Fix a crash in CJX_HostPseudoModel::openList().
BUG=pdfium:1273
Change-Id: I7c9cb23e7d96ef218e1ecdc964a74c9bc85e51c9
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/52172
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/fxjs/xfa/cjx_hostpseudomodel.cpp b/fxjs/xfa/cjx_hostpseudomodel.cpp
index 109f743..678b052 100644
--- a/fxjs/xfa/cjx_hostpseudomodel.cpp
+++ b/fxjs/xfa/cjx_hostpseudomodel.cpp
@@ -302,8 +302,11 @@
return CJS_Result::Success();
CXFA_LayoutProcessor* pDocLayout = GetDocument()->GetLayoutProcessor();
- CXFA_FFWidget* hWidget =
- XFA_GetWidgetFromLayoutItem(pDocLayout->GetLayoutItem(pNode));
+ CXFA_LayoutItem* pLayoutItem = pDocLayout->GetLayoutItem(pNode);
+ if (!pLayoutItem)
+ return CJS_Result::Success();
+
+ CXFA_FFWidget* hWidget = XFA_GetWidgetFromLayoutItem(pLayoutItem);
if (!hWidget)
return CJS_Result::Success();
diff --git a/testing/resources/pixel/xfa_specific/bug_1273.in b/testing/resources/pixel/xfa_specific/bug_1273.in
new file mode 100644
index 0000000..4f8f144
--- /dev/null
+++ b/testing/resources/pixel/xfa_specific/bug_1273.in
@@ -0,0 +1,19 @@
+{{header}}
+{{include ../../xfa_catalog_1_0.fragment}}
+{{include ../../xfa_object_single_2_0.fragment}}
+{{object 3 0}} <<
+ {{streamlen}}
+>>
+stream
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template>
+<subform>
+<breakBefore>
+<script>host.openList("""")</script>
+endstream
+endobj
+{{include ../../xfa_pages_8_0.fragment}}
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF
diff --git a/testing/resources/pixel/xfa_specific/bug_1273_expected.pdf.0.png b/testing/resources/pixel/xfa_specific/bug_1273_expected.pdf.0.png
new file mode 100644
index 0000000..08c11b0
--- /dev/null
+++ b/testing/resources/pixel/xfa_specific/bug_1273_expected.pdf.0.png
Binary files differ
