commit d8dbc5259f2b52832abfc29a196e8bb785fefc0f
author Lei Zhang <thestig@chromium.org> Mon Jul 24 22:08:44 2023 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Jul 24 22:08:44 2023 +0000
tree 2f3b3081b93bee58a16bbd7691553e8b2a65b791
parent 72299abe696ce726493fe4391db0d49e9fbfceef

XFA: Recognize delta objects as nodes

Make an exception for delta objects in CXFA_Object::IsNode() and
recognize it as a node. The delta object is special, as its the only
scripting object type whose parent class is none.

Bug: chromium:1465239
Change-Id: Ib5aa08b582941d559ab7fdd095f9b23e1aa00637
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/110150
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

xfa/fxfa/parser/cxfa_node_unittest.cpp

diff --git a/xfa/fxfa/parser/cxfa_node_unittest.cpp b/xfa/fxfa/parser/cxfa_node_unittest.cpp
index 2c745ca..e00772c 100644
--- a/xfa/fxfa/parser/cxfa_node_unittest.cpp
+++ b/xfa/fxfa/parser/cxfa_node_unittest.cpp
@@ -411,3 +411,14 @@
   EXPECT_TRUE(GetNode()->IsAncestorOf(grandchild));
   EXPECT_FALSE(child1->IsAncestorOf(grandchild));
 }
+
+TEST_F(CXFANodeTest, DeltaObjectIsNode) {
+  CXFA_Node* delta =
+      CXFA_Node::Create(GetDoc(), XFA_Element::Delta, XFA_PacketType::Form);
+  ASSERT_TRUE(delta);
+  ASSERT_TRUE(delta->IsNode());
+
+  // This call should not crash, like in crbug.com/1465239.
+  delta->JSObject()->SetAttributeByEnum(XFA_Attribute::Name, L"delta",
+                                        /*bNotify=*/false);
+}

xfa/fxfa/parser/cxfa_object.h

diff --git a/xfa/fxfa/parser/cxfa_object.h b/xfa/fxfa/parser/cxfa_object.h
index 84c4e98..c482d3b 100644
--- a/xfa/fxfa/parser/cxfa_object.h
+++ b/xfa/fxfa/parser/cxfa_object.h
@@ -59,7 +59,8 @@
            m_objectType == XFA_ObjectType::ModelNode ||
            m_objectType == XFA_ObjectType::TextNode ||
            m_objectType == XFA_ObjectType::ContainerNode ||
-           m_objectType == XFA_ObjectType::ContentNode;
+           m_objectType == XFA_ObjectType::ContentNode ||
+           m_elementType == XFA_Element::Delta;
   }
   bool IsTreeList() const { return m_objectType == XFA_ObjectType::TreeList; }
   bool IsContentNode() const {