Use RemoveChild() in XFA_ReleaseLayoutItem.

Split off from https://pdfium-review.googlesource.com/c/pdfium/+/53571
to land separately.

Also fix the recursion in XFA_ReleaseLayoutItem() so that we operate
in an obvious depth-first manner (the old code had the potential to
fire duplicate OnLayoutItemRemoving() callbacks on the same node,
for example).

Change-Id: I3fb1e9bfde38f057c61fad14662143690459e0e5
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/54050
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

xfa/fxfa/layout/cxfa_layoutitem.cpp

diff --git a/xfa/fxfa/layout/cxfa_layoutitem.cpp b/xfa/fxfa/layout/cxfa_layoutitem.cpp
index 3dc65ce..4677c34 100644
--- a/xfa/fxfa/layout/cxfa_layoutitem.cpp
+++ b/xfa/fxfa/layout/cxfa_layoutitem.cpp
@@ -16,21 +16,21 @@
 
 void XFA_ReleaseLayoutItem(CXFA_LayoutItem* pLayoutItem) {
   CXFA_LayoutItem* pNode = pLayoutItem->GetFirstChild();
-  CXFA_Document* pDocument = pLayoutItem->GetFormNode()->GetDocument();
-  CXFA_FFNotify* pNotify = pDocument->GetNotify();
-  CXFA_LayoutProcessor* pDocLayout = pDocument->GetLayoutProcessor();
   while (pNode) {
     CXFA_LayoutItem* pNext = pNode->GetNextSibling();
-    pNode->SetParent(nullptr);
-    pNotify->OnLayoutItemRemoving(pDocLayout, pNode);
     XFA_ReleaseLayoutItem(pNode);
     pNode = pNext;
   }
+  CXFA_Document* pDocument = pLayoutItem->GetFormNode()->GetDocument();
+  CXFA_FFNotify* pNotify = pDocument->GetNotify();
+  CXFA_LayoutProcessor* pDocLayout = pDocument->GetLayoutProcessor();
   pNotify->OnLayoutItemRemoving(pDocLayout, pLayoutItem);
   if (pLayoutItem->GetFormNode()->GetElementType() == XFA_Element::PageArea) {
     pNotify->OnPageEvent(ToViewLayoutItem(pLayoutItem),
                          XFA_PAGEVIEWEVENT_PostRemoved);
   }
+  if (pLayoutItem->GetParent())
+    pLayoutItem->GetParent()->RemoveChild(pLayoutItem);
   delete pLayoutItem;
 }