Fixed a return value error in CJS_Document::getAnnots.

The function incorrectly returned the number of pages. After the fix, it
returns the total number of annotations across all pages.

Bug: 421304870
Change-Id: I923dfa5b9cabf7d37bdc75a1cb2f41e90d60c9c5
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/135230
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
diff --git a/AUTHORS b/AUTHORS
index 567f8f5..4a65f36 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -47,6 +47,7 @@
 Tibor Dusnoki <tdusnoki@inf.u-szeged.hu>
 Wang Chuan <jdyaomo@gmail.com>
 Wang Qing <wangqing-hf@loongson.cn>
+Wang Yongjie <tycket033@gmail.com>
 Zhuo Qingliang <zhuo.dev@gmail.com>
 # END individuals section.
 
diff --git a/fxjs/cjs_document.cpp b/fxjs/cjs_document.cpp
index bd226fe..2b0b4fb 100644
--- a/fxjs/cjs_document.cpp
+++ b/fxjs/cjs_document.cpp
@@ -1127,6 +1127,11 @@
         return CJS_Result::Failure(JSMessage::kBadObjectError);
       }
 
+      if (pSDKAnnotCur->GetAnnotSubtype() == CPDF_Annot::Subtype::POPUP ||
+          pSDKAnnotCur->GetAnnotSubtype() == CPDF_Annot::Subtype::WIDGET) {
+        continue;
+      }
+
       v8::Local<v8::Object> pObj = pRuntime->NewFXJSBoundObject(
           CJS_Annot::GetObjDefnID(), FXJSOBJTYPE_DYNAMIC);
       if (pObj.IsEmpty()) {
@@ -1137,7 +1142,7 @@
           CFXJS_Engine::GetBinding(pRuntime->GetIsolate(), pObj));
       pJS_Annot->SetSDKAnnot(pSDKAnnotCur->AsBAAnnot());
       pRuntime->PutArrayElement(
-          annots, i,
+          annots, annots->Length(),
           pJS_Annot ? v8::Local<v8::Value>(pJS_Annot->ToV8Object())
                     : v8::Local<v8::Value>());
     }
diff --git a/testing/resources/javascript/bug_421304870.in b/testing/resources/javascript/bug_421304870.in
new file mode 100644
index 0000000..71da68b
--- /dev/null
+++ b/testing/resources/javascript/bug_421304870.in
@@ -0,0 +1,57 @@
+{{header}}
+{{object 1 0}} <<
+  /Type /Catalog
+  /Pages 2 0 R
+  /OpenAction 7 0 R
+>>
+endobj
+
+{{object 2 0}} <<
+  /Type /Pages
+  /MediaBox [0 0 400 400]
+  /Kids [3 0 R]
+  /Count 1
+>>
+endobj
+
+{{object 3 0}} <<
+  /Type /Page
+  /Parent 2 0 R
+  /Annots [4 0 R 5 0 R 6 0 R]
+>>
+endobj
+
+{{object 4 0}} <<
+  /Type /Annot
+  /Subtype /Text
+  /Rect [100 100 200 200]
+  /Contents (Hello Annotation_1)
+>>
+endobj
+
+{{object 5 0}} <<
+  /Type /Annot
+  /Subtype /Popup
+  /Parent 4 0 R
+  /Rect [200 200 300 300]
+>>
+endobj
+
+{{object 6 0}} <<
+  /Type /Annot
+  /Subtype /Widget
+  /Rect [300 300 400 400]
+>>
+endobj
+
+{{object 7 0}} <<
+  /Type /Action
+  /S /JavaScript
+  /JS (app.alert(this.getAnnots().length);)
+>>
+endobj
+
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF
diff --git a/testing/resources/javascript/bug_421304870_expected.txt b/testing/resources/javascript/bug_421304870_expected.txt
new file mode 100644
index 0000000..31a857b
--- /dev/null
+++ b/testing/resources/javascript/bug_421304870_expected.txt
@@ -0,0 +1 @@
+Alert: 1