Fix downcast in CXFA_FFTextEdit.
The |ff_widget_type_| of a CXFA_Node may reflect the type of its
UI child node if it is of widget type |kNone|, so even if it claims
to be of a particular type, it is only safe to downcast its UI
child to that particular type.
Bug: chromium:1026918
Change-Id: I5daef3c6436ada6d31126ddb380f6420651b47e5
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/62670
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
diff --git a/testing/resources/pixel/xfa_specific/bug_1026918.evt b/testing/resources/pixel/xfa_specific/bug_1026918.evt
new file mode 100644
index 0000000..3a16c14
--- /dev/null
+++ b/testing/resources/pixel/xfa_specific/bug_1026918.evt
@@ -0,0 +1,2 @@
+mousemove,0,0
+mousedown,left,0,0
\ No newline at end of file
diff --git a/testing/resources/pixel/xfa_specific/bug_1026918.in b/testing/resources/pixel/xfa_specific/bug_1026918.in
new file mode 100644
index 0000000..3dee61e
--- /dev/null
+++ b/testing/resources/pixel/xfa_specific/bug_1026918.in
@@ -0,0 +1,50 @@
+{{header}}
+{{object 1 0}} <<
+ /Type /Catalog
+ /Pages 2 0 R
+ /AcroForm <<
+ /XFA 4 0 R
+ >>
+ /NeedsRendering true
+>>
+endobj
+{{object 2 0}} <<
+ /Type /Pages
+ /Count 1
+ /Kids [3 0 R]
+>>
+endobj
+{{object 3 0}} <<
+ /Type /Page
+ /Parent 2 0 R
+ /MediaBox [0 0 3 3]
+>>
+endobj
+{{object 4 0}} <<
+ {{streamlen}}
+>>
+stream
+<xdp xmlns="http://ns.adobe.com/xdp/">
+ <config>
+ <acrobat>
+ <acrobat7>
+ <dynamicRender>required</dynamicRender>
+ </acrobat7>
+ </acrobat>
+ </config>
+ <template>
+ <subform>
+ <bookend leader="$"></bookend>
+ <field>
+ <keep next="pageArea"></keep>
+ <ui>
+ <barcode type="code3Of9"></barcode>
+ </ui>
+ </field>
+ </subform>
+ </template>
+</xdp>
+endstream
+endobj
+{{trailer}}
+%%EOF
\ No newline at end of file
diff --git a/testing/resources/pixel/xfa_specific/bug_1026918_expected.pdf.0.png b/testing/resources/pixel/xfa_specific/bug_1026918_expected.pdf.0.png
new file mode 100644
index 0000000..08c11b0
--- /dev/null
+++ b/testing/resources/pixel/xfa_specific/bug_1026918_expected.pdf.0.png
Binary files differ
diff --git a/xfa/fxfa/cxfa_fftextedit.cpp b/xfa/fxfa/cxfa_fftextedit.cpp
index f5282ba..5ac9f57 100644
--- a/xfa/fxfa/cxfa_fftextedit.cpp
+++ b/xfa/fxfa/cxfa_fftextedit.cpp
@@ -274,7 +274,7 @@
} else if (m_pNode->GetFFWidgetType() == XFA_FFWidgetType::kBarcode) {
int32_t nDataLen = 0;
if (eType == XFA_VALUEPICTURE_Edit) {
- nDataLen = static_cast<CXFA_Barcode*>(m_pNode.Get())
+ nDataLen = static_cast<CXFA_Barcode*>(m_pNode->GetUIChildNode())
->GetDataLength()
.value_or(0);
}
diff --git a/xfa/fxfa/parser/cxfa_node.h b/xfa/fxfa/parser/cxfa_node.h
index 057c26a..9d9aec5 100644
--- a/xfa/fxfa/parser/cxfa_node.h
+++ b/xfa/fxfa/parser/cxfa_node.h
@@ -266,6 +266,9 @@
CXFA_EventParam* pEventParam);
CXFA_Node* GetUIChildNode();
+
+ // NOTE: value returned is often determined by child UI node, and
+ // can't be used to infer anything about this particual node itself.
XFA_FFWidgetType GetFFWidgetType();
CFX_RectF GetUIMargin();
