Detailed report: https://clusterfuzz.com/testcase?key=5420687954280448

Fuzzer: afl_pdfium_xfa_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Heap-use-after-free READ 1
Crash Address: 0x606000030ec0
Crash State:
  fxcrt::UnownedPtr<CXFA_LayoutItem>::ProbeForLowSeverityLifetimeIssue
  CJX_Object::~CJX_Object
  CJX_PageSet::~CJX_PageSet
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5420687954280448

Issue manually filed by: metzman

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.