Prevent parentless siblings in CXFA_ItemLayoutProcessor::SplitLayoutItem().
In this corner case, there isn't any place to put the split node,
so make it a child of the first, and the tree invariant is
preserved.
Bug: pdfium:1287
Change-Id: I64cad355cf6b4f4edd0acb0dbbbba8026d5c5de4
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/53614
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
diff --git a/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp b/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp
index a6ddfc8..bb14e68 100644
--- a/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp
+++ b/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp
@@ -707,6 +707,7 @@
if (pLayoutItem->GetFirstChild())
pSecondLayoutItem->m_sSize.height += fCurTopMargin;
+ bool bOrphanedItem = false;
if (pSecondParent) {
pSecondParent->AddChild(pSecondLayoutItem);
if (fCurTopMargin > 0 && pLayoutItem->GetFirstChild()) {
@@ -721,10 +722,14 @@
pContentItem->m_sSize.height += fCurTopMargin;
}
}
+ } else if (pLayoutItem->GetParent()) {
+ pLayoutItem->GetParent()->InsertChild(pLayoutItem, pSecondLayoutItem);
} else {
- pSecondLayoutItem->SetParent(pLayoutItem->GetParent());
- pSecondLayoutItem->SetNextSibling(pLayoutItem->GetNextSibling());
- pLayoutItem->SetNextSibling(pSecondLayoutItem);
+ // Parentless |pLayoutitem| would like to have |pSecondLayoutItem| as a
+ // sibling, but that would violate the tree invariant. Instead, keep
+ // it an orphan and add it as a child of |pLayoutItem| after performing
+ // the split.
+ bOrphanedItem = true;
}
CXFA_ContentLayoutItem* pChildren =
@@ -787,6 +792,8 @@
fAddMarginHeight = pSecondLayoutItem->m_sSize.height - fOldHeight;
pLayoutItem->AddChild(pChildItem);
}
+ if (bOrphanedItem)
+ pLayoutItem->AddChild(pSecondLayoutItem);
}
void CXFA_ItemLayoutProcessor::SplitLayoutItem(float fSplitPos) {