Fix a crasher in CFX_ArrayTemplate::GetAt()

xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp

Index: xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
diff --git a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
index 6f2a5010a1facf5bbf8024d7c60698cb751fdbd3..be987659aa75b596192109ae679f6d8d598334cd 100644
--- a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
+++ b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
@@ -1129,17 +1129,15 @@ void CXFA_ItemLayoutProcessor::DoLayoutPositionedContainer(
           pContext->m_prgSpecifiedColumnWidths->GetSize() - iColIndex) {
         pContext->m_fCurColumnWidth = 0;
         pContext->m_bCurColumnWidthAvaiable = TRUE;
-        if (iColSpan == -1) {
+        if (iColSpan == -1)
           iColSpan = pContext->m_prgSpecifiedColumnWidths->GetSize();
-        }
-        for (int32_t i = 0; i < iColSpan; i++) {
+        for (int32_t i = 0; iColIndex + i < iColSpan; ++i) {
           pContext->m_fCurColumnWidth +=
               pContext->m_prgSpecifiedColumnWidths->GetAt(iColIndex + i);
         }
-        if (pContext->m_fCurColumnWidth == 0) {
+        if (pContext->m_fCurColumnWidth == 0)
           pContext->m_bCurColumnWidthAvaiable = FALSE;
-        }
-        iColIndex += iColSpan;
+        iColIndex += iColSpan >= 0 ? iColSpan : 0;
       }
     }
     pProcessor->DoLayout(FALSE, XFA_LAYOUT_FLOAT_MAX, XFA_LAYOUT_FLOAT_MAX,