From ee47c0ef8b813c8c681643688e9e425e87ee391f Mon Sep 17 00:00:00 2001
From: Tom Sepez <tsepez@google.com>
Date: Mon, 15 Jun 2026 18:36:16 -0700
Subject: [PATCH] Clear more object bindings in CFXJSE_Engine destructor.

These objects are unreachable, but it doesn't hurt to be more defensive
about clearing out old bindings.

Fixed: 522938824
Change-Id: I58e1f2de98a459231f87e3291fc3748edc3b9925
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/149910
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
---

diff --git a/fxjs/xfa/cfxjse_engine.cpp b/fxjs/xfa/cfxjse_engine.cpp
index ed6a65c..b47dbfc 100644
--- a/fxjs/xfa/cfxjse_engine.cpp
+++ b/fxjs/xfa/cfxjse_engine.cpp
@@ -171,6 +171,10 @@
     const v8::Global<v8::Object>& binding = pair.second;
     FXJSE_ClearObjectBinding(v8::Local<v8::Object>::New(GetIsolate(), binding));
   }
+  for (const auto& pair : map_variable_to_context_) {
+    FXJSE_ClearObjectBinding(pair.second->GetGlobalObject());
+  }
+  FXJSE_ClearObjectBinding(js_context_->GetGlobalObject());
 }
 
 CFXJSE_Engine::EventParamScope::EventParamScope(CFXJSE_Engine* pEngine,