Actually fix clang-tidy report

Returning a retained reference is always safer, although this
is not reachable in practice. The clang-tidy report fires when
a function returning a retained reference is assigned to a bare
pointer because it can't deduce that there are other references.
When the temporary holding the retained result prior to conversion
goes out of scope at the next semicolon, the pointer outlives it.

Fixed: chromium:1380478
Change-Id: Iaa582b40c2f6a8d4fb227a2437e4a1635c618521
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/100612
Reviewed-by: Lei Zhang <thestig@chromium.org>
Auto-Submit: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/core/fpdfapi/parser/cpdf_object_walker.cpp b/core/fpdfapi/parser/cpdf_object_walker.cpp
index 577c1e0..71acdfb 100644
--- a/core/fpdfapi/parser/cpdf_object_walker.cpp
+++ b/core/fpdfapi/parser/cpdf_object_walker.cpp
@@ -98,13 +98,13 @@
 
 CPDF_ObjectWalker::SubobjectIterator::~SubobjectIterator() = default;
 
-const CPDF_Object* CPDF_ObjectWalker::SubobjectIterator::Increment() {
+RetainPtr<const CPDF_Object> CPDF_ObjectWalker::SubobjectIterator::Increment() {
   if (!IsStarted()) {
     Start();
     is_started_ = true;
   }
   while (!IsFinished()) {
-    const CPDF_Object* result = IncrementImpl();
+    RetainPtr<const CPDF_Object> result = IncrementImpl();
     if (result)
       return result;
   }
@@ -142,17 +142,14 @@
         // Schedule walk within composite objects.
         stack_.push(std::move(new_iterator));
       }
-      // TODO(crbug.com/1380478): see if this skirts clang-analyzer issue.
-      // next_object_ will now be NULL after move.
-      auto result = std::move(next_object_);
-      return result;
+      return std::move(next_object_);  // next_object_ is NULL after move.
     }
 
     SubobjectIterator* it = stack_.top().get();
     if (it->IsFinished()) {
       stack_.pop();
     } else {
-      next_object_.Reset(it->Increment());
+      next_object_ = it->Increment();
       parent_object_.Reset(it->object());
       dict_key_ = parent_object_->IsDictionary()
                       ? static_cast<DictionaryIterator*>(it)->dict_key()
diff --git a/core/fpdfapi/parser/cpdf_object_walker.h b/core/fpdfapi/parser/cpdf_object_walker.h
index 8ff86c1..c779da1 100644
--- a/core/fpdfapi/parser/cpdf_object_walker.h
+++ b/core/fpdfapi/parser/cpdf_object_walker.h
@@ -22,7 +22,7 @@
     virtual ~SubobjectIterator();
     virtual bool IsFinished() const = 0;
     bool IsStarted() const { return is_started_; }
-    const CPDF_Object* Increment();
+    RetainPtr<const CPDF_Object> Increment();
     const CPDF_Object* object() const { return object_.Get(); }
 
    protected: