Check return values for all uses of GetFirstChildByClass<>() Follow-up to https://pdfium-review.googlesource.com/c/pdfium/+/47030 Tidy one non-vulnerable for loop while we're at it. Change-Id: I2bc92743b9fb6be4c6799ab3bda7432b1d9112a6 Reviewed-on: https://pdfium-review.googlesource.com/c/47050 Reviewed-by: Lei Zhang <thestig@chromium.org> Commit-Queue: Tom Sepez <tsepez@chromium.org>

diff --git a/fxjs/xfa/cjx_layoutpseudomodel.cpp b/fxjs/xfa/cjx_layoutpseudomodel.cpp
index 2bd6c67..9fe8ddb 100644
--- a/fxjs/xfa/cjx_layoutpseudomodel.cpp
+++ b/fxjs/xfa/cjx_layoutpseudomodel.cpp

@@ -406,13 +406,14 @@
     CFX_V8* runtime,
     const std::vector<v8::Local<v8::Value>>& params) {
   CXFA_Node* pRootNode = GetDocument()->GetRoot();
+  CXFA_LayoutProcessor* pLayoutProcessor = GetDocument()->GetLayoutProcessor();
   CXFA_Form* pFormRoot =
       pRootNode->GetFirstChildByClass<CXFA_Form>(XFA_Element::Form);
-  CXFA_Node* pContentRootNode = pFormRoot->GetFirstChild();
-  CXFA_LayoutProcessor* pLayoutProcessor = GetDocument()->GetLayoutProcessor();
-  if (pContentRootNode)
-    pLayoutProcessor->AddChangedContainer(pContentRootNode);
-
+  if (pFormRoot) {
+    CXFA_Node* pContentRootNode = pFormRoot->GetFirstChild();
+    if (pContentRootNode)
+      pLayoutProcessor->AddChangedContainer(pContentRootNode);
+  }
   pLayoutProcessor->SetForceReLayout(true);
   return CJS_Result::Success();
 }

diff --git a/fxjs/xfa/cjx_object.cpp b/fxjs/xfa/cjx_object.cpp
index a2311d4..0ad03af 100644
--- a/fxjs/xfa/cjx_object.cpp
+++ b/fxjs/xfa/cjx_object.cpp

@@ -1161,9 +1161,11 @@
 
   CXFA_Node* pTemplateNode =
       ToNode(GetDocument()->GetXFAObject(XFA_HASHCODE_Template));
+  CXFA_Subform* pSubForm =
+      pTemplateNode->GetFirstChildByClass<CXFA_Subform>(XFA_Element::Subform);
   CXFA_Proto* pProtoRoot =
-      pTemplateNode->GetFirstChildByClass<CXFA_Subform>(XFA_Element::Subform)
-          ->GetFirstChildByClass<CXFA_Proto>(XFA_Element::Proto);
+      pSubForm ? pSubForm->GetFirstChildByClass<CXFA_Proto>(XFA_Element::Proto)
+               : nullptr;
 
   WideString wsID;
   WideString wsSOM;

diff --git a/xfa/fxfa/cxfa_ffwidgethandler.cpp b/xfa/fxfa/cxfa_ffwidgethandler.cpp
index be96b71..73e88f8 100644
--- a/xfa/fxfa/cxfa_ffwidgethandler.cpp
+++ b/xfa/fxfa/cxfa_ffwidgethandler.cpp

@@ -378,8 +378,14 @@
                                                    CXFA_Node* pBefore) const {
   CXFA_Node* pField = CreateField(XFA_Element::CheckButton, pParent, pBefore);
   CXFA_Ui* pUi = pField->GetFirstChildByClass<CXFA_Ui>(XFA_Element::Ui);
+  if (!pUi)
+    return nullptr;
+
   CXFA_CheckButton* pWidget =
       pUi->GetFirstChildByClass<CXFA_CheckButton>(XFA_Element::CheckButton);
+  if (!pWidget)
+    return nullptr;
+
   pWidget->JSObject()->SetEnum(XFA_Attribute::Shape, XFA_AttributeValue::Round,
                                false);
   return pField;

diff --git a/xfa/fxfa/parser/cxfa_layoutpagemgr.cpp b/xfa/fxfa/parser/cxfa_layoutpagemgr.cpp
index e0814cc..43e1182 100644
--- a/xfa/fxfa/parser/cxfa_layoutpagemgr.cpp
+++ b/xfa/fxfa/parser/cxfa_layoutpagemgr.cpp

@@ -1599,6 +1599,9 @@
 
   CXFA_Node* pContentArea = pPageNode->GetFirstChildByClass<CXFA_ContentArea>(
       XFA_Element::ContentArea);
+  if (!pContentArea)
+    return false;
+
   float fNextContentHeight = pContentArea->JSObject()
                                  ->GetMeasure(XFA_Attribute::H)
                                  .ToUnit(XFA_Unit::Pt);
@@ -1832,7 +1835,8 @@
           pDocument->GetXFAObject(XFA_HASHCODE_Form)
               ->AsNode()
               ->GetFirstChildByClass<CXFA_Subform>(XFA_Element::Subform);
-      pFormToplevelSubform->InsertChild(pPendingPageSet, nullptr);
+      if (pFormToplevelSubform)
+        pFormToplevelSubform->InsertChild(pPendingPageSet, nullptr);
     }
     pDocument->DataMerge_UpdateBindingRelations(pPendingPageSet);
     pPendingPageSet->SetFlagAndNotify(XFA_NodeFlag_Initialized);

diff --git a/xfa/fxfa/parser/cxfa_node.cpp b/xfa/fxfa/parser/cxfa_node.cpp
index ba5f4c5..8ec8da1 100644
--- a/xfa/fxfa/parser/cxfa_node.cpp
+++ b/xfa/fxfa/parser/cxfa_node.cpp

@@ -1256,7 +1256,8 @@
   CXFA_Node* pForm = GetDocument()->GetXFAObject(XFA_HASHCODE_Form)->AsNode();
   CXFA_Subform* pTopSubform =
       pForm->GetFirstChildByClass<CXFA_Subform>(XFA_Element::Subform);
-  ASSERT(pTopSubform);
+  if (!pTopSubform)
+    return {};
 
   CXFA_Node* pLocaleNode = this;
   do {

diff --git a/xfa/fxfa/parser/cxfa_nodelocale.cpp b/xfa/fxfa/parser/cxfa_nodelocale.cpp
index 4f4e3a9..9d495f4 100644
--- a/xfa/fxfa/parser/cxfa_nodelocale.cpp
+++ b/xfa/fxfa/parser/cxfa_nodelocale.cpp

@@ -164,8 +164,8 @@
   if (!pCalendar)
     return WideString();
 
-  CXFA_Node* pNode = pCalendar->GetFirstChildByClass<CXFA_Node>(eElement);
-  for (; pNode; pNode = pNode->GetNextSameClassSibling<CXFA_Node>(eElement)) {
+  for (CXFA_Node* pNode = pCalendar->GetFirstChildByClass<CXFA_Node>(eElement);
+       pNode; pNode = pNode->GetNextSameClassSibling<CXFA_Node>(eElement)) {
     if (pNode->JSObject()->GetBoolean(XFA_Attribute::Abbr) == bAbbr) {
       CXFA_Node* pSymbol =
           pNode->GetChild<CXFA_Node>(index, XFA_Element::Unknown, false);