commit 5a6d70c82d6a2b4617265b2e3d5cac339cd04246
author Lei Zhang <thestig@chromium.org> Wed Dec 19 03:58:51 2018 +0000
committer Chromium commit bot <commit-bot@chromium.org> Wed Dec 19 03:58:51 2018 +0000
tree 9962b0547932646f185acdfa8016e050e64593fb
parent ff027cee9d6d7a5ead772229d6c1538b66d243d8

Fix a crash in CXFA_Document::DoProtoMerge().

Also fix nit found while looking inside CFXJSE_Engine::ResolveObjects().

BUG=pdfium:1205

Change-Id: I10245fdb8f2cfe68229cc9ae6ab747e0cf263418
Reviewed-on: https://pdfium-review.googlesource.com/c/47350
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

fxjs/xfa/cfxjse_engine.cpp

diff --git a/fxjs/xfa/cfxjse_engine.cpp b/fxjs/xfa/cfxjse_engine.cpp
index 70b8d60..1569514 100644
--- a/fxjs/xfa/cfxjse_engine.cpp
+++ b/fxjs/xfa/cfxjse_engine.cpp
@@ -706,7 +706,7 @@
     }
     if (rndFind.m_dwFlag == XFA_ResolveNode_RSType_Attribute) {
       resolveNodeRS->script_attribute = rndFind.m_ScriptAttribute;
-      return 1;
+      return true;
     }
   }
   if (dwStyles & (XFA_RESOLVENODE_CreateNode | XFA_RESOLVENODE_Bind |

xfa/fxfa/parser/cxfa_document.cpp

diff --git a/xfa/fxfa/parser/cxfa_document.cpp b/xfa/fxfa/parser/cxfa_document.cpp
index 5d94efc..7bfa23a 100644
--- a/xfa/fxfa/parser/cxfa_document.cpp
+++ b/xfa/fxfa/parser/cxfa_document.cpp
@@ -1560,10 +1560,12 @@
                         XFA_RESOLVENODE_Properties | XFA_RESOLVENODE_Parent |
                         XFA_RESOLVENODE_Siblings;
       XFA_RESOLVENODE_RS resolveNodeRS;
-      int32_t iRet = m_pScriptContext->ResolveObjects(
-          pUseHrefNode, wsSOM, &resolveNodeRS, dwFlag, nullptr);
-      if (iRet > 0 && resolveNodeRS.objects.front()->IsNode())
-        pProtoNode = resolveNodeRS.objects.front()->AsNode();
+      if (m_pScriptContext->ResolveObjects(pUseHrefNode, wsSOM, &resolveNodeRS,
+                                           dwFlag, nullptr)) {
+        auto* pFirstObject = resolveNodeRS.objects.front().Get();
+        if (pFirstObject && pFirstObject->IsNode())
+          pProtoNode = pFirstObject->AsNode();
+      }
     } else if (!wsID.IsEmpty()) {
       auto it = mIDMap.find(FX_HashCode_GetW(wsID, false));
       if (it == mIDMap.end())