScrollBar::CPWL_ScrollBar(const CreateParams& cp,
-                               std::unique_ptr<PrivateData> pAttachedData,
-                               PWL_SCROLLBAR_TYPE sbType)
+CPWL_ScrollBar::CPWL_ScrollBar(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData,
+    PWL_SCROLLBAR_TYPE sbType)
     : CPWL_Wnd(cp, std::move(pAttachedData)), m_sbType(sbType) {
   GetCreationParams()->eCursorType = FXCT_ARROW;
 }
@@ -472,9 +475,8 @@ bool CPWL_ScrollBar::OnLButtonUp(const CFX_PointF& point, uint32_t nFlag) {
     }
   }
 
-  EndTimer();
+  m_pTimer.reset();
   m_bMouseDown = false;
-
   return true;
 }
 
@@ -671,12 +673,10 @@ void CPWL_ScrollBar::OnMinButtonLBDown(const CFX_PointF& point) {
   m_sData.SubSmall();
   if (!MovePosButton(true))
     return;
-  NotifyScrollWindow();
 
+  NotifyScrollWindow();
   m_bMinOrMax = true;
-
-  EndTimer();
-  BeginTimer(100);
+  m_pTimer = pdfium::MakeUnique<CFX_Timer>(GetTimerHandler(), this, 100);
 }
 
 void CPWL_ScrollBar::OnMinButtonLBUp(const CFX_PointF& point) {}
@@ -687,12 +687,10 @@ void CPWL_ScrollBar::OnMaxButtonLBDown(const CFX_PointF& point) {
   m_sData.AddSmall();
   if (!MovePosButton(true))
     return;
-  NotifyScrollWindow();
 
+  NotifyScrollWindow();
   m_bMinOrMax = false;
-
-  EndTimer();
-  BeginTimer(100);
+  m_pTimer = pdfium::MakeUnique<CFX_Timer>(GetTimerHandler(), this, 100);
 }
 
 void CPWL_ScrollBar::OnMaxButtonLBUp(const CFX_PointF& point) {}
@@ -885,16 +883,18 @@ void CPWL_ScrollBar::CreateChildWnd(const CreateParams& cp) {
   CreateButtons(cp);
 }
 
-void CPWL_ScrollBar::TimerProc() {
+void CPWL_ScrollBar::OnTimerFired() {
   PWL_SCROLL_PRIVATEDATA sTemp = m_sData;
   if (m_bMinOrMax)
     m_sData.SubSmall();
   else
     m_sData.AddSmall();
 
-  if (sTemp != m_sData) {
-    if (!MovePosButton(true))
-      return;
-    NotifyScrollWindow();
-  }
+  if (sTemp == m_sData)
+    return;
+
+  if (!MovePosButton(true))
+    return;
+
+  NotifyScrollWindow();
 }
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_scroll_bar.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_scroll_bar.h
index 414f718c33c..f6bb2b9230c 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_scroll_bar.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_scroll_bar.h
@@ -9,6 +9,7 @@
 
 #include <memory>
 
+#include "core/fxcrt/cfx_timer.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "fpdfsdk/pwl/cpwl_wnd.h"
 
@@ -43,10 +44,11 @@ enum PWL_SBBUTTON_TYPE { PSBT_MIN, PSBT_MAX, PSBT_POS };
 
 class CPWL_SBButton final : public CPWL_Wnd {
  public:
-  CPWL_SBButton(const CreateParams& cp,
-                std::unique_ptr<PrivateData> pAttachedData,
-                PWL_SCROLLBAR_TYPE eScrollBarType,
-                PWL_SBBUTTON_TYPE eButtonType);
+  CPWL_SBButton(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData,
+      PWL_SCROLLBAR_TYPE eScrollBarType,
+      PWL_SBBUTTON_TYPE eButtonType);
   ~CPWL_SBButton() override;
 
   // CPWL_Wnd
@@ -112,11 +114,12 @@ struct PWL_SCROLL_PRIVATEDATA {
   float fSmallStep;
 };
 
-class CPWL_ScrollBar final : public CPWL_Wnd {
+class CPWL_ScrollBar final : public CPWL_Wnd, public CFX_Timer::CallbackIface {
  public:
-  CPWL_ScrollBar(const CreateParams& cp,
-                 std::unique_ptr<PrivateData> pAttachedData,
-                 PWL_SCROLLBAR_TYPE sbType);
+  CPWL_ScrollBar(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData,
+      PWL_SCROLLBAR_TYPE sbType);
   ~CPWL_ScrollBar() override;
 
   // CPWL_Wnd:
@@ -132,7 +135,9 @@ class CPWL_ScrollBar final : public CPWL_Wnd {
   void NotifyLButtonUp(CPWL_Wnd* child, const CFX_PointF& pos) override;
   void NotifyMouseMove(CPWL_Wnd* child, const CFX_PointF& pos) override;
   void CreateChildWnd(const CreateParams& cp) override;
-  void TimerProc() override;
+
+  // CFX_Timer::CallbackIface:
+  void OnTimerFired() override;
 
   float GetScrollBarWidth() const;
   PWL_SCROLLBAR_TYPE GetScrollBarType() const { return m_sbType; }
@@ -171,6 +176,7 @@ class CPWL_ScrollBar final : public CPWL_Wnd {
   UnownedPtr<CPWL_SBButton> m_pMinButton;
   UnownedPtr<CPWL_SBButton> m_pMaxButton;
   UnownedPtr<CPWL_SBButton> m_pPosButton;
+  std::unique_ptr<CFX_Timer> m_pTimer;
   PWL_SCROLL_PRIVATEDATA m_sData;
   bool m_bMouseDown = false;
   bool m_bMinOrMax = false;
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_special_button.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_special_button.cpp
index 16f8c89738a..3fbf9193db1 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_special_button.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_special_button.cpp
@@ -11,8 +11,9 @@
 #include "fpdfsdk/pwl/cpwl_button.h"
 #include "fpdfsdk/pwl/cpwl_wnd.h"
 
-CPWL_PushButton::CPWL_PushButton(const CreateParams& cp,
-                                 std::unique_ptr<PrivateData> pAttachedData)
+CPWL_PushButton::CPWL_PushButton(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Button(cp, std::move(pAttachedData)) {}
 
 CPWL_PushButton::~CPWL_PushButton() = default;
@@ -22,8 +23,9 @@ CFX_FloatRect CPWL_PushButton::GetFocusRect() const {
                                      static_cast<float>(GetBorderWidth()));
 }
 
-CPWL_CheckBox::CPWL_CheckBox(const CreateParams& cp,
-                             std::unique_ptr<PrivateData> pAttachedData)
+CPWL_CheckBox::CPWL_CheckBox(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Button(cp, std::move(pAttachedData)) {}
 
 CPWL_CheckBox::~CPWL_CheckBox() = default;
@@ -41,8 +43,9 @@ bool CPWL_CheckBox::OnChar(uint16_t nChar, uint32_t nFlag) {
   return true;
 }
 
-CPWL_RadioButton::CPWL_RadioButton(const CreateParams& cp,
-                                   std::unique_ptr<PrivateData> pAttachedData)
+CPWL_RadioButton::CPWL_RadioButton(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : CPWL_Button(cp, std::move(pAttachedData)) {}
 
 CPWL_RadioButton::~CPWL_RadioButton() = default;
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_special_button.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_special_button.h
index 68bb965a49b..3d9fa254eb0 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_special_button.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_special_button.h
@@ -13,8 +13,9 @@
 
 class CPWL_PushButton final : public CPWL_Button {
  public:
-  CPWL_PushButton(const CreateParams& cp,
-                  std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_PushButton(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_PushButton() override;
 
   // CPWL_Button:
@@ -23,8 +24,9 @@ class CPWL_PushButton final : public CPWL_Button {
 
 class CPWL_CheckBox final : public CPWL_Button {
  public:
-  CPWL_CheckBox(const CreateParams& cp,
-                std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_CheckBox(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_CheckBox() override;
 
   // CPWL_Button:
@@ -40,8 +42,9 @@ class CPWL_CheckBox final : public CPWL_Button {
 
 class CPWL_RadioButton final : public CPWL_Button {
  public:
-  CPWL_RadioButton(const CreateParams& cp,
-                   std::unique_ptr<PrivateData> pAttachedData);
+  CPWL_RadioButton(
+      const CreateParams& cp,
+      std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
   ~CPWL_RadioButton() override;
 
   // CPWL_Button
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer.cpp
deleted file mode 100644
index b5436d4cc0f..00000000000
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright 2017 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#include "fpdfsdk/pwl/cpwl_timer.h"
-
-#include <map>
-
-#include "fpdfsdk/pwl/cpwl_timer_handler.h"
-
-namespace {
-
-std::map<int32_t, CPWL_Timer*>& GetPWLTimeMap() {
-  // Leak the object at shutdown.
-  static auto* timeMap = new std::map<int32_t, CPWL_Timer*>;
-  return *timeMap;
-}
-
-}  // namespace
-
-CPWL_Timer::CPWL_Timer(CPWL_TimerHandler* pAttached,
-                       CFX_SystemHandler* pSystemHandler)
-    : m_pAttached(pAttached), m_pSystemHandler(pSystemHandler) {
-  ASSERT(m_pAttached);
-  ASSERT(m_pSystemHandler);
-}
-
-CPWL_Timer::~CPWL_Timer() {
-  KillPWLTimer();
-}
-
-int32_t CPWL_Timer::SetPWLTimer(int32_t nElapse) {
-  KillPWLTimer();
-
-  m_nTimerID = m_pSystemHandler->SetTimer(nElapse, TimerProc);
-  if (HasValidID())
-    GetPWLTimeMap()[m_nTimerID] = this;
-  return m_nTimerID;
-}
-
-void CPWL_Timer::KillPWLTimer() {
-  if (!HasValidID())
-    return;
-
-  m_pSystemHandler->KillTimer(m_nTimerID);
-  GetPWLTimeMap().erase(m_nTimerID);
-  m_nTimerID = CFX_SystemHandler::kInvalidTimerID;
-}
-
-// static
-void CPWL_Timer::TimerProc(int32_t idEvent) {
-  auto it = GetPWLTimeMap().find(idEvent);
-  if (it == GetPWLTimeMap().end())
-    return;
-
-  CPWL_Timer* pTimer = it->second;
-  if (pTimer->m_pAttached)
-    pTimer->m_pAttached->TimerProc();
-}
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer.h
deleted file mode 100644
index 79259fefdc3..00000000000
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer.h
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2017 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef FPDFSDK_PWL_CPWL_TIMER_H_
-#define FPDFSDK_PWL_CPWL_TIMER_H_
-
-#include "core/fxcrt/unowned_ptr.h"
-#include "fpdfsdk/cfx_systemhandler.h"
-
-class CPWL_TimerHandler;
-
-class CPWL_Timer {
- public:
-  CPWL_Timer(CPWL_TimerHandler* pAttached, CFX_SystemHandler* pSystemHandler);
-  ~CPWL_Timer();
-
-  static void TimerProc(int32_t idEvent);
-
-  int32_t SetPWLTimer(int32_t nElapse);
-  void KillPWLTimer();
-
- private:
-  bool HasValidID() const {
-    return m_nTimerID != CFX_SystemHandler::kInvalidTimerID;
-  }
-
-  int32_t m_nTimerID = CFX_SystemHandler::kInvalidTimerID;
-  UnownedPtr<CPWL_TimerHandler> const m_pAttached;
-  UnownedPtr<CFX_SystemHandler> const m_pSystemHandler;
-};
-
-#endif  // FPDFSDK_PWL_CPWL_TIMER_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer_handler.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer_handler.cpp
deleted file mode 100644
index d5ebc256cb5..00000000000
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer_handler.cpp
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2017 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#include "fpdfsdk/pwl/cpwl_timer_handler.h"
-
-#include "fpdfsdk/pwl/cpwl_timer.h"
-#include "third_party/base/ptr_util.h"
-
-CPWL_TimerHandler::CPWL_TimerHandler() = default;
-
-CPWL_TimerHandler::~CPWL_TimerHandler() = default;
-
-void CPWL_TimerHandler::BeginTimer(int32_t nElapse) {
-  if (!m_pTimer)
-    m_pTimer = pdfium::MakeUnique<CPWL_Timer>(this, GetSystemHandler());
-  m_pTimer->SetPWLTimer(nElapse);
-}
-
-void CPWL_TimerHandler::EndTimer() {
-  if (m_pTimer)
-    m_pTimer->KillPWLTimer();
-}
-
-void CPWL_TimerHandler::TimerProc() {}
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer_handler.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer_handler.h
deleted file mode 100644
index f208e1cdf61..00000000000
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_timer_handler.h
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2017 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef FPDFSDK_PWL_CPWL_TIMER_HANDLER_H_
-#define FPDFSDK_PWL_CPWL_TIMER_HANDLER_H_
-
-#include <memory>
-
-class CFX_SystemHandler;
-class CPWL_Timer;
-
-class CPWL_TimerHandler {
- public:
-  CPWL_TimerHandler();
-  virtual ~CPWL_TimerHandler();
-
-  virtual void TimerProc();
-  virtual CFX_SystemHandler* GetSystemHandler() const = 0;
-
-  void BeginTimer(int32_t nElapse);
-  void EndTimer();
-
- private:
-  std::unique_ptr<CPWL_Timer> m_pTimer;
-};
-
-#endif  // FPDFSDK_PWL_CPWL_TIMER_HANDLER_H_
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_wnd.cpp b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_wnd.cpp
index 4805ff297eb..0202cb4396e 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_wnd.cpp
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_wnd.cpp
@@ -13,6 +13,8 @@
 
 #include "core/fxge/cfx_renderdevice.h"
 #include "fpdfsdk/pwl/cpwl_scroll_bar.h"
+#include "public/fpdf_fwlevent.h"
+#include "third_party/base/ptr_util.h"
 #include "third_party/base/stl_util.h"
 
 namespace {
@@ -100,8 +102,24 @@ class CPWL_MsgControl final : public Observable {
   UnownedPtr<CPWL_Wnd> m_pMainKeyboardWnd;
 };
 
-CPWL_Wnd::CPWL_Wnd(const CreateParams& cp,
-                   std::unique_ptr<PrivateData> pAttachedData)
+// static
+bool CPWL_Wnd::IsSHIFTKeyDown(uint32_t nFlag) {
+  return !!(nFlag & FWL_EVENTFLAG_ShiftKey);
+}
+
+// static
+bool CPWL_Wnd::IsCTRLKeyDown(uint32_t nFlag) {
+  return !!(nFlag & FWL_EVENTFLAG_ControlKey);
+}
+
+// static
+bool CPWL_Wnd::IsALTKeyDown(uint32_t nFlag) {
+  return !!(nFlag & FWL_EVENTFLAG_AltKey);
+}
+
+CPWL_Wnd::CPWL_Wnd(
+    const CreateParams& cp,
+    std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData)
     : m_CreationParams(cp), m_pAttachedData(std::move(pAttachedData)) {}
 
 CPWL_Wnd::~CPWL_Wnd() {
@@ -236,31 +254,21 @@ void CPWL_Wnd::DrawChildAppearance(CFX_RenderDevice* pDevice,
 }
 
 bool CPWL_Wnd::InvalidateRect(CFX_FloatRect* pRect) {
-    if (!IsValid())
+  if (!IsValid())
     return true;
 
-    ObservedPtr<CPWL_Wnd> thisObserved(this);
-    CFX_FloatRect rcRefresh = pRect ? *pRect : GetWindowRect();
-    if (!HasFlag(PWS_NOREFRESHCLIP)) {
-      CFX_FloatRect rcClip = GetClipRect();
-      if (!rcClip.IsEmpty())
-        rcRefresh.Intersect(rcClip);
-    }
+  ObservedPtr<CPWL_Wnd> thisObserved(this);
+  CFX_FloatRect rcRefresh = pRect ? *pRect : GetWindowRect();
+  if (!HasFlag(PWS_NOREFRESHCLIP)) {
+    CFX_FloatRect rcClip = GetClipRect();
+    if (!rcClip.IsEmpty())
+      rcRefresh.Intersect(rcClip);
+  }
 
   CFX_FloatRect rcWin = PWLtoWnd(rcRefresh);
   rcWin.Inflate(1, 1);
   rcWin.Normalize();
-
-  CFX_SystemHandler* pSH = GetSystemHandler();
-  if (!pSH)
-    return true;
-
-  CPDFSDK_Widget* widget =
-      ToCPDFSDKWidget(m_CreationParams.pAttachedWidget.Get());
-  if (!widget)
-    return true;
-
-  pSH->InvalidateRect(widget, rcWin);
+  GetSystemHandler()->InvalidateRect(m_pAttachedData.get(), rcWin);
   return !!thisObserved;
 }
 
@@ -515,7 +523,8 @@ void CPWL_Wnd::OnSetFocus() {}
 
 void CPWL_Wnd::OnKillFocus() {}
 
-std::unique_ptr<CPWL_Wnd::PrivateData> CPWL_Wnd::CloneAttachedData() const {
+std::unique_ptr<IPWL_SystemHandler::PerWindowData> CPWL_Wnd::CloneAttachedData()
+    const {
   return m_pAttachedData ? m_pAttachedData->Clone() : nullptr;
 }
 
@@ -588,10 +597,8 @@ bool CPWL_Wnd::RePosChildWnd() {
 void CPWL_Wnd::CreateChildWnd(const CreateParams& cp) {}
 
 void CPWL_Wnd::SetCursor() {
-  if (IsValid()) {
-    if (CFX_SystemHandler* pSH = GetSystemHandler())
-      pSH->SetCursor(GetCreationParams()->eCursorType);
-  }
+  if (IsValid())
+    GetSystemHandler()->SetCursor(GetCreationParams()->eCursorType);
 }
 
 void CPWL_Wnd::CreateMsgControl() {
@@ -645,10 +652,6 @@ void CPWL_Wnd::SetFontSize(float fFontSize) {
   m_CreationParams.fFontSize = fFontSize;
 }
 
-CFX_SystemHandler* CPWL_Wnd::GetSystemHandler() const {
-  return m_CreationParams.pSystemHandler.Get();
-}
-
 CFX_Color CPWL_Wnd::GetBorderLeftTopColor(BorderStyle nBorderStyle) const {
   switch (nBorderStyle) {
     case BorderStyle::BEVELED:
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_wnd.h b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_wnd.h
index af1d8890ce3..3436a69f967 100644
--- a/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_wnd.h
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/cpwl_wnd.h
@@ -10,20 +10,16 @@
 #include <memory>
 #include <vector>
 
-#include "core/fpdfdoc/cpdf_formcontrol.h"
+#include "core/fxcrt/cfx_timer.h"
 #include "core/fxcrt/observed_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "core/fxge/cfx_color.h"
 #include "core/fxge/cfx_renderdevice.h"
-#include "fpdfsdk/cpdfsdk_formfillenvironment.h"
-#include "fpdfsdk/cpdfsdk_widget.h"
-#include "fpdfsdk/pwl/cpwl_timer.h"
-#include "fpdfsdk/pwl/cpwl_timer_handler.h"
+#include "fpdfsdk/pwl/ipwl_systemhandler.h"
 
 class CPWL_Edit;
 class CPWL_MsgControl;
 class CPWL_ScrollBar;
-class CFX_SystemHandler;
 class IPVT_FontMap;
 struct PWL_SCROLL_INFO;
 
@@ -93,20 +89,15 @@ struct CPWL_Dash {
 #define PWL_DEFAULT_BLACKCOLOR CFX_Color(CFX_Color::kGray, 0)
 #define PWL_DEFAULT_WHITECOLOR CFX_Color(CFX_Color::kGray, 1)
 
-class CPWL_Wnd : public CPWL_TimerHandler, public Observable {
+class CPWL_Wnd : public Observable {
  public:
-  class PrivateData {
-   public:
-    virtual ~PrivateData() = default;
-    virtual std::unique_ptr<PrivateData> Clone() const = 0;
-  };
-
   class ProviderIface : public Observable {
    public:
     virtual ~ProviderIface() = default;
 
     // get a matrix which map user space to CWnd client space
-    virtual CFX_Matrix GetWindowMatrix(const PrivateData* pAttached) = 0;
+    virtual CFX_Matrix GetWindowMatrix(
+        const IPWL_SystemHandler::PerWindowData* pAttached) = 0;
   };
 
   class FocusHandlerIface {
@@ -122,13 +113,13 @@ class CPWL_Wnd : public CPWL_TimerHandler, public Observable {
     ~CreateParams();
 
     CFX_FloatRect rcRectWnd;                          // required
-    UnownedPtr<CFX_SystemHandler> pSystemHandler;     // required
+    UnownedPtr<TimerHandlerIface> pTimerHandler;      // required
+    UnownedPtr<IPWL_SystemHandler> pSystemHandler;    // required
     UnownedPtr<IPVT_FontMap> pFontMap;                // required
     ObservedPtr<ProviderIface> pProvider;             // required
     UnownedPtr<FocusHandlerIface> pFocusHandler;      // optional
     uint32_t dwFlags = 0;                             // optional
     CFX_Color sBackgroundColor;                       // optional
-    ObservedPtr<CPDFSDK_Widget> pAttachedWidget;      // required
     BorderStyle nBorderStyle = BorderStyle::SOLID;    // optional
     int32_t dwBorderWidth = 1;                        // optional
     CFX_Color sBorderColor;                           // optional
@@ -141,8 +132,13 @@ class CPWL_Wnd : public CPWL_TimerHandler, public Observable {
     CFX_Matrix mtChild;                               // ignore
   };
 
-  CPWL_Wnd(const CreateParams& cp, std::unique_ptr<PrivateData> pAttachedData);
-  ~CPWL_Wnd() override;
+  static bool IsSHIFTKeyDown(uint32_t nFlag);
+  static bool IsCTRLKeyDown(uint32_t nFlag);
+  static bool IsALTKeyDown(uint32_t nFlag);
+
+  CPWL_Wnd(const CreateParams& cp,
+           std::unique_ptr<IPWL_SystemHandler::PerWindowData> pAttachedData);
+  virtual ~CPWL_Wnd();
 
   // Returns |true| iff this instance is still allocated.
   virtual bool InvalidateRect(CFX_FloatRect* pRect);
@@ -224,8 +220,10 @@ class CPWL_Wnd : public CPWL_TimerHandler, public Observable {
   const CFX_FloatRect& GetClipRect() const;
 
   CPWL_Wnd* GetParentWindow() const { return m_pParent.Get(); }
-  const PrivateData* GetAttachedData() const { return m_pAttachedData.get(); }
-  std::unique_ptr<PrivateData> CloneAttachedData() const;
+  const IPWL_SystemHandler::PerWindowData* GetAttachedData() const {
+    return m_pAttachedData.get();
+  }
+  std::unique_ptr<IPWL_SystemHandler::PerWindowData> CloneAttachedData() const;
 
   bool WndHitTest(const CFX_PointF& point) const;
   bool ClientHitTest(const CFX_PointF& point) const;
@@ -258,9 +256,6 @@ class CPWL_Wnd : public CPWL_TimerHandler, public Observable {
   virtual void OnKillFocus();
 
  protected:
-  // CPWL_TimerHandler:
-  CFX_SystemHandler* GetSystemHandler() const override;
-
   virtual void CreateChildWnd(const CreateParams& cp);
 
   // Returns |true| iff this instance is still allocated.
@@ -275,6 +270,12 @@ class CPWL_Wnd : public CPWL_TimerHandler, public Observable {
   bool IsNotifying() const { return m_bNotifying; }
   bool IsValid() const { return m_bCreated; }
   CreateParams* GetCreationParams() { return &m_CreationParams; }
+  TimerHandlerIface* GetTimerHandler() const {
+    return m_CreationParams.pTimerHandler.Get();
+  }
+  IPWL_SystemHandler* GetSystemHandler() const {
+    return m_CreationParams.pSystemHandler.Get();
+  }
 
   // Returns |true| iff this instance is still allocated.
   bool InvalidateRectMove(const CFX_FloatRect& rcOld,
@@ -284,13 +285,13 @@ class CPWL_Wnd : public CPWL_TimerHandler, public Observable {
   bool IsWndCaptureKeyboard(const CPWL_Wnd* pWnd) const;
 
   static bool IsCTRLpressed(uint32_t nFlag) {
-    return CPDFSDK_FormFillEnvironment::IsCTRLKeyDown(nFlag);
+    return CPWL_Wnd::IsCTRLKeyDown(nFlag);
   }
   static bool IsSHIFTpressed(uint32_t nFlag) {
-    return CPDFSDK_FormFillEnvironment::IsSHIFTKeyDown(nFlag);
+    return CPWL_Wnd::IsSHIFTKeyDown(nFlag);
   }
   static bool IsALTpressed(uint32_t nFlag) {
-    return CPDFSDK_FormFillEnvironment::IsALTKeyDown(nFlag);
+    return CPWL_Wnd::IsALTKeyDown(nFlag);
   }
 
  private:
@@ -312,7 +313,7 @@ class CPWL_Wnd : public CPWL_TimerHandler, public Observable {
   CPWL_MsgControl* GetMsgControl() const;
 
   CreateParams m_CreationParams;
-  std::unique_ptr<PrivateData> m_pAttachedData;
+  std::unique_ptr<IPWL_SystemHandler::PerWindowData> m_pAttachedData;
   UnownedPtr<CPWL_Wnd> m_pParent;
   std::vector<std::unique_ptr<CPWL_Wnd>> m_Children;
   UnownedPtr<CPWL_ScrollBar> m_pVScrollBar;
diff --git a/chromium/third_party/pdfium/fpdfsdk/pwl/ipwl_systemhandler.h b/chromium/third_party/pdfium/fpdfsdk/pwl/ipwl_systemhandler.h
new file mode 100644
index 00000000000..8a14d8eb8d5
--- /dev/null
+++ b/chromium/third_party/pdfium/fpdfsdk/pwl/ipwl_systemhandler.h
@@ -0,0 +1,35 @@
+// Copyright 2019 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
+
+#ifndef FPDFSDK_PWL_IPWL_SYSTEMHANDLER_H_
+#define FPDFSDK_PWL_IPWL_SYSTEMHANDLER_H_
+
+#include <memory>
+
+#include "core/fxcrt/fx_coordinates.h"
+#include "core/fxcrt/fx_system.h"
+
+class CFFL_FormFiller;
+
+class IPWL_SystemHandler {
+ public:
+  class PerWindowData {
+   public:
+    virtual ~PerWindowData() = default;
+    virtual std::unique_ptr<PerWindowData> Clone() const = 0;
+  };
+
+  virtual ~IPWL_SystemHandler() = default;
+
+  virtual void InvalidateRect(PerWindowData* pWidgetData,
+                              const CFX_FloatRect& rect) = 0;
+  virtual void OutputSelectedRect(CFFL_FormFiller* pFormFiller,
+                                  const CFX_FloatRect& rect) = 0;
+  virtual bool IsSelectionImplemented() const = 0;
+  virtual void SetCursor(int32_t nCursorType) = 0;
+};
+
+#endif  // FPDFSDK_PWL_IPWL_SYSTEMHANDLER_H_
diff --git a/chromium/third_party/pdfium/fxbarcode/datamatrix/BC_DefaultPlacement.h b/chromium/third_party/pdfium/fxbarcode/datamatrix/BC_DefaultPlacement.h
index 12ea852136c..823d587969d 100644
--- a/chromium/third_party/pdfium/fxbarcode/datamatrix/BC_DefaultPlacement.h
+++ b/chromium/third_party/pdfium/fxbarcode/datamatrix/BC_DefaultPlacement.h
@@ -11,10 +11,10 @@
 
 #include "core/fxcrt/fx_string.h"
 
-class CBC_DefaultPlacement {
+class CBC_DefaultPlacement final {
  public:
   CBC_DefaultPlacement(WideString codewords, int32_t numcols, int32_t numrows);
-  virtual ~CBC_DefaultPlacement();
+  ~CBC_DefaultPlacement();
 
   int32_t getNumrows();
   int32_t getNumcols();
diff --git a/chromium/third_party/pdfium/fxbarcode/pdf417/BC_PDF417BarcodeMatrix.h b/chromium/third_party/pdfium/fxbarcode/pdf417/BC_PDF417BarcodeMatrix.h
index 60978391cb2..d059cee2579 100644
--- a/chromium/third_party/pdfium/fxbarcode/pdf417/BC_PDF417BarcodeMatrix.h
+++ b/chromium/third_party/pdfium/fxbarcode/pdf417/BC_PDF417BarcodeMatrix.h
@@ -12,10 +12,10 @@
 
 class CBC_BarcodeRow;
 
-class CBC_BarcodeMatrix {
+class CBC_BarcodeMatrix final {
  public:
   CBC_BarcodeMatrix(size_t width, size_t height);
-  virtual ~CBC_BarcodeMatrix();
+  ~CBC_BarcodeMatrix();
 
   CBC_BarcodeRow* getRow(size_t row) const { return m_matrix[row].get(); }
   size_t getWidth() const { return m_width; }
diff --git a/chromium/third_party/pdfium/fxbarcode/pdf417/BC_PDF417BarcodeRow.h b/chromium/third_party/pdfium/fxbarcode/pdf417/BC_PDF417BarcodeRow.h
index 4709420111f..07ebbd770ca 100644
--- a/chromium/third_party/pdfium/fxbarcode/pdf417/BC_PDF417BarcodeRow.h
+++ b/chromium/third_party/pdfium/fxbarcode/pdf417/BC_PDF417BarcodeRow.h
@@ -11,10 +11,10 @@
 
 #include <vector>
 
-class CBC_BarcodeRow {
+class CBC_BarcodeRow final {
  public:
   explicit CBC_BarcodeRow(size_t width);
-  virtual ~CBC_BarcodeRow();
+  ~CBC_BarcodeRow();
 
   void addBar(bool black, int32_t width);
   std::vector<uint8_t>& getRow();
diff --git a/chromium/third_party/pdfium/fxbarcode/qrcode/BC_QRCoder.h b/chromium/third_party/pdfium/fxbarcode/qrcode/BC_QRCoder.h
index 882822f7af1..57938581966 100644
--- a/chromium/third_party/pdfium/fxbarcode/qrcode/BC_QRCoder.h
+++ b/chromium/third_party/pdfium/fxbarcode/qrcode/BC_QRCoder.h
@@ -15,12 +15,12 @@ class CBC_QRCoderErrorCorrectionLevel;
 class CBC_QRCoderMode;
 class CBC_CommonByteMatrix;
 
-class CBC_QRCoder {
+class CBC_QRCoder final {
  public:
   static constexpr int32_t kNumMaskPatterns = 8;
 
   CBC_QRCoder();
-  virtual ~CBC_QRCoder();
+  ~CBC_QRCoder();
 
   static bool IsValidMaskPattern(int32_t maskPattern);
 
diff --git a/chromium/third_party/pdfium/fxbarcode/qrcode/BC_QRCoderMode.h b/chromium/third_party/pdfium/fxbarcode/qrcode/BC_QRCoderMode.h
index ba762f0deb6..b61d751a616 100644
--- a/chromium/third_party/pdfium/fxbarcode/qrcode/BC_QRCoderMode.h
+++ b/chromium/third_party/pdfium/fxbarcode/qrcode/BC_QRCoderMode.h
@@ -11,9 +11,9 @@
 
 #include <vector>
 
-class CBC_QRCoderMode {
+class CBC_QRCoderMode final {
  public:
-  virtual ~CBC_QRCoderMode();
+  ~CBC_QRCoderMode();
 
   static void Initialize();
   static void Finalize();
diff --git a/chromium/third_party/pdfium/fxjs/BUILD.gn b/chromium/third_party/pdfium/fxjs/BUILD.gn
index 8d2e7b8cbd7..0f51f9c247a 100644
--- a/chromium/third_party/pdfium/fxjs/BUILD.gn
+++ b/chromium/third_party/pdfium/fxjs/BUILD.gn
@@ -104,7 +104,6 @@ jumbo_source_set("fxjs") {
     deps += [
       "../constants",
       "../core/fdrm",
-      "../core/fpdfapi/font",
       "../core/fpdfapi/page",
       "../core/fpdfapi/parser",
       "../core/fpdfapi/render",
@@ -212,7 +211,6 @@ jumbo_source_set("fxjs") {
       ]
       deps += [
         "../xfa/fgas",
-        "../xfa/fgas/layout",
         "../xfa/fxfa/fm2js",
       ]
     }
diff --git a/chromium/third_party/pdfium/fxjs/cfxjs_engine.h b/chromium/third_party/pdfium/fxjs/cfxjs_engine.h
index 8c6c69c9be4..933c2508e91 100644
--- a/chromium/third_party/pdfium/fxjs/cfxjs_engine.h
+++ b/chromium/third_party/pdfium/fxjs/cfxjs_engine.h
@@ -24,11 +24,6 @@
 #include "fxjs/ijs_runtime.h"
 #include "v8/include/v8.h"
 
-#ifdef PDF_ENABLE_XFA
-// CFXJS_ENGINE doesn't interpret this class, it is just passed along to XFA.
-class CFXJSE_RuntimeData;
-#endif  // PDF_ENABLE_XFA
-
 class CFXJS_ObjDefinition;
 class CJS_Object;
 class V8TemplateMap;
@@ -45,6 +40,12 @@ enum FXJSOBJTYPE {
 
 class FXJS_PerIsolateData {
  public:
+  // Hook for XFA's data, when present.
+  class ExtensionIface {
+   public:
+    virtual ~ExtensionIface() = default;
+  };
+
   ~FXJS_PerIsolateData();
 
   static void SetUp(v8::Isolate* pIsolate);
@@ -56,9 +57,7 @@ class FXJS_PerIsolateData {
 
   std::vector<std::unique_ptr<CFXJS_ObjDefinition>> m_ObjectDefnArray;
   std::unique_ptr<V8TemplateMap> m_pDynamicObjsMap;
-#ifdef PDF_ENABLE_XFA
-  std::unique_ptr<CFXJSE_RuntimeData> m_pFXJSERuntimeData;
-#endif  // PDF_ENABLE_XFA
+  std::unique_ptr<ExtensionIface> m_pFXJSERuntimeData;
 
  protected:
   explicit FXJS_PerIsolateData(v8::Isolate* pIsolate);
diff --git a/chromium/third_party/pdfium/fxjs/cjs_app.cpp b/chromium/third_party/pdfium/fxjs/cjs_app.cpp
index 6459a00f6a7..992fd985ae7 100644
--- a/chromium/third_party/pdfium/fxjs/cjs_app.cpp
+++ b/chromium/third_party/pdfium/fxjs/cjs_app.cpp
@@ -22,9 +22,7 @@
 #define JS_STR_PLATFORM L"WIN"
 #define JS_STR_LANGUAGE L"ENU"
 #define JS_NUM_VIEWERVERSION 8
-#ifdef PDF_ENABLE_XFA
 #define JS_NUM_VIEWERVERSION_XFA 11
-#endif  // PDF_ENABLE_XFA
 #define JS_NUM_FORMSVERSION 7
 
 const JSPropertySpec CJS_App::PropertySpecs[] = {
@@ -146,11 +144,12 @@ CJS_Result CJS_App::set_viewer_variation(CJS_Runtime* pRuntime,
 }
 
 CJS_Result CJS_App::get_viewer_version(CJS_Runtime* pRuntime) {
-#ifdef PDF_ENABLE_XFA
-  if (pRuntime->GetFormFillEnv()->ContainsXFAForm())
-    return CJS_Result::Success(pRuntime->NewNumber(JS_NUM_VIEWERVERSION_XFA));
-#endif  // PDF_ENABLE_XFA
-  return CJS_Result::Success(pRuntime->NewNumber(JS_NUM_VIEWERVERSION));
+  CPDF_Document::Extension* pContext =
+      pRuntime->GetFormFillEnv()->GetDocExtension();
+  int version = pContext && pContext->ContainsExtensionForm()
+                    ? JS_NUM_VIEWERVERSION_XFA
+                    : JS_NUM_VIEWERVERSION;
+  return CJS_Result::Success(pRuntime->NewNumber(version));
 }
 
 CJS_Result CJS_App::set_viewer_version(CJS_Runtime* pRuntime,
@@ -159,15 +158,12 @@ CJS_Result CJS_App::set_viewer_version(CJS_Runtime* pRuntime,
 }
 
 CJS_Result CJS_App::get_platform(CJS_Runtime* pRuntime) {
-#ifdef PDF_ENABLE_XFA
   CPDFSDK_FormFillEnvironment* pFormFillEnv = pRuntime->GetFormFillEnv();
-  if (!pFormFillEnv)
-    return CJS_Result::Failure(JSMessage::kBadObjectError);
-
-  WideString platform = pFormFillEnv->GetPlatform();
-  if (!platform.IsEmpty())
-    return CJS_Result::Success(pRuntime->NewString(platform.AsStringView()));
-#endif
+  if (pFormFillEnv) {
+    WideString platform = pFormFillEnv->GetPlatform();
+    if (!platform.IsEmpty())
+      return CJS_Result::Success(pRuntime->NewString(platform.AsStringView()));
+  }
   return CJS_Result::Success(pRuntime->NewString(JS_STR_PLATFORM));
 }
 
@@ -177,15 +173,12 @@ CJS_Result CJS_App::set_platform(CJS_Runtime* pRuntime,
 }
 
 CJS_Result CJS_App::get_language(CJS_Runtime* pRuntime) {
-#ifdef PDF_ENABLE_XFA
   CPDFSDK_FormFillEnvironment* pFormFillEnv = pRuntime->GetFormFillEnv();
-  if (!pFormFillEnv)
-    return CJS_Result::Failure(JSMessage::kBadObjectError);
-
-  WideString language = pFormFillEnv->GetLanguage();
-  if (!language.IsEmpty())
-    return CJS_Result::Success(pRuntime->NewString(language.AsStringView()));
-#endif
+  if (pFormFillEnv) {
+    WideString language = pFormFillEnv->GetLanguage();
+    if (!language.IsEmpty())
+      return CJS_Result::Success(pRuntime->NewString(language.AsStringView()));
+  }
   return CJS_Result::Success(pRuntime->NewString(JS_STR_LANGUAGE));
 }
 
@@ -310,8 +303,7 @@ CJS_Result CJS_App::setInterval(
 
   uint32_t dwInterval = params.size() > 1 ? pRuntime->ToInt32(params[1]) : 1000;
   auto timerRef = pdfium::MakeUnique<GlobalTimer>(
-      this, pRuntime->GetFormFillEnv(), pRuntime, GlobalTimer::Type::kRepeating,
-      script, dwInterval, 0);
+      this, pRuntime, GlobalTimer::Type::kRepeating, script, dwInterval, 0);
   GlobalTimer* pTimerRef = timerRef.get();
   m_Timers.insert(std::move(timerRef));
 
@@ -338,9 +330,9 @@ CJS_Result CJS_App::setTimeOut(
     return CJS_Result::Failure(JSMessage::kInvalidInputError);
 
   uint32_t dwTimeOut = params.size() > 1 ? pRuntime->ToInt32(params[1]) : 1000;
-  auto timerRef = pdfium::MakeUnique<GlobalTimer>(
-      this, pRuntime->GetFormFillEnv(), pRuntime, GlobalTimer::Type::kOneShot,
-      script, dwTimeOut, dwTimeOut);
+  auto timerRef = pdfium::MakeUnique<GlobalTimer>(this, pRuntime,
+                                                  GlobalTimer::Type::kOneShot,
+                                                  script, dwTimeOut, dwTimeOut);
   GlobalTimer* pTimerRef = timerRef.get();
   m_Timers.insert(std::move(timerRef));
 
diff --git a/chromium/third_party/pdfium/fxjs/cjs_document.cpp b/chromium/third_party/pdfium/fxjs/cjs_document.cpp
index a9a9368fd44..c7965f06d40 100644
--- a/chromium/third_party/pdfium/fxjs/cjs_document.cpp
+++ b/chromium/third_party/pdfium/fxjs/cjs_document.cpp
@@ -8,7 +8,6 @@
 
 #include <utility>
 
-#include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/page/cpdf_pageobject.h"
 #include "core/fpdfapi/page/cpdf_textobject.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
@@ -29,75 +28,6 @@
 #include "fxjs/cjs_icon.h"
 #include "fxjs/js_resources.h"
 
-namespace {
-
-#define ISLATINWORD(u) (u != 0x20 && u <= 0x28FF)
-
-int CountWords(const CPDF_TextObject* pTextObj) {
-  CPDF_Font* pFont = pTextObj->GetFont();
-  if (!pFont)
-    return 0;
-
-  bool bInLatinWord = false;
-  int nWords = 0;
-  for (size_t i = 0, sz = pTextObj->CountChars(); i < sz; ++i) {
-    uint32_t charcode = CPDF_Font::kInvalidCharCode;
-    float unused_kerning;
-
-    pTextObj->GetCharInfo(i, &charcode, &unused_kerning);
-    WideString swUnicode = pFont->UnicodeFromCharCode(charcode);
-
-    uint16_t unicode = 0;
-    if (swUnicode.GetLength() > 0)
-      unicode = swUnicode[0];
-
-    bool bIsLatin = ISLATINWORD(unicode);
-    if (bIsLatin && bInLatinWord)
-      continue;
-
-    bInLatinWord = bIsLatin;
-    if (unicode != 0x20)
-      nWords++;
-  }
-
-  return nWords;
-}
-
-WideString GetObjWordStr(const CPDF_TextObject* pTextObj, int nWordIndex) {
-  CPDF_Font* pFont = pTextObj->GetFont();
-  if (!pFont)
-    return WideString();
-
-  WideString swRet;
-  int nWords = 0;
-  bool bInLatinWord = false;
-  for (size_t i = 0, sz = pTextObj->CountChars(); i < sz; ++i) {
-    uint32_t charcode = CPDF_Font::kInvalidCharCode;
-    float unused_kerning;
-
-    pTextObj->GetCharInfo(i, &charcode, &unused_kerning);
-    WideString swUnicode = pFont->UnicodeFromCharCode(charcode);
-
-    uint16_t unicode = 0;
-    if (swUnicode.GetLength() > 0)
-      unicode = swUnicode[0];
-
-    bool bIsLatin = ISLATINWORD(unicode);
-    if (!bIsLatin || !bInLatinWord) {
-      bInLatinWord = bIsLatin;
-      if (unicode != 0x20)
-        nWords++;
-    }
-
-    if (nWords - 1 == nWordIndex)
-      swRet += unicode;
-  }
-
-  return swRet;
-}
-
-}  // namespace
-
 const JSPropertySpec CJS_Document::PropertySpecs[] = {
     {"ADBE", get_ADBE_static, set_ADBE_static},
     {"author", get_author_static, set_author_static},
@@ -893,14 +823,14 @@ CJS_Result CJS_Document::set_subject(CJS_Runtime* pRuntime,
 }
 
 CJS_Result CJS_Document::get_title(CJS_Runtime* pRuntime) {
-  if (!m_pFormFillEnv || !m_pFormFillEnv->GetPDFDocument())
+  if (!m_pFormFillEnv)
     return CJS_Result::Failure(JSMessage::kBadObjectError);
   return getPropertyInternal(pRuntime, "Title");
 }
 
 CJS_Result CJS_Document::set_title(CJS_Runtime* pRuntime,
                                    v8::Local<v8::Value> vp) {
-  if (!m_pFormFillEnv || !m_pFormFillEnv->GetPDFDocument())
+  if (!m_pFormFillEnv)
     return CJS_Result::Failure(JSMessage::kBadObjectError);
   return setPropertyInternal(pRuntime, vp, "Title");
 }
@@ -1300,9 +1230,6 @@ CJS_Result CJS_Document::getPageNthWord(
   bool bStrip = params.size() > 2 ? pRuntime->ToBoolean(params[2]) : true;
 
   CPDF_Document* pDocument = m_pFormFillEnv->GetPDFDocument();
-  if (!pDocument)
-    return CJS_Result::Failure(JSMessage::kBadObjectError);
-
   if (nPageNo < 0 || nPageNo >= pDocument->GetPageCount())
     return CJS_Result::Failure(JSMessage::kValueError);
 
@@ -1319,9 +1246,9 @@ CJS_Result CJS_Document::getPageNthWord(
   for (auto& pPageObj : *page) {
     if (pPageObj->IsText()) {
       CPDF_TextObject* pTextObj = pPageObj->AsText();
-      int nObjWords = CountWords(pTextObj);
+      int nObjWords = pTextObj->CountWords();
       if (nWords + nObjWords >= nWordNo) {
-        swRet = GetObjWordStr(pTextObj, nWordNo - nWords);
+        swRet = pTextObj->GetWordString(nWordNo - nWords);
         break;
       }
       nWords += nObjWords;
@@ -1367,9 +1294,8 @@ CJS_Result CJS_Document::getPageNumWords(
   int nWords = 0;
   for (auto& pPageObj : *page) {
     if (pPageObj->IsText())
-      nWords += CountWords(pPageObj->AsText());
+      nWords += pPageObj->AsText()->CountWords();
   }
-
   return CJS_Result::Success(pRuntime->NewNumber(nWords));
 }
 
@@ -1442,9 +1368,6 @@ CJS_Result CJS_Document::gotoNamedDest(
     return CJS_Result::Failure(JSMessage::kBadObjectError);
 
   CPDF_Document* pDocument = m_pFormFillEnv->GetPDFDocument();
-  if (!pDocument)
-    return CJS_Result::Failure(JSMessage::kBadObjectError);
-
   CPDF_NameTree nameTree(pDocument, "Dests");
   CPDF_Array* destArray =
       nameTree.LookupNamedDest(pDocument, pRuntime->ToWideString(params[0]));
diff --git a/chromium/third_party/pdfium/fxjs/cjs_field.cpp b/chromium/third_party/pdfium/fxjs/cjs_field.cpp
index dd3dd02df6c..45e5ad79ee1 100644
--- a/chromium/third_party/pdfium/fxjs/cjs_field.cpp
+++ b/chromium/third_party/pdfium/fxjs/cjs_field.cpp
@@ -12,7 +12,6 @@
 
 #include "constants/annotation_flags.h"
 #include "constants/form_flags.h"
-#include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfdoc/cpdf_formcontrol.h"
 #include "core/fpdfdoc/cpdf_formfield.h"
 #include "core/fpdfdoc/cpdf_interactiveform.h"
@@ -1984,13 +1983,12 @@ CJS_Result CJS_Field::get_text_font(CJS_Runtime* pRuntime) {
     return CJS_Result::Failure(JSMessage::kObjectTypeError);
   }
 
-  CPDF_Font* pFont = pFormControl->GetDefaultControlFont();
-  if (!pFont)
+  Optional<WideString> wsFontName = pFormControl->GetDefaultControlFontName();
+  if (!wsFontName.has_value())
     return CJS_Result::Failure(JSMessage::kBadObjectError);
 
-  return CJS_Result::Success(pRuntime->NewString(
-      WideString::FromDefANSI(pFont->GetBaseFont().AsStringView())
-          .AsStringView()));
+  return CJS_Result::Success(
+      pRuntime->NewString(wsFontName.value().AsStringView()));
 }
 
 CJS_Result CJS_Field::set_text_font(CJS_Runtime* pRuntime,
diff --git a/chromium/third_party/pdfium/fxjs/cjs_runtime.cpp b/chromium/third_party/pdfium/fxjs/cjs_runtime.cpp
index e488c260115..81148de9a10 100644
--- a/chromium/third_party/pdfium/fxjs/cjs_runtime.cpp
+++ b/chromium/third_party/pdfium/fxjs/cjs_runtime.cpp
@@ -39,14 +39,9 @@
 #include "fxjs/js_define.h"
 #include "third_party/base/ptr_util.h"
 
-#ifdef PDF_ENABLE_XFA
-#include "fxjs/xfa/cfxjse_value.h"
-#endif  // PDF_ENABLE_XFA
-
 CJS_Runtime::CJS_Runtime(CPDFSDK_FormFillEnvironment* pFormFillEnv)
     : m_pFormFillEnv(pFormFillEnv) {
   v8::Isolate* pIsolate = nullptr;
-
   IPDF_JSPLATFORM* pPlatform = m_pFormFillEnv->GetFormFillInfo()->m_pJsPlatform;
   if (pPlatform->version <= 2) {
     unsigned int embedderDataSlot = 0;
@@ -60,11 +55,8 @@ CJS_Runtime::CJS_Runtime(CPDFSDK_FormFillEnvironment* pFormFillEnv)
   m_isolateManaged = FXJS_GetIsolate(&pIsolate);
   SetIsolate(pIsolate);
 
-#ifdef PDF_ENABLE_XFA
   v8::Isolate::Scope isolate_scope(pIsolate);
   v8::HandleScope handle_scope(pIsolate);
-#endif
-
   if (m_isolateManaged || FXJS_GlobalIsolateRefCount() == 0)
     DefineJSObjects();
 
@@ -142,6 +134,10 @@ CJS_EventContext* CJS_Runtime::GetCurrentEventContext() const {
                                      : m_EventContextArray.back().get();
 }
 
+TimerHandlerIface* CJS_Runtime::GetTimerHandler() const {
+  return m_pFormFillEnv ? m_pFormFillEnv->GetTimerHandler() : nullptr;
+}
+
 void CJS_Runtime::SetFormFillEnvToDocument() {
   v8::Isolate::Scope isolate_scope(GetIsolate());
   v8::HandleScope handle_scope(GetIsolate());
@@ -176,21 +172,13 @@ void CJS_Runtime::RemoveEventFromSet(const FieldEvent& event) {
   m_FieldEventSet.erase(event);
 }
 
-#ifdef PDF_ENABLE_XFA
-WideString ChangeObjName(const WideString& str) {
-  WideString sRet = str;
-  sRet.Replace(L"_", L".");
-  return sRet;
-}
-
 CJS_Runtime* CJS_Runtime::AsCJSRuntime() {
   return this;
 }
 
 bool CJS_Runtime::GetValueByNameFromGlobalObject(ByteStringView utf8Name,
-                                                 CFXJSE_Value* pValue) {
+                                                 v8::Local<v8::Value>* pValue) {
   v8::Isolate::Scope isolate_scope(GetIsolate());
-  v8::HandleScope handle_scope(GetIsolate());
   v8::Local<v8::Context> context = GetV8Context();
   v8::Context::Scope context_scope(context);
   v8::Local<v8::String> str =
@@ -199,39 +187,29 @@ bool CJS_Runtime::GetValueByNameFromGlobalObject(ByteStringView utf8Name,
           .ToLocalChecked();
   v8::MaybeLocal<v8::Value> maybe_propvalue =
       context->Global()->Get(context, str);
-  if (maybe_propvalue.IsEmpty()) {
-    pValue->SetUndefined();
-    return false;
-  }
-  v8::Local<v8::Value> propvalue = maybe_propvalue.ToLocalChecked();
-  if (propvalue.IsEmpty()) {
-    pValue->SetUndefined();
+  if (maybe_propvalue.IsEmpty())
     return false;
-  }
-  pValue->ForceSetValue(propvalue);
+
+  *pValue = maybe_propvalue.ToLocalChecked();
   return true;
 }
 
 bool CJS_Runtime::SetValueByNameInGlobalObject(ByteStringView utf8Name,
-                                               CFXJSE_Value* pValue) {
-  if (utf8Name.IsEmpty() || !pValue)
+                                               v8::Local<v8::Value> pValue) {
+  if (utf8Name.IsEmpty() || pValue.IsEmpty())
     return false;
 
   v8::Isolate* pIsolate = GetIsolate();
   v8::Isolate::Scope isolate_scope(pIsolate);
-  v8::HandleScope handle_scope(pIsolate);
   v8::Local<v8::Context> context = GetV8Context();
   v8::Context::Scope context_scope(context);
-  v8::Local<v8::Value> propvalue =
-      v8::Local<v8::Value>::New(pIsolate, pValue->DirectGetValue());
   v8::Local<v8::String> str =
       v8::String::NewFromUtf8(pIsolate, utf8Name.unterminated_c_str(),
                               v8::NewStringType::kNormal, utf8Name.GetLength())
           .ToLocalChecked();
-  v8::Maybe<bool> result = context->Global()->Set(context, str, propvalue);
+  v8::Maybe<bool> result = context->Global()->Set(context, str, pValue);
   return result.IsJust() && result.FromJust();
 }
-#endif  // PDF_ENABLE_XFA
 
 v8::Local<v8::Value> CJS_Runtime::MaybeCoerceToNumber(
     v8::Local<v8::Value> value) {
diff --git a/chromium/third_party/pdfium/fxjs/cjs_runtime.h b/chromium/third_party/pdfium/fxjs/cjs_runtime.h
index 55eb766dbfd..b3f8ef68f2a 100644
--- a/chromium/third_party/pdfium/fxjs/cjs_runtime.h
+++ b/chromium/third_party/pdfium/fxjs/cjs_runtime.h
@@ -13,12 +13,13 @@
 #include <vector>
 
 #include "core/fxcrt/observed_ptr.h"
-#include "fpdfsdk/cpdfsdk_formfillenvironment.h"
+#include "core/fxcrt/timerhandler_iface.h"
 #include "fxjs/cfxjs_engine.h"
 #include "fxjs/cjs_eventrecorder.h"
 #include "fxjs/ijs_runtime.h"
 
 class CJS_EventContext;
+class CPDFSDK_FormFillEnvironment;
 
 class CJS_Runtime final : public IJS_Runtime,
                           public CFXJS_Engine,
@@ -29,7 +30,8 @@ class CJS_Runtime final : public IJS_Runtime,
   explicit CJS_Runtime(CPDFSDK_FormFillEnvironment* pFormFillEnv);
   ~CJS_Runtime() override;
 
-  // IJS_Runtime
+  // IJS_Runtime:
+  CJS_Runtime* AsCJSRuntime() override;
   IJS_EventContext* NewEventContext() override;
   void ReleaseEventContext(IJS_EventContext* pContext) override;
   CPDFSDK_FormFillEnvironment* GetFormFillEnv() const override;
@@ -37,6 +39,7 @@ class CJS_Runtime final : public IJS_Runtime,
       const WideString& script) override;
 
   CJS_EventContext* GetCurrentEventContext() const;
+  TimerHandlerIface* GetTimerHandler() const;
 
   // Returns true if the event isn't already found in the set.
   bool AddEventToSet(const FieldEvent& event);
@@ -50,13 +53,10 @@ class CJS_Runtime final : public IJS_Runtime,
   // value will be returned, otherwise |value| is returned.
   v8::Local<v8::Value> MaybeCoerceToNumber(v8::Local<v8::Value> value);
 
-#ifdef PDF_ENABLE_XFA
-  CJS_Runtime* AsCJSRuntime() override;
   bool GetValueByNameFromGlobalObject(ByteStringView utf8Name,
-                                      CFXJSE_Value* pValue) override;
+                                      v8::Local<v8::Value>* pValue);
   bool SetValueByNameInGlobalObject(ByteStringView utf8Name,
-                                    CFXJSE_Value* pValue) override;
-#endif  // PDF_ENABLE_XFA
+                                    v8::Local<v8::Value> pValue);
 
  private:
   void DefineJSObjects();
diff --git a/chromium/third_party/pdfium/fxjs/cjs_runtimestub.cpp b/chromium/third_party/pdfium/fxjs/cjs_runtimestub.cpp
index 0a774a5699f..6e313de584a 100644
--- a/chromium/third_party/pdfium/fxjs/cjs_runtimestub.cpp
+++ b/chromium/third_party/pdfium/fxjs/cjs_runtimestub.cpp
@@ -26,22 +26,10 @@ CPDFSDK_FormFillEnvironment* CJS_RuntimeStub::GetFormFillEnv() const {
   return m_pFormFillEnv.Get();
 }
 
-#ifdef PDF_ENABLE_XFA
 CJS_Runtime* CJS_RuntimeStub::AsCJSRuntime() {
   return nullptr;
 }
 
-bool CJS_RuntimeStub::GetValueByNameFromGlobalObject(ByteStringView,
-                                                     CFXJSE_Value*) {
-  return false;
-}
-
-bool CJS_RuntimeStub::SetValueByNameInGlobalObject(ByteStringView,
-                                                   CFXJSE_Value*) {
-  return false;
-}
-#endif  // PDF_ENABLE_XFA
-
 Optional<IJS_Runtime::JS_Error> CJS_RuntimeStub::ExecuteScript(
     const WideString& script) {
   return pdfium::nullopt;
diff --git a/chromium/third_party/pdfium/fxjs/cjs_runtimestub.h b/chromium/third_party/pdfium/fxjs/cjs_runtimestub.h
index a702b7738b5..2b5e71349dd 100644
--- a/chromium/third_party/pdfium/fxjs/cjs_runtimestub.h
+++ b/chromium/third_party/pdfium/fxjs/cjs_runtimestub.h
@@ -22,16 +22,11 @@ class CJS_RuntimeStub final : public IJS_Runtime {
   ~CJS_RuntimeStub() override;
 
   // IJS_Runtime:
+  CJS_Runtime* AsCJSRuntime() override;
   IJS_EventContext* NewEventContext() override;
   void ReleaseEventContext(IJS_EventContext* pContext) override;
   CPDFSDK_FormFillEnvironment* GetFormFillEnv() const override;
 
-#ifdef PDF_ENABLE_XFA
-  CJS_Runtime* AsCJSRuntime() override;
-  bool GetValueByNameFromGlobalObject(ByteStringView, CFXJSE_Value*) override;
-  bool SetValueByNameInGlobalObject(ByteStringView, CFXJSE_Value*) override;
-#endif  // PDF_ENABLE_XFA
-
   Optional<IJS_Runtime::JS_Error> ExecuteScript(
       const WideString& script) override;
 
diff --git a/chromium/third_party/pdfium/fxjs/fx_date_helpers.cpp b/chromium/third_party/pdfium/fxjs/fx_date_helpers.cpp
index 00b50cc22a3..f95758e0f15 100644
--- a/chromium/third_party/pdfium/fxjs/fx_date_helpers.cpp
+++ b/chromium/third_party/pdfium/fxjs/fx_date_helpers.cpp
@@ -31,7 +31,7 @@ double Mod(double x, double y) {
 }
 
 double GetLocalTZA() {
-  if (!FSDK_IsSandBoxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS))
+  if (!IsPDFSandboxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS))
     return 0;
   time_t t = 0;
   FXSYS_time(&t);
@@ -46,7 +46,7 @@ double GetLocalTZA() {
 }
 
 int GetDaylightSavingTA(double d) {
-  if (!FSDK_IsSandBoxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS))
+  if (!IsPDFSandboxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS))
     return 0;
   time_t t = (time_t)(d / 1000);
   struct tm* tmp = FXSYS_localtime(&t);
@@ -188,7 +188,7 @@ static constexpr size_t KMonthAbbreviationLength = 3;  // Anything in |kMonths|.
 static constexpr size_t kLongestFullMonthLength = 9;   // September
 
 double FX_GetDateTime() {
-  if (!FSDK_IsSandBoxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS))
+  if (!IsPDFSandboxPolicyEnabled(FPDF_POLICY_MACHINETIME_ACCESS))
     return 0;
 
   time_t t = FXSYS_time(nullptr);
diff --git a/chromium/third_party/pdfium/fxjs/global_timer.cpp b/chromium/third_party/pdfium/fxjs/global_timer.cpp
index a4d3c041caf..b3049a0a695 100644
--- a/chromium/third_party/pdfium/fxjs/global_timer.cpp
+++ b/chromium/third_party/pdfium/fxjs/global_timer.cpp
@@ -8,7 +8,7 @@
 
 #include <map>
 
-#include "fpdfsdk/cfx_systemhandler.h"
+#include "core/fxcrt/timerhandler_iface.h"
 #include "fxjs/cjs_app.h"
 
 namespace {
@@ -23,19 +23,17 @@ TimerMap* GetGlobalTimerMap() {
 }  // namespace
 
 GlobalTimer::GlobalTimer(CJS_App* pObj,
-                         CPDFSDK_FormFillEnvironment* pFormFillEnv,
                          CJS_Runtime* pRuntime,
                          Type nType,
                          const WideString& script,
                          uint32_t dwElapse,
                          uint32_t dwTimeOut)
-    : m_nTimerID(pFormFillEnv->GetSysHandler()->SetTimer(dwElapse, Trigger)),
-      m_pEmbedApp(pObj),
-      m_nType(nType),
+    : m_nType(nType),
+      m_nTimerID(pRuntime->GetTimerHandler()->SetTimer(dwElapse, Trigger)),
       m_dwTimeOut(dwTimeOut),
       m_swJScript(script),
       m_pRuntime(pRuntime),
-      m_pFormFillEnv(pFormFillEnv) {
+      m_pEmbedApp(pObj) {
   if (HasValidID())
     (*GetGlobalTimerMap())[m_nTimerID] = this;
 }
@@ -44,8 +42,8 @@ GlobalTimer::~GlobalTimer() {
   if (!HasValidID())
     return;
 
-  if (GetRuntime())
-    m_pFormFillEnv->GetSysHandler()->KillTimer(m_nTimerID);
+  if (m_pRuntime && m_pRuntime->GetTimerHandler())
+    m_pRuntime->GetTimerHandler()->KillTimer(m_nTimerID);
 
   GetGlobalTimerMap()->erase(m_nTimerID);
 }
@@ -86,5 +84,5 @@ void GlobalTimer::Cancel(int32_t nTimerID) {
 }
 
 bool GlobalTimer::HasValidID() const {
-  return m_nTimerID != CFX_SystemHandler::kInvalidTimerID;
+  return m_nTimerID != TimerHandlerIface::kInvalidTimerID;
 }
diff --git a/chromium/third_party/pdfium/fxjs/global_timer.h b/chromium/third_party/pdfium/fxjs/global_timer.h
index 0b8e8aaa33f..ef6bbb63b42 100644
--- a/chromium/third_party/pdfium/fxjs/global_timer.h
+++ b/chromium/third_party/pdfium/fxjs/global_timer.h
@@ -7,7 +7,6 @@
 #ifndef FXJS_GLOBAL_TIMER_H_
 #define FXJS_GLOBAL_TIMER_H_
 
-#include "fpdfsdk/cpdfsdk_formfillenvironment.h"
 #include "fxjs/cjs_runtime.h"
 
 class CJS_App;
@@ -20,7 +19,6 @@ class GlobalTimer {
   };
 
   GlobalTimer(CJS_App* pObj,
-              CPDFSDK_FormFillEnvironment* pFormFillEnv,
               CJS_Runtime* pRuntime,
               Type nType,
               const WideString& script,
@@ -40,16 +38,13 @@ class GlobalTimer {
  private:
   bool HasValidID() const;
 
-  const int32_t m_nTimerID;
-  CJS_App* const m_pEmbedApp;
-  bool m_bProcessing = false;
-
-  // data
   const Type m_nType;
+  bool m_bProcessing = false;
+  const int32_t m_nTimerID;
   const uint32_t m_dwTimeOut;
   const WideString m_swJScript;
   ObservedPtr<CJS_Runtime> m_pRuntime;
-  ObservedPtr<CPDFSDK_FormFillEnvironment> m_pFormFillEnv;
+  CJS_App* const m_pEmbedApp;
 };
 
 #endif  // FXJS_GLOBAL_TIMER_H_
diff --git a/chromium/third_party/pdfium/fxjs/ijs_runtime.h b/chromium/third_party/pdfium/fxjs/ijs_runtime.h
index 2d879f69bc2..ca103aa9a46 100644
--- a/chromium/third_party/pdfium/fxjs/ijs_runtime.h
+++ b/chromium/third_party/pdfium/fxjs/ijs_runtime.h
@@ -52,19 +52,12 @@ class IJS_Runtime {
 
   virtual ~IJS_Runtime();
 
+  virtual CJS_Runtime* AsCJSRuntime() = 0;
   virtual IJS_EventContext* NewEventContext() = 0;
   virtual void ReleaseEventContext(IJS_EventContext* pContext) = 0;
   virtual CPDFSDK_FormFillEnvironment* GetFormFillEnv() const = 0;
   virtual Optional<JS_Error> ExecuteScript(const WideString& script) = 0;
 
-#ifdef PDF_ENABLE_XFA
-  virtual CJS_Runtime* AsCJSRuntime() = 0;
-  virtual bool GetValueByNameFromGlobalObject(ByteStringView utf8Name,
-                                              CFXJSE_Value* pValue) = 0;
-  virtual bool SetValueByNameInGlobalObject(ByteStringView utf8Name,
-                                            CFXJSE_Value* pValue) = 0;
-#endif  // PDF_ENABLE_XFA
-
  protected:
   IJS_Runtime() = default;
 };
diff --git a/chromium/third_party/pdfium/fxjs/js_resources.cpp b/chromium/third_party/pdfium/fxjs/js_resources.cpp
index 16df281dbf9..3bc8df3756d 100644
--- a/chromium/third_party/pdfium/fxjs/js_resources.cpp
+++ b/chromium/third_party/pdfium/fxjs/js_resources.cpp
@@ -81,7 +81,6 @@ WideString JSGetStringFromID(JSMessage msg) {
     case JSMessage::kUserGestureRequiredError:
       msg_string = "User gesture required.";
       break;
-#ifdef PDF_ENABLE_XFA
     case JSMessage::kTooManyOccurances:
       msg_string = "Too many occurances.";
       break;
@@ -91,7 +90,6 @@ WideString JSGetStringFromID(JSMessage msg) {
     default:
       NOTREACHED();
       break;
-#endif
   }
   return WideString::FromASCII(msg_string);
 }
diff --git a/chromium/third_party/pdfium/fxjs/js_resources.h b/chromium/third_party/pdfium/fxjs/js_resources.h
index a95e1b30961..8a308628847 100644
--- a/chromium/third_party/pdfium/fxjs/js_resources.h
+++ b/chromium/third_party/pdfium/fxjs/js_resources.h
@@ -33,10 +33,8 @@ enum class JSMessage {
   kUnknownProperty,
   kInvalidSetError,
   kUserGestureRequiredError,
-#ifdef PDF_ENABLE_XFA
   kTooManyOccurances,
   kUnknownMethod,
-#endif
 };
 
 WideString JSGetStringFromID(JSMessage msg);
diff --git a/chromium/third_party/pdfium/fxjs/xfa/cfxjse_engine.cpp b/chromium/third_party/pdfium/fxjs/xfa/cfxjse_engine.cpp
index e4675fd3d66..7ac440d0a23 100644
--- a/chromium/third_party/pdfium/fxjs/xfa/cfxjse_engine.cpp
+++ b/chromium/third_party/pdfium/fxjs/xfa/cfxjse_engine.cpp
@@ -198,19 +198,25 @@ void CFXJSE_Engine::GlobalPropertySetter(CFXJSE_Value* pObject,
           true)) {
     return;
   }
-  if (lpOrginalNode->IsThisProxy()) {
-    if (pValue && pValue->IsUndefined()) {
-      pObject->DeleteObjectProperty(szPropName);
-      return;
-    }
+  if (lpOrginalNode->IsThisProxy() && pValue && pValue->IsUndefined()) {
+    pObject->DeleteObjectProperty(szPropName);
+    return;
   }
   CXFA_FFNotify* pNotify = pDoc->GetNotify();
   if (!pNotify)
     return;
 
   CXFA_FFDoc* hDoc = pNotify->GetHDOC();
-  hDoc->GetDocEnvironment()->SetPropertyInNonXFAGlobalObject(hDoc, szPropName,
-                                                             pValue);
+  auto* pCJSRuntime =
+      static_cast<CJS_Runtime*>(hDoc->GetDocEnvironment()->GetIJSRuntime(hDoc));
+  if (!pCJSRuntime)
+    return;
+
+  v8::HandleScope handle_scope(lpScriptContext->GetIsolate());
+  IJS_Runtime::ScopedEventContext pContext(pCJSRuntime);
+  pCJSRuntime->SetValueByNameInGlobalObject(
+      szPropName, v8::Local<v8::Value>::New(lpScriptContext->GetIsolate(),
+                                            pValue->DirectGetValue()));
 }
 
 // static
@@ -222,6 +228,7 @@ void CFXJSE_Engine::GlobalPropertyGetter(CFXJSE_Value* pObject,
   CFXJSE_Engine* lpScriptContext = pDoc->GetScriptContext();
   WideString wsPropName = WideString::FromUTF8(szPropName);
 
+  pValue->SetUndefined();  // Assume failure.
   if (lpScriptContext->GetType() == CXFA_Script::Type::Formcalc) {
     if (szPropName == kFormCalcRuntime) {
       lpScriptContext->m_FM2JSContext->GlobalPropertyGetter(pValue);
@@ -244,7 +251,6 @@ void CFXJSE_Engine::GlobalPropertyGetter(CFXJSE_Value* pObject,
     pRefNode =
         ToNode(lpScriptContext->GetVariablesThis(pOriginalObject, false));
   }
-
   if (lpScriptContext->QueryNodeByFlag(
           pRefNode, wsPropName.AsStringView(), pValue,
           XFA_RESOLVENODE_Children | XFA_RESOLVENODE_Properties |
@@ -252,7 +258,6 @@ void CFXJSE_Engine::GlobalPropertyGetter(CFXJSE_Value* pObject,
           false)) {
     return;
   }
-
   if (lpScriptContext->QueryNodeByFlag(
           pRefNode, wsPropName.AsStringView(), pValue,
           XFA_RESOLVENODE_Parent | XFA_RESOLVENODE_Siblings, false)) {
@@ -271,8 +276,21 @@ void CFXJSE_Engine::GlobalPropertyGetter(CFXJSE_Value* pObject,
     return;
 
   CXFA_FFDoc* hDoc = pNotify->GetHDOC();
-  hDoc->GetDocEnvironment()->GetPropertyFromNonXFAGlobalObject(hDoc, szPropName,
-                                                               pValue);
+  auto* pCJSRuntime =
+      static_cast<CJS_Runtime*>(hDoc->GetDocEnvironment()->GetIJSRuntime(hDoc));
+  if (!pCJSRuntime)
+    return;
+
+  v8::HandleScope handle_scope(lpScriptContext->GetIsolate());
+  IJS_Runtime::ScopedEventContext pContext(pCJSRuntime);
+  v8::Local<v8::Value> temp_value;
+  if (!pCJSRuntime->GetValueByNameFromGlobalObject(szPropName, &temp_value))
+    return;
+
+  if (temp_value.IsEmpty())
+    return;
+
+  pValue->ForceSetValue(temp_value);
 }
 
 int32_t CFXJSE_Engine::GlobalPropTypeGetter(CFXJSE_Value* pOriginalValue,
@@ -295,11 +313,10 @@ int32_t CFXJSE_Engine::GlobalPropTypeGetter(CFXJSE_Value* pOriginalValue,
 void CFXJSE_Engine::NormalPropertyGetter(CFXJSE_Value* pOriginalValue,
                                          ByteStringView szPropName,
                                          CFXJSE_Value* pReturnValue) {
+  pReturnValue->SetUndefined();  // Assume failure.
   CXFA_Object* pOriginalObject = ToObject(pOriginalValue);
-  if (!pOriginalObject) {
-    pReturnValue->SetUndefined();
+  if (!pOriginalObject)
     return;
-  }
 
   WideString wsPropName = WideString::FromUTF8(szPropName);
   CFXJSE_Engine* lpScriptContext =
@@ -333,36 +350,43 @@ void CFXJSE_Engine::NormalPropertyGetter(CFXJSE_Value* pOriginalValue,
 
   CXFA_Object* pScriptObject =
       lpScriptContext->GetVariablesThis(pOriginalObject, true);
-  if (pScriptObject) {
-    bRet = lpScriptContext->QueryVariableValue(ToNode(pScriptObject),
-                                               szPropName, pReturnValue, true);
-
-    if (!bRet) {
-      Optional<XFA_SCRIPTATTRIBUTEINFO> info = XFA_GetScriptAttributeByName(
-          pObject->GetElementType(), wsPropName.AsStringView());
-      if (info.has_value()) {
-        CJX_Object* jsObject = pObject->JSObject();
-        (*info.value().callback)(jsObject, pReturnValue, false,
-                                 info.value().attribute);
-        return;
-      }
-    }
+  if (!pScriptObject)
+    return;
 
-    CXFA_FFNotify* pNotify = pObject->GetDocument()->GetNotify();
-    if (!pNotify) {
-      pReturnValue->SetUndefined();
-      return;
-    }
+  bRet = lpScriptContext->QueryVariableValue(ToNode(pScriptObject), szPropName,
+                                             pReturnValue, true);
+  if (bRet)
+    return;
 
-    CXFA_FFDoc* hDoc = pNotify->GetHDOC();
-    if (hDoc->GetDocEnvironment()->GetPropertyFromNonXFAGlobalObject(
-            hDoc, szPropName, pReturnValue)) {
-      return;
-    }
+  Optional<XFA_SCRIPTATTRIBUTEINFO> info = XFA_GetScriptAttributeByName(
+      pObject->GetElementType(), wsPropName.AsStringView());
+  if (info.has_value()) {
+    CJX_Object* jsObject = pObject->JSObject();
+    (*info.value().callback)(jsObject, pReturnValue, false,
+                             info.value().attribute);
+    return;
   }
 
-  if (!bRet)
-    pReturnValue->SetUndefined();
+  CXFA_FFNotify* pNotify = pObject->GetDocument()->GetNotify();
+  if (!pNotify)
+    return;
+
+  CXFA_FFDoc* hDoc = pNotify->GetHDOC();
+  auto* pCJSRuntime =
+      static_cast<CJS_Runtime*>(hDoc->GetDocEnvironment()->GetIJSRuntime(hDoc));
+  if (!pCJSRuntime)
+    return;
+
+  v8::HandleScope handle_scope(lpScriptContext->GetIsolate());
+  IJS_Runtime::ScopedEventContext pContext(pCJSRuntime);
+  v8::Local<v8::Value> temp_local;
+  if (!pCJSRuntime->GetValueByNameFromGlobalObject(szPropName, &temp_local))
+    return;
+
+  if (temp_local.IsEmpty())
+    return;
+
+  pReturnValue->ForceSetValue(temp_local);
 }
 
 // static
@@ -460,7 +484,7 @@ CJS_Result CFXJSE_Engine::NormalMethodCall(
 }
 
 bool CFXJSE_Engine::IsStrictScopeInJavaScript() {
-  return m_pDocument->HasFlag(XFA_DOCFLAG_StrictScoping);
+  return m_pDocument->is_strict_scoping();
 }
 
 CXFA_Script::Type CFXJSE_Engine::GetType() {
diff --git a/chromium/third_party/pdfium/fxjs/xfa/cfxjse_runtimedata.cpp b/chromium/third_party/pdfium/fxjs/xfa/cfxjse_runtimedata.cpp
index fdff67a584a..0478e3e6ca0 100644
--- a/chromium/third_party/pdfium/fxjs/xfa/cfxjse_runtimedata.cpp
+++ b/chromium/third_party/pdfium/fxjs/xfa/cfxjse_runtimedata.cpp
@@ -51,5 +51,5 @@ CFXJSE_RuntimeData* CFXJSE_RuntimeData::Get(v8::Isolate* pIsolate) {
   FXJS_PerIsolateData* pData = FXJS_PerIsolateData::Get(pIsolate);
   if (!pData->m_pFXJSERuntimeData)
     pData->m_pFXJSERuntimeData = CFXJSE_RuntimeData::Create(pIsolate);
-  return pData->m_pFXJSERuntimeData.get();
+  return static_cast<CFXJSE_RuntimeData*>(pData->m_pFXJSERuntimeData.get());
 }
diff --git a/chromium/third_party/pdfium/fxjs/xfa/cfxjse_runtimedata.h b/chromium/third_party/pdfium/fxjs/xfa/cfxjse_runtimedata.h
index c0f5da35cdc..148b01ec0c2 100644
--- a/chromium/third_party/pdfium/fxjs/xfa/cfxjse_runtimedata.h
+++ b/chromium/third_party/pdfium/fxjs/xfa/cfxjse_runtimedata.h
@@ -9,13 +9,12 @@
 
 #include <memory>
 
+#include "fxjs/cfxjs_engine.h"
 #include "v8/include/v8.h"
 
-class CFXJSE_RuntimeList;
-
-class CFXJSE_RuntimeData {
+class CFXJSE_RuntimeData : public FXJS_PerIsolateData::ExtensionIface {
  public:
-  ~CFXJSE_RuntimeData();
+  ~CFXJSE_RuntimeData() override;
 
   static CFXJSE_RuntimeData* Get(v8::Isolate* pIsolate);
 
diff --git a/chromium/third_party/pdfium/fxjs/xfa/cjx_hostpseudomodel.cpp b/chromium/third_party/pdfium/fxjs/xfa/cjx_hostpseudomodel.cpp
index 2437a30f870..0cfffa6d095 100644
--- a/chromium/third_party/pdfium/fxjs/xfa/cjx_hostpseudomodel.cpp
+++ b/chromium/third_party/pdfium/fxjs/xfa/cjx_hostpseudomodel.cpp
@@ -310,8 +310,13 @@ CJS_Result CJX_HostPseudoModel::openList(
   if (!hWidget)
     return CJS_Result::Success();
 
+  // SetFocusWidget() may destroy |hWidget| object by JS callback.
+  ObservedPtr<CXFA_FFWidget> pObservedWidget(hWidget);
   CXFA_FFDoc* hDoc = pNotify->GetHDOC();
   hDoc->GetDocEnvironment()->SetFocusWidget(hDoc, hWidget);
+  if (!pObservedWidget)
+    return CJS_Result::Success();
+
   pNotify->OpenDropDownList(hWidget);
   return CJS_Result::Success();
 }
diff --git a/chromium/third_party/pdfium/public/cpp/fpdf_deleters.h b/chromium/third_party/pdfium/public/cpp/fpdf_deleters.h
index 9a700e3b349..633ddf5e34e 100644
--- a/chromium/third_party/pdfium/public/cpp/fpdf_deleters.h
+++ b/chromium/third_party/pdfium/public/cpp/fpdf_deleters.h
@@ -9,6 +9,7 @@
 #include "public/fpdf_dataavail.h"
 #include "public/fpdf_edit.h"
 #include "public/fpdf_formfill.h"
+#include "public/fpdf_javascript.h"
 #include "public/fpdf_structtree.h"
 #include "public/fpdf_text.h"
 #include "public/fpdf_transformpage.h"
@@ -48,6 +49,12 @@ struct FPDFFormHandleDeleter {
   }
 };
 
+struct FPDFJavaScriptActionDeleter {
+  inline void operator()(FPDF_JAVASCRIPT_ACTION javascript) {
+    FPDFDoc_CloseJavaScriptAction(javascript);
+  }
+};
+
 struct FPDFPageDeleter {
   inline void operator()(FPDF_PAGE page) { FPDF_ClosePage(page); }
 };
diff --git a/chromium/third_party/pdfium/public/cpp/fpdf_scopers.h b/chromium/third_party/pdfium/public/cpp/fpdf_scopers.h
index ebae1073f14..ff57c1b4891 100644
--- a/chromium/third_party/pdfium/public/cpp/fpdf_scopers.h
+++ b/chromium/third_party/pdfium/public/cpp/fpdf_scopers.h
@@ -9,13 +9,6 @@
 #include <type_traits>
 
 #include "public/cpp/fpdf_deleters.h"
-#include "public/fpdf_annot.h"
-#include "public/fpdf_dataavail.h"
-#include "public/fpdf_edit.h"
-#include "public/fpdf_formfill.h"
-#include "public/fpdf_structtree.h"
-#include "public/fpdf_text.h"
-#include "public/fpdfview.h"
 
 // Versions of FPDF types that clean up the object at scope exit.
 
@@ -44,6 +37,10 @@ using ScopedFPDFFormHandle =
     std::unique_ptr<std::remove_pointer<FPDF_FORMHANDLE>::type,
                     FPDFFormHandleDeleter>;
 
+using ScopedFPDFJavaScriptAction =
+    std::unique_ptr<std::remove_pointer<FPDF_JAVASCRIPT_ACTION>::type,
+                    FPDFJavaScriptActionDeleter>;
+
 using ScopedFPDFPage =
     std::unique_ptr<std::remove_pointer<FPDF_PAGE>::type, FPDFPageDeleter>;
 
diff --git a/chromium/third_party/pdfium/public/fpdf_annot.h b/chromium/third_party/pdfium/public/fpdf_annot.h
index e6e7765a62b..411efaee0b4 100644
--- a/chromium/third_party/pdfium/public/fpdf_annot.h
+++ b/chromium/third_party/pdfium/public/fpdf_annot.h
@@ -519,18 +519,15 @@ FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV FPDFAnnot_SetFlags(FPDF_ANNOTATION annot,
                                                        int flags);
 
 // Experimental API.
-// Get the annotation flags of |annot|, which is an interactive form
-// annotation in |page|.
+// Get the annotation flags of |annot|.
 //
 //    hHandle     -   handle to the form fill module, returned by
 //                    FPDFDOC_InitFormFillEnvironment().
-//    page        -   handle to a page.
 //    annot       -   handle to an interactive form annotation.
 //
 // Returns the annotation flags specific to interactive forms.
 FPDF_EXPORT int FPDF_CALLCONV
 FPDFAnnot_GetFormFieldFlags(FPDF_FORMHANDLE handle,
-                            FPDF_PAGE page,
                             FPDF_ANNOTATION annot);
 
 // Experimental API.
diff --git a/chromium/third_party/pdfium/public/fpdf_edit.h b/chromium/third_party/pdfium/public/fpdf_edit.h
index b6df86675bc..5596c551fb3 100644
--- a/chromium/third_party/pdfium/public/fpdf_edit.h
+++ b/chromium/third_party/pdfium/public/fpdf_edit.h
@@ -1110,8 +1110,7 @@ FPDF_EXPORT FPDF_FONT FPDF_CALLCONV FPDFText_LoadFont(FPDF_DOCUMENT document,
 // document   - handle to the document.
 // font       - string containing the font name, without spaces.
 //
-// The loaded font should NOT be closed using FPDFFont_Close. It will be
-// unloaded during the document's destruction.
+// The loaded font can be closed using FPDFFont_Close.
 //
 // Returns NULL on failure.
 FPDF_EXPORT FPDF_FONT FPDF_CALLCONV
diff --git a/chromium/third_party/pdfium/public/fpdf_formfill.h b/chromium/third_party/pdfium/public/fpdf_formfill.h
index bf5005cc36f..abb72bbf47e 100644
--- a/chromium/third_party/pdfium/public/fpdf_formfill.h
+++ b/chromium/third_party/pdfium/public/fpdf_formfill.h
@@ -889,7 +889,7 @@ typedef struct _FPDF_FORMFILLINFO {
    * Parameters:
    *     pThis           -   Pointer to the interface structure itself.
    *     page            -   Handle to page. Returned by FPDF_LoadPage().
-   *     hWidget         -   Handle to XFA fields.
+   *     hWidget         -   Always null, exists for compatibility.
    *     menuFlag        -   The menu flags. Please refer to macro definition
    *                         of FXFA_MENU_XXX and this can be one or a
    *                         combination of these macros.
diff --git a/chromium/third_party/pdfium/public/fpdf_javascript.h b/chromium/third_party/pdfium/public/fpdf_javascript.h
new file mode 100644
index 00000000000..19f38106cea
--- /dev/null
+++ b/chromium/third_party/pdfium/public/fpdf_javascript.h
@@ -0,0 +1,77 @@
+// Copyright 2019 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PUBLIC_FPDF_JAVASCRIPT_H_
+#define PUBLIC_FPDF_JAVASCRIPT_H_
+
+// NOLINTNEXTLINE(build/include)
+#include "fpdfview.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif  // __cplusplus
+
+// Experimental API.
+// Get the number of JavaScript actions in |document|.
+//
+//   document - handle to a document.
+//
+// Returns the number of JavaScript actions in |document| or -1 on error.
+FPDF_EXPORT int FPDF_CALLCONV
+FPDFDoc_GetJavaScriptActionCount(FPDF_DOCUMENT document);
+
+// Experimental API.
+// Get the JavaScript action at |index| in |document|.
+//
+//   document - handle to a document.
+//   index    - the index of the requested JavaScript action.
+//
+// Returns the handle to the JavaScript action, or NULL on failure.
+// Caller owns the returned handle and must close it with
+// FPDFDoc_CloseJavaScriptAction().
+FPDF_EXPORT FPDF_JAVASCRIPT_ACTION FPDF_CALLCONV
+FPDFDoc_GetJavaScriptAction(FPDF_DOCUMENT document, int index);
+
+// Experimental API.
+// Close a loaded FPDF_JAVASCRIPT_ACTION object.
+
+//   javascript - Handle to a JavaScript action.
+FPDF_EXPORT void FPDF_CALLCONV
+FPDFDoc_CloseJavaScriptAction(FPDF_JAVASCRIPT_ACTION javascript);
+
+// Experimental API.
+// Get the name from the |javascript| handle. |buffer| is only modified if
+// |buflen| is longer than the length of the name. On errors, |buffer| is
+// unmodified and the returned length is 0.
+//
+//   javascript - handle to an JavaScript action.
+//   buffer     - buffer for holding the name, encoded in UTF-16LE.
+//   buflen     - length of the buffer in bytes.
+//
+// Returns the length of the JavaScript action name in bytes.
+FPDF_EXPORT unsigned long FPDF_CALLCONV
+FPDFJavaScriptAction_GetName(FPDF_JAVASCRIPT_ACTION javascript,
+                             FPDF_WCHAR* buffer,
+                             unsigned long buflen);
+
+// Experimental API.
+// Get the script from the |javascript| handle. |buffer| is only modified if
+// |buflen| is longer than the length of the script. On errors, |buffer| is
+// unmodified and the returned length is 0.
+//
+//   javascript - handle to an JavaScript action.
+//   buffer     - buffer for holding the name, encoded in UTF-16LE.
+//   buflen     - length of the buffer in bytes.
+//
+// Returns the length of the JavaScript action name in bytes.
+FPDF_EXPORT unsigned long FPDF_CALLCONV
+FPDFJavaScriptAction_GetScript(FPDF_JAVASCRIPT_ACTION javascript,
+                               FPDF_WCHAR* buffer,
+                               unsigned long buflen);
+
+#ifdef __cplusplus
+}  // extern "C"
+#endif  // __cplusplus
+
+#endif  // PUBLIC_FPDF_JAVASCRIPT_H_
diff --git a/chromium/third_party/pdfium/public/fpdf_text.h b/chromium/third_party/pdfium/public/fpdf_text.h
index 7bd84bf96ab..63793bbb9b7 100644
--- a/chromium/third_party/pdfium/public/fpdf_text.h
+++ b/chromium/third_party/pdfium/public/fpdf_text.h
@@ -112,6 +112,20 @@ FPDFText_GetFontInfo(FPDF_TEXTPAGE text_page,
                      unsigned long buflen,
                      int* flags);
 
+// Experimental API.
+// Function: FPDFText_GetCharAngle
+//          Get character rotation angle.
+// Parameters:
+//          text_page   -   Handle to a text page information structure.
+//                          Returned by FPDFText_LoadPage function.
+//          index       -   Zero-based index of the character.
+// Return Value:
+//          On success, return the angle value in radian. Value will always be
+//          greater or equal to 0. If |text_page| is invalid, or if |index| is
+//          out of bounds, then return -1.
+FPDF_EXPORT double FPDF_CALLCONV FPDFText_GetCharAngle(FPDF_TEXTPAGE text_page,
+                                                       int index);
+
 // Function: FPDFText_GetCharBox
 //          Get bounding box of a particular character.
 // Parameters:
diff --git a/chromium/third_party/pdfium/public/fpdf_transformpage.h b/chromium/third_party/pdfium/public/fpdf_transformpage.h
index a2eb6b0e239..38ef1130ab8 100644
--- a/chromium/third_party/pdfium/public/fpdf_transformpage.h
+++ b/chromium/third_party/pdfium/public/fpdf_transformpage.h
@@ -220,6 +220,51 @@ FPDFPageObj_TransformClipPath(FPDF_PAGEOBJECT page_object,
                               double e,
                               double f);
 
+// Experimental API.
+// Get the clip path of the page object.
+//
+//   page object - Handle to a page object. Returned by e.g.
+//                 FPDFPage_GetObject().
+//
+// Caller does not take ownership of the returned FPDF_CLIPPATH. Instead, it
+// remains valid until FPDF_ClosePage() is called for the page containing
+// page_object.
+FPDF_EXPORT FPDF_CLIPPATH FPDF_CALLCONV
+FPDFPageObj_GetClipPath(FPDF_PAGEOBJECT page_object);
+
+// Experimental API.
+// Get number of paths inside |clip_path|.
+//
+//   clip_path - handle to a clip_path.
+//
+// Returns the number of objects in |clip_path| or -1 on failure.
+FPDF_EXPORT int FPDF_CALLCONV FPDFClipPath_CountPaths(FPDF_CLIPPATH clip_path);
+
+// Experimental API.
+// Get number of segments inside one path of |clip_path|.
+//
+//   clip_path  - handle to a clip_path.
+//   path_index - index into the array of paths of the clip path.
+//
+// Returns the number of segments or -1 on failure.
+FPDF_EXPORT int FPDF_CALLCONV
+FPDFClipPath_CountPathSegments(FPDF_CLIPPATH clip_path, int path_index);
+
+// Experimental API.
+// Get segment in one specific path of |clip_path| at index.
+//
+//   clip_path     - handle to a clip_path.
+//   path_index    - the index of a path.
+//   segment_index - the index of a segment.
+//
+// Returns the handle to the segment, or NULL on failure.  The caller does not
+// take ownership of the returned FPDF_CLIPPATH. Instead, it remains valid until
+// FPDF_ClosePage() is called for the page containing page_object.
+FPDF_EXPORT FPDF_PATHSEGMENT FPDF_CALLCONV
+FPDFClipPath_GetPathSegment(FPDF_CLIPPATH clip_path,
+                            int path_index,
+                            int segment_index);
+
 /**
  * Create a new clip path, with a rectangle inserted.
  *
diff --git a/chromium/third_party/pdfium/public/fpdfview.h b/chromium/third_party/pdfium/public/fpdfview.h
index 6bbc2bfcd9a..f8c6a992ed3 100644
--- a/chromium/third_party/pdfium/public/fpdfview.h
+++ b/chromium/third_party/pdfium/public/fpdfview.h
@@ -45,6 +45,7 @@ typedef struct fpdf_dest_t__* FPDF_DEST;
 typedef struct fpdf_document_t__* FPDF_DOCUMENT;
 typedef struct fpdf_font_t__* FPDF_FONT;
 typedef struct fpdf_form_handle_t__* FPDF_FORMHANDLE;
+typedef struct fpdf_javascript_action_t* FPDF_JAVASCRIPT_ACTION;
 typedef struct fpdf_link_t__* FPDF_LINK;
 typedef struct fpdf_page_t__* FPDF_PAGE;
 typedef struct fpdf_pagelink_t__* FPDF_PAGELINK;
@@ -888,7 +889,8 @@ FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV FPDF_PageToDevice(FPDF_PAGE page,
 //
 //          This function allocates enough memory for holding all pixels in the
 //          bitmap, but it doesn't initialize the buffer. Applications can use
-//          FPDFBitmap_FillRect to fill the bitmap using any color.
+//          FPDFBitmap_FillRect() to fill the bitmap using any color. If the OS
+//          allows it, this function can allocate up to 4 GB of memory.
 FPDF_EXPORT FPDF_BITMAP FPDF_CALLCONV FPDFBitmap_Create(int width,
                                                         int height,
                                                         int alpha);
diff --git a/chromium/third_party/pdfium/third_party/agg23/0004-ubsan-sweep-scanline-error.patch b/chromium/third_party/pdfium/third_party/agg23/0004-ubsan-sweep-scanline-error.patch
index 3348f0500bd..cde293f40cc 100644
--- a/chromium/third_party/pdfium/third_party/agg23/0004-ubsan-sweep-scanline-error.patch
+++ b/chromium/third_party/pdfium/third_party/agg23/0004-ubsan-sweep-scanline-error.patch
@@ -1,13 +1,37 @@
+diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.cpp b/third_party/agg23/agg_rasterizer_scanline_aa.cpp
+index c90bdafdd..1fe9a0c32 100644
+--- a/third_party/agg23/agg_rasterizer_scanline_aa.cpp
++++ b/third_party/agg23/agg_rasterizer_scanline_aa.cpp
+@@ -495,4 +495,11 @@ void outline_aa::sort_cells()
+     }
+     m_sorted = true;
+ }
++// static
++int rasterizer_scanline_aa::calculate_area(int cover, int shift)
++{
++    unsigned int result = cover;
++    result <<= shift;
++    return result;
++}
+ }
 diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.h b/third_party/agg23/agg_rasterizer_scanline_aa.h
-index c747ee379..da166bb14 100644
+index c747ee379..281933710 100644
 --- a/third_party/agg23/agg_rasterizer_scanline_aa.h
 +++ b/third_party/agg23/agg_rasterizer_scanline_aa.h
-@@ -349,14 +349,14 @@ public:
+@@ -338,7 +338,6 @@ public:
+                 const cell_aa* cur_cell = *cells;
+                 int x    = cur_cell->x;
+                 int area = cur_cell->area;
+-                unsigned alpha;
+                 cover += cur_cell->cover;
+                 while(--num_cells) {
+                     cur_cell = *++cells;
+@@ -349,14 +348,14 @@ public:
                      cover += cur_cell->cover;
                  }
                  if(area) {
 -                    alpha = calculate_alpha((cover << (poly_base_shift + 1)) - area, no_smooth);
-+                    alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1) - area, no_smooth);
++                    unsigned alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1) - area, no_smooth);
                      if(alpha) {
                          sl.add_cell(x, alpha);
                      }
@@ -15,19 +39,16 @@ index c747ee379..da166bb14 100644
                  }
                  if(num_cells && cur_cell->x > x) {
 -                    alpha = calculate_alpha(cover << (poly_base_shift + 1), no_smooth);
-+                    alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1), no_smooth);
++                    unsigned alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1), no_smooth);
                      if(alpha) {
                          sl.add_span(x, cur_cell->x - x, alpha);
                      }
-@@ -458,6 +458,11 @@ private:
-         m_prev_x = x;
+@@ -459,6 +458,8 @@ private:
          m_prev_y = y;
      }
-+    static int calculate_area(int cover, int shift) {
-+        unsigned int result = cover;
-+        result <<= shift;
-+        return result;
-+    }
  private:
++    static int calculate_area(int cover, int shift);
++
      outline_aa     m_outline;
      filling_rule_e m_filling_rule;
+     int            m_clipped_start_x;
diff --git a/chromium/third_party/pdfium/third_party/agg23/0006-ubsan-sweep-scanline-error.patch b/chromium/third_party/pdfium/third_party/agg23/0006-ubsan-sweep-scanline-error.patch
new file mode 100644
index 00000000000..ec3707de8a5
--- /dev/null
+++ b/chromium/third_party/pdfium/third_party/agg23/0006-ubsan-sweep-scanline-error.patch
@@ -0,0 +1,70 @@
+diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.cpp b/third_party/agg23/agg_rasterizer_scanline_aa.cpp
+index 1fe9a0c32..9254d830d 100644
+--- a/third_party/agg23/agg_rasterizer_scanline_aa.cpp
++++ b/third_party/agg23/agg_rasterizer_scanline_aa.cpp
+@@ -502,4 +502,16 @@ int rasterizer_scanline_aa::calculate_area(int cover, int shift)
+     result <<= shift;
+     return result;
+ }
++// static
++bool rasterizer_scanline_aa::safe_add(int* op1, int op2)
++{
++    pdfium::base::CheckedNumeric<int> safeOp1 = *op1;
++    safeOp1 += op2;
++    if(!safeOp1.IsValid()) {
++        return false;
++    }
++
++    *op1 = safeOp1.ValueOrDie();
++    return true;
++}
+ }
+diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.h b/third_party/agg23/agg_rasterizer_scanline_aa.h
+index 281933710..eade78333 100644
+--- a/third_party/agg23/agg_rasterizer_scanline_aa.h
++++ b/third_party/agg23/agg_rasterizer_scanline_aa.h
+@@ -338,14 +338,33 @@ public:
+                 const cell_aa* cur_cell = *cells;
+                 int x    = cur_cell->x;
+                 int area = cur_cell->area;
+-                cover += cur_cell->cover;
++                bool seen_area_overflow = false;
++                bool seen_cover_overflow = false;
++                if(!safe_add(&cover, cur_cell->cover)) {
++                    break;
++                }
+                 while(--num_cells) {
+                     cur_cell = *++cells;
+                     if(cur_cell->x != x) {
+                         break;
+                     }
+-                    area  += cur_cell->area;
+-                    cover += cur_cell->cover;
++                    if(seen_area_overflow) {
++                        continue;
++                    }
++                    if(!safe_add(&area, cur_cell->area)) {
++                        seen_area_overflow = true;
++                        continue;
++                    }
++                    if(!safe_add(&cover, cur_cell->cover)) {
++                        seen_cover_overflow = true;
++                        break;
++                    }
++                }
++                if(seen_area_overflow) {
++                    continue;
++                }
++                if(seen_cover_overflow) {
++                    break;
+                 }
+                 if(area) {
+                     unsigned alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1) - area, no_smooth);
+@@ -459,6 +478,7 @@ private:
+     }
+ private:
+     static int calculate_area(int cover, int shift);
++    static bool safe_add(int* op1, int op2);
+ 
+     outline_aa     m_outline;
+     filling_rule_e m_filling_rule;
diff --git a/chromium/third_party/pdfium/third_party/agg23/README.pdfium b/chromium/third_party/pdfium/third_party/agg23/README.pdfium
index c6212e2eb41..12de42912ec 100644
--- a/chromium/third_party/pdfium/third_party/agg23/README.pdfium
+++ b/chromium/third_party/pdfium/third_party/agg23/README.pdfium
@@ -20,3 +20,5 @@ non-enumeral type in conditional.
 error in sweep_scanline.
 0005-assignment-return-values.patch: Fix assignment operator return values in
 agg_array.h.
+0006-ubsan-sweep-scanline-error.patch: Fix UBSan integer overflow error in
+sweep_scanline.
diff --git a/chromium/third_party/pdfium/third_party/agg23/agg_rasterizer_scanline_aa.cpp b/chromium/third_party/pdfium/third_party/agg23/agg_rasterizer_scanline_aa.cpp
index c90bdafdd07..9254d830d85 100644
--- a/chromium/third_party/pdfium/third_party/agg23/agg_rasterizer_scanline_aa.cpp
+++ b/chromium/third_party/pdfium/third_party/agg23/agg_rasterizer_scanline_aa.cpp
@@ -495,4 +495,23 @@ void outline_aa::sort_cells()
     }
     m_sorted = true;
 }
+// static
+int rasterizer_scanline_aa::calculate_area(int cover, int shift)
+{
+    unsigned int result = cover;
+    result <<= shift;
+    return result;
+}
+// static
+bool rasterizer_scanline_aa::safe_add(int* op1, int op2)
+{
+    pdfium::base::CheckedNumeric<int> safeOp1 = *op1;
+    safeOp1 += op2;
+    if(!safeOp1.IsValid()) {
+        return false;
+    }
+
+    *op1 = safeOp1.ValueOrDie();
+    return true;
+}
 }
diff --git a/chromium/third_party/pdfium/third_party/agg23/agg_rasterizer_scanline_aa.h b/chromium/third_party/pdfium/third_party/agg23/agg_rasterizer_scanline_aa.h
index da166bb14aa..eade7833386 100644
--- a/chromium/third_party/pdfium/third_party/agg23/agg_rasterizer_scanline_aa.h
+++ b/chromium/third_party/pdfium/third_party/agg23/agg_rasterizer_scanline_aa.h
@@ -338,25 +338,43 @@ public:
                 const cell_aa* cur_cell = *cells;
                 int x    = cur_cell->x;
                 int area = cur_cell->area;
-                unsigned alpha;
-                cover += cur_cell->cover;
+                bool seen_area_overflow = false;
+                bool seen_cover_overflow = false;
+                if(!safe_add(&cover, cur_cell->cover)) {
+                    break;
+                }
                 while(--num_cells) {
                     cur_cell = *++cells;
                     if(cur_cell->x != x) {
                         break;
                     }
-                    area  += cur_cell->area;
-                    cover += cur_cell->cover;
+                    if(seen_area_overflow) {
+                        continue;
+                    }
+                    if(!safe_add(&area, cur_cell->area)) {
+                        seen_area_overflow = true;
+                        continue;
+                    }
+                    if(!safe_add(&cover, cur_cell->cover)) {
+                        seen_cover_overflow = true;
+                        break;
+                    }
+                }
+                if(seen_area_overflow) {
+                    continue;
+                }
+                if(seen_cover_overflow) {
+                    break;
                 }
                 if(area) {
-                    alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1) - area, no_smooth);
+                    unsigned alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1) - area, no_smooth);
                     if(alpha) {
                         sl.add_cell(x, alpha);
                     }
                     x++;
                 }
                 if(num_cells && cur_cell->x > x) {
-                    alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1), no_smooth);
+                    unsigned alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1), no_smooth);
                     if(alpha) {
                         sl.add_span(x, cur_cell->x - x, alpha);
                     }
@@ -458,12 +476,10 @@ private:
         m_prev_x = x;
         m_prev_y = y;
     }
-    static int calculate_area(int cover, int shift) {
-        unsigned int result = cover;
-        result <<= shift;
-        return result;
-    }
 private:
+    static int calculate_area(int cover, int shift);
+    static bool safe_add(int* op1, int op2);
+
     outline_aa     m_outline;
     filling_rule_e m_filling_rule;
     int            m_clipped_start_x;
diff --git a/chromium/third_party/pdfium/third_party/freetype/README.pdfium b/chromium/third_party/pdfium/third_party/freetype/README.pdfium
index 6fea13e4663..6a309b910e5 100644
--- a/chromium/third_party/pdfium/third_party/freetype/README.pdfium
+++ b/chromium/third_party/pdfium/third_party/freetype/README.pdfium
@@ -1,7 +1,7 @@
 Name: FreeType
 URL: http://www.freetype.org/
-Version: VER-2-10-1-4
-Revision: b110acba9e6f7e40314f0da5d249cb3cb3beeab8
+Version: VER-2-10-1-41
+Revision: 543a3b939df50e02e52b948f4c9c8ba63bf38059
 Security Critical: yes
 License: FreeType License (FTL)
 License File: FTL.TXT
diff --git a/chromium/third_party/pdfium/third_party/googletest/README.pdfium b/chromium/third_party/pdfium/third_party/googletest/README.pdfium
index c963971e0ef..bd2d36a68e4 100644
--- a/chromium/third_party/pdfium/third_party/googletest/README.pdfium
+++ b/chromium/third_party/pdfium/third_party/googletest/README.pdfium
@@ -1,7 +1,7 @@
 Name: Google Test: Google's C++ Testing Framework
 Short Name: googletest
 URL: https://github.com/google/googletest.git
-Version: 1.8.0.git-9997a830ee5589c2da79198bc3b60d1c47e50118
+Version: 1.8.0.git-a45c24ac1878932e0dc5fbc0d78a699befd386d3
 License: BSD
 License File: NOT_SHIPPED
 Security critical: no
diff --git a/chromium/third_party/pdfium/xfa/fde/cfde_texteditengine.cpp b/chromium/third_party/pdfium/xfa/fde/cfde_texteditengine.cpp
index e67b7d7f3f3..ca4091316b0 100644
--- a/chromium/third_party/pdfium/xfa/fde/cfde_texteditengine.cpp
+++ b/chromium/third_party/pdfium/xfa/fde/cfde_texteditengine.cpp
@@ -1116,19 +1116,17 @@ void CFDE_TextEditEngine::RebuildPieces() {
       const CFX_BreakPiece* piece = text_break_.GetBreakPieceUnstable(i);
 
       FDE_TEXTEDITPIECE txtEdtPiece;
-      memset(&txtEdtPiece, 0, sizeof(FDE_TEXTEDITPIECE));
-
-      txtEdtPiece.nBidiLevel = piece->m_iBidiLevel;
-      txtEdtPiece.nCount = piece->GetLength();
+      txtEdtPiece.rtPiece.left = piece->m_iStartPos / 20000.0f;
+      txtEdtPiece.rtPiece.top = current_line_start;
+      txtEdtPiece.rtPiece.width = piece->m_iWidth / 20000.0f;
+      txtEdtPiece.rtPiece.height = line_spacing_;
       txtEdtPiece.nStart = current_piece_start;
+      txtEdtPiece.nCount = piece->GetLength();
+      txtEdtPiece.nBidiLevel = piece->m_iBidiLevel;
       txtEdtPiece.dwCharStyles = piece->m_dwCharStyles;
       if (FX_IsOdd(piece->m_iBidiLevel))
         txtEdtPiece.dwCharStyles |= FX_TXTCHARSTYLE_OddBidiLevel;
 
-      txtEdtPiece.rtPiece.left = piece->m_iStartPos / 20000.0f;
-      txtEdtPiece.rtPiece.top = current_line_start;
-      txtEdtPiece.rtPiece.width = piece->m_iWidth / 20000.0f;
-      txtEdtPiece.rtPiece.height = line_spacing_;
       text_piece_info_.push_back(txtEdtPiece);
 
       if (initialized_bounding_box) {
diff --git a/chromium/third_party/pdfium/xfa/fde/cfde_textout.cpp b/chromium/third_party/pdfium/xfa/fde/cfde_textout.cpp
index 82ac53d16a8..39fcf20c575 100644
--- a/chromium/third_party/pdfium/xfa/fde/cfde_textout.cpp
+++ b/chromium/third_party/pdfium/xfa/fde/cfde_textout.cpp
@@ -82,6 +82,7 @@ bool CFDE_TextOut::DrawString(CFX_RenderDevice* device,
         CFX_Font* font;
 #if !defined(OS_WIN)
         FxFont.SetFace(pFxFont->GetFace());
+        FxFont.SetFontSpan(pFxFont->GetFontSpan());
         font = &FxFont;
 #else
         font = pFxFont;
@@ -104,6 +105,7 @@ bool CFDE_TextOut::DrawString(CFX_RenderDevice* device,
     CFX_Font* font;
 #if !defined(OS_WIN)
     FxFont.SetFace(pFxFont->GetFace());
+    FxFont.SetFontSpan(pFxFont->GetFontSpan());
     font = &FxFont;
 #else
     font = pFxFont;
@@ -113,10 +115,6 @@ bool CFDE_TextOut::DrawString(CFX_RenderDevice* device,
                                   color, FXTEXT_CLEARTYPE);
   }
 
-#if !defined(OS_WIN)
-  FxFont.SetFace(nullptr);
-#endif
-
   return bRet;
 }
 
@@ -295,7 +293,7 @@ void CFDE_TextOut::DrawLogicText(CFX_RenderDevice* device,
   CFX_RectF rtClip = m_Matrix.TransformRect(CFX_RectF());
   device->SaveState();
   if (rtClip.Width() > 0.0f && rtClip.Height() > 0.0f)
-    device->SetClip_Rect(rtClip);
+    device->SetClip_Rect(rtClip.GetOuterRect());
 
   for (auto& line : m_ttoLines) {
     int32_t iPieces = line.GetSize();
diff --git a/chromium/third_party/pdfium/xfa/fgas/BUILD.gn b/chromium/third_party/pdfium/xfa/fgas/BUILD.gn
index f11c990d684..e1d0a13bbfd 100644
--- a/chromium/third_party/pdfium/xfa/fgas/BUILD.gn
+++ b/chromium/third_party/pdfium/xfa/fgas/BUILD.gn
@@ -55,7 +55,7 @@ pdfium_unittest_source_set("unittests") {
   ]
   deps = [
     ":fgas",
-    "../../core/fpdfapi",
+    "../../core/fpdfapi/page",
     "../fxfa/parser",
   ]
   pdfium_root_dir = "../../"
diff --git a/chromium/third_party/pdfium/xfa/fgas/crt/cfgas_stringformatter_unittest.cpp b/chromium/third_party/pdfium/xfa/fgas/crt/cfgas_stringformatter_unittest.cpp
index f9bd450d925..8a9e60c3fe3 100644
--- a/chromium/third_party/pdfium/xfa/fgas/crt/cfgas_stringformatter_unittest.cpp
+++ b/chromium/third_party/pdfium/xfa/fgas/crt/cfgas_stringformatter_unittest.cpp
@@ -11,7 +11,7 @@
 #include <memory>
 
 #include "build/build_config.h"
-#include "core/fpdfapi/cpdf_modulemgr.h"
+#include "core/fpdfapi/page/cpdf_pagemodule.h"
 #include "testing/fx_string_testhelpers.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/base/ptr_util.h"
@@ -21,10 +21,10 @@ class CFGAS_StringFormatterTest : public testing::Test {
  public:
   CFGAS_StringFormatterTest() {
     SetTZ("UTC");
-    CPDF_ModuleMgr::Create();
+    CPDF_PageModule::Create();
   }
 
-  ~CFGAS_StringFormatterTest() override { CPDF_ModuleMgr::Destroy(); }
+  ~CFGAS_StringFormatterTest() override { CPDF_PageModule::Destroy(); }
 
   void TearDown() override {
     fmt_.reset();
diff --git a/chromium/third_party/pdfium/xfa/fgas/font/cfgas_gefont.cpp b/chromium/third_party/pdfium/xfa/fgas/font/cfgas_gefont.cpp
index 23c06623102..3f4c8869a01 100644
--- a/chromium/third_party/pdfium/xfa/fgas/font/cfgas_gefont.cpp
+++ b/chromium/third_party/pdfium/xfa/fgas/font/cfgas_gefont.cpp
@@ -37,11 +37,13 @@ RetainPtr<CFGAS_GEFont> CFGAS_GEFont::LoadFont(const wchar_t* pszFontFamily,
 }
 
 // static
-RetainPtr<CFGAS_GEFont> CFGAS_GEFont::LoadFont(CPDF_Font* pPDFFont,
-                                               CFGAS_FontMgr* pFontMgr) {
+RetainPtr<CFGAS_GEFont> CFGAS_GEFont::LoadFont(
+    const RetainPtr<CPDF_Font>& pPDFFont,
+    CFGAS_FontMgr* pFontMgr) {
   auto pFont = pdfium::MakeRetain<CFGAS_GEFont>(pFontMgr);
-  if (!pFont->LoadFontInternal(pPDFFont->GetFont()))
+  if (!pFont->LoadFontInternal(pPDFFont))
     return nullptr;
+
   return pFont;
 }
 
@@ -55,6 +57,16 @@ RetainPtr<CFGAS_GEFont> CFGAS_GEFont::LoadFont(
   return pFont;
 }
 
+// static
+RetainPtr<CFGAS_GEFont> CFGAS_GEFont::LoadStockFont(
+    CPDF_Document* pDoc,
+    CFGAS_FontMgr* pMgr,
+    const ByteString& font_family) {
+  RetainPtr<CPDF_Font> stock_font =
+      CPDF_Font::GetStockFont(pDoc, font_family.AsStringView());
+  return stock_font ? CFGAS_GEFont::LoadFont(stock_font, pMgr) : nullptr;
+}
+
 CFGAS_GEFont::CFGAS_GEFont(CFGAS_FontMgr* pFontMgr) : m_pFontMgr(pFontMgr) {}
 
 CFGAS_GEFont::~CFGAS_GEFont() = default;
@@ -85,12 +97,17 @@ bool CFGAS_GEFont::LoadFontInternal(const wchar_t* pszFontFamily,
 }
 #endif  // defined(OS_WIN)
 
-bool CFGAS_GEFont::LoadFontInternal(CFX_Font* pExternalFont) {
+bool CFGAS_GEFont::LoadFontInternal(const RetainPtr<CPDF_Font>& pPDFFont) {
+  CFX_Font* pExternalFont = pPDFFont->GetFont();
   if (m_pFont || !pExternalFont)
     return false;
 
   m_pFont = pExternalFont;
-  return InitFont();
+  if (!InitFont())
+    return false;
+
+  m_pPDFFont = pPDFFont;  // Keep pPDFFont alive for the duration.
+  return true;
 }
 
 bool CFGAS_GEFont::LoadFontInternal(std::unique_ptr<CFX_Font> pInternalFont) {
@@ -131,8 +148,6 @@ uint32_t CFGAS_GEFont::GetFontStyles() const {
   if (pSubstFont) {
     if (pSubstFont->m_Weight == FXFONT_FW_BOLD)
       dwStyles |= FXFONT_BOLD;
-    if (pSubstFont->m_bFlagItalic)
-      dwStyles |= FXFONT_ITALIC;
   } else {
     if (m_pFont->IsBold())
       dwStyles |= FXFONT_BOLD;
diff --git a/chromium/third_party/pdfium/xfa/fgas/font/cfgas_gefont.h b/chromium/third_party/pdfium/xfa/fgas/font/cfgas_gefont.h
index 30c439529c3..7e021e12e64 100644
--- a/chromium/third_party/pdfium/xfa/fgas/font/cfgas_gefont.h
+++ b/chromium/third_party/pdfium/xfa/fgas/font/cfgas_gefont.h
@@ -22,6 +22,7 @@
 
 class CFX_Font;
 class CFX_UnicodeEncodingEx;
+class CPDF_Document;
 class CPDF_Font;
 
 class CFGAS_GEFont final : public Retainable {
@@ -33,12 +34,16 @@ class CFGAS_GEFont final : public Retainable {
                                           uint32_t dwFontStyles,
                                           uint16_t wCodePage,
                                           CFGAS_FontMgr* pFontMgr);
-  static RetainPtr<CFGAS_GEFont> LoadFont(CPDF_Font* pPDFFont,
+  static RetainPtr<CFGAS_GEFont> LoadFont(const RetainPtr<CPDF_Font>& pPDFFont,
                                           CFGAS_FontMgr* pFontMgr);
   static RetainPtr<CFGAS_GEFont> LoadFont(
       std::unique_ptr<CFX_Font> pInternalFont,
       CFGAS_FontMgr* pFontMgr);
 
+  static RetainPtr<CFGAS_GEFont> LoadStockFont(CPDF_Document* pDoc,
+                                               CFGAS_FontMgr* pMgr,
+                                               const ByteString& font_family);
+
   uint32_t GetFontStyles() const;
   bool GetCharWidth(wchar_t wUnicode, int32_t* pWidth);
   int32_t GetGlyphIndex(wchar_t wUnicode);
@@ -66,7 +71,7 @@ class CFGAS_GEFont final : public Retainable {
   bool LoadFontInternal(const uint8_t* pBuffer, int32_t length);
 #endif
   bool LoadFontInternal(std::unique_ptr<CFX_Font> pInternalFont);
-  bool LoadFontInternal(CFX_Font* pExternalFont);
+  bool LoadFontInternal(const RetainPtr<CPDF_Font>& pPDFFont);
   bool InitFont();
   std::pair<int32_t, RetainPtr<CFGAS_GEFont>> GetGlyphIndexAndFont(
       wchar_t wUnicode,
@@ -74,7 +79,8 @@ class CFGAS_GEFont final : public Retainable {
   WideString GetFamilyName() const;
 
   Optional<uint32_t> m_dwLogFontStyle;
-  MaybeOwned<CFX_Font> m_pFont;  // Must come before |m_pFontEncoding|.
+  RetainPtr<CPDF_Font> m_pPDFFont;  // Must come before |m_pFont|.
+  MaybeOwned<CFX_Font> m_pFont;     // Must come before |m_pFontEncoding|.
   ObservedPtr<CFGAS_FontMgr> const m_pFontMgr;
   std::unique_ptr<CFX_UnicodeEncodingEx> m_pFontEncoding;
   std::map<wchar_t, int32_t> m_CharWidthMap;
diff --git a/chromium/third_party/pdfium/xfa/fgas/font/cfgas_pdffontmgr.cpp b/chromium/third_party/pdfium/xfa/fgas/font/cfgas_pdffontmgr.cpp
index 4cdaffa0f9d..e020007e131 100644
--- a/chromium/third_party/pdfium/xfa/fgas/font/cfgas_pdffontmgr.cpp
+++ b/chromium/third_party/pdfium/xfa/fgas/font/cfgas_pdffontmgr.cpp
@@ -51,6 +51,7 @@ RetainPtr<CFGAS_GEFont> CFGAS_PDFFontMgr::FindFont(const ByteString& strPsName,
   ByteString name = strPsName;
   name.Remove(' ');
 
+  auto* pData = CPDF_DocPageData::FromDocument(m_pDoc.Get());
   CPDF_DictionaryLocker locker(pFontSetDict);
   for (const auto& it : locker) {
     const ByteString& key = it.first;
@@ -63,12 +64,8 @@ RetainPtr<CFGAS_GEFont> CFGAS_PDFFontMgr::FindFont(const ByteString& strPsName,
     if (!pFontDict || pFontDict->GetStringFor("Type") != "Font")
       return nullptr;
 
-    auto* pData = CPDF_DocPageData::FromDocument(m_pDoc.Get());
-    CPDF_Font* pPDFFont = pData->GetFont(pFontDict);
-    if (!pPDFFont)
-      return nullptr;
-
-    if (!pPDFFont->IsEmbedded())
+    RetainPtr<CPDF_Font> pPDFFont = pData->GetFont(pFontDict);
+    if (!pPDFFont || !pPDFFont->IsEmbedded())
       return nullptr;
 
     return CFGAS_GEFont::LoadFont(pPDFFont, m_pFontMgr.Get());
diff --git a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_break.cpp b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_break.cpp
index 640ef1db569..46a854d4622 100644
--- a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_break.cpp
+++ b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_break.cpp
@@ -17,16 +17,14 @@ const float CFX_Break::kConversionFactor = 20000.0f;
 const int CFX_Break::kMinimumTabWidth = 160000;
 
 CFX_Break::CFX_Break(uint32_t dwLayoutStyles)
-    : m_dwLayoutStyles(dwLayoutStyles) {
-  m_pCurLine = &m_Line[0];
-}
+    : m_dwLayoutStyles(dwLayoutStyles), m_pCurLine(&m_Lines[0]) {}
 
 CFX_Break::~CFX_Break() = default;
 
 void CFX_Break::Reset() {
   m_eCharType = FX_CHARTYPE::kUnknown;
-  m_Line[0].Clear();
-  m_Line[1].Clear();
+  for (CFX_BreakLine& line : m_Lines)
+    line.Clear();
 }
 
 void CFX_Break::SetLayoutStyles(uint32_t dwLayoutStyles) {
@@ -169,20 +167,20 @@ CFX_Char* CFX_Break::GetLastChar(int32_t index,
 
 int32_t CFX_Break::CountBreakPieces() const {
   return HasLine() ? pdfium::CollectionSize<int32_t>(
-                         m_Line[m_iReadyLineIndex].m_LinePieces)
+                         m_Lines[m_iReadyLineIndex].m_LinePieces)
                    : 0;
 }
 
 const CFX_BreakPiece* CFX_Break::GetBreakPieceUnstable(int32_t index) const {
   if (!HasLine())
     return nullptr;
-  if (!pdfium::IndexInBounds(m_Line[m_iReadyLineIndex].m_LinePieces, index))
+  if (!pdfium::IndexInBounds(m_Lines[m_iReadyLineIndex].m_LinePieces, index))
     return nullptr;
-  return &m_Line[m_iReadyLineIndex].m_LinePieces[index];
+  return &m_Lines[m_iReadyLineIndex].m_LinePieces[index];
 }
 
 void CFX_Break::ClearBreakPieces() {
   if (HasLine())
-    m_Line[m_iReadyLineIndex].Clear();
+    m_Lines[m_iReadyLineIndex].Clear();
   m_iReadyLineIndex = -1;
 }
diff --git a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_break.h b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_break.h
index 44e5678c431..c611abfa0bf 100644
--- a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_break.h
+++ b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_break.h
@@ -92,7 +92,7 @@ class CFX_Break {
   RetainPtr<CFGAS_GEFont> m_pFont;
   UnownedPtr<CFX_BreakLine> m_pCurLine;
   int8_t m_iReadyLineIndex = -1;
-  CFX_BreakLine m_Line[2];
+  CFX_BreakLine m_Lines[2];
 
  private:
   void FontChanged();
diff --git a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_breakline.cpp b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_breakline.cpp
index 82e12d89659..02203c91cf1 100644
--- a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_breakline.cpp
+++ b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_breakline.cpp
@@ -8,9 +8,9 @@
 
 #include "third_party/base/stl_util.h"
 
-CFX_BreakLine::CFX_BreakLine() : m_iStart(0), m_iWidth(0), m_iArabicChars(0) {}
+CFX_BreakLine::CFX_BreakLine() = default;
 
-CFX_BreakLine::~CFX_BreakLine() {}
+CFX_BreakLine::~CFX_BreakLine() = default;
 
 CFX_Char* CFX_BreakLine::GetChar(int32_t index) {
   ASSERT(pdfium::IndexInBounds(m_LineChars, index));
@@ -27,3 +27,12 @@ void CFX_BreakLine::Clear() {
   m_iWidth = 0;
   m_iArabicChars = 0;
 }
+
+void CFX_BreakLine::IncrementArabicCharCount() {
+  ++m_iArabicChars;
+}
+
+void CFX_BreakLine::DecrementArabicCharCount() {
+  ASSERT(m_iArabicChars > 0);
+  --m_iArabicChars;
+}
diff --git a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_breakline.h b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_breakline.h
index e7635a5a5d3..c432b35ce29 100644
--- a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_breakline.h
+++ b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_breakline.h
@@ -22,11 +22,17 @@ class CFX_BreakLine {
 
   void Clear();
 
+  void IncrementArabicCharCount();
+  void DecrementArabicCharCount();
+  bool HasArabicChar() const { return m_iArabicChars > 0; }
+
   std::vector<CFX_Char> m_LineChars;
   std::vector<CFX_BreakPiece> m_LinePieces;
-  int32_t m_iStart;
-  int32_t m_iWidth;
-  int32_t m_iArabicChars;
+  int32_t m_iStart = 0;
+  int32_t m_iWidth = 0;
+
+ private:
+  int32_t m_iArabicChars = 0;
 };
 
 #endif  // XFA_FGAS_LAYOUT_CFX_BREAKLINE_H_
diff --git a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_rtfbreak.cpp b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_rtfbreak.cpp
index 81f0e1cb1d2..2a09810bb09 100644
--- a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_rtfbreak.cpp
+++ b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_rtfbreak.cpp
@@ -199,6 +199,8 @@ CFX_BreakType CFX_RTFBreak::AppendChar_Control(CFX_Char* pCurChar) {
 }
 
 CFX_BreakType CFX_RTFBreak::AppendChar_Arabic(CFX_Char* pCurChar) {
+  m_pCurLine->IncrementArabicCharCount();
+
   CFX_Char* pLastChar = nullptr;
   wchar_t wForm;
   bool bAlef = false;
@@ -264,7 +266,6 @@ CFX_BreakType CFX_RTFBreak::AppendChar_Arabic(CFX_Char* pCurChar) {
     return CFX_BreakType::None;
 
   m_pCurLine->m_iWidth = checked_width.ValueOrDie();
-  m_pCurLine->m_iArabicChars++;
 
   if (IsGreaterThanLineWidth(m_pCurLine->GetLineEnd()))
     return EndBreak(CFX_BreakType::Line);
@@ -313,12 +314,12 @@ CFX_BreakType CFX_RTFBreak::EndBreak(CFX_BreakType dwStatus) {
   }
 
   if (HasLine()) {
-    if (!m_Line[m_iReadyLineIndex].m_LinePieces.empty()) {
-      if (dwStatus != CFX_BreakType::Piece)
-        m_Line[m_iReadyLineIndex].m_LinePieces.back().m_dwStatus = dwStatus;
-      return m_Line[m_iReadyLineIndex].m_LinePieces.back().m_dwStatus;
-    }
-    return CFX_BreakType::None;
+    if (m_Lines[m_iReadyLineIndex].m_LinePieces.empty())
+      return CFX_BreakType::None;
+
+    if (dwStatus != CFX_BreakType::Piece)
+      m_Lines[m_iReadyLineIndex].m_LinePieces.back().m_dwStatus = dwStatus;
+    return m_Lines[m_iReadyLineIndex].m_LinePieces.back().m_dwStatus;
   }
 
   if (m_pCurLine->m_LineChars.empty())
@@ -329,8 +330,8 @@ CFX_BreakType CFX_RTFBreak::EndBreak(CFX_BreakType dwStatus) {
   if (dwStatus == CFX_BreakType::Piece)
     return dwStatus;
 
-  m_iReadyLineIndex = m_pCurLine == &m_Line[0] ? 0 : 1;
-  CFX_BreakLine* pNextLine = &m_Line[1 - m_iReadyLineIndex];
+  m_iReadyLineIndex = m_pCurLine == &m_Lines[0] ? 0 : 1;
+  CFX_BreakLine* pNextLine = &m_Lines[1 - m_iReadyLineIndex];
   bool bAllChars = m_iAlignment == CFX_RTFLineAlignment::Justified ||
                    m_iAlignment == CFX_RTFLineAlignment::Distributed;
 
@@ -422,7 +423,7 @@ void CFX_RTFBreak::EndBreak_BidiLine(std::deque<FX_TPO>* tpos,
                                      CFX_BreakType dwStatus) {
   CFX_Char* pTC;
   std::vector<CFX_Char>& chars = m_pCurLine->m_LineChars;
-  if (!m_bPagination && m_pCurLine->m_iArabicChars > 0) {
+  if (!m_bPagination && m_pCurLine->HasArabicChar()) {
     size_t iBidiNum = 0;
     for (size_t i = 0; i < m_pCurLine->m_LineChars.size(); ++i) {
       pTC = &chars[i];
@@ -713,8 +714,8 @@ void CFX_RTFBreak::SplitTextLine(CFX_BreakLine* pCurLine,
 
   for (size_t i = 0; i < pNextLine->m_LineChars.size(); ++i) {
     if (pNextLine->m_LineChars[i].GetCharType() >= FX_CHARTYPE::kArabicAlef) {
-      pCurLine->m_iArabicChars--;
-      pNextLine->m_iArabicChars++;
+      pCurLine->DecrementArabicCharCount();
+      pNextLine->IncrementArabicCharCount();
     }
     pNextLine->m_LineChars[i].m_dwStatus = CFX_BreakType::None;
   }
diff --git a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_rtfbreak_unittest.cpp b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_rtfbreak_unittest.cpp
index decf2e5f7c7..0775d7bb592 100644
--- a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_rtfbreak_unittest.cpp
+++ b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_rtfbreak_unittest.cpp
@@ -26,10 +26,10 @@ class CFX_RTFBreakTest : public testing::Test {
     ASSERT_TRUE(font_.Get());
   }
 
-  std::unique_ptr<CFX_RTFBreak> CreateBreak(int32_t args) {
-    auto b = pdfium::MakeUnique<CFX_RTFBreak>(args);
-    b->SetFont(font_);
-    return b;
+  std::unique_ptr<CFX_RTFBreak> CreateBreak(uint32_t layout_styles) {
+    auto rtf_break = pdfium::MakeUnique<CFX_RTFBreak>(layout_styles);
+    rtf_break->SetFont(font_);
+    return rtf_break;
   }
 
  private:
@@ -40,40 +40,41 @@ class CFX_RTFBreakTest : public testing::Test {
 // and must be consumed before you get any more characters ....
 
 TEST_F(CFX_RTFBreakTest, AddChars) {
-  auto b = CreateBreak(FX_LAYOUTSTYLE_ExpandTab);
+  auto rtf_break = CreateBreak(FX_LAYOUTSTYLE_ExpandTab);
 
   WideString str(L"Input String.");
-  for (const auto& c : str)
-    EXPECT_EQ(CFX_BreakType::None, b->AppendChar(c));
+  for (wchar_t ch : str)
+    EXPECT_EQ(CFX_BreakType::None, rtf_break->AppendChar(ch));
 
-  EXPECT_EQ(CFX_BreakType::Paragraph, b->AppendChar(L'\n'));
-  ASSERT_EQ(1, b->CountBreakPieces());
-  EXPECT_EQ(str + L"\n", b->GetBreakPieceUnstable(0)->GetString());
+  EXPECT_EQ(CFX_BreakType::Paragraph, rtf_break->AppendChar(L'\n'));
+  ASSERT_EQ(1, rtf_break->CountBreakPieces());
+  EXPECT_EQ(str + L"\n", rtf_break->GetBreakPieceUnstable(0)->GetString());
 
-  b->ClearBreakPieces();
-  b->Reset();
-  EXPECT_EQ(0, b->GetCurrentLineForTesting()->GetLineEnd());
+  rtf_break->ClearBreakPieces();
+  rtf_break->Reset();
+  EXPECT_EQ(0, rtf_break->GetCurrentLineForTesting()->GetLineEnd());
 
   str = L"Second str.";
-  for (const auto& c : str)
-    EXPECT_EQ(CFX_BreakType::None, b->AppendChar(c));
+  for (wchar_t ch : str)
+    EXPECT_EQ(CFX_BreakType::None, rtf_break->AppendChar(ch));
 
   // Force the end of the break at the end of the string.
-  b->EndBreak(CFX_BreakType::Paragraph);
-  ASSERT_EQ(1, b->CountBreakPieces());
-  EXPECT_EQ(str, b->GetBreakPieceUnstable(0)->GetString());
+  rtf_break->EndBreak(CFX_BreakType::Paragraph);
+  ASSERT_EQ(1, rtf_break->CountBreakPieces());
+  EXPECT_EQ(str, rtf_break->GetBreakPieceUnstable(0)->GetString());
 }
 
 TEST_F(CFX_RTFBreakTest, ControlCharacters) {
-  auto b = CreateBreak(FX_LAYOUTSTYLE_ExpandTab);
-  EXPECT_EQ(CFX_BreakType::Line, b->AppendChar(L'\v'));
-  EXPECT_EQ(CFX_BreakType::Page, b->AppendChar(L'\f'));
-  // 0x2029 is the Paragraph Separator unicode character.
-  EXPECT_EQ(CFX_BreakType::Paragraph, b->AppendChar(0x2029));
-  EXPECT_EQ(CFX_BreakType::Paragraph, b->AppendChar(L'\n'));
-
-  ASSERT_EQ(1, b->CountBreakPieces());
-  EXPECT_EQ(L"\v", b->GetBreakPieceUnstable(0)->GetString());
+  auto rtf_break = CreateBreak(FX_LAYOUTSTYLE_ExpandTab);
+  EXPECT_EQ(CFX_BreakType::Line, rtf_break->AppendChar(L'\v'));
+  EXPECT_EQ(CFX_BreakType::Page, rtf_break->AppendChar(L'\f'));
+  const wchar_t kUnicodeParagraphSeparator = 0x2029;
+  EXPECT_EQ(CFX_BreakType::Paragraph,
+            rtf_break->AppendChar(kUnicodeParagraphSeparator));
+  EXPECT_EQ(CFX_BreakType::Paragraph, rtf_break->AppendChar(L'\n'));
+
+  ASSERT_EQ(1, rtf_break->CountBreakPieces());
+  EXPECT_EQ(L"\v", rtf_break->GetBreakPieceUnstable(0)->GetString());
 }
 
 TEST_F(CFX_RTFBreakTest, BidiLine) {
@@ -82,10 +83,11 @@ TEST_F(CFX_RTFBreakTest, BidiLine) {
   rtf_break->SetFontSize(12);
 
   WideString input = WideString::FromUTF8(ByteStringView("\xa\x0\xa\xa", 4));
-  for (auto& ch : input)
+  for (wchar_t ch : input)
     rtf_break->AppendChar(ch);
 
-  auto chars = rtf_break->GetCurrentLineForTesting()->m_LineChars;
+  std::vector<CFX_Char> chars =
+      rtf_break->GetCurrentLineForTesting()->m_LineChars;
   CFX_Char::BidiLine(&chars, chars.size());
   EXPECT_EQ(3u, chars.size());
 }
diff --git a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_txtbreak.cpp b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_txtbreak.cpp
index ce722ed9e59..b347ec7bb0d 100644
--- a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_txtbreak.cpp
+++ b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_txtbreak.cpp
@@ -186,7 +186,7 @@ CFX_BreakType CFX_TxtBreak::AppendChar_Arabic(CFX_Char* pCurChar) {
   pCurChar->m_iCharWidth = iCharWidthValid;
   iLineWidth += iCharWidthValid;
 
-  m_pCurLine->m_iArabicChars++;
+  m_pCurLine->IncrementArabicCharCount();
   if (!m_bSingleLine && IsGreaterThanLineWidth(iLineWidth))
     return EndBreak(CFX_BreakType::Line);
   return CFX_BreakType::None;
@@ -316,101 +316,99 @@ void CFX_TxtBreak::EndBreak_BidiLine(std::deque<FX_TPO>* tpos,
   FX_TPO tpo;
   CFX_Char* pTC;
   std::vector<CFX_Char>& chars = m_pCurLine->m_LineChars;
-  bool bDone = m_pCurLine->m_iArabicChars > 0;
-  if (bDone) {
-    size_t iBidiNum = 0;
-    for (size_t i = 0; i < m_pCurLine->m_LineChars.size(); ++i) {
-      pTC = &chars[i];
-      pTC->m_iBidiPos = static_cast<int32_t>(i);
-      if (pTC->GetCharType() != FX_CHARTYPE::kControl)
-        iBidiNum = i;
-      if (i == 0)
-        pTC->m_iBidiLevel = 1;
-    }
-    CFX_Char::BidiLine(&chars, iBidiNum + 1);
-  }
-
-  if (bDone) {
-    tp.m_dwStatus = CFX_BreakType::Piece;
+  if (!m_pCurLine->HasArabicChar()) {
+    tp.m_dwStatus = dwStatus;
     tp.m_iStartPos = m_pCurLine->m_iStart;
+    tp.m_iWidth = m_pCurLine->m_iWidth;
+    tp.m_iStartChar = 0;
+    tp.m_iChars = m_pCurLine->m_LineChars.size();
     tp.m_pChars = &m_pCurLine->m_LineChars;
-    int32_t iBidiLevel = -1;
-    int32_t iCharWidth;
-    int32_t i = 0;
-    int32_t j = -1;
-    int32_t iCount = pdfium::CollectionSize<int32_t>(m_pCurLine->m_LineChars);
-    while (i < iCount) {
-      pTC = &chars[i];
-      if (iBidiLevel < 0) {
-        iBidiLevel = pTC->m_iBidiLevel;
-        tp.m_iWidth = 0;
-        tp.m_iBidiLevel = iBidiLevel;
-        tp.m_iBidiPos = pTC->m_iBidiOrder;
-        tp.m_dwCharStyles = pTC->m_dwCharStyles;
-        tp.m_iHorizontalScale = pTC->horizonal_scale();
-        tp.m_iVerticalScale = pTC->vertical_scale();
-        tp.m_dwStatus = CFX_BreakType::Piece;
-      }
-      if (iBidiLevel != pTC->m_iBidiLevel ||
-          pTC->m_dwStatus != CFX_BreakType::None) {
-        if (iBidiLevel == pTC->m_iBidiLevel) {
-          tp.m_dwStatus = pTC->m_dwStatus;
-          iCharWidth = pTC->m_iCharWidth;
-          if (iCharWidth > 0)
-            tp.m_iWidth += iCharWidth;
-
-          i++;
-        }
-        tp.m_iChars = i - tp.m_iStartChar;
-        m_pCurLine->m_LinePieces.push_back(tp);
-        tp.m_iStartPos += tp.m_iWidth;
-        tp.m_iStartChar = i;
-        tpo.index = ++j;
-        tpo.pos = tp.m_iBidiPos;
-        tpos->push_back(tpo);
-        iBidiLevel = -1;
-      } else {
+    pTC = &chars[0];
+    tp.m_dwCharStyles = pTC->m_dwCharStyles;
+    tp.m_iHorizontalScale = pTC->horizonal_scale();
+    tp.m_iVerticalScale = pTC->vertical_scale();
+    m_pCurLine->m_LinePieces.push_back(tp);
+    tpos->push_back({0, 0});
+    return;
+  }
+
+  size_t iBidiNum = 0;
+  for (size_t i = 0; i < m_pCurLine->m_LineChars.size(); ++i) {
+    pTC = &chars[i];
+    pTC->m_iBidiPos = static_cast<int32_t>(i);
+    if (pTC->GetCharType() != FX_CHARTYPE::kControl)
+      iBidiNum = i;
+    if (i == 0)
+      pTC->m_iBidiLevel = 1;
+  }
+  CFX_Char::BidiLine(&chars, iBidiNum + 1);
+
+  tp.m_dwStatus = CFX_BreakType::Piece;
+  tp.m_iStartPos = m_pCurLine->m_iStart;
+  tp.m_pChars = &m_pCurLine->m_LineChars;
+  int32_t iBidiLevel = -1;
+  int32_t iCharWidth;
+  int32_t i = 0;
+  int32_t j = -1;
+  int32_t iCount = pdfium::CollectionSize<int32_t>(m_pCurLine->m_LineChars);
+  while (i < iCount) {
+    pTC = &chars[i];
+    if (iBidiLevel < 0) {
+      iBidiLevel = pTC->m_iBidiLevel;
+      tp.m_iWidth = 0;
+      tp.m_iBidiLevel = iBidiLevel;
+      tp.m_iBidiPos = pTC->m_iBidiOrder;
+      tp.m_dwCharStyles = pTC->m_dwCharStyles;
+      tp.m_iHorizontalScale = pTC->horizonal_scale();
+      tp.m_iVerticalScale = pTC->vertical_scale();
+      tp.m_dwStatus = CFX_BreakType::Piece;
+    }
+    if (iBidiLevel != pTC->m_iBidiLevel ||
+        pTC->m_dwStatus != CFX_BreakType::None) {
+      if (iBidiLevel == pTC->m_iBidiLevel) {
+        tp.m_dwStatus = pTC->m_dwStatus;
         iCharWidth = pTC->m_iCharWidth;
         if (iCharWidth > 0)
           tp.m_iWidth += iCharWidth;
 
         i++;
       }
-    }
-    if (i > tp.m_iStartChar) {
-      tp.m_dwStatus = dwStatus;
       tp.m_iChars = i - tp.m_iStartChar;
       m_pCurLine->m_LinePieces.push_back(tp);
+      tp.m_iStartPos += tp.m_iWidth;
+      tp.m_iStartChar = i;
       tpo.index = ++j;
       tpo.pos = tp.m_iBidiPos;
       tpos->push_back(tpo);
+      iBidiLevel = -1;
+    } else {
+      iCharWidth = pTC->m_iCharWidth;
+      if (iCharWidth > 0)
+        tp.m_iWidth += iCharWidth;
+
+      i++;
     }
-    if (j > -1) {
-      if (j > 0) {
-        std::sort(tpos->begin(), tpos->end());
-        int32_t iStartPos = 0;
-        for (i = 0; i <= j; i++) {
-          tpo = (*tpos)[i];
-          CFX_BreakPiece& ttp = m_pCurLine->m_LinePieces[tpo.index];
-          ttp.m_iStartPos = iStartPos;
-          iStartPos += ttp.m_iWidth;
-        }
-      }
-      m_pCurLine->m_LinePieces[j].m_dwStatus = dwStatus;
-    }
-  } else {
+  }
+  if (i > tp.m_iStartChar) {
     tp.m_dwStatus = dwStatus;
-    tp.m_iStartPos = m_pCurLine->m_iStart;
-    tp.m_iWidth = m_pCurLine->m_iWidth;
-    tp.m_iStartChar = 0;
-    tp.m_iChars = m_pCurLine->m_LineChars.size();
-    tp.m_pChars = &m_pCurLine->m_LineChars;
-    pTC = &chars[0];
-    tp.m_dwCharStyles = pTC->m_dwCharStyles;
-    tp.m_iHorizontalScale = pTC->horizonal_scale();
-    tp.m_iVerticalScale = pTC->vertical_scale();
+    tp.m_iChars = i - tp.m_iStartChar;
     m_pCurLine->m_LinePieces.push_back(tp);
-    tpos->push_back({0, 0});
+    tpo.index = ++j;
+    tpo.pos = tp.m_iBidiPos;
+    tpos->push_back(tpo);
+  }
+  if (j > -1) {
+    if (j > 0) {
+      std::sort(tpos->begin(), tpos->end());
+      int32_t iStartPos = 0;
+      for (i = 0; i <= j; i++) {
+        tpo = (*tpos)[i];
+        CFX_BreakPiece& ttp = m_pCurLine->m_LinePieces[tpo.index];
+        ttp.m_iStartPos = iStartPos;
+        iStartPos += ttp.m_iWidth;
+      }
+    }
+    m_pCurLine->m_LinePieces[j].m_dwStatus = dwStatus;
   }
 }
 
@@ -496,12 +494,12 @@ CFX_BreakType CFX_TxtBreak::EndBreak(CFX_BreakType dwStatus) {
   }
 
   if (HasLine()) {
-    if (!m_Line[m_iReadyLineIndex].m_LinePieces.empty()) {
-      if (dwStatus != CFX_BreakType::Piece)
-        m_Line[m_iReadyLineIndex].m_LinePieces.back().m_dwStatus = dwStatus;
-      return m_Line[m_iReadyLineIndex].m_LinePieces.back().m_dwStatus;
-    }
-    return CFX_BreakType::None;
+    if (m_Lines[m_iReadyLineIndex].m_LinePieces.empty())
+      return CFX_BreakType::None;
+
+    if (dwStatus != CFX_BreakType::Piece)
+      m_Lines[m_iReadyLineIndex].m_LinePieces.back().m_dwStatus = dwStatus;
+    return m_Lines[m_iReadyLineIndex].m_LinePieces.back().m_dwStatus;
   }
 
   if (m_pCurLine->m_LineChars.empty())
@@ -511,8 +509,8 @@ CFX_BreakType CFX_TxtBreak::EndBreak(CFX_BreakType dwStatus) {
   if (dwStatus == CFX_BreakType::Piece)
     return dwStatus;
 
-  m_iReadyLineIndex = m_pCurLine == &m_Line[0] ? 0 : 1;
-  CFX_BreakLine* pNextLine = &m_Line[1 - m_iReadyLineIndex];
+  m_iReadyLineIndex = m_pCurLine == &m_Lines[0] ? 0 : 1;
+  CFX_BreakLine* pNextLine = &m_Lines[1 - m_iReadyLineIndex];
   bool bAllChars = m_iAlignment > CFX_TxtLineAlignment_Right;
   if (!EndBreak_SplitLine(pNextLine, bAllChars)) {
     std::deque<FX_TPO> tpos;
@@ -645,8 +643,8 @@ void CFX_TxtBreak::SplitTextLine(CFX_BreakLine* pCurLine,
   int32_t iWidth = 0;
   for (size_t i = 0; i < pNextLine->m_LineChars.size(); ++i) {
     if (pNextLine->m_LineChars[i].GetCharType() >= FX_CHARTYPE::kArabicAlef) {
-      pCurLine->m_iArabicChars--;
-      pNextLine->m_iArabicChars++;
+      pCurLine->DecrementArabicCharCount();
+      pNextLine->IncrementArabicCharCount();
     }
     iWidth += std::max(0, pNextLine->m_LineChars[i].m_iCharWidth);
     pNextLine->m_LineChars[i].m_dwStatus = CFX_BreakType::None;
diff --git a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_txtbreak_unittest.cpp b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_txtbreak_unittest.cpp
index ca8c363bb4e..a3ae2074379 100644
--- a/chromium/third_party/pdfium/xfa/fgas/layout/cfx_txtbreak_unittest.cpp
+++ b/chromium/third_party/pdfium/xfa/fgas/layout/cfx_txtbreak_unittest.cpp
@@ -24,9 +24,9 @@ class CFX_TxtBreakTest : public testing::Test {
   }
 
   std::unique_ptr<CFX_TxtBreak> CreateBreak() {
-    auto b = pdfium::MakeUnique<CFX_TxtBreak>();
-    b->SetFont(font_);
-    return b;
+    auto txt_break = pdfium::MakeUnique<CFX_TxtBreak>();
+    txt_break->SetFont(font_);
+    return txt_break;
   }
 
  private:
@@ -39,10 +39,11 @@ TEST_F(CFX_TxtBreakTest, BidiLine) {
   txt_break->SetFontSize(12);
 
   WideString input = WideString::FromUTF8(ByteStringView("\xa\x0\xa\xa", 4));
-  for (auto& ch : input)
+  for (wchar_t ch : input)
     txt_break->AppendChar(ch);
 
-  auto chars = txt_break->GetCurrentLineForTesting()->m_LineChars;
+  std::vector<CFX_Char> chars =
+      txt_break->GetCurrentLineForTesting()->m_LineChars;
   CFX_Char::BidiLine(&chars, chars.size());
   EXPECT_EQ(3u, chars.size());
 }
diff --git a/chromium/third_party/pdfium/xfa/fwl/BUILD.gn b/chromium/third_party/pdfium/xfa/fwl/BUILD.gn
index a30ba5e26ff..f39250210b4 100644
--- a/chromium/third_party/pdfium/xfa/fwl/BUILD.gn
+++ b/chromium/third_party/pdfium/xfa/fwl/BUILD.gn
@@ -74,10 +74,6 @@ jumbo_source_set("fwl") {
     "cfwl_themepart.cpp",
     "cfwl_themepart.h",
     "cfwl_themetext.h",
-    "cfwl_timer.cpp",
-    "cfwl_timer.h",
-    "cfwl_timerinfo.cpp",
-    "cfwl_timerinfo.h",
     "cfwl_widget.cpp",
     "cfwl_widget.h",
     "cfwl_widgetmgr.cpp",
@@ -88,7 +84,6 @@ jumbo_source_set("fwl") {
     "cfx_barcode.h",
     "fwl_widgetdef.h",
     "fwl_widgethit.h",
-    "ifwl_adaptertimermgr.h",
     "ifwl_themeprovider.h",
     "ifwl_widgetdelegate.h",
     "theme/cfwl_barcodetp.cpp",
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_app.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_app.h
index 3bac5bd4b77..a911ab2a171 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_app.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_app.h
@@ -10,12 +10,11 @@
 #include <memory>
 
 #include "core/fxcrt/fx_string.h"
+#include "core/fxcrt/timerhandler_iface.h"
 #include "xfa/fwl/cfwl_widgetmgr.h"
 
 class CFWL_NoteDriver;
 class CFWL_WidgetMgr;
-class CFWL_Widget;
-class IFWL_AdapterTimerMgr;
 
 enum FWL_KeyFlag {
   FWL_KEYFLAG_Ctrl = 1 << 0,
@@ -31,9 +30,9 @@ class CFWL_App {
  public:
   class AdapterIface {
    public:
-    virtual ~AdapterIface() {}
+    virtual ~AdapterIface() = default;
     virtual CFWL_WidgetMgr::AdapterIface* GetWidgetMgrAdapter() = 0;
-    virtual std::unique_ptr<IFWL_AdapterTimerMgr> NewTimerMgr() = 0;
+    virtual TimerHandlerIface* GetTimerHandler() = 0;
   };
 
   explicit CFWL_App(AdapterIface* pAdapter);
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_caret.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_caret.cpp
index 9380f9ebed6..ef5bdcc5497 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_caret.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_caret.cpp
@@ -9,9 +9,9 @@
 #include <utility>
 
 #include "third_party/base/ptr_util.h"
+#include "xfa/fwl/cfwl_app.h"
 #include "xfa/fwl/cfwl_notedriver.h"
 #include "xfa/fwl/cfwl_themebackground.h"
-#include "xfa/fwl/cfwl_timerinfo.h"
 #include "xfa/fwl/cfwl_widgetproperties.h"
 #include "xfa/fwl/ifwl_themeprovider.h"
 
@@ -26,18 +26,11 @@ constexpr int kStateHighlight = (1 << 0);
 CFWL_Caret::CFWL_Caret(const CFWL_App* app,
                        std::unique_ptr<CFWL_WidgetProperties> properties,
                        CFWL_Widget* pOuter)
-    : CFWL_Widget(app, std::move(properties), pOuter),
-      m_pTimer(pdfium::MakeUnique<CFWL_Caret::Timer>(this)),
-      m_pTimerInfo(nullptr) {
+    : CFWL_Widget(app, std::move(properties), pOuter) {
   SetStates(kStateHighlight);
 }
 
-CFWL_Caret::~CFWL_Caret() {
-  if (m_pTimerInfo) {
-    m_pTimerInfo->StopTimer();
-    m_pTimerInfo = nullptr;
-  }
-}
+CFWL_Caret::~CFWL_Caret() = default;
 
 FWL_Type CFWL_Caret::GetClassID() const {
   return FWL_Type::Caret;
@@ -58,22 +51,15 @@ void CFWL_Caret::DrawWidget(CXFA_Graphics* pGraphics,
 }
 
 void CFWL_Caret::ShowCaret() {
-  if (m_pTimerInfo) {
-    CFWL_TimerInfo* pOldTimerInfo = m_pTimerInfo.Release();
-    pOldTimerInfo->StopTimer();
-  }
-
-  m_pTimerInfo = m_pTimer->StartTimer(kBlinkPeriodMs, true);
+  m_pTimer = pdfium::MakeUnique<CFX_Timer>(
+      GetOwnerApp()->GetAdapterNative()->GetTimerHandler(), this,
+      kBlinkPeriodMs);
   RemoveStates(FWL_WGTSTATE_Invisible);
   SetStates(kStateHighlight);
 }
 
 void CFWL_Caret::HideCaret() {
-  if (m_pTimerInfo) {
-    CFWL_TimerInfo* pOldTimerInfo = m_pTimerInfo.Release();
-    pOldTimerInfo->StopTimer();
-  }
-
+  m_pTimer.reset();
   SetStates(FWL_WGTSTATE_Invisible);
 }
 
@@ -101,15 +87,12 @@ void CFWL_Caret::OnDrawWidget(CXFA_Graphics* pGraphics,
   DrawWidget(pGraphics, matrix);
 }
 
-CFWL_Caret::Timer::Timer(CFWL_Caret* pCaret) : CFWL_Timer(pCaret) {}
-
-void CFWL_Caret::Timer::Run(CFWL_TimerInfo* pTimerInfo) {
-  CFWL_Caret* pCaret = static_cast<CFWL_Caret*>(m_pWidget.Get());
-  if (!(pCaret->GetStates() & kStateHighlight))
-    pCaret->SetStates(kStateHighlight);
+void CFWL_Caret::OnTimerFired() {
+  if (!(GetStates() & kStateHighlight))
+    SetStates(kStateHighlight);
   else
-    pCaret->RemoveStates(kStateHighlight);
+    RemoveStates(kStateHighlight);
 
-  CFX_RectF rt = pCaret->GetWidgetRect();
-  pCaret->RepaintRect(CFX_RectF(0, 0, rt.width + 1, rt.height));
+  CFX_RectF rt = GetWidgetRect();
+  RepaintRect(CFX_RectF(0, 0, rt.width + 1, rt.height));
 }
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_caret.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_caret.h
index 88bec752cc3..7f5dfdff215 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_caret.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_caret.h
@@ -9,21 +9,21 @@
 
 #include <memory>
 
-#include "xfa/fwl/cfwl_timer.h"
+#include "core/fxcrt/cfx_timer.h"
 #include "xfa/fwl/cfwl_widget.h"
 #include "xfa/fxgraphics/cxfa_gecolor.h"
 
 class CFWL_WidgetProperties;
 class CFWL_Widget;
 
-class CFWL_Caret final : public CFWL_Widget {
+class CFWL_Caret final : public CFWL_Widget, public CFX_Timer::CallbackIface {
  public:
   CFWL_Caret(const CFWL_App* app,
              std::unique_ptr<CFWL_WidgetProperties> properties,
              CFWL_Widget* pOuter);
   ~CFWL_Caret() override;
 
-  // CFWL_Widget
+  // CFWL_Widget:
   FWL_Type GetClassID() const override;
   void DrawWidget(CXFA_Graphics* pGraphics, const CFX_Matrix& matrix) override;
   void OnProcessMessage(CFWL_Message* pMessage) override;
@@ -31,25 +31,18 @@ class CFWL_Caret final : public CFWL_Widget {
                     const CFX_Matrix& matrix) override;
   void Update() override;
 
+  // CFX_Timer::CallbackIface:
+  void OnTimerFired() override;
+
   void ShowCaret();
   void HideCaret();
 
  private:
-  class Timer final : public CFWL_Timer {
-   public:
-    explicit Timer(CFWL_Caret* pCaret);
-    ~Timer() override {}
-
-    void Run(CFWL_TimerInfo* hTimer) override;
-  };
-  friend class CFWL_Caret::Timer;
-
   void DrawCaretBK(CXFA_Graphics* pGraphics,
                    IFWL_ThemeProvider* pTheme,
                    const CFX_Matrix* pMatrix);
 
-  std::unique_ptr<CFWL_Caret::Timer> m_pTimer;
-  UnownedPtr<CFWL_TimerInfo> m_pTimerInfo;
+  std::unique_ptr<CFX_Timer> m_pTimer;
 };
 
 #endif  // XFA_FWL_CFWL_CARET_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_checkbox.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_checkbox.cpp
index 06dd54e86cb..f3ff43f7f57 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_checkbox.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_checkbox.cpp
@@ -127,9 +127,7 @@ void CFWL_CheckBox::Layout() {
                           m_rtClient.right() - fTextLeft, m_rtClient.height);
   m_rtCaption.Inflate(-kCaptionMargin, -kCaptionMargin);
 
-  CFX_RectF rtFocus(m_rtCaption.left, m_rtCaption.top, m_rtCaption.width,
-                    m_rtCaption.height);
-
+  CFX_RectF rtFocus = m_rtCaption;
   CalcTextRect(L"Check box", m_pProperties->m_pThemeProvider.Get(), m_TTOStyles,
                m_iTTOAlign, &rtFocus);
 
@@ -239,8 +237,9 @@ void CFWL_CheckBox::OnProcessMessage(CFWL_Message* pMessage) {
     default:
       break;
   }
-
-  CFWL_Widget::OnProcessMessage(pMessage);
+  // Dst target could be |this|, continue only if not destroyed by above.
+  if (pMessage->GetDstTarget())
+    CFWL_Widget::OnProcessMessage(pMessage);
 }
 
 void CFWL_CheckBox::OnDrawWidget(CXFA_Graphics* pGraphics,
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_combobox.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_combobox.cpp
index 9521e2d0b0f..808c8c2b30a 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_combobox.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_combobox.cpp
@@ -221,6 +221,8 @@ void CFWL_ComboBox::ShowDropList(bool bActivate) {
   if (bActivate) {
     CFWL_Event preEvent(CFWL_Event::Type::PreDropDown, this);
     DispatchEvent(&preEvent);
+    if (!preEvent.GetSrcTarget())
+      return;
 
     CFWL_ComboList* pComboList = m_pListBox.get();
     int32_t iItems = pComboList->CountItems(nullptr);
@@ -479,7 +481,8 @@ void CFWL_ComboBox::OnProcessMessage(CFWL_Message* pMessage) {
     default:
       break;
   }
-  if (backDefault)
+  // Dst target could be |this|, continue only if not destroyed by above.
+  if (backDefault && pMessage->GetDstTarget())
     CFWL_Widget::OnProcessMessage(pMessage);
 }
 
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_datetimepicker.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_datetimepicker.cpp
index a3fbc9cbdfe..b711ebaf794 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_datetimepicker.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_datetimepicker.cpp
@@ -378,8 +378,9 @@ void CFWL_DateTimePicker::OnProcessMessage(CFWL_Message* pMessage) {
     default:
       break;
   }
-
-  CFWL_Widget::OnProcessMessage(pMessage);
+  // Dst target could be |this|, continue only if not destroyed by above.
+  if (pMessage->GetDstTarget())
+    CFWL_Widget::OnProcessMessage(pMessage);
 }
 
 void CFWL_DateTimePicker::OnDrawWidget(CXFA_Graphics* pGraphics,
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_edit.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_edit.cpp
index 2f26706610e..8b70f4dd880 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_edit.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_edit.cpp
@@ -445,7 +445,7 @@ void CFWL_Edit::RenderText(CFX_RenderDevice* pRenderDev,
   if (!font)
     return;
 
-  pRenderDev->SetClip_Rect(clipRect);
+  pRenderDev->SetClip_Rect(clipRect.GetOuterRect());
 
   CFX_RectF rtDocClip = clipRect;
   if (rtDocClip.IsEmpty()) {
@@ -1039,7 +1039,9 @@ void CFWL_Edit::OnProcessMessage(CFWL_Message* pMessage) {
     default:
       break;
   }
-  CFWL_Widget::OnProcessMessage(pMessage);
+  // Dst target could be |this|, continue only if not destroyed by above.
+  if (pMessage->GetDstTarget())
+    CFWL_Widget::OnProcessMessage(pMessage);
 }
 
 void CFWL_Edit::OnProcessEvent(CFWL_Event* pEvent) {
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_event.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_event.h
index 0c4d23efd3d..832c01f01a3 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_event.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_event.h
@@ -7,14 +7,8 @@
 #ifndef XFA_FWL_CFWL_EVENT_H_
 #define XFA_FWL_CFWL_EVENT_H_
 
-#include "core/fxcrt/fx_coordinates.h"
-#include "core/fxcrt/fx_string.h"
-#include "core/fxcrt/fx_system.h"
-#include "xfa/fwl/cfwl_messagekey.h"
-#include "xfa/fwl/cfwl_messagemouse.h"
-
-class CXFA_Graphics;
-class CFWL_Widget;
+#include "core/fxcrt/observed_ptr.h"
+#include "xfa/fwl/cfwl_widget.h"
 
 class CFWL_Event {
  public:
@@ -44,8 +38,8 @@ class CFWL_Event {
 
  private:
   const Type m_type;
-  UnownedPtr<CFWL_Widget> const m_pSrcTarget;
-  UnownedPtr<CFWL_Widget> const m_pDstTarget;
+  ObservedPtr<CFWL_Widget> const m_pSrcTarget;
+  ObservedPtr<CFWL_Widget> const m_pDstTarget;
 };
 
 #endif  // XFA_FWL_CFWL_EVENT_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_eventmouse.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_eventmouse.h
index 170f39af4e4..273856fbc5b 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_eventmouse.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_eventmouse.h
@@ -8,6 +8,7 @@
 #define XFA_FWL_CFWL_EVENTMOUSE_H_
 
 #include "xfa/fwl/cfwl_event.h"
+#include "xfa/fwl/cfwl_messagemouse.h"
 
 class CFWL_EventMouse final : public CFWL_Event {
  public:
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_listbox.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_listbox.cpp
index 8f51f5be75a..4de06dbf814 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_listbox.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_listbox.cpp
@@ -687,7 +687,9 @@ void CFWL_ListBox::OnProcessMessage(CFWL_Message* pMessage) {
     default:
       break;
   }
-  CFWL_Widget::OnProcessMessage(pMessage);
+  // Dst target could be |this|, continue only if not destroyed by above.
+  if (pMessage->GetDstTarget())
+    CFWL_Widget::OnProcessMessage(pMessage);
 }
 
 void CFWL_ListBox::OnProcessEvent(CFWL_Event* pEvent) {
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_message.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_message.cpp
index 998966cc9e9..f330a084144 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_message.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_message.cpp
@@ -11,6 +11,4 @@ CFWL_Message::CFWL_Message(Type type,
                            CFWL_Widget* pDstTarget)
     : m_type(type), m_pSrcTarget(pSrcTarget), m_pDstTarget(pDstTarget) {}
 
-CFWL_Message::CFWL_Message(const CFWL_Message& that) = default;
-
 CFWL_Message::~CFWL_Message() = default;
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_message.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_message.h
index 227b7588c89..69f7bf533e0 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_message.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_message.h
@@ -11,32 +11,30 @@
 
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
-#include "core/fxcrt/unowned_ptr.h"
-
-class CFWL_Widget;
+#include "core/fxcrt/observed_ptr.h"
+#include "xfa/fwl/cfwl_widget.h"
 
 class CFWL_Message {
  public:
   enum class Type { Key, KillFocus, Mouse, MouseWheel, SetFocus };
 
-  CFWL_Message(Type type, CFWL_Widget* pSrcTarget, CFWL_Widget* pDstTarget);
   virtual ~CFWL_Message();
 
-  virtual std::unique_ptr<CFWL_Message> Clone() = 0;
-
   Type GetType() const { return m_type; }
   CFWL_Widget* GetSrcTarget() const { return m_pSrcTarget.Get(); }
   CFWL_Widget* GetDstTarget() const { return m_pDstTarget.Get(); }
-  void SetSrcTarget(CFWL_Widget* pWidget) { m_pSrcTarget = pWidget; }
-  void SetDstTarget(CFWL_Widget* pWidget) { m_pDstTarget = pWidget; }
+  void SetSrcTarget(CFWL_Widget* pWidget) { m_pSrcTarget.Reset(pWidget); }
+  void SetDstTarget(CFWL_Widget* pWidget) { m_pDstTarget.Reset(pWidget); }
 
  protected:
-  CFWL_Message(const CFWL_Message& that);
+  CFWL_Message(Type type, CFWL_Widget* pSrcTarget, CFWL_Widget* pDstTarget);
+  CFWL_Message(const CFWL_Message& that) = delete;
+  CFWL_Message& operator=(const CFWL_Message& that) = delete;
 
  private:
   const Type m_type;
-  UnownedPtr<CFWL_Widget> m_pSrcTarget;
-  UnownedPtr<CFWL_Widget> m_pDstTarget;
+  ObservedPtr<CFWL_Widget> m_pSrcTarget;
+  ObservedPtr<CFWL_Widget> m_pDstTarget;
 };
 
 #endif  // XFA_FWL_CFWL_MESSAGE_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekey.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekey.cpp
index 025175a56ba..9abb0c1a397 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekey.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekey.cpp
@@ -10,14 +10,13 @@
 
 #include "third_party/base/ptr_util.h"
 
-CFWL_MessageKey::CFWL_MessageKey(CFWL_Widget* pSrcTarget,
-                                 CFWL_Widget* pDstTarget)
-    : CFWL_Message(CFWL_Message::Type::Key, pSrcTarget, pDstTarget) {}
-
-CFWL_MessageKey::CFWL_MessageKey(const CFWL_MessageKey& that) = default;
+CFWL_MessageKey::CFWL_MessageKey(CFWL_Widget* pDstTarget,
+                                 FWL_KeyCommand cmd,
+                                 uint32_t flags,
+                                 uint32_t keycode)
+    : CFWL_Message(CFWL_Message::Type::Key, nullptr, pDstTarget),
+      m_dwCmd(cmd),
+      m_dwFlags(flags),
+      m_dwKeyCode(keycode) {}
 
 CFWL_MessageKey::~CFWL_MessageKey() = default;
-
-std::unique_ptr<CFWL_Message> CFWL_MessageKey::Clone() {
-  return pdfium::MakeUnique<CFWL_MessageKey>(*this);
-}
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekey.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekey.h
index 5ecb161ff11..3b46531d998 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekey.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekey.h
@@ -15,16 +15,15 @@ enum class FWL_KeyCommand { KeyDown, KeyUp, Char };
 
 class CFWL_MessageKey final : public CFWL_Message {
  public:
-  CFWL_MessageKey(CFWL_Widget* pSrcTarget, CFWL_Widget* pDstTarget);
-  CFWL_MessageKey(const CFWL_MessageKey& that);
+  CFWL_MessageKey(CFWL_Widget* pDstTarget,
+                  FWL_KeyCommand cmd,
+                  uint32_t flags,
+                  uint32_t keycode);
   ~CFWL_MessageKey() override;
 
-  // CFWL_Message
-  std::unique_ptr<CFWL_Message> Clone() override;
-
-  uint32_t m_dwKeyCode;
-  uint32_t m_dwFlags;
   FWL_KeyCommand m_dwCmd;
+  uint32_t m_dwFlags;
+  uint32_t m_dwKeyCode;
 };
 
 #endif  // XFA_FWL_CFWL_MESSAGEKEY_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekillfocus.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekillfocus.cpp
index 34c4c053e7b..15fe562b276 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekillfocus.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekillfocus.cpp
@@ -17,11 +17,4 @@ CFWL_MessageKillFocus::CFWL_MessageKillFocus(CFWL_Widget* pSrcTarget,
                                              CFWL_Widget* pDstTarget)
     : CFWL_Message(CFWL_Message::Type::KillFocus, pSrcTarget, pDstTarget) {}
 
-CFWL_MessageKillFocus::CFWL_MessageKillFocus(
-    const CFWL_MessageKillFocus& that) = default;
-
 CFWL_MessageKillFocus::~CFWL_MessageKillFocus() = default;
-
-std::unique_ptr<CFWL_Message> CFWL_MessageKillFocus::Clone() {
-  return pdfium::MakeUnique<CFWL_MessageKillFocus>(*this);
-}
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekillfocus.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekillfocus.h
index 56cfc399b55..18e64f98da7 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekillfocus.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagekillfocus.h
@@ -16,14 +16,10 @@ class CFWL_MessageKillFocus final : public CFWL_Message {
  public:
   explicit CFWL_MessageKillFocus(CFWL_Widget* pSrcTarget);
   CFWL_MessageKillFocus(CFWL_Widget* pSrcTarget, CFWL_Widget* pDstTarget);
-  CFWL_MessageKillFocus(const CFWL_MessageKillFocus& that);
   ~CFWL_MessageKillFocus() override;
 
-  // CFWL_Message:
-  std::unique_ptr<CFWL_Message> Clone() override;
-
   bool IsFocusedOnWidget(const CFWL_Widget* pWidget) const {
-    return pWidget == m_pSetFocus.Get();
+    return pWidget == m_pSetFocus;
   }
 
  private:
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemouse.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemouse.cpp
index 1d56b0f17b5..395c9e6cc9f 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemouse.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemouse.cpp
@@ -10,14 +10,18 @@
 
 #include "third_party/base/ptr_util.h"
 
-CFWL_MessageMouse::CFWL_MessageMouse(CFWL_Widget* pSrcTarget,
-                                     CFWL_Widget* pDstTarget)
-    : CFWL_Message(CFWL_Message::Type::Mouse, pSrcTarget, pDstTarget) {}
-
-CFWL_MessageMouse::CFWL_MessageMouse(const CFWL_MessageMouse& other) = default;
-
-CFWL_MessageMouse::~CFWL_MessageMouse() {}
-
-std::unique_ptr<CFWL_Message> CFWL_MessageMouse::Clone() {
-  return pdfium::MakeUnique<CFWL_MessageMouse>(*this);
-}
+CFWL_MessageMouse::CFWL_MessageMouse(CFWL_Widget* pDstTarget,
+                                     FWL_MouseCommand cmd)
+    : CFWL_Message(CFWL_Message::Type::Mouse, nullptr, pDstTarget),
+      m_dwCmd(cmd) {}
+
+CFWL_MessageMouse::CFWL_MessageMouse(CFWL_Widget* pDstTarget,
+                                     FWL_MouseCommand cmd,
+                                     uint32_t flags,
+                                     CFX_PointF pos)
+    : CFWL_Message(CFWL_Message::Type::Mouse, nullptr, pDstTarget),
+      m_dwCmd(cmd),
+      m_dwFlags(flags),
+      m_pos(pos) {}
+
+CFWL_MessageMouse::~CFWL_MessageMouse() = default;
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemouse.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemouse.h
index ae9711f17c3..b0cea2ab083 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemouse.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemouse.h
@@ -27,16 +27,16 @@ enum class FWL_MouseCommand {
 
 class CFWL_MessageMouse final : public CFWL_Message {
  public:
-  CFWL_MessageMouse(CFWL_Widget* pSrcTarget, CFWL_Widget* pDstTarget);
-  CFWL_MessageMouse(const CFWL_MessageMouse& other);
+  CFWL_MessageMouse(CFWL_Widget* pDstTarget, FWL_MouseCommand cmd);
+  CFWL_MessageMouse(CFWL_Widget* pDstTarget,
+                    FWL_MouseCommand cmd,
+                    uint32_t flags,
+                    CFX_PointF pos);
   ~CFWL_MessageMouse() override;
 
-  // CFWL_Message
-  std::unique_ptr<CFWL_Message> Clone() override;
-
-  CFX_PointF m_pos;
-  uint32_t m_dwFlags;
   FWL_MouseCommand m_dwCmd;
+  uint32_t m_dwFlags = 0;
+  CFX_PointF m_pos;
 };
 
 #endif  // XFA_FWL_CFWL_MESSAGEMOUSE_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemousewheel.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemousewheel.cpp
index 8996f650bf1..333117908a1 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemousewheel.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemousewheel.cpp
@@ -10,15 +10,13 @@
 
 #include "third_party/base/ptr_util.h"
 
-CFWL_MessageMouseWheel::CFWL_MessageMouseWheel(CFWL_Widget* pSrcTarget,
-                                               CFWL_Widget* pDstTarget)
-    : CFWL_Message(CFWL_Message::Type::MouseWheel, pSrcTarget, pDstTarget) {}
-
-CFWL_MessageMouseWheel::CFWL_MessageMouseWheel(const CFWL_MessageMouseWheel&) =
-    default;
-
-CFWL_MessageMouseWheel::~CFWL_MessageMouseWheel() {}
-
-std::unique_ptr<CFWL_Message> CFWL_MessageMouseWheel::Clone() {
-  return pdfium::MakeUnique<CFWL_MessageMouseWheel>(*this);
-}
+CFWL_MessageMouseWheel::CFWL_MessageMouseWheel(CFWL_Widget* pDstTarget,
+                                               uint32_t flags,
+                                               CFX_PointF pos,
+                                               CFX_PointF delta)
+    : CFWL_Message(CFWL_Message::Type::MouseWheel, nullptr, pDstTarget),
+      m_dwFlags(flags),
+      m_pos(pos),
+      m_delta(delta) {}
+
+CFWL_MessageMouseWheel::~CFWL_MessageMouseWheel() = default;
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemousewheel.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemousewheel.h
index 8fc3a633270..8eb4be7206a 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemousewheel.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagemousewheel.h
@@ -14,16 +14,15 @@
 
 class CFWL_MessageMouseWheel final : public CFWL_Message {
  public:
-  CFWL_MessageMouseWheel(CFWL_Widget* pSrcTarget, CFWL_Widget* pDstTarget);
-  CFWL_MessageMouseWheel(const CFWL_MessageMouseWheel&);
+  CFWL_MessageMouseWheel(CFWL_Widget* pDstTarget,
+                         uint32_t flags,
+                         CFX_PointF pos,
+                         CFX_PointF delta);
   ~CFWL_MessageMouseWheel() override;
 
-  // CFWL_Message
-  std::unique_ptr<CFWL_Message> Clone() override;
-
+  uint32_t m_dwFlags;
   CFX_PointF m_pos;
   CFX_PointF m_delta;
-  uint32_t m_dwFlags;
 };
 
 #endif  // XFA_FWL_CFWL_MESSAGEMOUSEWHEEL_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagesetfocus.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagesetfocus.cpp
index d7977814ac4..ec0c27ab062 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagesetfocus.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagesetfocus.cpp
@@ -14,11 +14,5 @@ CFWL_MessageSetFocus::CFWL_MessageSetFocus(CFWL_Widget* pSrcTarget,
                                            CFWL_Widget* pDstTarget)
     : CFWL_Message(CFWL_Message::Type::SetFocus, pSrcTarget, pDstTarget) {}
 
-CFWL_MessageSetFocus::CFWL_MessageSetFocus(const CFWL_MessageSetFocus& that) =
-    default;
-
 CFWL_MessageSetFocus::~CFWL_MessageSetFocus() = default;
 
-std::unique_ptr<CFWL_Message> CFWL_MessageSetFocus::Clone() {
-  return pdfium::MakeUnique<CFWL_MessageSetFocus>(*this);
-}
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagesetfocus.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagesetfocus.h
index 410d26b4cec..67e00356080 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_messagesetfocus.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_messagesetfocus.h
@@ -14,11 +14,7 @@
 class CFWL_MessageSetFocus final : public CFWL_Message {
  public:
   CFWL_MessageSetFocus(CFWL_Widget* pSrcTarget, CFWL_Widget* pDstTarget);
-  CFWL_MessageSetFocus(const CFWL_MessageSetFocus& that);
   ~CFWL_MessageSetFocus() override;
-
-  // CFWL_Message
-  std::unique_ptr<CFWL_Message> Clone() override;
 };
 
 #endif  // XFA_FWL_CFWL_MESSAGESETFOCUS_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_monthcalendar.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_monthcalendar.cpp
index a856af29403..76d915628ee 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_monthcalendar.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_monthcalendar.cpp
@@ -710,7 +710,9 @@ void CFWL_MonthCalendar::OnProcessMessage(CFWL_Message* pMessage) {
     default:
       break;
   }
-  CFWL_Widget::OnProcessMessage(pMessage);
+  // Dst target could be |this|, continue only if not destroyed by above.
+  if (pMessage->GetDstTarget())
+    CFWL_Widget::OnProcessMessage(pMessage);
 }
 
 void CFWL_MonthCalendar::OnDrawWidget(CXFA_Graphics* pGraphics,
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_notedriver.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_notedriver.cpp
index 614b71e0e5d..821dd5c25ae 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_notedriver.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_notedriver.cpp
@@ -259,10 +259,9 @@ void CFWL_NoteDriver::MouseSecondary(CFWL_Message* pMessage) {
 
   CFWL_MessageMouse* pMsg = static_cast<CFWL_MessageMouse*>(pMessage);
   if (m_pHover) {
-    CFWL_MessageMouse msLeave(nullptr, m_pHover.Get());
-    msLeave.m_pos = pTarget->TransformTo(m_pHover.Get(), pMsg->m_pos);
-    msLeave.m_dwFlags = 0;
-    msLeave.m_dwCmd = FWL_MouseCommand::Leave;
+    CFWL_MessageMouse msLeave(
+        m_pHover.Get(), FWL_MouseCommand::Leave, 0,
+        pTarget->TransformTo(m_pHover.Get(), pMsg->m_pos));
     DispatchMessage(&msLeave, nullptr);
   }
   if (pTarget->GetClassID() == FWL_Type::Form) {
@@ -271,10 +270,7 @@ void CFWL_NoteDriver::MouseSecondary(CFWL_Message* pMessage) {
   }
   m_pHover = pTarget;
 
-  CFWL_MessageMouse msHover(nullptr, pTarget);
-  msHover.m_pos = pMsg->m_pos;
-  msHover.m_dwFlags = 0;
-  msHover.m_dwCmd = FWL_MouseCommand::Hover;
+  CFWL_MessageMouse msHover(pTarget, FWL_MouseCommand::Hover, 0, pMsg->m_pos);
   DispatchMessage(&msHover, nullptr);
 }
 
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_pushbutton.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_pushbutton.cpp
index 947b24d9a52..980a89d40af 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_pushbutton.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_pushbutton.cpp
@@ -134,7 +134,9 @@ void CFWL_PushButton::OnProcessMessage(CFWL_Message* pMessage) {
     default:
       break;
   }
-  CFWL_Widget::OnProcessMessage(pMessage);
+  // Dst target could be |this|, continue only if not destroyed by above.
+  if (pMessage->GetDstTarget())
+    CFWL_Widget::OnProcessMessage(pMessage);
 }
 
 void CFWL_PushButton::OnDrawWidget(CXFA_Graphics* pGraphics,
@@ -222,6 +224,8 @@ void CFWL_PushButton::OnKeyDown(CFWL_MessageKey* pMsg) {
   CFWL_EventMouse wmMouse(this);
   wmMouse.m_dwCmd = FWL_MouseCommand::LeftButtonUp;
   DispatchEvent(&wmMouse);
+  if (!wmMouse.GetSrcTarget())
+    return;
 
   CFWL_Event wmClick(CFWL_Event::Type::Click, this);
   DispatchEvent(&wmClick);
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_scrollbar.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_scrollbar.cpp
index 9c9eec1976b..acc144f3611 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_scrollbar.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_scrollbar.cpp
@@ -10,13 +10,14 @@
 #include <memory>
 #include <utility>
 
+#include "third_party/base/ptr_util.h"
 #include "third_party/base/stl_util.h"
+#include "xfa/fwl/cfwl_app.h"
 #include "xfa/fwl/cfwl_messagemouse.h"
 #include "xfa/fwl/cfwl_messagemousewheel.h"
 #include "xfa/fwl/cfwl_notedriver.h"
 #include "xfa/fwl/cfwl_themebackground.h"
 #include "xfa/fwl/cfwl_themepart.h"
-#include "xfa/fwl/cfwl_timerinfo.h"
 #include "xfa/fwl/ifwl_themeprovider.h"
 
 #define FWL_SCROLLBAR_Elapse 500
@@ -31,11 +32,9 @@ CFWL_ScrollBar::CFWL_ScrollBar(
     const CFWL_App* app,
     std::unique_ptr<CFWL_WidgetProperties> properties,
     CFWL_Widget* pOuter)
-    : CFWL_Widget(app, std::move(properties), pOuter),
-      m_Timer(this) {
-}
+    : CFWL_Widget(app, std::move(properties), pOuter) {}
 
-CFWL_ScrollBar::~CFWL_ScrollBar() {}
+CFWL_ScrollBar::~CFWL_ScrollBar() = default;
 
 FWL_Type CFWL_ScrollBar::GetClassID() const {
   return FWL_Type::ScrollBar;
@@ -356,16 +355,15 @@ void CFWL_ScrollBar::OnLButtonDown(const CFX_PointF& point) {
   else
     DoMouseDown(4, m_rtMaxTrack, m_iMaxTrackState, point);
 
-  if (!SendEvent())
-    m_pTimerInfo = m_Timer.StartTimer(FWL_SCROLLBAR_Elapse, true);
+  if (!SendEvent()) {
+    m_pTimer = pdfium::MakeUnique<CFX_Timer>(
+        GetOwnerApp()->GetAdapterNative()->GetTimerHandler(), this,
+        FWL_SCROLLBAR_Elapse);
+  }
 }
 
 void CFWL_ScrollBar::OnLButtonUp(const CFX_PointF& point) {
-  if (m_pTimerInfo) {
-    m_pTimerInfo->StopTimer();
-    m_pTimerInfo = nullptr;
-  }
-
+  m_pTimer.reset();
   m_bMouseDown = false;
   DoMouseUp(0, m_rtMinBtn, m_iMinButtonState, point);
   DoMouseUp(1, m_rtThumb, m_iThumbButtonState, point);
@@ -462,15 +460,10 @@ void CFWL_ScrollBar::DoMouseHover(int32_t iItem,
   RepaintRect(rtItem);
 }
 
-CFWL_ScrollBar::Timer::Timer(CFWL_ScrollBar* pToolTip) : CFWL_Timer(pToolTip) {}
-
-void CFWL_ScrollBar::Timer::Run(CFWL_TimerInfo* pTimerInfo) {
-  CFWL_ScrollBar* pScrollBar = static_cast<CFWL_ScrollBar*>(m_pWidget.Get());
-  if (pScrollBar->m_pTimerInfo) {
-    pScrollBar->m_pTimerInfo->StopTimer();
-    pScrollBar->m_pTimerInfo = nullptr;
+void CFWL_ScrollBar::OnTimerFired() {
+  m_pTimer.reset();
+  if (!SendEvent()) {
+    m_pTimer = pdfium::MakeUnique<CFX_Timer>(
+        GetOwnerApp()->GetAdapterNative()->GetTimerHandler(), this, 0);
   }
-
-  if (!pScrollBar->SendEvent())
-    pScrollBar->m_pTimerInfo = StartTimer(0, true);
 }
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_scrollbar.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_scrollbar.h
index c3df6bb6a00..c98479d8477 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_scrollbar.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_scrollbar.h
@@ -9,10 +9,10 @@
 
 #include <memory>
 
+#include "core/fxcrt/cfx_timer.h"
 #include "core/fxcrt/fx_system.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "xfa/fwl/cfwl_eventscroll.h"
-#include "xfa/fwl/cfwl_timer.h"
 #include "xfa/fwl/cfwl_widget.h"
 #include "xfa/fwl/cfwl_widgetproperties.h"
 
@@ -21,14 +21,15 @@ class CFWL_Widget;
 #define FWL_STYLEEXT_SCB_Horz (0L << 0)
 #define FWL_STYLEEXT_SCB_Vert (1L << 0)
 
-class CFWL_ScrollBar final : public CFWL_Widget {
+class CFWL_ScrollBar final : public CFWL_Widget,
+                             public CFX_Timer::CallbackIface {
  public:
   CFWL_ScrollBar(const CFWL_App* app,
                  std::unique_ptr<CFWL_WidgetProperties> properties,
                  CFWL_Widget* pOuter);
   ~CFWL_ScrollBar() override;
 
-  // CFWL_Widget
+  // CFWL_Widget:
   FWL_Type GetClassID() const override;
   void Update() override;
   void DrawWidget(CXFA_Graphics* pGraphics, const CFX_Matrix& matrix) override;
@@ -36,6 +37,9 @@ class CFWL_ScrollBar final : public CFWL_Widget {
   void OnDrawWidget(CXFA_Graphics* pGraphics,
                     const CFX_Matrix& matrix) override;
 
+  // CFX_Timer::CallbackIface:
+  void OnTimerFired() override;
+
   void GetRange(float* fMin, float* fMax) const {
     ASSERT(fMin);
     ASSERT(fMax);
@@ -55,15 +59,6 @@ class CFWL_ScrollBar final : public CFWL_Widget {
   void SetTrackPos(float fTrackPos);
 
  private:
-  class Timer final : public CFWL_Timer {
-   public:
-    explicit Timer(CFWL_ScrollBar* pToolTip);
-    ~Timer() override {}
-
-    void Run(CFWL_TimerInfo* pTimerInfo) override;
-  };
-  friend class CFWL_ScrollBar::Timer;
-
   bool IsVertical() const {
     return !!(m_pProperties->m_dwStyleExes & FWL_STYLEEXT_SCB_Vert);
   }
@@ -110,7 +105,6 @@ class CFWL_ScrollBar final : public CFWL_Widget {
   void DoMouseLeave(int32_t iItem, const CFX_RectF& rtItem, int32_t& iState);
   void DoMouseHover(int32_t iItem, const CFX_RectF& rtItem, int32_t& iState);
 
-  UnownedPtr<CFWL_TimerInfo> m_pTimerInfo;
   float m_fRangeMin = 0.0f;
   float m_fRangeMax = -1.0f;
   float m_fPageSize = 0.0f;
@@ -134,7 +128,7 @@ class CFWL_ScrollBar final : public CFWL_Widget {
   CFX_RectF m_rtMaxBtn;
   CFX_RectF m_rtMinTrack;
   CFX_RectF m_rtMaxTrack;
-  CFWL_ScrollBar::Timer m_Timer;
+  std::unique_ptr<CFX_Timer> m_pTimer;
 };
 
 #endif  // XFA_FWL_CFWL_SCROLLBAR_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_timer.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_timer.cpp
deleted file mode 100644
index 8e828344e8f..00000000000
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_timer.cpp
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2014 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#include "xfa/fwl/cfwl_timer.h"
-
-#include "xfa/fwl/cfwl_app.h"
-#include "xfa/fwl/cfwl_timerinfo.h"
-#include "xfa/fwl/cfwl_widget.h"
-#include "xfa/fwl/ifwl_adaptertimermgr.h"
-
-CFWL_Timer::CFWL_Timer(CFWL_Widget* parent) : m_pWidget(parent) {}
-
-CFWL_Timer::~CFWL_Timer() {}
-
-CFWL_TimerInfo* CFWL_Timer::StartTimer(uint32_t dwElapse, bool bImmediately) {
-  CFWL_App::AdapterIface* pAdapterNative =
-      m_pWidget->GetOwnerApp()->GetAdapterNative();
-  if (!pAdapterNative)
-    return nullptr;
-
-  if (!m_pAdapterTimerMgr)
-    m_pAdapterTimerMgr = pAdapterNative->NewTimerMgr();
-
-  if (!m_pAdapterTimerMgr)
-    return nullptr;
-
-  return m_pAdapterTimerMgr->Start(this, dwElapse, bImmediately);
-}
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_timer.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_timer.h
deleted file mode 100644
index 586c2f3e40b..00000000000
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_timer.h
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2014 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef XFA_FWL_CFWL_TIMER_H_
-#define XFA_FWL_CFWL_TIMER_H_
-
-#include <memory>
-
-#include "core/fxcrt/fx_system.h"
-#include "core/fxcrt/unowned_ptr.h"
-
-class CFWL_TimerInfo;
-class CFWL_Widget;
-class IFWL_AdapterTimerMgr;
-
-class CFWL_Timer {
- public:
-  explicit CFWL_Timer(CFWL_Widget* parent);
-  virtual ~CFWL_Timer();
-
-  virtual void Run(CFWL_TimerInfo* hTimer) = 0;
-  CFWL_TimerInfo* StartTimer(uint32_t dwElapse, bool bImmediately);
-
- protected:
-  UnownedPtr<CFWL_Widget> m_pWidget;
-  std::unique_ptr<IFWL_AdapterTimerMgr> m_pAdapterTimerMgr;
-};
-
-#endif  // XFA_FWL_CFWL_TIMER_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_timerinfo.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_timerinfo.cpp
deleted file mode 100644
index ee4746af3fd..00000000000
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_timerinfo.cpp
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright 2016 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#include "xfa/fwl/cfwl_timerinfo.h"
-
-#include "xfa/fwl/ifwl_adaptertimermgr.h"
-
-CFWL_TimerInfo::CFWL_TimerInfo(IFWL_AdapterTimerMgr* mgr) : m_pMgr(mgr) {
-  ASSERT(mgr);
-}
-
-CFWL_TimerInfo::~CFWL_TimerInfo() {}
-
-void CFWL_TimerInfo::StopTimer() {
-  m_pMgr->Stop(this);
-}
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_timerinfo.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_timerinfo.h
deleted file mode 100644
index c58bcff9a93..00000000000
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_timerinfo.h
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2016 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef XFA_FWL_CFWL_TIMERINFO_H_
-#define XFA_FWL_CFWL_TIMERINFO_H_
-
-#include "core/fxcrt/fx_system.h"
-#include "core/fxcrt/unowned_ptr.h"
-
-class IFWL_AdapterTimerMgr;
-
-class CFWL_TimerInfo {
- public:
-  explicit CFWL_TimerInfo(IFWL_AdapterTimerMgr* mgr);
-  virtual ~CFWL_TimerInfo();
-
-  void StopTimer();
-
- private:
-  UnownedPtr<IFWL_AdapterTimerMgr> m_pMgr;
-};
-
-#endif  // XFA_FWL_CFWL_TIMERINFO_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_widget.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_widget.h
index 28a3aa3e9e0..c36cd8fa674 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_widget.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_widget.h
@@ -11,15 +11,23 @@
 
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/observed_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "xfa/fde/cfde_data.h"
-#include "xfa/fwl/cfwl_event.h"
 #include "xfa/fwl/cfwl_themepart.h"
 #include "xfa/fwl/cfwl_widgetmgr.h"
 #include "xfa/fwl/cfwl_widgetproperties.h"
 #include "xfa/fwl/fwl_widgethit.h"
 #include "xfa/fwl/ifwl_widgetdelegate.h"
 
+class CFWL_App;
+class CFWL_AppImp;
+class CFWL_Event;
+class CFWL_MessageKey;
+class CFWL_Widget;
+class CFWL_WidgetMgr;
+class IFWL_ThemeProvider;
+
 enum class FWL_Type {
   Unknown = 0,
 
@@ -40,15 +48,8 @@ enum class FWL_Type {
   ToolTip
 };
 
-class CFWL_App;
-class CFWL_AppImp;
-class CFWL_MessageKey;
-class CFWL_Widget;
-class CFWL_WidgetMgr;
-class IFWL_ThemeProvider;
-
 // NOTE: CFWL_Widget serves as its own delegate until replaced at runtime.
-class CFWL_Widget : public IFWL_WidgetDelegate {
+class CFWL_Widget : public Observable, public IFWL_WidgetDelegate {
  public:
   class AdapterIface {
    public:
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_widgetmgr.cpp b/chromium/third_party/pdfium/xfa/fwl/cfwl_widgetmgr.cpp
index 184b403c458..cb41430961b 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_widgetmgr.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_widgetmgr.cpp
@@ -11,6 +11,7 @@
 #include "build/build_config.h"
 #include "third_party/base/ptr_util.h"
 #include "xfa/fwl/cfwl_app.h"
+#include "xfa/fwl/cfwl_message.h"
 #include "xfa/fwl/cfwl_notedriver.h"
 
 CFWL_WidgetMgr::CFWL_WidgetMgr(AdapterIface* pAdapterNative)
@@ -309,16 +310,14 @@ void CFWL_WidgetMgr::GetAdapterPopupPos(CFWL_Widget* pWidget,
                           pPopupRect);
 }
 
-void CFWL_WidgetMgr::OnProcessMessageToForm(CFWL_Message* pMessage) {
-  if (!pMessage)
-    return;
-
+void CFWL_WidgetMgr::OnProcessMessageToForm(
+    std::unique_ptr<CFWL_Message> pMessage) {
   CFWL_Widget* pDstWidget = pMessage->GetDstTarget();
   if (!pDstWidget)
     return;
 
   CFWL_NoteDriver* pNoteDriver = pDstWidget->GetOwnerApp()->GetNoteDriver();
-  pNoteDriver->ProcessMessage(pMessage->Clone());
+  pNoteDriver->ProcessMessage(std::move(pMessage));
 }
 
 void CFWL_WidgetMgr::OnDrawWidget(CFWL_Widget* pWidget,
diff --git a/chromium/third_party/pdfium/xfa/fwl/cfwl_widgetmgr.h b/chromium/third_party/pdfium/xfa/fwl/cfwl_widgetmgr.h
index 75b72507b24..a401e225f82 100644
--- a/chromium/third_party/pdfium/xfa/fwl/cfwl_widgetmgr.h
+++ b/chromium/third_party/pdfium/xfa/fwl/cfwl_widgetmgr.h
@@ -37,7 +37,7 @@ class CFWL_WidgetMgr {
 
   static CFWL_Widget* NextTab(CFWL_Widget* parent, CFWL_Widget* focus);
 
-  void OnProcessMessageToForm(CFWL_Message* pMessage);
+  void OnProcessMessageToForm(std::unique_ptr<CFWL_Message> pMessage);
   void OnDrawWidget(CFWL_Widget* pWidget,
                     CXFA_Graphics* pGraphics,
                     const CFX_Matrix& matrix);
diff --git a/chromium/third_party/pdfium/xfa/fwl/ifwl_adaptertimermgr.h b/chromium/third_party/pdfium/xfa/fwl/ifwl_adaptertimermgr.h
deleted file mode 100644
index afa87c4e2c2..00000000000
--- a/chromium/third_party/pdfium/xfa/fwl/ifwl_adaptertimermgr.h
+++ /dev/null
@@ -1,22 +0,0 @@
-// Copyright 2014 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef XFA_FWL_IFWL_ADAPTERTIMERMGR_H_
-#define XFA_FWL_IFWL_ADAPTERTIMERMGR_H_
-
-#include "xfa/fwl/cfwl_timer.h"
-
-class IFWL_AdapterTimerMgr {
- public:
-  virtual ~IFWL_AdapterTimerMgr() = default;
-
-  virtual CFWL_TimerInfo* Start(CFWL_Timer* pTimer,
-                                uint32_t dwElapse,
-                                bool bImmediately) = 0;
-  virtual void Stop(CFWL_TimerInfo* pTimerInfo) = 0;
-};
-
-#endif  // XFA_FWL_IFWL_ADAPTERTIMERMGR_H_
diff --git a/chromium/third_party/pdfium/xfa/fwl/theme/cfwl_widgettp.cpp b/chromium/third_party/pdfium/xfa/fwl/theme/cfwl_widgettp.cpp
index e85994aa155..b8aa2a8aa28 100644
--- a/chromium/third_party/pdfium/xfa/fwl/theme/cfwl_widgettp.cpp
+++ b/chromium/third_party/pdfium/xfa/fwl/theme/cfwl_widgettp.cpp
@@ -24,6 +24,12 @@
 #include "xfa/fxgraphics/cxfa_gepath.h"
 #include "xfa/fxgraphics/cxfa_geshading.h"
 
+namespace {
+
+CFWL_FontManager* g_FontManager = nullptr;
+
+}  // namespace
+
 CFWL_WidgetTP::CFWL_WidgetTP() = default;
 
 CFWL_WidgetTP::~CFWL_WidgetTP() = default;
@@ -261,21 +267,20 @@ RetainPtr<CFGAS_GEFont> CFWL_FontData::GetFont() const {
   return m_pFont;
 }
 
-CFWL_FontManager* CFWL_FontManager::s_FontManager = nullptr;
 CFWL_FontManager* CFWL_FontManager::GetInstance() {
-  if (!s_FontManager)
-    s_FontManager = new CFWL_FontManager;
-  return s_FontManager;
+  if (!g_FontManager)
+    g_FontManager = new CFWL_FontManager;
+  return g_FontManager;
 }
 
 void CFWL_FontManager::DestroyInstance() {
-  delete s_FontManager;
-  s_FontManager = nullptr;
+  delete g_FontManager;
+  g_FontManager = nullptr;
 }
 
-CFWL_FontManager::CFWL_FontManager() {}
+CFWL_FontManager::CFWL_FontManager() = default;
 
-CFWL_FontManager::~CFWL_FontManager() {}
+CFWL_FontManager::~CFWL_FontManager() = default;
 
 RetainPtr<CFGAS_GEFont> CFWL_FontManager::FindFont(WideStringView wsFontFamily,
                                                    uint32_t dwFontStyles,
diff --git a/chromium/third_party/pdfium/xfa/fwl/theme/cfwl_widgettp.h b/chromium/third_party/pdfium/xfa/fwl/theme/cfwl_widgettp.h
index 6bb60eaff53..28e206f29fa 100644
--- a/chromium/third_party/pdfium/xfa/fwl/theme/cfwl_widgettp.h
+++ b/chromium/third_party/pdfium/xfa/fwl/theme/cfwl_widgettp.h
@@ -81,10 +81,10 @@ class CFWL_WidgetTP {
   std::unique_ptr<CColorData> m_pColorData;
 };
 
-class CFWL_FontData {
+class CFWL_FontData final {
  public:
   CFWL_FontData();
-  virtual ~CFWL_FontData();
+  ~CFWL_FontData();
 
   bool Equal(WideStringView wsFontFamily,
              uint32_t dwFontStyles,
@@ -102,7 +102,7 @@ class CFWL_FontData {
   RetainPtr<CFGAS_GEFont> m_pFont;
 };
 
-class CFWL_FontManager {
+class CFWL_FontManager final {
  public:
   static CFWL_FontManager* GetInstance();
   static void DestroyInstance();
@@ -111,11 +111,10 @@ class CFWL_FontManager {
                                    uint32_t dwFontStyles,
                                    uint16_t dwCodePage);
 
- protected:
+ private:
   CFWL_FontManager();
-  virtual ~CFWL_FontManager();
+  ~CFWL_FontManager();
 
-  static CFWL_FontManager* s_FontManager;
   std::vector<std::unique_ptr<CFWL_FontData>> m_FontsArray;
 };
 
diff --git a/chromium/third_party/pdfium/xfa/fxfa/BUILD.gn b/chromium/third_party/pdfium/xfa/fxfa/BUILD.gn
index f3c132db3be..06fb25628df 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/BUILD.gn
+++ b/chromium/third_party/pdfium/xfa/fxfa/BUILD.gn
@@ -96,7 +96,6 @@ jumbo_source_set("fxfa") {
     "fxfa_basic.h",
   ]
   deps = [
-    "../../core/fpdfapi/font",
     "../../core/fpdfapi/parser",
     "../../core/fpdfdoc",
     "../../core/fxcodec",
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffapp.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffapp.cpp
index a70de91e1b3..656b559289f 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffapp.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffapp.cpp
@@ -15,7 +15,6 @@
 #include "xfa/fgas/font/cfgas_fontmgr.h"
 #include "xfa/fwl/cfwl_notedriver.h"
 #include "xfa/fwl/cfwl_widgetmgr.h"
-#include "xfa/fwl/ifwl_adaptertimermgr.h"
 #include "xfa/fxfa/cxfa_ffdoc.h"
 #include "xfa/fxfa/cxfa_ffwidgethandler.h"
 #include "xfa/fxfa/cxfa_fontmgr.h"
@@ -66,8 +65,8 @@ CFWL_WidgetMgr::AdapterIface* CXFA_FFApp::GetWidgetMgrAdapter() {
   return m_pAdapterWidgetMgr.get();
 }
 
-std::unique_ptr<IFWL_AdapterTimerMgr> CXFA_FFApp::NewTimerMgr() {
-  return m_pProvider->NewTimerMgr();
+TimerHandlerIface* CXFA_FFApp::GetTimerHandler() {
+  return m_pProvider->GetTimerHandler();
 }
 
 void CXFA_FFApp::ClearEventTargets() {
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffapp.h b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffapp.h
index 3bf0a930042..b01ba2fa3a1 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffapp.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffapp.h
@@ -18,7 +18,6 @@ class CFGAS_FontMgr;
 class CFWL_WidgetMgr;
 class CXFA_FWLAdapterWidgetMgr;
 class CXFA_FWLTheme;
-class IFWL_AdapterTimerMgr;
 
 class CXFA_FFApp : public CFWL_App::AdapterIface {
  public:
@@ -29,7 +28,7 @@ class CXFA_FFApp : public CFWL_App::AdapterIface {
 
   // CFWL_App::AdapterIface:
   CFWL_WidgetMgr::AdapterIface* GetWidgetMgrAdapter() override;
-  std::unique_ptr<IFWL_AdapterTimerMgr> NewTimerMgr() override;
+  TimerHandlerIface* GetTimerHandler() override;
 
   CFWL_WidgetMgr* GetFWLWidgetMgr() const { return m_pFWLApp->GetWidgetMgr(); }
   CFGAS_FontMgr* GetFDEFontMgr();
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffbarcode.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffbarcode.cpp
index 0d813a67d52..08fda05514a 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffbarcode.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffbarcode.cpp
@@ -89,6 +89,31 @@ const BarCodeInfo g_BarCodeData[] = {
     {0xfb48155c, "code3Of9", BarcodeType::code3Of9, BC_CODE39},
 };
 
+Optional<BC_CHAR_ENCODING> CharEncodingFromString(const WideString& value) {
+  if (value.CompareNoCase(L"UTF-16"))
+    return CHAR_ENCODING_UNICODE;
+  if (value.CompareNoCase(L"UTF-8"))
+    return CHAR_ENCODING_UTF8;
+  return {};
+}
+
+Optional<BC_TEXT_LOC> TextLocFromAttribute(XFA_AttributeValue value) {
+  switch (value) {
+    case XFA_AttributeValue::None:
+      return BC_TEXT_LOC_NONE;
+    case XFA_AttributeValue::Above:
+      return BC_TEXT_LOC_ABOVE;
+    case XFA_AttributeValue::Below:
+      return BC_TEXT_LOC_BELOW;
+    case XFA_AttributeValue::AboveEmbedded:
+      return BC_TEXT_LOC_ABOVEEMBED;
+    case XFA_AttributeValue::BelowEmbedded:
+      return BC_TEXT_LOC_BELOWEMBED;
+    default:
+      return {};
+  }
+}
+
 }  // namespace.
 
 // static
@@ -162,9 +187,13 @@ void CXFA_FFBarcode::UpdateWidgetProperty() {
   auto* pBarCodeWidget = static_cast<CFWL_Barcode*>(m_pNormalWidget.get());
   pBarCodeWidget->SetType(info->eBCType);
 
-  Optional<BC_CHAR_ENCODING> encoding = barcode_->GetCharEncoding();
-  if (encoding)
-    pBarCodeWidget->SetCharEncoding(*encoding);
+  Optional<WideString> encoding_string = barcode_->GetCharEncoding();
+  if (encoding_string) {
+    Optional<BC_CHAR_ENCODING> encoding =
+        CharEncodingFromString(*encoding_string);
+    if (encoding)
+      pBarCodeWidget->SetCharEncoding(*encoding);
+  }
 
   Optional<bool> calcChecksum = barcode_->GetChecksum();
   if (calcChecksum)
@@ -198,9 +227,12 @@ void CXFA_FFBarcode::UpdateWidgetProperty() {
   if (printCheck)
     pBarCodeWidget->SetPrintChecksum(*printCheck);
 
-  Optional<BC_TEXT_LOC> textLoc = barcode_->GetTextLocation();
-  if (textLoc)
-    pBarCodeWidget->SetTextLocation(*textLoc);
+  Optional<XFA_AttributeValue> text_attr = barcode_->GetTextLocation();
+  if (text_attr) {
+    Optional<BC_TEXT_LOC> textLoc = TextLocFromAttribute(*text_attr);
+    if (textLoc)
+      pBarCodeWidget->SetTextLocation(*textLoc);
+  }
 
   // Truncated is currently not a supported flag.
 
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffcheckbutton.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffcheckbutton.cpp
index 7156ee6b1e8..d48cf332090 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffcheckbutton.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffcheckbutton.cpp
@@ -250,11 +250,10 @@ bool CXFA_FFCheckButton::OnLButtonUp(uint32_t dwFlags,
     return false;
 
   SetButtonDown(false);
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::LeftButtonUp;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::LeftButtonUp, dwFlags,
+      FWLToClient(point)));
+
   return true;
 }
 
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp
index 9016c55ef92..97a28832aac 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp
@@ -300,10 +300,10 @@ bool CXFA_FFDocView::SetFocus(CXFA_FFWidget* pNewFocus) {
   if (pNewFocus) {
     CXFA_Node* node = pNewFocus->GetNode();
     m_pFocusNode = node->IsWidgetReady() ? node : nullptr;
-    m_pFocusWidget = pNewFocus;
+    m_pFocusWidget.Reset(pNewFocus);
   } else {
     m_pFocusNode = nullptr;
-    m_pFocusWidget = nullptr;
+    m_pFocusWidget.Reset();
   }
 
   return true;
@@ -329,7 +329,7 @@ void CXFA_FFDocView::DeleteLayoutItem(CXFA_FFWidget* pWidget) {
     return;
 
   m_pFocusNode = nullptr;
-  m_pFocusWidget = nullptr;
+  m_pFocusWidget.Reset();
 }
 
 static XFA_EventError XFA_ProcessEvent(CXFA_FFDocView* pDocView,
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.h b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.h
index e9a094fc2b7..092616e4bf0 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffdocview.h
@@ -11,14 +11,15 @@
 #include <memory>
 #include <vector>
 
+#include "core/fxcrt/observed_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "xfa/fxfa/cxfa_eventparam.h"
 #include "xfa/fxfa/cxfa_ffdoc.h"
+#include "xfa/fxfa/cxfa_ffwidget.h"
 #include "xfa/fxfa/fxfa.h"
 
 class CXFA_BindItems;
 class CXFA_FFDoc;
-class CXFA_FFWidget;
 class CXFA_FFWidgetHandler;
 class CXFA_Node;
 class CXFA_ReadyNodeIterator;
@@ -120,7 +121,7 @@ class CXFA_FFDocView {
   std::unique_ptr<CXFA_FFWidgetHandler> m_pWidgetHandler;
   UnownedPtr<CXFA_LayoutProcessor> m_pXFADocLayout;
   UnownedPtr<CXFA_Node> m_pFocusNode;
-  UnownedPtr<CXFA_FFWidget> m_pFocusWidget;
+  ObservedPtr<CXFA_FFWidget> m_pFocusWidget;
   std::deque<CXFA_Node*> m_ValidateNodes;
   std::vector<CXFA_Node*> m_CalculateNodes;
   std::deque<CXFA_BindItems*> m_BindItems;
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_fffield.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_fffield.cpp
index 7a6f845acbc..e4c3fab32ac 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_fffield.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_fffield.cpp
@@ -7,8 +7,10 @@
 #include "xfa/fxfa/cxfa_fffield.h"
 
 #include <algorithm>
+#include <utility>
 
 #include "core/fxge/render_defines.h"
+#include "third_party/base/ptr_util.h"
 #include "xfa/fwl/cfwl_edit.h"
 #include "xfa/fwl/cfwl_eventmouse.h"
 #include "xfa/fwl/cfwl_messagekey.h"
@@ -365,9 +367,8 @@ bool CXFA_FFField::OnMouseEnter() {
   if (!m_pNormalWidget)
     return false;
 
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::Enter;
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::Enter));
   return true;
 }
 
@@ -375,9 +376,8 @@ bool CXFA_FFField::OnMouseExit() {
   if (!m_pNormalWidget)
     return false;
 
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::Leave;
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::Leave));
   return true;
 }
 
@@ -401,11 +401,9 @@ bool CXFA_FFField::AcceptsFocusOnButtonDown(uint32_t dwFlags,
 
 void CXFA_FFField::OnLButtonDown(uint32_t dwFlags, const CFX_PointF& point) {
   SetButtonDown(true);
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::LeftButtonDown;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::LeftButtonDown, dwFlags,
+      FWLToClient(point)));
 }
 
 bool CXFA_FFField::OnLButtonUp(uint32_t dwFlags, const CFX_PointF& point) {
@@ -415,11 +413,9 @@ bool CXFA_FFField::OnLButtonUp(uint32_t dwFlags, const CFX_PointF& point) {
     return false;
 
   SetButtonDown(false);
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::LeftButtonUp;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::LeftButtonUp, dwFlags,
+      FWLToClient(point)));
   return true;
 }
 
@@ -427,11 +423,9 @@ bool CXFA_FFField::OnLButtonDblClk(uint32_t dwFlags, const CFX_PointF& point) {
   if (!m_pNormalWidget)
     return false;
 
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::LeftButtonDblClk;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::LeftButtonDblClk, dwFlags,
+      FWLToClient(point)));
   return true;
 }
 
@@ -439,11 +433,9 @@ bool CXFA_FFField::OnMouseMove(uint32_t dwFlags, const CFX_PointF& point) {
   if (!m_pNormalWidget)
     return false;
 
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::Move;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::Move, dwFlags,
+      FWLToClient(point)));
   return true;
 }
 
@@ -453,22 +445,17 @@ bool CXFA_FFField::OnMouseWheel(uint32_t dwFlags,
   if (!m_pNormalWidget)
     return false;
 
-  CFWL_MessageMouseWheel ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  ms.m_delta = CFX_PointF(zDelta, 0);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouseWheel>(
+      m_pNormalWidget.get(), dwFlags, FWLToClient(point),
+      CFX_PointF(zDelta, 0)));
   return true;
 }
 
 void CXFA_FFField::OnRButtonDown(uint32_t dwFlags, const CFX_PointF& point) {
   SetButtonDown(true);
-
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::RightButtonDown;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::RightButtonDown, dwFlags,
+      FWLToClient(point)));
 }
 
 bool CXFA_FFField::OnRButtonUp(uint32_t dwFlags, const CFX_PointF& point) {
@@ -478,11 +465,9 @@ bool CXFA_FFField::OnRButtonUp(uint32_t dwFlags, const CFX_PointF& point) {
     return false;
 
   SetButtonDown(false);
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::RightButtonUp;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::RightButtonUp, dwFlags,
+      FWLToClient(point)));
   return true;
 }
 
@@ -490,11 +475,9 @@ bool CXFA_FFField::OnRButtonDblClk(uint32_t dwFlags, const CFX_PointF& point) {
   if (!m_pNormalWidget)
     return false;
 
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::RightButtonDblClk;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::RightButtonDblClk, dwFlags,
+      FWLToClient(point)));
   return true;
 }
 
@@ -505,8 +488,8 @@ bool CXFA_FFField::OnSetFocus(CXFA_FFWidget* pOldWidget) {
   if (!m_pNormalWidget)
     return false;
 
-  CFWL_MessageSetFocus ms(nullptr, m_pNormalWidget.get());
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(
+      pdfium::MakeUnique<CFWL_MessageSetFocus>(nullptr, m_pNormalWidget.get()));
   GetLayoutItem()->SetStatusBits(XFA_WidgetStatus_Focused);
   InvalidateRect();
   return true;
@@ -514,8 +497,8 @@ bool CXFA_FFField::OnSetFocus(CXFA_FFWidget* pOldWidget) {
 
 bool CXFA_FFField::OnKillFocus(CXFA_FFWidget* pNewWidget) {
   if (m_pNormalWidget) {
-    CFWL_MessageKillFocus ms(nullptr, m_pNormalWidget.get());
-    TranslateFWLMessage(&ms);
+    SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageKillFocus>(
+        nullptr, m_pNormalWidget.get()));
     GetLayoutItem()->ClearStatusBits(XFA_WidgetStatus_Focused);
     InvalidateRect();
   }
@@ -526,11 +509,8 @@ bool CXFA_FFField::OnKeyDown(uint32_t dwKeyCode, uint32_t dwFlags) {
   if (!m_pNormalWidget || !GetDoc()->GetXFADoc()->IsInteractive())
     return false;
 
-  CFWL_MessageKey ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_KeyCommand::KeyDown;
-  ms.m_dwFlags = dwFlags;
-  ms.m_dwKeyCode = dwKeyCode;
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageKey>(
+      m_pNormalWidget.get(), FWL_KeyCommand::KeyDown, dwFlags, dwKeyCode));
   return true;
 }
 
@@ -538,11 +518,8 @@ bool CXFA_FFField::OnKeyUp(uint32_t dwKeyCode, uint32_t dwFlags) {
   if (!m_pNormalWidget || !GetDoc()->GetXFADoc()->IsInteractive())
     return false;
 
-  CFWL_MessageKey ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_KeyCommand::KeyUp;
-  ms.m_dwFlags = dwFlags;
-  ms.m_dwKeyCode = dwKeyCode;
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageKey>(
+      m_pNormalWidget.get(), FWL_KeyCommand::KeyUp, dwFlags, dwKeyCode));
   return true;
 }
 
@@ -556,11 +533,8 @@ bool CXFA_FFField::OnChar(uint32_t dwChar, uint32_t dwFlags) {
   if (!m_pNode->IsOpenAccess())
     return false;
 
-  CFWL_MessageKey ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_KeyCommand::Char;
-  ms.m_dwFlags = dwFlags;
-  ms.m_dwKeyCode = dwChar;
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageKey>(
+      m_pNormalWidget.get(), FWL_KeyCommand::Char, dwFlags, dwChar));
   return true;
 }
 
@@ -722,8 +696,9 @@ bool CXFA_FFField::IsDataChanged() {
   return false;
 }
 
-void CXFA_FFField::TranslateFWLMessage(CFWL_Message* pMessage) {
-  GetApp()->GetFWLWidgetMgr()->OnProcessMessageToForm(pMessage);
+void CXFA_FFField::SendMessageToFWLWidget(
+    std::unique_ptr<CFWL_Message> pMessage) {
+  GetApp()->GetFWLWidgetMgr()->OnProcessMessageToForm(std::move(pMessage));
 }
 
 void CXFA_FFField::OnProcessMessage(CFWL_Message* pMessage) {}
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_fffield.h b/chromium/third_party/pdfium/xfa/fxfa/cxfa_fffield.h
index 1e2b9db352f..d3ae1fb4f1d 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_fffield.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_fffield.h
@@ -86,7 +86,7 @@ class CXFA_FFField : public CXFA_FFWidget, public IFWL_WidgetDelegate {
                      HighlightOption highlight,
                      ShapeOption shape);
   void DrawFocus(CXFA_Graphics* pGS, CFX_Matrix* pMatrix);
-  void TranslateFWLMessage(CFWL_Message* pMessage);
+  void SendMessageToFWLWidget(std::unique_ptr<CFWL_Message> pMessage);
   void CapPlacement();
   void CapTopBottomPlacement(const CXFA_Margin* margin,
                              const CFX_RectF& rtWidget,
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffimageedit.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffimageedit.cpp
index ae683dbfa64..0f50c6a4020 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffimageedit.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffimageedit.cpp
@@ -105,12 +105,9 @@ bool CXFA_FFImageEdit::AcceptsFocusOnButtonDown(uint32_t dwFlags,
 void CXFA_FFImageEdit::OnLButtonDown(uint32_t dwFlags,
                                      const CFX_PointF& point) {
   SetButtonDown(true);
-
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::LeftButtonDown;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::LeftButtonDown, dwFlags,
+      FWLToClient(point)));
 }
 
 void CXFA_FFImageEdit::SetFWLRect() {
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffpageview.h b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffpageview.h
index 768a3b910e1..d49c69c8581 100644..100755
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffpageview.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffpageview.h
@@ -10,6 +10,7 @@
 #include <memory>
 #include <vector>
 
+#include "core/fxcrt/observed_ptr.h"
 #include "xfa/fxfa/layout/cxfa_contentlayoutitem.h"
 #include "xfa/fxfa/layout/cxfa_traversestrategy_layoutitem.h"
 #include "xfa/fxfa/layout/cxfa_viewlayoutitem.h"
@@ -17,7 +18,7 @@
 class CXFA_FFWidget;
 class CXFA_FFDocView;
 
-class CXFA_FFPageView {
+class CXFA_FFPageView : public Observable {
  public:
   CXFA_FFPageView(CXFA_FFDocView* pDocView, CXFA_Node* pPageArea);
   ~CXFA_FFPageView();
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_fftextedit.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_fftextedit.cpp
index da52cf5c677..7916432b7ab 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_fftextedit.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_fftextedit.cpp
@@ -125,13 +125,10 @@ void CXFA_FFTextEdit::OnLButtonDown(uint32_t dwFlags, const CFX_PointF& point) {
     UpdateFWLData();
     InvalidateRect();
   }
-
   SetButtonDown(true);
-  CFWL_MessageMouse ms(nullptr, m_pNormalWidget.get());
-  ms.m_dwCmd = FWL_MouseCommand::LeftButtonDown;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      m_pNormalWidget.get(), FWL_MouseCommand::LeftButtonDown, dwFlags,
+      FWLToClient(point)));
 }
 
 void CXFA_FFTextEdit::OnRButtonDown(uint32_t dwFlags, const CFX_PointF& point) {
@@ -140,13 +137,9 @@ void CXFA_FFTextEdit::OnRButtonDown(uint32_t dwFlags, const CFX_PointF& point) {
     UpdateFWLData();
     InvalidateRect();
   }
-
   SetButtonDown(true);
-  CFWL_MessageMouse ms(nullptr, nullptr);
-  ms.m_dwCmd = FWL_MouseCommand::RightButtonDown;
-  ms.m_dwFlags = dwFlags;
-  ms.m_pos = FWLToClient(point);
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageMouse>(
+      nullptr, FWL_MouseCommand::RightButtonDown, dwFlags, FWLToClient(point)));
 }
 
 bool CXFA_FFTextEdit::OnRButtonUp(uint32_t dwFlags, const CFX_PointF& point) {
@@ -167,17 +160,16 @@ bool CXFA_FFTextEdit::OnSetFocus(CXFA_FFWidget* pOldWidget) {
   if (!CXFA_FFWidget::OnSetFocus(pOldWidget))
     return false;
 
-  CFWL_MessageSetFocus ms(nullptr, m_pNormalWidget.get());
-  TranslateFWLMessage(&ms);
+  SendMessageToFWLWidget(
+      pdfium::MakeUnique<CFWL_MessageSetFocus>(nullptr, m_pNormalWidget.get()));
+
   return true;
 }
 
 bool CXFA_FFTextEdit::OnKillFocus(CXFA_FFWidget* pNewWidget) {
-  {
-    // Message can't outlive the OnKillFocus call.
-    CFWL_MessageKillFocus ms(nullptr, m_pNormalWidget.get());
-    TranslateFWLMessage(&ms);
-  }
+  SendMessageToFWLWidget(pdfium::MakeUnique<CFWL_MessageKillFocus>(
+      nullptr, m_pNormalWidget.get()));
+
   GetLayoutItem()->ClearStatusBits(XFA_WidgetStatus_Focused);
   SetEditScrollOffset();
   ProcessCommittedData();
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffwidget.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffwidget.cpp
index 78c541cd553..8862359eb53 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffwidget.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_ffwidget.cpp
@@ -417,8 +417,9 @@ bool CXFA_FFWidget::OnSetFocus(CXFA_FFWidget* pOldWidget) {
 }
 
 bool CXFA_FFWidget::OnKillFocus(CXFA_FFWidget* pNewWidget) {
-  // OnKillFocus event may remove this widget.
+  // OnKillFocus event may remove these widgets.
   ObservedPtr<CXFA_FFWidget> pWatched(this);
+  ObservedPtr<CXFA_FFWidget> pNewWatched(pNewWidget);
   GetLayoutItem()->ClearStatusBits(XFA_WidgetStatus_Focused);
   EventKillFocus();
   if (!pWatched)
@@ -427,15 +428,16 @@ bool CXFA_FFWidget::OnKillFocus(CXFA_FFWidget* pNewWidget) {
   if (!pNewWidget)
     return true;
 
+  if (!pNewWatched)
+    return false;
+
+  // OnKillFocus event may remove |pNewWidget|.
   CXFA_FFWidget* pParent = GetFFWidget(ToContentLayoutItem(GetParent()));
   if (pParent && !pParent->IsAncestorOf(pNewWidget)) {
     if (!pParent->OnKillFocus(pNewWidget))
       return false;
   }
-  if (!pWatched)
-    return false;
-
-  return true;
+  return pWatched && pNewWatched;
 }
 
 bool CXFA_FFWidget::OnKeyDown(uint32_t dwKeyCode, uint32_t dwFlags) {
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_fontmgr.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_fontmgr.cpp
index f78de663999..7259f6cf847 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_fontmgr.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_fontmgr.cpp
@@ -10,7 +10,6 @@
 #include <memory>
 #include <utility>
 
-#include "core/fpdfapi/font/cpdf_font.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fxge/cfx_fontmgr.h"
@@ -35,7 +34,6 @@ RetainPtr<CFGAS_GEFont> CXFA_FontMgr::GetFont(CXFA_FFDoc* hDoc,
     return iter->second;
 
   WideString wsEnglishName = FGAS_FontNameToEnglishName(wsFontFamily);
-
   CFGAS_PDFFontMgr* pMgr = hDoc->GetPDFFontMgr();
   RetainPtr<CFGAS_GEFont> pFont;
   if (pMgr) {
@@ -47,27 +45,19 @@ RetainPtr<CFGAS_GEFont> CXFA_FontMgr::GetFont(CXFA_FFDoc* hDoc,
     pFont = CFGAS_DefaultFontManager::GetFont(hDoc->GetApp()->GetFDEFontMgr(),
                                               wsFontFamily, dwFontStyles);
   }
-
   if (!pFont && pMgr) {
     pFont = pMgr->GetFont(wsEnglishName.AsStringView(), dwFontStyles, false);
     if (pFont)
       return pFont;
   }
-
   if (!pFont) {
     pFont = CFGAS_DefaultFontManager::GetDefaultFont(
         hDoc->GetApp()->GetFDEFontMgr(), wsFontFamily, dwFontStyles);
   }
-
   if (!pFont) {
-    ByteString font_family =
-        ByteString::Format("%ls", WideString(wsFontFamily).c_str());
-    CPDF_Font* stock_font =
-        CPDF_Font::GetStockFont(hDoc->GetPDFDoc(), font_family.AsStringView());
-    if (stock_font) {
-      pFont =
-          CFGAS_GEFont::LoadFont(stock_font, hDoc->GetApp()->GetFDEFontMgr());
-    }
+    pFont = CFGAS_GEFont::LoadStockFont(
+        hDoc->GetPDFDoc(), hDoc->GetApp()->GetFDEFontMgr(),
+        ByteString::Format("%ls", WideString(wsFontFamily).c_str()));
   }
   if (pFont)
     m_FontMap[bsKey] = pFont;
diff --git a/chromium/third_party/pdfium/xfa/fxfa/cxfa_textlayout.cpp b/chromium/third_party/pdfium/xfa/fxfa/cxfa_textlayout.cpp
index b57c77a869e..9772f5dca0e 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/cxfa_textlayout.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/cxfa_textlayout.cpp
@@ -571,7 +571,7 @@ bool CXFA_TextLayout::DrawString(CFX_RenderDevice* pFxDevice,
     return false;
 
   pFxDevice->SaveState();
-  pFxDevice->SetClip_Rect(rtClip);
+  pFxDevice->SetClip_Rect(rtClip.GetOuterRect());
 
   if (m_pieceLines.empty()) {
     size_t szBlockCount = CountBlocks();
diff --git a/chromium/third_party/pdfium/xfa/fxfa/fxfa.h b/chromium/third_party/pdfium/xfa/fxfa/fxfa.h
index 83fb3ccb3a1..9193d1ba3c2 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/fxfa.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/fxfa.h
@@ -9,18 +9,18 @@
 
 #include <memory>
 
+#include "core/fxcrt/cfx_timer.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/retain_ptr.h"
 #include "core/fxge/fx_dib.h"
 #include "xfa/fxfa/fxfa_basic.h"
 
-class CFXJSE_Value;
 class CXFA_FFDoc;
 class CXFA_FFPageView;
 class CXFA_FFWidget;
 class CXFA_Submit;
-class IFWL_AdapterTimerMgr;
 class IFX_SeekableReadStream;
+class IJS_Runtime;
 
 // Note, values must match fpdf_formfill.h JSPLATFORM_ALERT_BUTTON_* flags.
 enum class AlertButton {
@@ -217,7 +217,7 @@ class IXFA_AppProvider {
                              const WideString& wsData,
                              const WideString& wsEncode) = 0;
 
-  virtual std::unique_ptr<IFWL_AdapterTimerMgr> NewTimerMgr() = 0;
+  virtual TimerHandlerIface* GetTimerHandler() const = 0;
 };
 
 class IXFA_DocEnvironment {
@@ -227,19 +227,23 @@ class IXFA_DocEnvironment {
   virtual void SetChangeMark(CXFA_FFDoc* hDoc) = 0;
   virtual void InvalidateRect(CXFA_FFPageView* pPageView,
                               const CFX_RectF& rt) = 0;
+  // Show or hide caret.
   virtual void DisplayCaret(CXFA_FFWidget* hWidget,
                             bool bVisible,
                             const CFX_RectF* pRtAnchor) = 0;
+
   virtual bool GetPopupPos(CXFA_FFWidget* hWidget,
                            float fMinPopup,
                            float fMaxPopup,
                            const CFX_RectF& rtAnchor,
                            CFX_RectF* pPopupRect) = 0;
   virtual bool PopupMenu(CXFA_FFWidget* hWidget, const CFX_PointF& ptPopup) = 0;
+
+  // Specify dwFlags XFA_PAGEVIEWEVENT_Added, XFA_PAGEVIEWEVENT_Removing
   virtual void PageViewEvent(CXFA_FFPageView* pPageView, uint32_t dwFlags) = 0;
+
   virtual void WidgetPostAdd(CXFA_FFWidget* hWidget) = 0;
   virtual void WidgetPreRemove(CXFA_FFWidget* hWidget) = 0;
-
   virtual int32_t CountPages(CXFA_FFDoc* hDoc) = 0;
   virtual int32_t GetCurrentPage(CXFA_FFDoc* hDoc) = 0;
   virtual void SetCurrentPage(CXFA_FFDoc* hDoc, int32_t iCurPage) = 0;
@@ -259,20 +263,14 @@ class IXFA_DocEnvironment {
                      int32_t nEndPage,
                      uint32_t dwOptions) = 0;
   virtual FX_ARGB GetHighlightColor(CXFA_FFDoc* hDoc) = 0;
+  virtual IJS_Runtime* GetIJSRuntime(CXFA_FFDoc* hDoc) const = 0;
+  virtual RetainPtr<IFX_SeekableReadStream> OpenLinkedFile(
+      CXFA_FFDoc* hDoc,
+      const WideString& wsLink) = 0;
 
 #ifdef PDF_XFA_ELEMENT_SUBMIT_ENABLED
   virtual bool Submit(CXFA_FFDoc* hDoc, CXFA_Submit* submit) = 0;
 #endif  // PDF_XFA_ELEMENT_SUBMIT_ENABLED
-
-  virtual bool GetPropertyFromNonXFAGlobalObject(CXFA_FFDoc* hDoc,
-                                                 ByteStringView szPropName,
-                                                 CFXJSE_Value* pValue) = 0;
-  virtual bool SetPropertyInNonXFAGlobalObject(CXFA_FFDoc* hDoc,
-                                               ByteStringView szPropName,
-                                               CFXJSE_Value* pValue) = 0;
-  virtual RetainPtr<IFX_SeekableReadStream> OpenLinkedFile(
-      CXFA_FFDoc* hDoc,
-      const WideString& wsLink) = 0;
 };
 
 class IXFA_WidgetIterator {
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutitem.h b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutitem.h
index c83ec3f38f3..063f9a369ef 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutitem.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutitem.h
@@ -9,6 +9,7 @@
 
 #include <memory>
 
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "xfa/fxfa/layout/cxfa_layoutitem.h"
 
@@ -16,8 +17,9 @@ class CXFA_FFWidget;
 
 class CXFA_ContentLayoutItem : public CXFA_LayoutItem {
  public:
-  CXFA_ContentLayoutItem(CXFA_Node* pNode,
-                         std::unique_ptr<CXFA_FFWidget> pFFWidget);
+  template <typename T, typename... Args>
+  friend RetainPtr<T> pdfium::MakeRetain(Args&&... args);
+
   ~CXFA_ContentLayoutItem() override;
 
   CXFA_FFWidget* GetFFWidget() { return m_pFFWidget.get(); }
@@ -41,6 +43,9 @@ class CXFA_ContentLayoutItem : public CXFA_LayoutItem {
   CFX_SizeF m_sSize;
 
  private:
+  CXFA_ContentLayoutItem(CXFA_Node* pNode,
+                         std::unique_ptr<CXFA_FFWidget> pFFWidget);
+
   void RemoveSelf();
 
   mutable uint32_t m_dwStatus = 0;
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutprocessor.cpp b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutprocessor.cpp
index 866cbdf21a0..52e763b4201 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutprocessor.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutprocessor.cpp
@@ -184,7 +184,7 @@ CFX_FloatRect GetMarginInset(const CXFA_Margin* pMargin) {
   return inset;
 }
 
-void RelocateTableRowCells(CXFA_ContentLayoutItem* pLayoutRow,
+void RelocateTableRowCells(const RetainPtr<CXFA_ContentLayoutItem>& pLayoutRow,
                            const std::vector<float>& rgSpecifiedColumnWidths,
                            XFA_AttributeValue eLayout) {
   bool bContainerWidthAutoSize = true;
@@ -436,13 +436,12 @@ void DeleteLayoutGeneratedNode(CXFA_Node* pGenerateNode) {
   CXFA_NodeIterator sIterator(pGenerateNode);
   for (CXFA_Node* pNode = sIterator.GetCurrent(); pNode;
        pNode = sIterator.MoveToNext()) {
-    CXFA_ContentLayoutItem* pCurLayoutItem =
-        ToContentLayoutItem(pNode->JSObject()->GetLayoutItem());
+    RetainPtr<CXFA_ContentLayoutItem> pCurLayoutItem(
+        ToContentLayoutItem(pNode->JSObject()->GetLayoutItem()));
     while (pCurLayoutItem) {
       CXFA_ContentLayoutItem* pNextLayoutItem = pCurLayoutItem->GetNext();
-      pNotify->OnLayoutItemRemoving(pDocLayout, pCurLayoutItem);
-      delete pCurLayoutItem;
-      pCurLayoutItem = pNextLayoutItem;
+      pNotify->OnLayoutItemRemoving(pDocLayout, pCurLayoutItem.Get());
+      pCurLayoutItem.Reset(pNextLayoutItem);
     }
   }
   pGenerateNode->GetParent()->RemoveChildAndNotify(pGenerateNode, true);
@@ -624,35 +623,34 @@ CXFA_ContentLayoutProcessor::CXFA_ContentLayoutProcessor(
   ASSERT(GetFormNode());
   ASSERT(GetFormNode()->IsContainerNode() ||
          GetFormNode()->GetElementType() == XFA_Element::Form);
-  m_pOldLayoutItem =
-      ToContentLayoutItem(GetFormNode()->JSObject()->GetLayoutItem());
+  m_pOldLayoutItem.Reset(
+      ToContentLayoutItem(GetFormNode()->JSObject()->GetLayoutItem()));
 }
 
 CXFA_ContentLayoutProcessor::~CXFA_ContentLayoutProcessor() {}
 
-CXFA_ContentLayoutItem* CXFA_ContentLayoutProcessor::CreateContentLayoutItem(
-    CXFA_Node* pFormNode) {
+RetainPtr<CXFA_ContentLayoutItem>
+CXFA_ContentLayoutProcessor::CreateContentLayoutItem(CXFA_Node* pFormNode) {
   if (!pFormNode)
     return nullptr;
 
-  CXFA_ContentLayoutItem* pLayoutItem = nullptr;
   if (m_pOldLayoutItem) {
-    pLayoutItem = m_pOldLayoutItem;
-    m_pOldLayoutItem = m_pOldLayoutItem->GetNext();
+    RetainPtr<CXFA_ContentLayoutItem> pLayoutItem = m_pOldLayoutItem;
+    m_pOldLayoutItem.Reset(m_pOldLayoutItem->GetNext());
     return pLayoutItem;
   }
   CXFA_FFNotify* pNotify = pFormNode->GetDocument()->GetNotify();
-  pLayoutItem = pdfium::MakeUnique<CXFA_ContentLayoutItem>(
-                    pFormNode, pNotify->OnCreateContentLayoutItem(pFormNode))
-                    .release();
+  auto pNewLayoutItem = pdfium::MakeRetain<CXFA_ContentLayoutItem>(
+      pFormNode, pNotify->OnCreateContentLayoutItem(pFormNode));
+
   CXFA_ContentLayoutItem* pPrevLayoutItem =
       ToContentLayoutItem(pFormNode->JSObject()->GetLayoutItem());
   if (pPrevLayoutItem) {
-    pPrevLayoutItem->GetLast()->InsertAfter(pLayoutItem);
+    pPrevLayoutItem->GetLast()->InsertAfter(pNewLayoutItem.Get());
   } else {
-    pFormNode->JSObject()->SetLayoutItem(pLayoutItem);
+    pFormNode->JSObject()->SetLayoutItem(pNewLayoutItem.Get());
   }
-  return pLayoutItem;
+  return pNewLayoutItem;
 }
 
 float CXFA_ContentLayoutProcessor::FindSplitPos(float fProposedSplitPos) {
@@ -662,7 +660,7 @@ float CXFA_ContentLayoutProcessor::FindSplitPos(float fProposedSplitPos) {
   bool bCalculateMargin = eLayout != XFA_AttributeValue::Position;
   while (fProposedSplitPos > kXFALayoutPrecision) {
     bool bAppChange = false;
-    if (!FindLayoutItemSplitPos(m_pLayoutItem, 0, &fProposedSplitPos,
+    if (!FindLayoutItemSplitPos(m_pLayoutItem.Get(), 0, &fProposedSplitPos,
                                 &bAppChange, bCalculateMargin)) {
       break;
     }
@@ -692,7 +690,7 @@ void CXFA_ContentLayoutProcessor::SplitLayoutItem(
         XFA_Attribute::BottomInset, XFA_Unit::Pt);
   }
 
-  CXFA_ContentLayoutItem* pSecondLayoutItem = nullptr;
+  RetainPtr<CXFA_ContentLayoutItem> pSecondLayoutItem;
   if (m_pCurChildPreprocessor &&
       m_pCurChildPreprocessor->GetFormNode() == pLayoutItem->GetFormNode()) {
     pSecondLayoutItem = m_pCurChildPreprocessor->CreateContentLayoutItem(
@@ -733,16 +731,16 @@ void CXFA_ContentLayoutProcessor::SplitLayoutItem(
     bOrphanedItem = true;
   }
 
-  std::vector<CXFA_ContentLayoutItem*> children;
+  std::vector<RetainPtr<CXFA_ContentLayoutItem>> children;
   while (auto* pFirst = ToContentLayoutItem(pLayoutItem->GetFirstChild())) {
-    children.push_back(pFirst);
-    pLayoutItem->RemoveChild(pFirst);
+    children.emplace_back(pFirst);
+    pLayoutItem->RemoveChild(children.back());
   }
 
   float lHeightForKeep = 0;
   float fAddMarginHeight = 0;
-  std::vector<CXFA_ContentLayoutItem*> keepLayoutItems;
-  for (auto* pChildItem : children) {
+  std::vector<RetainPtr<CXFA_ContentLayoutItem>> keepLayoutItems;
+  for (auto& pChildItem : children) {
     if (fSplitPos <= fCurTopMargin + pChildItem->m_sPos.y + fCurBottomMargin +
                          kXFALayoutPrecision) {
       if (!ExistContainerKeep(pChildItem->GetFormNode(), true)) {
@@ -753,7 +751,7 @@ void CXFA_ContentLayoutProcessor::SplitLayoutItem(
         continue;
       }
       if (lHeightForKeep < kXFALayoutPrecision) {
-        for (auto* pPreItem : keepLayoutItems) {
+        for (auto& pPreItem : keepLayoutItems) {
           pLayoutItem->RemoveChild(pPreItem);
           pPreItem->m_sPos.y -= fSplitPos;
           if (pPreItem->m_sPos.y < 0)
@@ -787,7 +785,7 @@ void CXFA_ContentLayoutProcessor::SplitLayoutItem(
 
     float fOldHeight = pSecondLayoutItem->m_sSize.height;
     SplitLayoutItem(
-        pChildItem, pSecondLayoutItem,
+        pChildItem.Get(), pSecondLayoutItem.Get(),
         fSplitPos - fCurTopMargin - fCurBottomMargin - pChildItem->m_sPos.y);
     fAddMarginHeight = pSecondLayoutItem->m_sSize.height - fOldHeight;
     pLayoutItem->AppendLastChild(pChildItem);
@@ -798,13 +796,14 @@ void CXFA_ContentLayoutProcessor::SplitLayoutItem(
 
 void CXFA_ContentLayoutProcessor::SplitLayoutItem(float fSplitPos) {
   ASSERT(m_pLayoutItem);
-  SplitLayoutItem(m_pLayoutItem, nullptr, fSplitPos);
+  SplitLayoutItem(m_pLayoutItem.Get(), nullptr, fSplitPos);
 }
 
-CXFA_ContentLayoutItem* CXFA_ContentLayoutProcessor::ExtractLayoutItem() {
-  CXFA_ContentLayoutItem* pLayoutItem = m_pLayoutItem;
+RetainPtr<CXFA_ContentLayoutItem>
+CXFA_ContentLayoutProcessor::ExtractLayoutItem() {
+  RetainPtr<CXFA_ContentLayoutItem> pLayoutItem = m_pLayoutItem;
   if (pLayoutItem) {
-    m_pLayoutItem = ToContentLayoutItem(pLayoutItem->GetNextSibling());
+    m_pLayoutItem.Reset(ToContentLayoutItem(pLayoutItem->GetNextSibling()));
     pLayoutItem->RemoveSelfIfParented();
   }
   if (m_nCurChildNodeStage != Stage::kDone || !m_pOldLayoutItem)
@@ -816,13 +815,12 @@ CXFA_ContentLayoutItem* CXFA_ContentLayoutProcessor::ExtractLayoutItem() {
       m_pOldLayoutItem->GetFormNode()->GetDocument());
 
   while (m_pOldLayoutItem) {
-    CXFA_ContentLayoutItem* pToDeleteItem = m_pOldLayoutItem;
-    m_pOldLayoutItem = pToDeleteItem->GetNext();
+    RetainPtr<CXFA_ContentLayoutItem> pToDeleteItem = m_pOldLayoutItem;
+    m_pOldLayoutItem.Reset(pToDeleteItem->GetNext());
     if (pToDeleteItem == pLayoutItem)
       break;
-    pNotify->OnLayoutItemRemoving(pDocLayout, pToDeleteItem);
+    pNotify->OnLayoutItemRemoving(pDocLayout, pToDeleteItem.Get());
     pToDeleteItem->RemoveSelfIfParented();
-    delete pToDeleteItem;
   }
   return pLayoutItem;
 }
@@ -994,21 +992,21 @@ void CXFA_ContentLayoutProcessor::DoLayoutPageArea(
 
     pProcessor->SetCurrentComponentPos(CalculatePositionedContainerPos(
         pCurChildNode, pProcessor->GetCurrentComponentSize()));
-    CXFA_LayoutItem* pProcessItem = pProcessor->ExtractLayoutItem();
+    RetainPtr<CXFA_LayoutItem> pProcessItem = pProcessor->ExtractLayoutItem();
     if (!pBeforeItem)
       pPageAreaLayoutItem->AppendFirstChild(pProcessItem);
     else
       pPageAreaLayoutItem->InsertAfter(pProcessItem, pBeforeItem);
 
-    pBeforeItem = pProcessItem;
+    pBeforeItem = pProcessItem.Get();
   }
 
   pBeforeItem = nullptr;
-  CXFA_LayoutItem* pLayoutItem = pPageAreaLayoutItem->GetFirstChild();
+  RetainPtr<CXFA_LayoutItem> pLayoutItem(pPageAreaLayoutItem->GetFirstChild());
   while (pLayoutItem) {
     if (!pLayoutItem->IsContentLayoutItem() ||
         pLayoutItem->GetFormNode()->GetElementType() != XFA_Element::Draw) {
-      pLayoutItem = pLayoutItem->GetNextSibling();
+      pLayoutItem.Reset(pLayoutItem->GetNextSibling());
       continue;
     }
     if (pLayoutItem->GetFormNode()->GetElementType() != XFA_Element::Draw)
@@ -1021,8 +1019,8 @@ void CXFA_ContentLayoutProcessor::DoLayoutPageArea(
     else
       pPageAreaLayoutItem->InsertAfter(pLayoutItem, pBeforeItem);
 
-    pBeforeItem = pLayoutItem;
-    pLayoutItem = pNextLayoutItem;
+    pBeforeItem = pLayoutItem.Get();
+    pLayoutItem.Reset(pNextLayoutItem);
   }
 }
 
@@ -1299,10 +1297,9 @@ void CXFA_ContentLayoutProcessor::DoLayoutTableContainer(
   float fCurrentRowY = 0;
   for (CXFA_LayoutItem* pIter = m_pLayoutItem->GetFirstChild(); pIter;
        pIter = pIter->GetNextSibling()) {
-    CXFA_ContentLayoutItem* pLayoutChild = pIter->AsContentLayoutItem();
-    if (!pLayoutChild)
-      continue;
-    if (!pLayoutChild->GetFormNode()->PresenceRequiresSpace())
+    RetainPtr<CXFA_ContentLayoutItem> pLayoutChild(
+        pIter->AsContentLayoutItem());
+    if (!pLayoutChild || !pLayoutChild->GetFormNode()->PresenceRequiresSpace())
       continue;
 
     if (pLayoutChild->GetFormNode()->GetElementType() == XFA_Element::Subform) {
@@ -1371,7 +1368,7 @@ bool CXFA_ContentLayoutProcessor::IsAddNewRowForTrailer(
 }
 
 float CXFA_ContentLayoutProcessor::InsertKeepLayoutItems() {
-  if (m_arrayKeepItems.empty())
+  if (m_ArrayKeepItems.empty())
     return 0;
 
   if (!m_pLayoutItem) {
@@ -1380,12 +1377,12 @@ float CXFA_ContentLayoutProcessor::InsertKeepLayoutItems() {
   }
 
   float fTotalHeight = 0;
-  for (auto iter = m_arrayKeepItems.rbegin(); iter != m_arrayKeepItems.rend();
+  for (auto iter = m_ArrayKeepItems.rbegin(); iter != m_ArrayKeepItems.rend();
        iter++) {
     AddLeaderAfterSplit(*iter);
     fTotalHeight += (*iter)->m_sSize.height;
   }
-  m_arrayKeepItems.clear();
+  m_ArrayKeepItems.clear();
 
   return fTotalHeight;
 }
@@ -1393,7 +1390,7 @@ float CXFA_ContentLayoutProcessor::InsertKeepLayoutItems() {
 bool CXFA_ContentLayoutProcessor::ProcessKeepForSplit(
     CXFA_ContentLayoutProcessor* pChildProcessor,
     Result eRetValue,
-    std::vector<CXFA_ContentLayoutItem*>* rgCurLineLayoutItem,
+    std::vector<RetainPtr<CXFA_ContentLayoutItem>>* rgCurLineLayoutItem,
     float* fContentCurRowAvailWidth,
     float* fContentCurRowHeight,
     float* fContentCurRowY,
@@ -1411,14 +1408,14 @@ bool CXFA_ContentLayoutProcessor::ProcessKeepForSplit(
     return false;
 
   CFX_SizeF childSize = pChildProcessor->GetCurrentComponentSize();
-  std::vector<CXFA_ContentLayoutItem*> keepLayoutItems;
-  if (JudgePutNextPage(m_pLayoutItem, childSize.height, &keepLayoutItems)) {
-    m_arrayKeepItems.clear();
-
-    for (auto* item : keepLayoutItems) {
+  std::vector<RetainPtr<CXFA_ContentLayoutItem>> keepLayoutItems;
+  if (JudgePutNextPage(m_pLayoutItem.Get(), childSize.height,
+                       &keepLayoutItems)) {
+    m_ArrayKeepItems.clear();
+    for (auto& item : keepLayoutItems) {
       m_pLayoutItem->RemoveChild(item);
       *fContentCurRowY -= item->m_sSize.height;
-      m_arrayKeepItems.push_back(item);
+      m_ArrayKeepItems.push_back(item);
     }
     *bAddedItemInRow = true;
     *bForceEndPage = true;
@@ -1437,14 +1434,15 @@ bool CXFA_ContentLayoutProcessor::ProcessKeepForSplit(
 bool CXFA_ContentLayoutProcessor::JudgePutNextPage(
     CXFA_ContentLayoutItem* pParentLayoutItem,
     float fChildHeight,
-    std::vector<CXFA_ContentLayoutItem*>* pKeepItems) {
+    std::vector<RetainPtr<CXFA_ContentLayoutItem>>* pKeepItems) {
   if (!pParentLayoutItem)
     return false;
 
   float fItemsHeight = 0;
   for (CXFA_LayoutItem* pIter = pParentLayoutItem->GetFirstChild(); pIter;
        pIter = pIter->GetNextSibling()) {
-    CXFA_ContentLayoutItem* pChildLayoutItem = pIter->AsContentLayoutItem();
+    RetainPtr<CXFA_ContentLayoutItem> pChildLayoutItem(
+        pIter->AsContentLayoutItem());
     if (!pChildLayoutItem)
       continue;
 
@@ -1481,7 +1479,7 @@ void CXFA_ContentLayoutProcessor::ProcessUnUseBinds(CXFA_Node* pFormNode) {
 void CXFA_ContentLayoutProcessor::ProcessUnUseOverFlow(
     CXFA_Node* pLeaderNode,
     CXFA_Node* pTrailerNode,
-    CXFA_ContentLayoutItem* pTrailerItem,
+    const RetainPtr<CXFA_ContentLayoutItem>& pTrailerItem,
     CXFA_Node* pFormNode) {
   ProcessUnUseBinds(pLeaderNode);
   ProcessUnUseBinds(pTrailerNode);
@@ -1561,7 +1559,7 @@ CXFA_ContentLayoutProcessor::DoLayoutFlowedContainer(
     float fContentCurRowHeight = 0;
     float fContentCurRowAvailWidth = fContentWidthLimit;
     m_fWidthLimit = fContentCurRowAvailWidth;
-    std::vector<CXFA_ContentLayoutItem*> rgCurLineLayoutItems[3];
+    std::vector<RetainPtr<CXFA_ContentLayoutItem>> rgCurLineLayoutItems[3];
     uint8_t uCurHAlignState =
         (eFlowStrategy != XFA_AttributeValue::Rl_tb ? 0 : 2);
     if (pLastChild) {
@@ -1574,14 +1572,15 @@ CXFA_ContentLayoutProcessor::DoLayoutFlowedContainer(
             m_pCurChildPreprocessor->GetFormNode() ==
                 pLayoutNext->GetFormNode()) {
           if (m_pCurChildPreprocessor->m_pLayoutItem)
-            pLayoutNext->InsertAfter(m_pCurChildPreprocessor->m_pLayoutItem);
-          m_pCurChildPreprocessor->m_pLayoutItem = pLayoutNext;
+            pLayoutNext->InsertAfter(
+                m_pCurChildPreprocessor->m_pLayoutItem.Get());
+          m_pCurChildPreprocessor->m_pLayoutItem.Reset(pLayoutNext);
           break;
         }
         uint8_t uHAlign =
             HAlignEnumToInt(pLayoutNext->GetFormNode()->JSObject()->GetEnum(
                 XFA_Attribute::HAlign));
-        rgCurLineLayoutItems[uHAlign].push_back(pLayoutNext);
+        rgCurLineLayoutItems[uHAlign].emplace_back(pLayoutNext);
         if (eFlowStrategy == XFA_AttributeValue::Lr_tb) {
           if (uHAlign > uCurHAlignState)
             uCurHAlignState = uHAlign;
@@ -1595,12 +1594,12 @@ CXFA_ContentLayoutProcessor::DoLayoutFlowedContainer(
         }
       }
 
-      CXFA_ContentLayoutItem* pLayoutNextTemp = pLastChild;
+      RetainPtr<CXFA_ContentLayoutItem> pLayoutNextTemp(pLastChild);
       while (pLayoutNextTemp) {
         CXFA_ContentLayoutItem* pSaveLayoutNext =
             ToContentLayoutItem(pLayoutNextTemp->GetNextSibling());
         pLayoutNextTemp->RemoveSelfIfParented();
-        pLayoutNextTemp = pSaveLayoutNext;
+        pLayoutNextTemp.Reset(pSaveLayoutNext);
       }
       pLastChild = nullptr;
     }
@@ -1614,7 +1613,7 @@ CXFA_ContentLayoutProcessor::DoLayoutFlowedContainer(
         case Stage::kNone:
           break;
         case Stage::kBreakBefore: {
-          for (auto* item : m_arrayKeepItems) {
+          for (auto& item : m_ArrayKeepItems) {
             m_pLayoutItem->RemoveChild(item);
             calculated_size.height -= item->m_sSize.height;
           }
@@ -1871,7 +1870,7 @@ CXFA_ContentLayoutProcessor::DoLayoutFlowedContainer(
 }
 
 bool CXFA_ContentLayoutProcessor::CalculateRowChildPosition(
-    std::vector<CXFA_ContentLayoutItem*> (&rgCurLineLayoutItems)[3],
+    std::vector<RetainPtr<CXFA_ContentLayoutItem>> (&rgCurLineLayoutItems)[3],
     XFA_AttributeValue eFlowStrategy,
     bool bContainerHeightAutoSize,
     bool bContainerWidthAutoSize,
@@ -2132,7 +2131,7 @@ bool CXFA_ContentLayoutProcessor::JudgeLeaderOrTrailerForOccur(
 }
 
 void CXFA_ContentLayoutProcessor::UpdatePendingItemLayout(
-    CXFA_ContentLayoutItem* pLayoutItem) {
+    const RetainPtr<CXFA_ContentLayoutItem>& pLayoutItem) {
   XFA_AttributeValue eLayout =
       pLayoutItem->GetFormNode()->JSObject()->GetEnum(XFA_Attribute::Layout);
   switch (eLayout) {
@@ -2147,7 +2146,7 @@ void CXFA_ContentLayoutProcessor::UpdatePendingItemLayout(
 
 void CXFA_ContentLayoutProcessor::AddTrailerBeforeSplit(
     float fSplitPos,
-    CXFA_ContentLayoutItem* pTrailerLayoutItem,
+    const RetainPtr<CXFA_ContentLayoutItem>& pTrailerLayoutItem,
     bool bUseInherited) {
   if (!pTrailerLayoutItem)
     return;
@@ -2166,7 +2165,7 @@ void CXFA_ContentLayoutProcessor::AddTrailerBeforeSplit(
   CXFA_Margin* pMargin =
       GetFormNode()->GetFirstChildByClass<CXFA_Margin>(XFA_Element::Margin);
   CFX_FloatRect inset = GetMarginInset(pMargin);
-  if (!IsAddNewRowForTrailer(pTrailerLayoutItem)) {
+  if (!IsAddNewRowForTrailer(pTrailerLayoutItem.Get())) {
     pTrailerLayoutItem->m_sPos.y = m_fLastRowY;
     pTrailerLayoutItem->m_sPos.x = m_fLastRowWidth;
     m_pLayoutItem->m_sSize.width += pTrailerLayoutItem->m_sSize.width;
@@ -2208,7 +2207,7 @@ void CXFA_ContentLayoutProcessor::AddTrailerBeforeSplit(
 }
 
 void CXFA_ContentLayoutProcessor::AddLeaderAfterSplit(
-    CXFA_ContentLayoutItem* pLeaderLayoutItem) {
+    const RetainPtr<CXFA_ContentLayoutItem>& pLeaderLayoutItem) {
   UpdatePendingItemLayout(pLeaderLayoutItem);
 
   CXFA_Margin* pMarginNode =
@@ -2276,10 +2275,9 @@ float CXFA_ContentLayoutProcessor::InsertPendingItems(
         m_PendingNodes.front(), nullptr);
     m_PendingNodes.pop_front();
     pPendingProcessor->DoLayout(false, FLT_MAX, FLT_MAX);
-    CXFA_ContentLayoutItem* pPendingLayoutItem =
-        pPendingProcessor->HasLayoutItem()
-            ? pPendingProcessor->ExtractLayoutItem()
-            : nullptr;
+    RetainPtr<CXFA_ContentLayoutItem> pPendingLayoutItem;
+    if (pPendingProcessor->HasLayoutItem())
+      pPendingLayoutItem = pPendingProcessor->ExtractLayoutItem();
     if (pPendingLayoutItem) {
       AddLeaderAfterSplit(pPendingLayoutItem);
       if (m_bBreakPending)
@@ -2297,7 +2295,7 @@ CXFA_ContentLayoutProcessor::InsertFlowedItem(
     float fContainerHeight,
     XFA_AttributeValue eFlowStrategy,
     uint8_t* uCurHAlignState,
-    std::vector<CXFA_ContentLayoutItem*> (&rgCurLineLayoutItems)[3],
+    std::vector<RetainPtr<CXFA_ContentLayoutItem>> (&rgCurLineLayoutItems)[3],
     bool bUseBreakControl,
     float fAvailHeight,
     float fRealHeight,
@@ -2380,7 +2378,7 @@ CXFA_ContentLayoutProcessor::InsertFlowedItem(
   CXFA_Node* pOverflowLeaderNode = nullptr;
   CXFA_Node* pOverflowTrailerNode = nullptr;
   CXFA_Node* pFormNode = nullptr;
-  CXFA_ContentLayoutItem* pTrailerLayoutItem = nullptr;
+  RetainPtr<CXFA_ContentLayoutItem> pTrailerLayoutItem;
   bool bIsAddTrailerHeight = false;
   if (m_pViewLayoutProcessor &&
       pProcessor->GetFormNode()->GetIntact() == XFA_AttributeValue::None) {
@@ -2409,8 +2407,8 @@ CXFA_ContentLayoutProcessor::InsertFlowedItem(
 
         bIsAddTrailerHeight =
             bUseInherited
-                ? IsAddNewRowForTrailer(pTrailerLayoutItem)
-                : pProcessor->IsAddNewRowForTrailer(pTrailerLayoutItem);
+                ? IsAddNewRowForTrailer(pTrailerLayoutItem.Get())
+                : pProcessor->IsAddNewRowForTrailer(pTrailerLayoutItem.Get());
         if (bIsAddTrailerHeight) {
           childSize.height += pTrailerLayoutItem->m_sSize.height;
           bIsAddTrailerHeight = true;
@@ -2442,13 +2440,13 @@ CXFA_ContentLayoutProcessor::InsertFlowedItem(
                                          pTrailerLayoutItem, pFormNode);
       }
 
-      CXFA_ContentLayoutItem* pChildLayoutItem =
+      RetainPtr<CXFA_ContentLayoutItem> pChildLayoutItem =
           pProcessor->ExtractLayoutItem();
       if (ExistContainerKeep(pProcessor->GetFormNode(), false) &&
           pProcessor->GetFormNode()->GetIntact() == XFA_AttributeValue::None) {
-        m_arrayKeepItems.push_back(pChildLayoutItem);
+        m_ArrayKeepItems.push_back(pChildLayoutItem);
       } else {
-        m_arrayKeepItems.clear();
+        m_ArrayKeepItems.clear();
       }
       rgCurLineLayoutItems[uHAlign].push_back(pChildLayoutItem);
       *bAddedItemInRow = true;
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutprocessor.h b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutprocessor.h
index e8a425c7b63..c4cfbe7dd5f 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutprocessor.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_contentlayoutprocessor.h
@@ -15,6 +15,7 @@
 #include <vector>
 
 #include "core/fxcrt/fx_coordinates.h"
+#include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "third_party/base/optional.h"
 #include "xfa/fxfa/fxfa_basic.h"
@@ -56,7 +57,7 @@ class CXFA_ContentLayoutProcessor {
   void DoLayoutPageArea(CXFA_ViewLayoutItem* pPageAreaLayoutItem);
 
   CXFA_Node* GetFormNode() { return m_pFormNode; }
-  CXFA_ContentLayoutItem* ExtractLayoutItem();
+  RetainPtr<CXFA_ContentLayoutItem> ExtractLayoutItem();
 
  private:
   class Context {
@@ -78,27 +79,27 @@ class CXFA_ContentLayoutProcessor {
   CFX_SizeF GetCurrentComponentSize();
   bool HasLayoutItem() const { return !!m_pLayoutItem; }
   void SplitLayoutItem(float fSplitPos);
-
   float FindSplitPos(float fProposedSplitPos);
-
   bool ProcessKeepForSplit(
       CXFA_ContentLayoutProcessor* pChildProcessor,
       Result eRetValue,
-      std::vector<CXFA_ContentLayoutItem*>* rgCurLineLayoutItem,
+      std::vector<RetainPtr<CXFA_ContentLayoutItem>>* rgCurLineLayoutItem,
       float* fContentCurRowAvailWidth,
       float* fContentCurRowHeight,
       float* fContentCurRowY,
       bool* bAddedItemInRow,
       bool* bForceEndPage,
       Result* result);
-  void ProcessUnUseOverFlow(CXFA_Node* pLeaderNode,
-                            CXFA_Node* pTrailerNode,
-                            CXFA_ContentLayoutItem* pTrailerItem,
-                            CXFA_Node* pFormNode);
+  void ProcessUnUseOverFlow(
+      CXFA_Node* pLeaderNode,
+      CXFA_Node* pTrailerNode,
+      const RetainPtr<CXFA_ContentLayoutItem>& pTrailerItem,
+      CXFA_Node* pFormNode);
   bool IsAddNewRowForTrailer(CXFA_ContentLayoutItem* pTrailerItem);
   bool JudgeLeaderOrTrailerForOccur(CXFA_Node* pFormNode);
 
-  CXFA_ContentLayoutItem* CreateContentLayoutItem(CXFA_Node* pFormNode);
+  RetainPtr<CXFA_ContentLayoutItem> CreateContentLayoutItem(
+      CXFA_Node* pFormNode);
 
   void SetCurrentComponentPos(const CFX_PointF& pos);
   void SetCurrentComponentSize(const CFX_SizeF& size);
@@ -108,7 +109,7 @@ class CXFA_ContentLayoutProcessor {
                        float fSplitPos);
   float InsertKeepLayoutItems();
   bool CalculateRowChildPosition(
-      std::vector<CXFA_ContentLayoutItem*> (&rgCurLineLayoutItems)[3],
+      std::vector<RetainPtr<CXFA_ContentLayoutItem>> (&rgCurLineLayoutItems)[3],
       XFA_AttributeValue eFlowStrategy,
       bool bContainerHeightAutoSize,
       bool bContainerWidthAutoSize,
@@ -119,9 +120,10 @@ class CXFA_ContentLayoutProcessor {
       float fContentWidthLimit,
       bool bRootForceTb);
   void ProcessUnUseBinds(CXFA_Node* pFormNode);
-  bool JudgePutNextPage(CXFA_ContentLayoutItem* pParentLayoutItem,
-                        float fChildHeight,
-                        std::vector<CXFA_ContentLayoutItem*>* pKeepItems);
+  bool JudgePutNextPage(
+      CXFA_ContentLayoutItem* pParentLayoutItem,
+      float fChildHeight,
+      std::vector<RetainPtr<CXFA_ContentLayoutItem>>* pKeepItems);
 
   void DoLayoutPositionedContainer(Context* pContext);
   void DoLayoutTableContainer(CXFA_Node* pLayoutNode);
@@ -148,11 +150,14 @@ class CXFA_ContentLayoutProcessor {
 
   CXFA_Node* GetSubformSetParent(CXFA_Node* pSubformSet);
 
-  void UpdatePendingItemLayout(CXFA_ContentLayoutItem* pLayoutItem);
-  void AddTrailerBeforeSplit(float fSplitPos,
-                             CXFA_ContentLayoutItem* pTrailerLayoutItem,
-                             bool bUseInherited);
-  void AddLeaderAfterSplit(CXFA_ContentLayoutItem* pLeaderLayoutItem);
+  void UpdatePendingItemLayout(
+      const RetainPtr<CXFA_ContentLayoutItem>& pLayoutItem);
+  void AddTrailerBeforeSplit(
+      float fSplitPos,
+      const RetainPtr<CXFA_ContentLayoutItem>& pTrailerLayoutItem,
+      bool bUseInherited);
+  void AddLeaderAfterSplit(
+      const RetainPtr<CXFA_ContentLayoutItem>& pLeaderLayoutItem);
   void AddPendingNode(CXFA_Node* pPendingNode, bool bBreakPending);
   float InsertPendingItems(CXFA_Node* pCurChildNode);
   Result InsertFlowedItem(
@@ -162,7 +167,7 @@ class CXFA_ContentLayoutProcessor {
       float fContainerHeight,
       XFA_AttributeValue eFlowStrategy,
       uint8_t* uCurHAlignState,
-      std::vector<CXFA_ContentLayoutItem*> (&rgCurLineLayoutItems)[3],
+      std::vector<RetainPtr<CXFA_ContentLayoutItem>> (&rgCurLineLayoutItems)[3],
       bool bUseBreakControl,
       float fAvailHeight,
       float fRealHeight,
@@ -212,11 +217,11 @@ class CXFA_ContentLayoutProcessor {
   CXFA_Node* m_pCurChildNode = nullptr;
   CXFA_Node* m_pKeepHeadNode = nullptr;
   CXFA_Node* m_pKeepTailNode = nullptr;
-  CXFA_ContentLayoutItem* m_pLayoutItem = nullptr;
-  CXFA_ContentLayoutItem* m_pOldLayoutItem = nullptr;
+  RetainPtr<CXFA_ContentLayoutItem> m_pLayoutItem;
+  RetainPtr<CXFA_ContentLayoutItem> m_pOldLayoutItem;
   UnownedPtr<CXFA_ViewLayoutProcessor> m_pViewLayoutProcessor;
   std::vector<float> m_rgSpecifiedColumnWidths;
-  std::vector<CXFA_ContentLayoutItem*> m_arrayKeepItems;
+  std::vector<RetainPtr<CXFA_ContentLayoutItem>> m_ArrayKeepItems;
   std::list<CXFA_Node*> m_PendingNodes;
   std::map<CXFA_Node*, int32_t> m_PendingNodesCount;
   std::unique_ptr<CXFA_ContentLayoutProcessor> m_pCurChildPreprocessor;
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutitem.cpp b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutitem.cpp
index b4244bed23f..9ee7b612c47 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutitem.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutitem.cpp
@@ -6,6 +6,8 @@
 
 #include "xfa/fxfa/layout/cxfa_layoutitem.h"
 
+#include <utility>
+
 #include "fxjs/xfa/cjx_object.h"
 #include "xfa/fxfa/cxfa_ffnotify.h"
 #include "xfa/fxfa/layout/cxfa_contentlayoutitem.h"
@@ -15,23 +17,22 @@
 #include "xfa/fxfa/parser/cxfa_measurement.h"
 #include "xfa/fxfa/parser/cxfa_node.h"
 
-void XFA_ReleaseLayoutItem(CXFA_LayoutItem* pLayoutItem) {
-  CXFA_LayoutItem* pNode = pLayoutItem->GetFirstChild();
+void XFA_ReleaseLayoutItem(const RetainPtr<CXFA_LayoutItem>& pLayoutItem) {
+  RetainPtr<CXFA_LayoutItem> pNode(pLayoutItem->GetFirstChild());
   while (pNode) {
-    CXFA_LayoutItem* pNext = pNode->GetNextSibling();
+    RetainPtr<CXFA_LayoutItem> pNext(pNode->GetNextSibling());
     XFA_ReleaseLayoutItem(pNode);
-    pNode = pNext;
+    pNode = std::move(pNext);
   }
   CXFA_Document* pDocument = pLayoutItem->GetFormNode()->GetDocument();
   CXFA_FFNotify* pNotify = pDocument->GetNotify();
   auto* pDocLayout = CXFA_LayoutProcessor::FromDocument(pDocument);
-  pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem);
+  pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem.Get());
   if (pLayoutItem->GetFormNode()->GetElementType() == XFA_Element::PageArea) {
-    pNotify->OnPageEvent(ToViewLayoutItem(pLayoutItem),
+    pNotify->OnPageEvent(ToViewLayoutItem(pLayoutItem.Get()),
                          XFA_PAGEVIEWEVENT_PostRemoved);
   }
   pLayoutItem->RemoveSelfIfParented();
-  delete pLayoutItem;
 }
 
 CXFA_LayoutItem::CXFA_LayoutItem(CXFA_Node* pNode, ItemType type)
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutitem.h b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutitem.h
index b162fc09e6f..034c145e98b 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutitem.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutitem.h
@@ -7,7 +7,8 @@
 #ifndef XFA_FXFA_LAYOUT_CXFA_LAYOUTITEM_H_
 #define XFA_FXFA_LAYOUT_CXFA_LAYOUTITEM_H_
 
-#include "core/fxcrt/tree_node.h"
+#include "core/fxcrt/retain_ptr.h"
+#include "core/fxcrt/retained_tree_node.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "xfa/fxfa/parser/cxfa_document.h"
 
@@ -15,7 +16,7 @@ class CXFA_ContentLayoutItem;
 class CXFA_LayoutProcessor;
 class CXFA_ViewLayoutItem;
 
-class CXFA_LayoutItem : public TreeNode<CXFA_LayoutItem> {
+class CXFA_LayoutItem : public RetainedTreeNode<CXFA_LayoutItem> {
  public:
   ~CXFA_LayoutItem() override;
 
@@ -47,6 +48,6 @@ inline CXFA_ContentLayoutItem* ToContentLayoutItem(CXFA_LayoutItem* item) {
   return item ? item->AsContentLayoutItem() : nullptr;
 }
 
-void XFA_ReleaseLayoutItem(CXFA_LayoutItem* pLayoutItem);
+void XFA_ReleaseLayoutItem(const RetainPtr<CXFA_LayoutItem>& pLayoutItem);
 
 #endif  // XFA_FXFA_LAYOUT_CXFA_LAYOUTITEM_H_
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutprocessor.cpp b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutprocessor.cpp
index 0edfefdaec6..e84c262ce0e 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutprocessor.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutprocessor.cpp
@@ -35,7 +35,7 @@ void CXFA_LayoutProcessor::SetForceRelayout(bool bForceRestart) {
 }
 
 int32_t CXFA_LayoutProcessor::StartLayout(bool bForceRestart) {
-  if (!bForceRestart && !IsNeedLayout())
+  if (!bForceRestart && !NeedLayout())
     return 100;
 
   m_pContentLayoutProcessor.reset();
@@ -81,7 +81,7 @@ int32_t CXFA_LayoutProcessor::DoLayout() {
     if (eStatus != CXFA_ContentLayoutProcessor::Result::kDone)
       m_nProgressCounter++;
 
-    CXFA_ContentLayoutItem* pLayoutItem =
+    RetainPtr<CXFA_ContentLayoutItem> pLayoutItem =
         m_pContentLayoutProcessor->ExtractLayoutItem();
     if (pLayoutItem)
       pLayoutItem->m_sPos = CFX_PointF(fPosX, fPosY);
@@ -133,6 +133,6 @@ CXFA_ViewLayoutItem* CXFA_LayoutProcessor::GetRootLayoutItem() const {
                                 : nullptr;
 }
 
-bool CXFA_LayoutProcessor::IsNeedLayout() {
+bool CXFA_LayoutProcessor::NeedLayout() const {
   return m_bNeedLayout || !m_rgChangedContainers.empty();
 }
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutprocessor.h b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutprocessor.h
index 29cd3d6f083..5b6730ad043 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutprocessor.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_layoutprocessor.h
@@ -46,7 +46,7 @@ class CXFA_LayoutProcessor : public CXFA_Document::LayoutProcessorIface {
   }
 
  private:
-  bool IsNeedLayout();
+  bool NeedLayout() const;
 
   std::unique_ptr<CXFA_ViewLayoutProcessor> m_pViewLayoutProcessor;
   std::unique_ptr<CXFA_ContentLayoutProcessor> m_pContentLayoutProcessor;
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_traversestrategy_layoutitem.h b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_traversestrategy_layoutitem.h
index d35ce11900c..f71d7086494 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_traversestrategy_layoutitem.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_traversestrategy_layoutitem.h
@@ -7,6 +7,7 @@
 #ifndef XFA_FXFA_LAYOUT_CXFA_TRAVERSESTRATEGY_LAYOUTITEM_H_
 #define XFA_FXFA_LAYOUT_CXFA_TRAVERSESTRATEGY_LAYOUTITEM_H_
 
+#include "core/fxcrt/retain_ptr.h"
 #include "xfa/fxfa/layout/cxfa_layoutitem.h"
 #include "xfa/fxfa/parser/cxfa_nodeiteratortemplate.h"
 
@@ -25,6 +26,7 @@ class CXFA_TraverseStrategy_LayoutItem {
 
 using CXFA_LayoutItemIterator =
     CXFA_NodeIteratorTemplate<CXFA_LayoutItem,
-                              CXFA_TraverseStrategy_LayoutItem>;
+                              CXFA_TraverseStrategy_LayoutItem,
+                              RetainPtr<CXFA_LayoutItem>>;
 
 #endif  // XFA_FXFA_LAYOUT_CXFA_TRAVERSESTRATEGY_LAYOUTITEM_H_
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutitem.h b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutitem.h
index 1ced4817450..1c9f77c81b6 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutitem.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutitem.h
@@ -15,8 +15,9 @@ class CXFA_FFPageView;
 
 class CXFA_ViewLayoutItem : public CXFA_LayoutItem {
  public:
-  CXFA_ViewLayoutItem(CXFA_Node* pNode,
-                      std::unique_ptr<CXFA_FFPageView> pPageView);
+  template <typename T, typename... Args>
+  friend RetainPtr<T> pdfium::MakeRetain(Args&&... args);
+
   ~CXFA_ViewLayoutItem() override;
 
   CXFA_FFPageView* GetPageView() const { return m_pFFPageView.get(); }
@@ -28,6 +29,9 @@ class CXFA_ViewLayoutItem : public CXFA_LayoutItem {
   UnownedPtr<CXFA_Node> m_pOldSubform;
 
  private:
+  CXFA_ViewLayoutItem(CXFA_Node* pNode,
+                      std::unique_ptr<CXFA_FFPageView> pPageView);
+
   std::unique_ptr<CXFA_FFPageView> const m_pFFPageView;
 };
 
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp
index 0605aa65a74..97a89e01714 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp
@@ -158,7 +158,7 @@ void SyncContainer(CXFA_FFNotify* pNotify,
   }
 }
 
-void ReorderLayoutItemToTail(CXFA_LayoutItem* pLayoutItem) {
+void ReorderLayoutItemToTail(const RetainPtr<CXFA_LayoutItem>& pLayoutItem) {
   CXFA_LayoutItem* pParentLayoutItem = pLayoutItem->GetParent();
   if (!pParentLayoutItem)
     return;
@@ -246,15 +246,15 @@ Optional<CXFA_ViewLayoutItem*> CheckContentAreaNotUsed(
 void SyncRemoveLayoutItem(CXFA_LayoutItem* pLayoutItem,
                           CXFA_FFNotify* pNotify,
                           CXFA_LayoutProcessor* pDocLayout) {
-  CXFA_LayoutItem* pCurLayoutItem = pLayoutItem->GetFirstChild();
+  RetainPtr<CXFA_LayoutItem> pCurLayoutItem(pLayoutItem->GetFirstChild());
   while (pCurLayoutItem) {
-    CXFA_LayoutItem* pNextLayoutItem = pCurLayoutItem->GetNextSibling();
-    SyncRemoveLayoutItem(pCurLayoutItem, pNotify, pDocLayout);
-    pCurLayoutItem = pNextLayoutItem;
+    RetainPtr<CXFA_LayoutItem> pNextLayoutItem(
+        pCurLayoutItem->GetNextSibling());
+    SyncRemoveLayoutItem(pCurLayoutItem.Get(), pNotify, pDocLayout);
+    pCurLayoutItem = std::move(pNextLayoutItem);
   }
   pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem);
   pLayoutItem->RemoveSelfIfParented();
-  delete pLayoutItem;
 }
 
 bool RunBreakTestScript(CXFA_Script* pTestScript) {
@@ -329,40 +329,22 @@ bool ContentAreasFitInPageAreas(const CXFA_Node* pNode,
 
 }  // namespace
 
-class CXFA_ViewRecord {
- public:
-  CXFA_ViewRecord(CXFA_ViewLayoutItem* pPageSet = nullptr,
-                  CXFA_ViewLayoutItem* pPageArea = nullptr,
-                  CXFA_ViewLayoutItem* pContentArea = nullptr)
-      : pCurPageSet(pPageSet),
-        pCurPageArea(pPageArea),
-        pCurContentArea(pContentArea) {}
-
-  CXFA_ViewLayoutItem* pCurPageSet;
-  CXFA_ViewLayoutItem* pCurPageArea;
-  CXFA_ViewLayoutItem* pCurContentArea;
-};
+CXFA_ViewLayoutProcessor::CXFA_ViewRecord::CXFA_ViewRecord() = default;
+
+CXFA_ViewLayoutProcessor::CXFA_ViewRecord::~CXFA_ViewRecord() = default;
 
 CXFA_ViewLayoutProcessor::CXFA_ViewLayoutProcessor(
     CXFA_LayoutProcessor* pLayoutProcessor)
     : m_pLayoutProcessor(pLayoutProcessor),
-      m_pTemplatePageSetRoot(nullptr),
-      m_pPageSetLayoutItemRoot(nullptr),
-      m_pPageSetCurRoot(nullptr),
-      m_CurrentViewRecordIter(m_ProposedViewRecords.end()),
-      m_pCurPageArea(nullptr),
-      m_nAvailPages(0),
-      m_nCurPageCount(0),
-      m_ePageSetMode(XFA_AttributeValue::OrderedOccurrence),
-      m_bCreateOverFlowPage(false) {}
+      m_CurrentViewRecordIter(m_ProposedViewRecords.end()) {}
 
 CXFA_ViewLayoutProcessor::~CXFA_ViewLayoutProcessor() {
   ClearData();
-  CXFA_LayoutItem* pLayoutItem = GetRootLayoutItem();
-  CXFA_LayoutItem* pNextLayout = nullptr;
-  for (; pLayoutItem; pLayoutItem = pNextLayout) {
-    pNextLayout = pLayoutItem->GetNextSibling();
+  RetainPtr<CXFA_LayoutItem> pLayoutItem(GetRootLayoutItem());
+  while (pLayoutItem) {
+    CXFA_LayoutItem* pNextLayout = pLayoutItem->GetNextSibling();
     XFA_ReleaseLayoutItem(pLayoutItem);
+    pLayoutItem.Reset(pNextLayout);
   }
 }
 
@@ -380,11 +362,12 @@ bool CXFA_ViewLayoutProcessor::InitLayoutPage(CXFA_Node* pFormNode) {
   if (m_pPageSetLayoutItemRoot) {
     m_pPageSetLayoutItemRoot->RemoveSelfIfParented();
   } else {
-    m_pPageSetLayoutItemRoot =
-        new CXFA_ViewLayoutItem(m_pTemplatePageSetRoot, nullptr);
+    m_pPageSetLayoutItemRoot = pdfium::MakeRetain<CXFA_ViewLayoutItem>(
+        m_pTemplatePageSetRoot, nullptr);
   }
   m_pPageSetCurRoot = m_pPageSetLayoutItemRoot;
-  m_pTemplatePageSetRoot->JSObject()->SetLayoutItem(m_pPageSetLayoutItemRoot);
+  m_pTemplatePageSetRoot->JSObject()->SetLayoutItem(
+      m_pPageSetLayoutItemRoot.Get());
 
   XFA_AttributeValue eRelation =
       m_pTemplatePageSetRoot->JSObject()->GetEnum(XFA_Attribute::Relation);
@@ -546,9 +529,12 @@ void CXFA_ViewLayoutProcessor::ReorderPendingLayoutRecordToTail(
 }
 
 void CXFA_ViewLayoutProcessor::SubmitContentItem(
-    CXFA_ContentLayoutItem* pContentLayoutItem,
+    const RetainPtr<CXFA_ContentLayoutItem>& pContentLayoutItem,
     CXFA_ContentLayoutProcessor::Result eStatus) {
   if (pContentLayoutItem) {
+    if (!HasCurrentViewRecord())
+      return;
+
     GetCurrentViewRecord()->pCurContentArea->AppendLastChild(
         pContentLayoutItem);
     m_bCreateOverFlowPage = false;
@@ -565,7 +551,11 @@ void CXFA_ViewLayoutProcessor::SubmitContentItem(
 }
 
 float CXFA_ViewLayoutProcessor::GetAvailHeight() {
-  CXFA_ViewLayoutItem* pLayoutItem = GetCurrentViewRecord()->pCurContentArea;
+  if (!HasCurrentViewRecord())
+    return 0.0f;
+
+  RetainPtr<CXFA_ViewLayoutItem> pLayoutItem =
+      GetCurrentViewRecord()->pCurContentArea;
   if (!pLayoutItem || !pLayoutItem->GetFormNode())
     return 0.0f;
 
@@ -578,15 +568,16 @@ float CXFA_ViewLayoutProcessor::GetAvailHeight() {
   return FLT_MAX;
 }
 
-CXFA_ViewRecord* CXFA_ViewLayoutProcessor::AppendNewRecord(
+CXFA_ViewLayoutProcessor::CXFA_ViewRecord*
+CXFA_ViewLayoutProcessor::AppendNewRecord(
     std::unique_ptr<CXFA_ViewRecord> pNewRecord) {
   m_ProposedViewRecords.push_back(std::move(pNewRecord));
   return m_ProposedViewRecords.back().get();
 }
 
-CXFA_ViewRecord* CXFA_ViewLayoutProcessor::CreateViewRecord(
-    CXFA_Node* pPageNode,
-    bool bCreateNew) {
+CXFA_ViewLayoutProcessor::CXFA_ViewRecord*
+CXFA_ViewLayoutProcessor::CreateViewRecord(CXFA_Node* pPageNode,
+                                           bool bCreateNew) {
   ASSERT(pPageNode);
   auto pNewRecord = pdfium::MakeUnique<CXFA_ViewRecord>();
   if (!HasCurrentViewRecord()) {
@@ -594,11 +585,11 @@ CXFA_ViewRecord* CXFA_ViewLayoutProcessor::CreateViewRecord(
     if (pPageSet == m_pTemplatePageSetRoot) {
       pNewRecord->pCurPageSet = m_pPageSetLayoutItemRoot;
     } else {
-      CXFA_ViewLayoutItem* pPageSetLayoutItem =
-          new CXFA_ViewLayoutItem(pPageSet, nullptr);
-      pPageSet->JSObject()->SetLayoutItem(pPageSetLayoutItem);
+      auto pPageSetLayoutItem =
+          pdfium::MakeRetain<CXFA_ViewLayoutItem>(pPageSet, nullptr);
+      pPageSet->JSObject()->SetLayoutItem(pPageSetLayoutItem.Get());
       m_pPageSetLayoutItemRoot->AppendLastChild(pPageSetLayoutItem);
-      pNewRecord->pCurPageSet = pPageSetLayoutItem;
+      pNewRecord->pCurPageSet = std::move(pPageSetLayoutItem);
     }
     return AppendNewRecord(std::move(pNewRecord));
   }
@@ -613,8 +604,8 @@ CXFA_ViewRecord* CXFA_ViewLayoutProcessor::CreateViewRecord(
     if (pPageSet == m_pTemplatePageSetRoot) {
       pNewRecord->pCurPageSet = m_pPageSetCurRoot;
     } else {
-      CXFA_ViewLayoutItem* pParentLayoutItem =
-          ToViewLayoutItem(pPageSet->JSObject()->GetLayoutItem());
+      RetainPtr<CXFA_ViewLayoutItem> pParentLayoutItem(
+          ToViewLayoutItem(pPageSet->JSObject()->GetLayoutItem()));
       if (!pParentLayoutItem)
         pParentLayoutItem = m_pPageSetCurRoot;
 
@@ -631,15 +622,18 @@ CXFA_ViewRecord* CXFA_ViewLayoutProcessor::CreateViewRecord(
     pParentPageSetLayout =
         ToViewLayoutItem(pPageSet->GetParent()->JSObject()->GetLayoutItem());
   }
-  auto* pPageSetLayoutItem = new CXFA_ViewLayoutItem(pPageSet, nullptr);
-  pPageSet->JSObject()->SetLayoutItem(pPageSetLayoutItem);
+  auto pPageSetLayoutItem =
+      pdfium::MakeRetain<CXFA_ViewLayoutItem>(pPageSet, nullptr);
+  pPageSet->JSObject()->SetLayoutItem(pPageSetLayoutItem.Get());
   if (!pParentPageSetLayout) {
-    CXFA_ViewLayoutItem* pPrePageSet = m_pPageSetLayoutItemRoot;
+    RetainPtr<CXFA_ViewLayoutItem> pPrePageSet(m_pPageSetLayoutItemRoot);
     while (pPrePageSet->GetNextSibling()) {
-      pPrePageSet = pPrePageSet->GetNextSibling()->AsViewLayoutItem();
+      pPrePageSet.Reset(pPrePageSet->GetNextSibling()->AsViewLayoutItem());
+    }
+    if (pPrePageSet->GetParent()) {
+      pPrePageSet->GetParent()->InsertAfter(pPageSetLayoutItem,
+                                            pPrePageSet.Get());
     }
-    if (pPrePageSet->GetParent())
-      pPrePageSet->GetParent()->InsertAfter(pPageSetLayoutItem, pPrePageSet);
     m_pPageSetCurRoot = pPageSetLayoutItem;
   } else {
     pParentPageSetLayout->AppendLastChild(pPageSetLayoutItem);
@@ -648,7 +642,8 @@ CXFA_ViewRecord* CXFA_ViewLayoutProcessor::CreateViewRecord(
   return AppendNewRecord(std::move(pNewRecord));
 }
 
-CXFA_ViewRecord* CXFA_ViewLayoutProcessor::CreateViewRecordSimple() {
+CXFA_ViewLayoutProcessor::CXFA_ViewRecord*
+CXFA_ViewLayoutProcessor::CreateViewRecordSimple() {
   auto pNewRecord = pdfium::MakeUnique<CXFA_ViewRecord>();
   if (HasCurrentViewRecord())
     *pNewRecord = *GetCurrentViewRecord();
@@ -660,21 +655,19 @@ CXFA_ViewRecord* CXFA_ViewLayoutProcessor::CreateViewRecordSimple() {
 void CXFA_ViewLayoutProcessor::AddPageAreaLayoutItem(
     CXFA_ViewRecord* pNewRecord,
     CXFA_Node* pNewPageArea) {
-  CXFA_ViewLayoutItem* pNewPageAreaLayoutItem = nullptr;
+  RetainPtr<CXFA_ViewLayoutItem> pNewPageAreaLayoutItem;
   if (pdfium::IndexInBounds(m_PageArray, m_nAvailPages)) {
-    CXFA_ViewLayoutItem* pViewItem = m_PageArray[m_nAvailPages];
+    RetainPtr<CXFA_ViewLayoutItem> pViewItem = m_PageArray[m_nAvailPages];
     pViewItem->SetFormNode(pNewPageArea);
     m_nAvailPages++;
-    pNewPageAreaLayoutItem = pViewItem;
+    pNewPageAreaLayoutItem = std::move(pViewItem);
   } else {
     CXFA_FFNotify* pNotify = pNewPageArea->GetDocument()->GetNotify();
-    auto* pViewItem =
-        pdfium::MakeUnique<CXFA_ViewLayoutItem>(
-            pNewPageArea, pNotify->OnCreateViewLayoutItem(pNewPageArea))
-            .release();
+    auto pViewItem = pdfium::MakeRetain<CXFA_ViewLayoutItem>(
+        pNewPageArea, pNotify->OnCreateViewLayoutItem(pNewPageArea));
     m_PageArray.push_back(pViewItem);
     m_nAvailPages++;
-    pNotify->OnPageEvent(pViewItem, XFA_PAGEVIEWEVENT_PostRemoved);
+    pNotify->OnPageEvent(pViewItem.Get(), XFA_PAGEVIEWEVENT_PostRemoved);
     pNewPageAreaLayoutItem = pViewItem;
   }
   pNewRecord->pCurPageSet->AppendLastChild(pNewPageAreaLayoutItem);
@@ -689,15 +682,15 @@ void CXFA_ViewLayoutProcessor::AddContentAreaLayoutItem(
     pNewRecord->pCurContentArea = nullptr;
     return;
   }
-  CXFA_ViewLayoutItem* pNewViewLayoutItem =
-      new CXFA_ViewLayoutItem(pContentArea, nullptr);
-  ASSERT(pNewRecord->pCurPageArea);
+  auto pNewViewLayoutItem =
+      pdfium::MakeRetain<CXFA_ViewLayoutItem>(pContentArea, nullptr);
   pNewRecord->pCurPageArea->AppendLastChild(pNewViewLayoutItem);
-  pNewRecord->pCurContentArea = pNewViewLayoutItem;
+  pNewRecord->pCurContentArea = std::move(pNewViewLayoutItem);
 }
 
 void CXFA_ViewLayoutProcessor::FinishPaginatedPageSets() {
-  for (CXFA_ViewLayoutItem* pRootPageSetLayoutItem = m_pPageSetLayoutItemRoot;
+  for (CXFA_ViewLayoutItem* pRootPageSetLayoutItem =
+           m_pPageSetLayoutItemRoot.Get();
        pRootPageSetLayoutItem; pRootPageSetLayoutItem = ToViewLayoutItem(
                                    pRootPageSetLayoutItem->GetNextSibling())) {
     PageSetIterator sIterator(pRootPageSetLayoutItem);
@@ -728,7 +721,7 @@ int32_t CXFA_ViewLayoutProcessor::GetPageCount() const {
 CXFA_ViewLayoutItem* CXFA_ViewLayoutProcessor::GetPage(int32_t index) const {
   if (!pdfium::IndexInBounds(m_PageArray, index))
     return nullptr;
-  return m_PageArray[index];
+  return m_PageArray[index].Get();
 }
 
 int32_t CXFA_ViewLayoutProcessor::GetPageIndex(
@@ -1318,7 +1311,6 @@ CXFA_Node* CXFA_ViewLayoutProcessor::GetNextAvailPageArea(
   if (!m_pCurPageArea) {
     FindPageAreaFromPageSet(m_pTemplatePageSetRoot, nullptr, pTargetPageArea,
                             pTargetContentArea, bNewPage, bQuery);
-    ASSERT(m_pCurPageArea);
     return m_pCurPageArea;
   }
 
@@ -1394,7 +1386,7 @@ bool CXFA_ViewLayoutProcessor::GetNextContentArea(CXFA_Node* pContentArea) {
       return false;
 
     Optional<CXFA_ViewLayoutItem*> pContentAreaLayout = CheckContentAreaNotUsed(
-        GetCurrentViewRecord()->pCurPageArea, pContentArea);
+        GetCurrentViewRecord()->pCurPageArea.Get(), pContentArea);
     if (!pContentAreaLayout.has_value())
       return false;
     if (pContentAreaLayout.value()) {
@@ -1402,7 +1394,7 @@ bool CXFA_ViewLayoutProcessor::GetNextContentArea(CXFA_Node* pContentArea) {
         return false;
 
       CXFA_ViewRecord* pNewRecord = CreateViewRecordSimple();
-      pNewRecord->pCurContentArea = pContentAreaLayout.value();
+      pNewRecord->pCurContentArea.Reset(pContentAreaLayout.value());
       return true;
     }
   }
@@ -1513,6 +1505,9 @@ void CXFA_ViewLayoutProcessor::CreateNextMinRecord(CXFA_Node* pRecordNode) {
 }
 
 void CXFA_ViewLayoutProcessor::ProcessLastPageSet() {
+  if (!m_pCurPageArea)
+    return;
+
   CreateMinPageRecord(m_pCurPageArea, false, true);
   CreateNextMinRecord(m_pCurPageArea);
   CXFA_Node* pPageSet = m_pCurPageArea->GetParent();
@@ -1609,26 +1604,21 @@ void CXFA_ViewLayoutProcessor::SaveLayoutItemChildren(
   CXFA_Document* pDocument = m_pTemplatePageSetRoot->GetDocument();
   CXFA_FFNotify* pNotify = pDocument->GetNotify();
   auto* pDocLayout = CXFA_LayoutProcessor::FromDocument(pDocument);
-  CXFA_LayoutItem* pCurLayoutItem = pParentLayoutItem->GetFirstChild();
+  RetainPtr<CXFA_LayoutItem> pCurLayoutItem(pParentLayoutItem->GetFirstChild());
   while (pCurLayoutItem) {
-    CXFA_LayoutItem* pNextLayoutItem = pCurLayoutItem->GetNextSibling();
+    RetainPtr<CXFA_LayoutItem> pNextLayoutItem(
+        pCurLayoutItem->GetNextSibling());
     if (pCurLayoutItem->IsContentLayoutItem()) {
       if (pCurLayoutItem->GetFormNode()->HasRemovedChildren()) {
-        SyncRemoveLayoutItem(pCurLayoutItem, pNotify, pDocLayout);
-        pCurLayoutItem = pNextLayoutItem;
+        SyncRemoveLayoutItem(pCurLayoutItem.Get(), pNotify, pDocLayout);
+        pCurLayoutItem = std::move(pNextLayoutItem);
         continue;
       }
       if (pCurLayoutItem->GetFormNode()->IsLayoutGeneratedNode())
         pCurLayoutItem->GetFormNode()->SetNodeAndDescendantsUnused();
     }
-    SaveLayoutItemChildren(pCurLayoutItem);
-    pCurLayoutItem->RemoveSelfIfParented();
-    if (!pCurLayoutItem->IsContentLayoutItem() &&
-        pCurLayoutItem->GetFormNode()->GetElementType() !=
-            XFA_Element::PageArea) {
-      delete pCurLayoutItem;
-    }
-    pCurLayoutItem = pNextLayoutItem;
+    SaveLayoutItemChildren(pCurLayoutItem.Get());
+    pCurLayoutItem = std::move(pNextLayoutItem);
   }
 }
 
@@ -1732,12 +1722,12 @@ void CXFA_ViewLayoutProcessor::MergePageSetContents() {
               for (CXFA_Node* pIter = sIterator.GetCurrent(); pIter;
                    pIter = sIterator.MoveToNext()) {
                 if (pIter->GetElementType() != XFA_Element::ContentArea) {
-                  CXFA_LayoutItem* pLayoutItem =
-                      pIter->JSObject()->GetLayoutItem();
+                  RetainPtr<CXFA_LayoutItem> pLayoutItem(
+                      pIter->JSObject()->GetLayoutItem());
                   if (pLayoutItem) {
-                    pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem);
+                    pNotify->OnLayoutItemRemoving(pDocLayout,
+                                                  pLayoutItem.Get());
                     pLayoutItem->RemoveSelfIfParented();
-                    delete pLayoutItem;
                   }
                 }
               }
@@ -1798,20 +1788,19 @@ void CXFA_ViewLayoutProcessor::MergePageSetContents() {
             CXFA_ContainerIterator iteChild(pNode);
             CXFA_Node* pChildNode = iteChild.MoveToNext();
             for (; pChildNode; pChildNode = iteChild.MoveToNext()) {
-              CXFA_LayoutItem* pLayoutItem =
-                  pChildNode->JSObject()->GetLayoutItem();
+              RetainPtr<CXFA_LayoutItem> pLayoutItem(
+                  pChildNode->JSObject()->GetLayoutItem());
               if (pLayoutItem) {
-                pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem);
+                pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem.Get());
                 pLayoutItem->RemoveSelfIfParented();
-                delete pLayoutItem;
               }
             }
           } else if (eType != XFA_Element::ContentArea) {
-            CXFA_LayoutItem* pLayoutItem = pNode->JSObject()->GetLayoutItem();
+            RetainPtr<CXFA_LayoutItem> pLayoutItem(
+                pNode->JSObject()->GetLayoutItem());
             if (pLayoutItem) {
-              pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem);
+              pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem.Get());
               pLayoutItem->RemoveSelfIfParented();
-              delete pLayoutItem;
             }
           }
           CXFA_Node* pNext = sIterator.SkipChildrenAndMoveToNext();
@@ -1866,9 +1855,7 @@ void CXFA_ViewLayoutProcessor::SyncLayoutData() {
       nPageIdx++;
       uint32_t dwRelevant =
           XFA_WidgetStatus_Viewable | XFA_WidgetStatus_Printable;
-      CXFA_NodeIteratorTemplate<CXFA_LayoutItem,
-                                CXFA_TraverseStrategy_LayoutItem>
-          iterator(pViewItem);
+      CXFA_LayoutItemIterator iterator(pViewItem);
       CXFA_LayoutItem* pChildLayoutItem = iterator.GetCurrent();
       while (pChildLayoutItem) {
         CXFA_ContentLayoutItem* pContentItem =
@@ -1895,10 +1882,9 @@ void CXFA_ViewLayoutProcessor::SyncLayoutData() {
 
   int32_t nPage = pdfium::CollectionSize<int32_t>(m_PageArray);
   for (int32_t i = nPage - 1; i >= m_nAvailPages; i--) {
-    CXFA_ViewLayoutItem* pPage = m_PageArray[i];
+    RetainPtr<CXFA_ViewLayoutItem> pPage = m_PageArray[i];
     m_PageArray.erase(m_PageArray.begin() + i);
-    pNotify->OnPageEvent(pPage, XFA_PAGEVIEWEVENT_PostRemoved);
-    delete pPage;
+    pNotify->OnPageEvent(pPage.Get(), XFA_PAGEVIEWEVENT_PostRemoved);
   }
   ClearData();
 }
@@ -1911,7 +1897,7 @@ void CXFA_ViewLayoutProcessor::PrepareLayout() {
   if (!m_pPageSetLayoutItemRoot)
     return;
 
-  CXFA_ViewLayoutItem* pRootLayoutItem = m_pPageSetLayoutItemRoot;
+  RetainPtr<CXFA_ViewLayoutItem> pRootLayoutItem = m_pPageSetLayoutItemRoot;
   if (pRootLayoutItem &&
       pRootLayoutItem->GetFormNode()->GetPacketType() == XFA_PacketType::Form) {
     CXFA_Node* pPageSetFormNode = pRootLayoutItem->GetFormNode();
@@ -1937,11 +1923,10 @@ void CXFA_ViewLayoutProcessor::PrepareLayout() {
   }
   pRootLayoutItem = m_pPageSetLayoutItemRoot;
   CXFA_ViewLayoutItem* pNextLayout = nullptr;
-  for (; pRootLayoutItem; pRootLayoutItem = pNextLayout) {
+  for (; pRootLayoutItem; pRootLayoutItem.Reset(pNextLayout)) {
     pNextLayout = ToViewLayoutItem(pRootLayoutItem->GetNextSibling());
-    SaveLayoutItemChildren(pRootLayoutItem);
+    SaveLayoutItemChildren(pRootLayoutItem.Get());
     pRootLayoutItem->RemoveSelfIfParented();
-    delete pRootLayoutItem;
   }
   m_pPageSetLayoutItemRoot = nullptr;
 }
diff --git a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.h b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.h
index 332cbc0efa5..0f4b351f535 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.h
@@ -13,12 +13,12 @@
 #include <memory>
 #include <vector>
 
+#include "core/fxcrt/retain_ptr.h"
 #include "third_party/base/optional.h"
 #include "xfa/fxfa/layout/cxfa_contentlayoutprocessor.h"
 
 class CXFA_LayoutItem;
 class CXFA_Node;
-class CXFA_ViewRecord;
 
 class CXFA_ViewLayoutProcessor {
  public:
@@ -40,15 +40,16 @@ class CXFA_ViewLayoutProcessor {
   bool PrepareFirstPage(CXFA_Node* pRootSubform);
   float GetAvailHeight();
   bool GetNextAvailContentHeight(float fChildHeight);
-  void SubmitContentItem(CXFA_ContentLayoutItem* pContentLayoutItem,
-                         CXFA_ContentLayoutProcessor::Result eStatus);
+  void SubmitContentItem(
+      const RetainPtr<CXFA_ContentLayoutItem>& pContentLayoutItem,
+      CXFA_ContentLayoutProcessor::Result eStatus);
   void FinishPaginatedPageSets();
   void SyncLayoutData();
   int32_t GetPageCount() const;
   CXFA_ViewLayoutItem* GetPage(int32_t index) const;
   int32_t GetPageIndex(const CXFA_ViewLayoutItem* pPage) const;
-  inline CXFA_ViewLayoutItem* GetRootLayoutItem() const {
-    return m_pPageSetLayoutItemRoot;
+  CXFA_ViewLayoutItem* GetRootLayoutItem() const {
+    return m_pPageSetLayoutItemRoot.Get();
   }
   Optional<BreakData> ProcessBreakBefore(const CXFA_Node* pBreakNode);
   Optional<BreakData> ProcessBreakAfter(const CXFA_Node* pBreakNode);
@@ -59,6 +60,15 @@ class CXFA_ViewLayoutProcessor {
   CXFA_Node* ProcessBookendTrailer(const CXFA_Node* pBookendNode);
 
  private:
+  struct CXFA_ViewRecord {
+    CXFA_ViewRecord();
+    ~CXFA_ViewRecord();
+
+    RetainPtr<CXFA_ViewLayoutItem> pCurPageSet;
+    RetainPtr<CXFA_ViewLayoutItem> pCurPageArea;
+    RetainPtr<CXFA_ViewLayoutItem> pCurContentArea;
+  };
+
   using RecordList = std::list<std::unique_ptr<CXFA_ViewRecord>>;
 
   bool AppendNewPage(bool bFirstTemPage);
@@ -150,19 +160,19 @@ class CXFA_ViewLayoutProcessor {
   void ProcessSimplexOrDuplexPageSets(CXFA_ViewLayoutItem* pPageSetLayoutItem,
                                       bool bIsSimplex);
 
-  CXFA_LayoutProcessor* m_pLayoutProcessor;
-  CXFA_Node* m_pTemplatePageSetRoot;
-  CXFA_ViewLayoutItem* m_pPageSetLayoutItemRoot;
-  CXFA_ViewLayoutItem* m_pPageSetCurRoot;
+  CXFA_LayoutProcessor* m_pLayoutProcessor = nullptr;
+  CXFA_Node* m_pTemplatePageSetRoot = nullptr;
+  RetainPtr<CXFA_ViewLayoutItem> m_pPageSetLayoutItemRoot;
+  RetainPtr<CXFA_ViewLayoutItem> m_pPageSetCurRoot;
   RecordList m_ProposedViewRecords;
   RecordList::iterator m_CurrentViewRecordIter;
-  CXFA_Node* m_pCurPageArea;
-  int32_t m_nAvailPages;
-  int32_t m_nCurPageCount;
-  XFA_AttributeValue m_ePageSetMode;
-  bool m_bCreateOverFlowPage;
+  CXFA_Node* m_pCurPageArea = nullptr;
+  int32_t m_nAvailPages = 0;
+  int32_t m_nCurPageCount = 0;
+  XFA_AttributeValue m_ePageSetMode = XFA_AttributeValue::OrderedOccurrence;
+  bool m_bCreateOverFlowPage = false;
   std::map<CXFA_Node*, int32_t> m_pPageSetMap;
-  std::vector<CXFA_ViewLayoutItem*> m_PageArray;
+  std::vector<RetainPtr<CXFA_ViewLayoutItem>> m_PageArray;
 };
 
 #endif  // XFA_FXFA_LAYOUT_CXFA_VIEWLAYOUTPROCESSOR_H_
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/BUILD.gn b/chromium/third_party/pdfium/xfa/fxfa/parser/BUILD.gn
index 770cd526e3d..c03e5033a9a 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/BUILD.gn
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/BUILD.gn
@@ -685,7 +685,6 @@ jumbo_source_set("parser") {
     "../../../core/fxcodec",
     "../../../core/fxcrt",
     "../../../core/fxge",
-    "../../../fxbarcode",
     "../../../fxjs",
     "../../fde",
     "../../fgas",
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_barcode.cpp b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_barcode.cpp
index d84acd5749f..ae3f9e248a9 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_barcode.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_barcode.cpp
@@ -62,16 +62,8 @@ WideString CXFA_Barcode::GetBarcodeType() {
   return WideString(JSObject()->GetCData(XFA_Attribute::Type));
 }
 
-Optional<BC_CHAR_ENCODING> CXFA_Barcode::GetCharEncoding() {
-  Optional<WideString> wsCharEncoding =
-      JSObject()->TryCData(XFA_Attribute::CharEncoding, true);
-  if (!wsCharEncoding)
-    return {};
-  if (wsCharEncoding->CompareNoCase(L"UTF-16"))
-    return {CHAR_ENCODING_UNICODE};
-  if (wsCharEncoding->CompareNoCase(L"UTF-8"))
-    return {CHAR_ENCODING_UTF8};
-  return {};
+Optional<WideString> CXFA_Barcode::GetCharEncoding() {
+  return JSObject()->TryCData(XFA_Attribute::CharEncoding, true);
 }
 
 Optional<bool> CXFA_Barcode::GetChecksum() {
@@ -151,27 +143,8 @@ Optional<bool> CXFA_Barcode::GetPrintChecksum() {
   return JSObject()->TryBoolean(XFA_Attribute::PrintCheckDigit, true);
 }
 
-Optional<BC_TEXT_LOC> CXFA_Barcode::GetTextLocation() {
-  Optional<XFA_AttributeValue> textLocation =
-      JSObject()->TryEnum(XFA_Attribute::TextLocation, true);
-  if (!textLocation)
-    return {};
-
-  switch (*textLocation) {
-    case XFA_AttributeValue::None:
-      return {BC_TEXT_LOC_NONE};
-    case XFA_AttributeValue::Above:
-      return {BC_TEXT_LOC_ABOVE};
-    case XFA_AttributeValue::Below:
-      return {BC_TEXT_LOC_BELOW};
-    case XFA_AttributeValue::AboveEmbedded:
-      return {BC_TEXT_LOC_ABOVEEMBED};
-    case XFA_AttributeValue::BelowEmbedded:
-      return {BC_TEXT_LOC_BELOWEMBED};
-    default:
-      break;
-  }
-  return {};
+Optional<XFA_AttributeValue> CXFA_Barcode::GetTextLocation() {
+  return JSObject()->TryEnum(XFA_Attribute::TextLocation, true);
 }
 
 Optional<bool> CXFA_Barcode::GetTruncate() {
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_barcode.h b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_barcode.h
index bf503e5d5cb..219e8b33c4b 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_barcode.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_barcode.h
@@ -7,7 +7,6 @@
 #ifndef XFA_FXFA_PARSER_CXFA_BARCODE_H_
 #define XFA_FXFA_PARSER_CXFA_BARCODE_H_
 
-#include "fxbarcode/BC_Library.h"
 #include "third_party/base/optional.h"
 #include "xfa/fxfa/parser/cxfa_node.h"
 
@@ -19,7 +18,7 @@ class CXFA_Barcode final : public CXFA_Node {
   XFA_FFWidgetType GetDefaultFFWidgetType() const override;
 
   WideString GetBarcodeType();
-  Optional<BC_CHAR_ENCODING> GetCharEncoding();
+  Optional<WideString> GetCharEncoding();
   Optional<bool> GetChecksum();
   Optional<int32_t> GetDataLength();
   Optional<char> GetStartChar();
@@ -28,7 +27,7 @@ class CXFA_Barcode final : public CXFA_Node {
   Optional<int32_t> GetModuleWidth();
   Optional<int32_t> GetModuleHeight();
   Optional<bool> GetPrintChecksum();
-  Optional<BC_TEXT_LOC> GetTextLocation();
+  Optional<XFA_AttributeValue> GetTextLocation();
   Optional<bool> GetTruncate();
   Optional<int8_t> GetWideNarrowRatio();
 };
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document.cpp b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document.cpp
index 0626909e74d..4212c1a7bbd 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document.cpp
@@ -1376,16 +1376,9 @@ CXFA_Node* CXFA_Document::CreateNode(XFA_PacketType packet,
   return AddOwnedNode(CXFA_Node::Create(this, eElement, packet));
 }
 
-void CXFA_Document::SetFlag(uint32_t dwFlag, bool bOn) {
-  if (bOn)
-    m_dwDocFlags |= dwFlag;
-  else
-    m_dwDocFlags &= ~dwFlag;
-}
-
 bool CXFA_Document::IsInteractive() {
-  if (m_dwDocFlags & XFA_DOCFLAG_HasInteractive)
-    return !!(m_dwDocFlags & XFA_DOCFLAG_Interactive);
+  if (m_Interactive.has_value())
+    return m_Interactive.value();
 
   CXFA_Node* pConfig = ToNode(GetXFAObject(XFA_HASHCODE_Config));
   if (!pConfig)
@@ -1402,16 +1395,13 @@ bool CXFA_Document::IsInteractive() {
 
   CXFA_Interactive* pFormFiller =
       pPDF->GetChild<CXFA_Interactive>(0, XFA_Element::Interactive, false);
-  if (pFormFiller) {
-    m_dwDocFlags |= XFA_DOCFLAG_HasInteractive;
+  if (!pFormFiller)
+    return false;
 
-    WideString wsInteractive = pFormFiller->JSObject()->GetContent(false);
-    if (wsInteractive.EqualsASCII("1")) {
-      m_dwDocFlags |= XFA_DOCFLAG_Interactive;
-      return true;
-    }
-  }
-  return false;
+  WideString wsInteractive = pFormFiller->JSObject()->GetContent(false);
+  bool bInteractive = wsInteractive.EqualsASCII("1");
+  m_Interactive = bInteractive;
+  return bInteractive;
 }
 
 CXFA_LocaleMgr* CXFA_Document::GetLocaleMgr() {
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document.h b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document.h
index ca402347f88..878284c7691 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document.h
@@ -12,6 +12,7 @@
 #include <vector>
 
 #include "core/fxcrt/unowned_ptr.h"
+#include "third_party/base/optional.h"
 #include "xfa/fxfa/fxfa.h"
 #include "xfa/fxfa/parser/cxfa_localemgr.h"
 #include "xfa/fxfa/parser/cxfa_nodeowner.h"
@@ -34,13 +35,6 @@ enum XFA_VERSION {
   XFA_VERSION_MAX = 400,
 };
 
-enum XFA_DocFlag {
-  XFA_DOCFLAG_StrictScoping = 0x0001,
-  XFA_DOCFLAG_HasInteractive = 0x0002,
-  XFA_DOCFLAG_Interactive = 0x0004,
-  XFA_DOCFLAG_Scripting = 0x0008
-};
-
 class CFXJSE_Engine;
 class CJS_Runtime;
 class CScript_DataWindow;
@@ -95,10 +89,11 @@ class CXFA_Document final : public CXFA_NodeOwner {
   CXFA_Node* GetRoot() const { return m_pRootNode; }
   void SetRoot(CXFA_Node* pNewRoot) { m_pRootNode = pNewRoot; }
 
-  bool HasFlag(uint32_t dwFlag) const {
-    return (m_dwDocFlags & dwFlag) == dwFlag;
-  }
-  void SetFlag(uint32_t dwFlag, bool bOn);
+  bool is_strict_scoping() const { return m_bStrictScoping; }
+  void set_is_strict_scoping() { m_bStrictScoping = true; }
+
+  bool is_scripting() const { return m_bScripting; }
+  void set_is_scripting() { m_bScripting = true; }
 
   bool IsInteractive();
   XFA_VERSION GetCurVersionMode() { return m_eCurVersionMode; }
@@ -140,7 +135,9 @@ class CXFA_Document final : public CXFA_NodeOwner {
   std::unique_ptr<CScript_LayoutPseudoModel> m_pScriptLayout;
   std::unique_ptr<CScript_SignaturePseudoModel> m_pScriptSignature;
   XFA_VERSION m_eCurVersionMode = XFA_VERSION_DEFAULT;
-  uint32_t m_dwDocFlags = 0;
+  Optional<bool> m_Interactive;
+  bool m_bStrictScoping = false;
+  bool m_bScripting = false;
 };
 
 #endif  // XFA_FXFA_PARSER_CXFA_DOCUMENT_H_
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document_parser.cpp b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document_parser.cpp
index da3cfce04be..b141f7de647 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document_parser.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document_parser.cpp
@@ -1028,14 +1028,14 @@ void CXFA_DocumentParser::ParseInstruction(CXFA_Node* pXFANode,
         (pXFANode->GetDocument()->RecognizeXFAVersionNumber(target_data[0]) !=
          XFA_VERSION_UNKNOWN) &&
         target_data[1].EqualsASCII("v2.7-scripting:1")) {
-      pXFANode->GetDocument()->SetFlag(XFA_DOCFLAG_Scripting, true);
+      pXFANode->GetDocument()->set_is_scripting();
     }
     return;
   }
   if (pXMLInstruction->IsAcrobat()) {
     if (target_data.size() > 1 && target_data[0].EqualsASCII("JavaScript") &&
         target_data[1].EqualsASCII("strictScoping")) {
-      pXFANode->GetDocument()->SetFlag(XFA_DOCFLAG_StrictScoping, true);
+      pXFANode->GetDocument()->set_is_strict_scoping();
     }
   }
 }
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document_parser_unittest.cpp b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document_parser_unittest.cpp
index 29127a0371b..625473aa462 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document_parser_unittest.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_document_parser_unittest.cpp
@@ -33,92 +33,92 @@ class CXFA_DocumentParserTest : public testing::Test {
 };
 
 TEST_F(CXFA_DocumentParserTest, XMLInstructionsScriptOff) {
-  static const char input[] =
+  static const char kInput[] =
       "<config>\n"
       "<?originalXFAVersion http://www.xfa.org/schema/xfa-template/2.7 "
       "v2.7-scripting:0 ?>\n"
       "</config>";
-  EXPECT_FALSE(GetDoc()->HasFlag(XFA_DOCFLAG_Scripting));
+  EXPECT_FALSE(GetDoc()->is_scripting());
 
   auto stream = pdfium::MakeRetain<CFX_ReadOnlyMemoryStream>(
-      pdfium::as_bytes(pdfium::make_span(input)));
+      pdfium::as_bytes(pdfium::make_span(kInput)));
   ASSERT_TRUE(GetParser()->Parse(stream, XFA_PacketType::Config));
 
   CXFA_Node* root = GetParser()->GetRootNode();
-  ASSERT_TRUE(root != nullptr);
-  EXPECT_FALSE(GetDoc()->HasFlag(XFA_DOCFLAG_Scripting));
+  ASSERT_TRUE(root);
+  EXPECT_FALSE(GetDoc()->is_scripting());
 }
 
 TEST_F(CXFA_DocumentParserTest, XMLInstructionsScriptOn) {
-  static const char input[] =
+  static const char kInput[] =
       "<config>\n"
       "<?originalXFAVersion http://www.xfa.org/schema/xfa-template/2.7 "
       "v2.7-scripting:1 ?>\n"
       "</config>";
 
-  EXPECT_FALSE(GetDoc()->HasFlag(XFA_DOCFLAG_Scripting));
+  EXPECT_FALSE(GetDoc()->is_scripting());
 
   auto stream = pdfium::MakeRetain<CFX_ReadOnlyMemoryStream>(
-      pdfium::as_bytes(pdfium::make_span(input)));
+      pdfium::as_bytes(pdfium::make_span(kInput)));
   ASSERT_TRUE(GetParser()->Parse(stream, XFA_PacketType::Config));
 
   CXFA_Node* root = GetParser()->GetRootNode();
-  ASSERT_TRUE(root != nullptr);
-  EXPECT_TRUE(GetDoc()->HasFlag(XFA_DOCFLAG_Scripting));
+  ASSERT_TRUE(root);
+  EXPECT_TRUE(GetDoc()->is_scripting());
 }
 
 TEST_F(CXFA_DocumentParserTest, XMLInstructionsStrictScope) {
-  static const char input[] =
+  static const char kInput[] =
       "<config>"
       "<?acrobat JavaScript strictScoping ?>\n"
       "</config>";
 
-  EXPECT_FALSE(GetDoc()->HasFlag(XFA_DOCFLAG_StrictScoping));
+  EXPECT_FALSE(GetDoc()->is_strict_scoping());
 
   auto stream = pdfium::MakeRetain<CFX_ReadOnlyMemoryStream>(
-      pdfium::as_bytes(pdfium::make_span(input)));
+      pdfium::as_bytes(pdfium::make_span(kInput)));
   ASSERT_TRUE(GetParser()->Parse(stream, XFA_PacketType::Config));
 
   CXFA_Node* root = GetParser()->GetRootNode();
-  ASSERT_TRUE(root != nullptr);
-  EXPECT_TRUE(GetDoc()->HasFlag(XFA_DOCFLAG_StrictScoping));
+  ASSERT_TRUE(root);
+  EXPECT_TRUE(GetDoc()->is_strict_scoping());
 }
 
 TEST_F(CXFA_DocumentParserTest, XMLInstructionsStrictScopeBad) {
-  static const char input[] =
+  static const char kInput[] =
       "<config>"
       "<?acrobat JavaScript otherScoping ?>\n"
       "</config>";
 
-  EXPECT_FALSE(GetDoc()->HasFlag(XFA_DOCFLAG_StrictScoping));
+  EXPECT_FALSE(GetDoc()->is_strict_scoping());
 
   auto stream = pdfium::MakeRetain<CFX_ReadOnlyMemoryStream>(
-      pdfium::as_bytes(pdfium::make_span(input)));
+      pdfium::as_bytes(pdfium::make_span(kInput)));
   ASSERT_TRUE(GetParser()->Parse(stream, XFA_PacketType::Config));
 
   CXFA_Node* root = GetParser()->GetRootNode();
-  ASSERT_TRUE(root != nullptr);
-  EXPECT_FALSE(GetDoc()->HasFlag(XFA_DOCFLAG_StrictScoping));
+  ASSERT_TRUE(root);
+  EXPECT_FALSE(GetDoc()->is_strict_scoping());
 }
 
 TEST_F(CXFA_DocumentParserTest, MultipleXMLInstructions) {
-  static const char input[] =
+  static const char kInput[] =
       "<config>"
       "<?originalXFAVersion http://www.xfa.org/schema/xfa-template/2.7 "
       "v2.7-scripting:1 ?>\n"
       "<?acrobat JavaScript strictScoping ?>\n"
       "</config>";
 
-  EXPECT_FALSE(GetDoc()->HasFlag(XFA_DOCFLAG_Scripting));
-  EXPECT_FALSE(GetDoc()->HasFlag(XFA_DOCFLAG_StrictScoping));
+  EXPECT_FALSE(GetDoc()->is_scripting());
+  EXPECT_FALSE(GetDoc()->is_strict_scoping());
 
   auto stream = pdfium::MakeRetain<CFX_ReadOnlyMemoryStream>(
-      pdfium::as_bytes(pdfium::make_span(input)));
+      pdfium::as_bytes(pdfium::make_span(kInput)));
   ASSERT_TRUE(GetParser()->Parse(stream, XFA_PacketType::Config));
 
   CXFA_Node* root = GetParser()->GetRootNode();
-  ASSERT_TRUE(root != nullptr);
+  ASSERT_TRUE(root);
 
-  EXPECT_TRUE(GetDoc()->HasFlag(XFA_DOCFLAG_Scripting));
-  EXPECT_TRUE(GetDoc()->HasFlag(XFA_DOCFLAG_StrictScoping));
+  EXPECT_TRUE(GetDoc()->is_scripting());
+  EXPECT_TRUE(GetDoc()->is_strict_scoping());
 }
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_node.cpp b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_node.cpp
index 465f7863093..59d5b738ba8 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_node.cpp
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_node.cpp
@@ -2599,18 +2599,14 @@ XFA_EventError CXFA_Node::ProcessValidate(CXFA_FFDocView* pDocView,
   }
 
   XFA_VERSION version = pDocView->GetDoc()->GetXFADoc()->GetCurVersionMode();
-  bool bVersionFlag = false;
-  if (version < XFA_VERSION_208)
-    bVersionFlag = true;
+  bool bVersionFlag = version < XFA_VERSION_208;
 
   if (bInitDoc) {
     validate->ClearFlag(XFA_NodeFlag_NeedsInitApp);
   } else {
     iFormat = ProcessFormatTestValidate(pDocView, validate, bVersionFlag);
-    if (!bVersionFlag) {
-      bVersionFlag =
-          pDocView->GetDoc()->GetXFADoc()->HasFlag(XFA_DOCFLAG_Scripting);
-    }
+    if (!bVersionFlag)
+      bVersionFlag = pDocView->GetDoc()->GetXFADoc()->is_scripting();
     XFA_EventErrorAccumulate(
         &iRet,
         ProcessNullTestValidate(pDocView, validate, iFlags, bVersionFlag));
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_node.h b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_node.h
index 22063c3f393..057c26ade1c 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_node.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_node.h
@@ -481,8 +481,8 @@ class CXFA_Node : public CXFA_Object, public TreeNode<CXFA_Node> {
 
   CFX_XMLDocument* GetXMLDocument() const;
 
-  pdfium::span<const PropertyData> const m_Properties;
-  pdfium::span<const AttributeData> const m_Attributes;
+  const pdfium::span<const PropertyData> m_Properties;
+  const pdfium::span<const AttributeData> m_Attributes;
   const uint32_t m_ValidPackets;
   UnownedPtr<CFX_XMLNode> xml_node_;
   const XFA_PacketType m_ePacket;
diff --git a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_nodeiteratortemplate.h b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_nodeiteratortemplate.h
index 10543fdbcfe..8803efa6fe3 100644
--- a/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_nodeiteratortemplate.h
+++ b/chromium/third_party/pdfium/xfa/fxfa/parser/cxfa_nodeiteratortemplate.h
@@ -9,7 +9,9 @@
 
 #include "core/fxcrt/unowned_ptr.h"
 
-template <class NodeType, class TraverseStrategy>
+template <class NodeType,
+          class TraverseStrategy,
+          typename HolderType = UnownedPtr<NodeType>>
 class CXFA_NodeIteratorTemplate {
  public:
   explicit CXFA_NodeIteratorTemplate(NodeType* pRoot)
@@ -24,7 +26,7 @@ class CXFA_NodeIteratorTemplate {
       m_pCurrent = nullptr;
       return false;
     }
-    m_pCurrent = pNode;
+    m_pCurrent.Reset(pNode);
     return true;
   }
 
@@ -32,20 +34,18 @@ class CXFA_NodeIteratorTemplate {
     if (!m_pRoot)
       return nullptr;
     if (!m_pCurrent) {
-      m_pCurrent = LastDescendant(m_pRoot.Get());
+      m_pCurrent.Reset(LastDescendant(m_pRoot.Get()));
       return m_pCurrent.Get();
     }
     NodeType* pSibling = PreviousSiblingWithinSubtree(m_pCurrent.Get());
     if (pSibling) {
-      m_pCurrent = LastDescendant(pSibling);
+      m_pCurrent.Reset(LastDescendant(pSibling));
       return m_pCurrent.Get();
     }
     NodeType* pParent = ParentWithinSubtree(m_pCurrent.Get());
-    if (pParent) {
-      m_pCurrent = pParent;
-      return pParent;
-    }
-    return nullptr;
+    if (pParent)
+      m_pCurrent.Reset(pParent);
+    return pParent;
   }
 
   NodeType* MoveToNext() {
@@ -53,7 +53,7 @@ class CXFA_NodeIteratorTemplate {
       return nullptr;
     NodeType* pChild = TraverseStrategy::GetFirstChild(m_pCurrent.Get());
     if (pChild) {
-      m_pCurrent = pChild;
+      m_pCurrent.Reset(pChild);
       return pChild;
     }
     return SkipChildrenAndMoveToNext();
@@ -66,7 +66,7 @@ class CXFA_NodeIteratorTemplate {
     while (pNode) {
       NodeType* pSibling = NextSiblingWithinSubtree(pNode);
       if (pSibling) {
-        m_pCurrent = pSibling;
+        m_pCurrent.Reset(pSibling);
         return pSibling;
       }
       pNode = ParentWithinSubtree(pNode);
@@ -77,23 +77,17 @@ class CXFA_NodeIteratorTemplate {
 
  private:
   bool RootReachableFromNode(NodeType* pNode) {
-    if (!pNode)
-      return false;
-    if (pNode == m_pRoot)
-      return true;
-    return RootReachableFromNode(TraverseStrategy::GetParent(pNode));
+    return pNode && (pNode == m_pRoot ||
+                     RootReachableFromNode(TraverseStrategy::GetParent(pNode)));
   }
 
   NodeType* ParentWithinSubtree(NodeType* pNode) {
-    if (!pNode || pNode == m_pRoot)
-      return nullptr;
-    return TraverseStrategy::GetParent(pNode);
+    return pNode && pNode != m_pRoot ? TraverseStrategy::GetParent(pNode)
+                                     : nullptr;
   }
 
   NodeType* NextSiblingWithinSubtree(NodeType* pNode) {
-    if (pNode == m_pRoot)
-      return nullptr;
-    return TraverseStrategy::GetNextSibling(pNode);
+    return pNode != m_pRoot ? TraverseStrategy::GetNextSibling(pNode) : nullptr;
   }
 
   NodeType* PreviousSiblingWithinSubtree(NodeType* pNode) {
@@ -124,8 +118,8 @@ class CXFA_NodeIteratorTemplate {
     return pChild ? LastDescendant(pChild) : pNode;
   }
 
-  UnownedPtr<NodeType> m_pRoot;
-  UnownedPtr<NodeType> m_pCurrent;
+  HolderType m_pRoot;
+  HolderType m_pCurrent;
 };
 
 #endif  // XFA_FXFA_PARSER_CXFA_NODEITERATORTEMPLATE_H_
diff --git a/chromium/third_party/pdfium/xfa/fxgraphics/cxfa_gepattern.h b/chromium/third_party/pdfium/xfa/fxgraphics/cxfa_gepattern.h
index d811ec91e10..f5a34139fe6 100644
--- a/chromium/third_party/pdfium/xfa/fxgraphics/cxfa_gepattern.h
+++ b/chromium/third_party/pdfium/xfa/fxgraphics/cxfa_gepattern.h
@@ -14,13 +14,13 @@
 class CFX_DIBitmap;
 class CFX_Matrix;
 
-class CXFA_GEPattern {
+class CXFA_GEPattern final {
  public:
   CXFA_GEPattern(FX_HatchStyle hatchStyle,
                  const FX_ARGB foreArgb,
                  const FX_ARGB backArgb);
 
-  virtual ~CXFA_GEPattern();
+  ~CXFA_GEPattern();
 
  private:
   friend class CXFA_Graphics;
diff --git a/chromium/third_party/pdfium/xfa/fxgraphics/cxfa_geshading.h b/chromium/third_party/pdfium/xfa/fxgraphics/cxfa_geshading.h
index fc7a13e619e..8905a127ea1 100644
--- a/chromium/third_party/pdfium/xfa/fxgraphics/cxfa_geshading.h
+++ b/chromium/third_party/pdfium/xfa/fxgraphics/cxfa_geshading.h
@@ -15,7 +15,7 @@
 
 enum CXFA_GEShading_Type { FX_SHADING_Axial = 1, FX_SHADING_Radial };
 
-class CXFA_GEShading {
+class CXFA_GEShading final {
  public:
   // Axial shading.
   CXFA_GEShading(const CFX_PointF& beginPoint,
@@ -34,7 +34,8 @@ class CXFA_GEShading {
                  bool isExtendedEnd,
                  const FX_ARGB beginArgb,
                  const FX_ARGB endArgb);
-  virtual ~CXFA_GEShading();
+
+  ~CXFA_GEShading();
 
  private:
   friend class CXFA_Graphics;
author	Allan Sandfeld Jensen <allan.jensen@qt.io>	2020-01-20 13:40:20 +0100
committer	Allan Sandfeld Jensen <allan.jensen@qt.io>	2020-01-22 12:41:23 +0000
commit	7961cea6d1041e3e454dae6a1da660b453efd238 (patch)
tree	c0eeb4a9ff9ba32986289c1653d9608e53ccb444 /chromium/third_party/pdfium
parent	b7034d0803538058e5c9d904ef03cf5eab34f6ef (diff)
download	qtwebengine-chromium-7961cea6d1041e3e454dae6a1da660b453efd238.tar.gz