Prevent parentless siblings in CXFA_ItemLayoutProcessor::SplitLayoutItem().

In this corner case, there isn't any place to put the split node,
so make it a child of the first, and the tree invariant is
preserved.

Bug: pdfium:1287
Change-Id: I64cad355cf6b4f4edd0acb0dbbbba8026d5c5de4
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/53614
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
diff --git a/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp b/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp
index a6ddfc8..bb14e68 100644
--- a/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp
+++ b/xfa/fxfa/layout/cxfa_itemlayoutprocessor.cpp
@@ -707,6 +707,7 @@
   if (pLayoutItem->GetFirstChild())
     pSecondLayoutItem->m_sSize.height += fCurTopMargin;
 
+  bool bOrphanedItem = false;
   if (pSecondParent) {
     pSecondParent->AddChild(pSecondLayoutItem);
     if (fCurTopMargin > 0 && pLayoutItem->GetFirstChild()) {
@@ -721,10 +722,14 @@
         pContentItem->m_sSize.height += fCurTopMargin;
       }
     }
+  } else if (pLayoutItem->GetParent()) {
+    pLayoutItem->GetParent()->InsertChild(pLayoutItem, pSecondLayoutItem);
   } else {
-    pSecondLayoutItem->SetParent(pLayoutItem->GetParent());
-    pSecondLayoutItem->SetNextSibling(pLayoutItem->GetNextSibling());
-    pLayoutItem->SetNextSibling(pSecondLayoutItem);
+    // Parentless |pLayoutitem| would like to have |pSecondLayoutItem| as a
+    // sibling, but that would violate the tree invariant. Instead, keep
+    // it an orphan and add it as a child of |pLayoutItem| after performing
+    // the split.
+    bOrphanedItem = true;
   }
 
   CXFA_ContentLayoutItem* pChildren =
@@ -787,6 +792,8 @@
     fAddMarginHeight = pSecondLayoutItem->m_sSize.height - fOldHeight;
     pLayoutItem->AddChild(pChildItem);
   }
+  if (bOrphanedItem)
+    pLayoutItem->AddChild(pSecondLayoutItem);
 }
 
 void CXFA_ItemLayoutProcessor::SplitLayoutItem(float fSplitPos) {