PDF: Destroy timers after pages.

When destroying the page we may need to cancel timers. Currently, the timers
will be free'd before the page. This CL changes the destruction order to free
the pages before freeing the timers.

Bug: 843493
Change-Id: Ic96707bd1dc7510f65218679dc12cd44ba012db8
Reviewed-on: https://chromium-review.googlesource.com/1062195Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
Cr-Commit-Position: refs/heads/master@{#559264}

pdf/pdfium/pdfium_engine.h

@@ -510,6 +510,19 @@ class PDFiumEngine : public PDFEngine,
   bool getting_password_ = false;
   int password_tries_remaining_ = 0;
 
+  // Used to manage timers that form fill API needs. The key is the timer id.
+  // The value holds the timer period and the callback function.
+  struct FormFillTimerData {
+    FormFillTimerData(base::TimeDelta period, TimerCallback callback);
+
+    base::TimeDelta timer_period;
+    TimerCallback timer_callback;
+  };
+
+  // Needs to be above pages_, as destroying a page may stop timers.
+  std::map<int, const FormFillTimerData> formfill_timers_;
+  int next_formfill_timer_id_ = 0;
+
   // Interface structure to provide access to document stream.
   FPDF_FILEACCESS file_access_;
 
@@ -600,17 +613,6 @@ class PDFiumEngine : public PDFEngine,
 
   pp::Size default_page_size_;
 
-  // Used to manage timers that form fill API needs. The key is the timer id.
-  // The value holds the timer period and the callback function.
-  struct FormFillTimerData {
-    FormFillTimerData(base::TimeDelta period, TimerCallback callback);
-
-    base::TimeDelta timer_period;
-    TimerCallback timer_callback;
-  };
-  std::map<int, const FormFillTimerData> formfill_timers_;
-  int next_formfill_timer_id_ = 0;
-
   // Used to manage timers for touch long press.
   std::map<int, pp::TouchInputEvent> touch_timers_;
   int next_touch_timer_id_ = 0;