Fix downcast in CXFA_FFTextEdit.

The |ff_widget_type_| of a CXFA_Node may reflect the type of its
UI child node if it is of widget type |kNone|, so even if it claims
to be of a particular type, it is only safe to downcast its UI
child to that particular type.

Bug: chromium:1026918
Change-Id: I5daef3c6436ada6d31126ddb380f6420651b47e5
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/62670
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

testing/resources/pixel/xfa_specific/bug_1026918.evt

diff --git a/testing/resources/pixel/xfa_specific/bug_1026918.evt b/testing/resources/pixel/xfa_specific/bug_1026918.evt
new file mode 100644
index 0000000..3a16c14
--- /dev/null
+++ b/testing/resources/pixel/xfa_specific/bug_1026918.evt
@@ -0,0 +1,2 @@
+mousemove,0,0
+mousedown,left,0,0
\ No newline at end of file

testing/resources/pixel/xfa_specific/bug_1026918.in

diff --git a/testing/resources/pixel/xfa_specific/bug_1026918.in b/testing/resources/pixel/xfa_specific/bug_1026918.in
new file mode 100644
index 0000000..3dee61e
--- /dev/null
+++ b/testing/resources/pixel/xfa_specific/bug_1026918.in
@@ -0,0 +1,50 @@
+{{header}}
+{{object 1 0}} <<
+  /Type /Catalog
+  /Pages 2 0 R
+  /AcroForm <<
+    /XFA 4 0 R
+  >>
+  /NeedsRendering true
+>>
+endobj
+{{object 2 0}} <<
+  /Type /Pages
+  /Count 1
+  /Kids [3 0 R]
+>>
+endobj
+{{object 3 0}} <<
+  /Type /Page
+  /Parent 2 0 R
+  /MediaBox [0 0 3 3]
+>>
+endobj
+{{object 4 0}} <<
+  {{streamlen}}
+>>
+stream
+<xdp xmlns="http://ns.adobe.com/xdp/">
+  <config>
+    <acrobat>
+      <acrobat7>
+        <dynamicRender>required</dynamicRender>
+      </acrobat7>
+    </acrobat>
+  </config>
+  <template>
+    <subform>
+      <bookend leader="$"></bookend>
+      <field>
+        <keep next="pageArea"></keep>
+        <ui>
+          <barcode type="code3Of9"></barcode>
+        </ui>
+      </field>
+    </subform>
+  </template>
+</xdp>
+endstream
+endobj
+{{trailer}}
+%%EOF
\ No newline at end of file

testing/resources/pixel/xfa_specific/bug_1026918_expected.pdf.0.png

diff --git a/testing/resources/pixel/xfa_specific/bug_1026918_expected.pdf.0.png b/testing/resources/pixel/xfa_specific/bug_1026918_expected.pdf.0.png
new file mode 100644
index 0000000..08c11b0
--- /dev/null
+++ b/testing/resources/pixel/xfa_specific/bug_1026918_expected.pdf.0.png
Binary files differ

xfa/fxfa/cxfa_fftextedit.cpp

diff --git a/xfa/fxfa/cxfa_fftextedit.cpp b/xfa/fxfa/cxfa_fftextedit.cpp
index f5282ba..5ac9f57 100644
--- a/xfa/fxfa/cxfa_fftextedit.cpp
+++ b/xfa/fxfa/cxfa_fftextedit.cpp
@@ -274,7 +274,7 @@
   } else if (m_pNode->GetFFWidgetType() == XFA_FFWidgetType::kBarcode) {
     int32_t nDataLen = 0;
     if (eType == XFA_VALUEPICTURE_Edit) {
-      nDataLen = static_cast<CXFA_Barcode*>(m_pNode.Get())
+      nDataLen = static_cast<CXFA_Barcode*>(m_pNode->GetUIChildNode())
                      ->GetDataLength()
                      .value_or(0);
     }

xfa/fxfa/parser/cxfa_node.h

diff --git a/xfa/fxfa/parser/cxfa_node.h b/xfa/fxfa/parser/cxfa_node.h
index 057c26a..9d9aec5 100644
--- a/xfa/fxfa/parser/cxfa_node.h
+++ b/xfa/fxfa/parser/cxfa_node.h
@@ -266,6 +266,9 @@
       CXFA_EventParam* pEventParam);
 
   CXFA_Node* GetUIChildNode();
+
+  // NOTE: value returned is often determined by child UI node, and
+  // can't be used to infer anything about this particual node itself.
   XFA_FFWidgetType GetFFWidgetType();
 
   CFX_RectF GetUIMargin();